We are Whitehall Garden Centre Limited (company number: 04981754) of Whitehall Garden Centres, Lacock, Chippenham, Wiltshire SN15 2LZ. We act as data controller in respect of your personal data, you can contact us at our head office by writing to us at the above address, calling us on 01249 730204 or emailing us at help@whitehallgardencentre.co.uk. We operate the website www.whitehallgardencentre.co.uk (website).

We are committed to being transparent about how we collect and use your personal data and to meeting our data protection obligations under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
This notice sets out how we will use your personal data when you use our website services, shop with us, complete any in-store forms and register to become part of our Garden or Little Acorn clubs. Please read this notice before browsing our website, completing a purchase with us, completing any in-store form and/or registering to be a member of our Loyalty clubs. We recommend you print a copy of this policy for future reference (although a copy will always be available on our website).

We collect the following personal data about you:

• Your IP address when you browse our website.
• Your name, email address, address, phone number and payment details for the purpose of completing a purchase on our website and/or for creating an account with us.
• The information you provide to us if you register to become part of our Garden or Little Acorn clubs.
• Where you are a member of our Garden or Little Acorn clubs we may also collect information about your purchase history (using your club card and account) and information generated from our own analysis of the information you have provided to us and your purchase history.
• The information you provide to us and which we generate about you when you make an enquiry or complaint with us.
• In addition to the above personal data we may also collect the following personal data about you when you are visiting us in-store:
• We may collect your name and contact details if you choose to provide these to us when completing a customer comment form.
• We operate CCTV for security and health and safety reasons and you may be captured on this CCTV.
• We operate a vehicle registration monitoring system which may capture an image of you along with your vehicle registration plate on entry to an exit from our car park.
• We occasionally take videos and photos in-store for use on our website, publications and social media but, unless you have specifically consented, you will never be the sole focus of these images. If you do see an image of you which we have taken which you would like us to remove from the relevant media and stop using, please contact us to let us know using the details set out above.

We may use your personal data in the following ways:

• We may use your IP address to analyse how you engage with us (on our website and through our email communications) to assist us in improving our website and review the effectiveness of our communications.
• Where you have made a purchase with us, we will use this information to supply the products/services you have requested, to process your payment and to provide our customer services and related administrative support to you.
• Where you are a member of our Garden or Little Acorn clubs to provide membership benefits to you and we may use your name, address, phone number and/or email address to send you marketing communications by your preferred contact method about our products, services and events which we feel may be of interest to you (which may include products or services promoted by our in-store retail partners and carefully selected third parties).
• Where you are a member of our Garden or Little Acorn clubs, we may use your address, date of birth and purchase history (including the types of products and services you purchase, the amount you spend with us, the time of year you shop and how you shop (online or in person)) to create a profile of you and your spending habits to assist us in sending to you relevant communications and information based on our understanding of your preferences and so we improve our customers’ experience.
• Where you have made an enquiry or complaint, we will use this information to deal with your enquiry or complaint and provide our services to you.
• Where you have provided your personal data to us on a comment form completed by you, we may use this information to contact you to discuss your comments and feedback.

Our lawful basis for processing your personal data:

• We process your IP address on the basis of our legitimate interests of keeping our website up to date and relevant, developing our business and informing our marketing strategy.
• We process your personal data which you provide to us when making a purchase or for an enquiry/complaint to perform our contract with you. If you opt to become a member of the Whitehall Garden or Little Acorn, clubs please also see below.
• We process your personal data as a member of our Garden or Little Acorn clubs on the basis of our legitimate interests of keeping in contact with our customers, keeping our customers up to date with our news, offers and events, promoting our products, services and events (on the basis of your mailing preferences) and understanding our customers’ spending habits to assist us in improving our centre and sales offering.
• We process any personal data you provide to us on comment forms in store on the basis of our legitimate interests of improving our customer service and understanding your complaints, concerns and feedback in respect of the service we provide.
• We operate CCTV and vehicle recognition technology on the basis of our legitimate interests of crime prevention and providing a safe and secure environment for our customers and colleagues.

Who has access to your personal data?

• We do not transfer any of your personal data outside of the European Economic Area (EEA).
• We will share some of your personal data with selected third parties. This will include our marketing agencies (who carry out the profiling referred to above on our behalf), our email platform provider, credit reference agencies, our product delivery agents, our payment providers and third parties who operate data storage/management systems on our behalf. Full details of such third parties can be provided on request (using the contact details below).
• We will share your personal information if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply the agreements concerning you (including agreements between you and us).

You may opt-out of receiving communications at any time. If you would like us to stop sending you Garden or Little Acorn communications and/or no longer wish to be a Garden or Little Acorn club member, you can let us know by using the contact details set out above or following the “opt out/unsubscribe” option in each of our communications.

We will retain and process your personal data as set out above as follows:

• We will retain your IP address for such period as you are a member of our Garden or Little Acorn clubs, following which it shall be deleted.
• Where you have provided payment details for the purpose of completing a purchase with us, we will keep such details for five years (which is the length of our warranty period for certain plants and is the longest warranty period we provide) although we will only retain such payment details as are necessary for this purpose for the full period.
• Where you have registered for an account with us, we will keep such personal data for such time as you wish to continue to hold an account with us.

If you are a member of our Garden or Little Acorn clubs, for such time as you remain a member of The Whitehall Garden or Little Acorn clubs. We may de-activate your membership in the event that you do not engage for more than 12 months (this means either making an online or in-store purchase or opening any of our emails). Once your membership has been de-activated we will retain your data for three years for record keeping and reference purposes only. In the event that you wish to re-activate your membership, please contact us to let us know at help@whitehallgardencentre.co.uk

• Where you have provided your personal details whilst completing an in store comment card, we will keep such details for so long as required to process your comments and investigate/review any issues arising from these. This will generally be not more than one month following collection of the personal data.

How do we keep your personal information safe?

We have put in place robust technical measures to protect the security of your information. Details of these measures are available on request.
Third parties will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and where they are subject to a duty of confidentiality.
You have the following rights in respect of the personal data we hold about you:

• a right of access to such data; any access request is free of charge and we will aim to respond within one month, unless the request is particularly complex in which case it may take longer and we will keep you informed in this regard. If the request is unfounded excessive we may refuse to comply with the request or if additional copies are required we may make a reasonable charge.
• a right to object to processing that is likely to cause or is causing you damage or distress;
• a right to prevent processing for direct marketing;
• a right to object to our profiling of you;
• a right to have inaccurate personal data rectified, blocked, erased or destroyed; and
• A right to claim compensation for damages caused by a breach of relevant data protection legislation.

If you wish to exercise any of these rights, please contact us using the details set out below.

You have a right to lodge a complaint with the Information Commissioner’s Office (ICO). We can be contacted at the above address and telephone number and by email to: privacy@whitehallgardencentre.co.uk. Please contact us before lodging a complaint with the ICO.

Job Applicant Privacy Notice

Data controller: Whitehall Garden Centres Ltd

Contacts: Privacy@whitehallgardencentre.co.uk

As part of any recruitment process, the Company collects and processes personal data relating to job applicants and is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What personal data do we collect?

We collect a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number
• details of your qualifications, skills, experience and employment history
• information about your current level of remuneration, including benefit entitlements
• whether or not you have a disability for which the Company needs to make reasonable adjustmentsduring the recruitment process
• information about your entitlement to work in the UK.

We may collect this information in a variety of ways e.g. data might be contained in CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.

Data will be stored in a range of different places, including in manual and digital folders and other IT systems (including email).

Why do we process personal data?

We need to process data to take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into a contract with you.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

We may also collect information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. We process such information to carry out our obligations and exercise specific rights in relation to employment.

We will not use your data for any purpose other than the recruitment exercise for which you have applied.

Who has access to personal data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR, interviewers involved in the recruitment process and managers in the business area with a vacancy.

We may share your data with an IT Company if access to the data is necessary for the provision of IT support. We shall not share your data with otherthird parties, unless your application for employment is successful and we make you an offer of employment, details of which will be provided when you join.

We will not transfer your data outside the European Economic Area.

For how long do we keep data?

If your application for employment is unsuccessful, we will hold your data on file for one year after the end of the relevant recruitment process.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file.   The periods for which your data will be held will be provided to you in our Data Protection Policy.

 How do we protect personal data?

We take the security of your data seriously and have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

Your rights

Under the General Data Protection Regulation (‘GDPR’) and the Data Protection Act 2018 (the ‘2018 Act’) you have a number of rights with regard to your personal data:

You have the right:

• to access and obtain a copy of your data on request;
• to require us to change incorrect or incomplete data;
• to require us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
• to object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, please contact:

privacy@whitehallgardencentre.co.uk

If you believe that we have not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

Automated decision-making

Recruitment processes are not based solely on automated decision-making.  

Klarna
 
In order to be able to offer you Klarna’s payment options, we will pass to Klarna certain aspects of your personal information, such as contact and order details, in order for Klarna to assess whether you qualify for their payment options and to tailor the payment options for you.
 
General information on Klarna you can find here. Your personal data is handled in accordance with applicable data protection law and accordance with the information in Klarna’s privacy policy.

Google Signals

Google Signals is active on our website, which is a feature of Google Analytics. Google Signals can associate the visitation information it collects from our site and/or apps with Google information from accounts of signed-in users who have consented to this association for the purpose of ads personalization. This Google information could include end user location, search history, YouTube history, and data from sites that partner with Google—we use it to provide aggregated and anonymised insights into your user cross device behaviours. Your personal settings can be changed via https://myactivity.google.com/myactivity