Personal information submitted to us via this website will only be used for the purposes specified in this privacy policy or in relevant parts of the website. We may use your personal information to:

• Administer the website;
• Improve your browsing experience by personalising the website;
• Enable your use of the services available on the website;
• Send you general (non-marketing) commercial communications;
• Send you by post or marketing email notifications which you have specifically agreed to and have been also unambiguously and properly opted in. For example, contact form used on our website
• Send to you our newsletter and other marketing communications relating to our business, where you have specifically agreed to this and they have also been unambiguously and properly opted in, by post, by email or similar technology. You can inform us at any time if you no longer require marketing communications.
• Provide third parties with statistical information about our users – but this information will not be used to identify any individual user; for example, as used by google analytics
• Deal with enquiries and complaints made by or about you relating to the website;
  We will not provide your personal information to any third parties for the purpose of direct marketing.
• Merchant cardholder receipt data is stored for the required minimum accounting period of 7 years and also to respond to providing copy receipts and chargebacks.

Asking for consent

We consider that consent is the most appropriate lawful basis for processing personal data.

The request for consent is prominent and separate from our terms and conditions.

We ask people to positively opt in.

We don’t use pre-ticked boxes or any other type of default consent.

We use clear, plain language that is easy to understand.

We specify why we want the data and what we’re going to do with it.

We give individual detailed options to consent separately to different purposes and types of processing.

We name our organisation and any third-party controllers who will be relying on the consent.

We tell individuals they can withdraw their consent.

We ensure that individuals can refuse to consent without detriment.

We avoid making consent a precondition of a service.

Recording consent

A record is kept of when and how we gained consent from an individual.

Managing Consent

We regularly review consents to check that the relationship, the processing and the purposes have not changed.

There are processes in place to refresh consent at appropriate intervals, including any parental consents.

Individuals may withdraw their consent at any time, and we publicise how to do so.

Withdrawals of consent are acted on as soon as possible.

We will not penalise individuals who wish to withdraw consent.

Legitimate Business Interests

We consider that legitimate interests are also another appropriate basis for processing and storing of for instance photographic images.

We understand our responsibility to protect the individual’s interests.

We have conducted a legitimate interest’s assessment (LIA) and kept a record of it, to ensure that we can justify our decision.

We have identified the relevant legitimate interests.

We have checked that the processing is necessary and there is no less intrusive way to achieve the same result.

We have done a balancing test, and are confident that the individual’s interests do not override those legitimate interests.

We only use individuals’ data in ways they would reasonably expect, unless we have a very good reason.

We are not using people’s data in ways they would find intrusive or which could cause them harm, unless we have a very good reason.

We have considered safeguards to reduce the impact where possible.

We have considered whether we can offer an opt-out.

If our LIA identifies a significant privacy impact, we have considered whether we also need to conduct a DPIA.

We keep our LIA under review and repeat it if circumstances change.

We include information about our legitimate interests in our privacy notice.