“We”, “us” or “our”
Embellish is the data controller and we are responsible for your personal data
“User,” “you” and “your”
Site visitors, customers and any other users of the site.
Information that you voluntarily provide to us which personally identifies you and/or your contact information, such as your name and email address.
Embellish provides a website where users can read articles on and around the subject of branding and a branding service which users can find out more about and purchase.
Information We Collect
The data we collect about you, for what purpose and on what ground we process it.
Personal data means any information capable of identifying an individual. It does not include anonymised data.
We may process the following categories of personal data about you:
Communication Data that includes any communication that you send to us whether that be through the contact form on our website, through email, text, social media messaging, social media posting or any other communication that you send us. We process this data for the purposes of communicating with you, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records and to establish, pursue or defend legal claims.
Customer Data that includes data relating to any purchases of goods and/or services such as your name, title, billing or delivery address, email address, telephone number, other contact details and purchase information. We use your email to communicate with you about your project and to manage our customer relationship with you. When you place an order you may be added to our mailing list from which you can unsubscribe at any time using the unsubscribe link in each email or by contacting us at firstname.lastname@example.org. Your payment information is securely communicated to and processed via PayPal, GoCardless, Etsy or your own bank and so not collected by Embellish. All personal information collected for an order is used for the fulfilment of that order and to manage our customer relationship with you. We process this data to supply the goods and/or services you have purchased and to keep records of such transactions. Our lawful ground for this processing is the contract between you and us and/or taking steps at your request to enter into such a contract.
User Data that includes data about how you use our website and any online services together with any data that you post for publication on our website or through other online services. We process this data to operate our website and ensure relevant content is provided to you, to ensure the security of our website, to maintain back-ups of our website and/or databases and to enable publication and administration of our website, other online services and business. Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business.
Technical Data that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website. The source of this data is from our analytics tracking system. We process this data to analyse your use of our website and other online services, to administer and protect our business and website, to deliver relevant website content and advertisements to you and to understand the effectiveness of our advertising. Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business and to grow our business and to decide our marketing strategy.
Marketing Data that includes data about your preferences in receiving marketing from us and our third parties and your communication preferences. We process this data to enable you to partake in our promotions such as competitions and give-aways, to deliver relevant website content and advertisements to you and measure or understand the effectiveness of this advertising. This data is collected at Embellishbox.co.uk or at the point of becoming a customer. Our lawful ground for this processing is our legitimate interests which in this case are to study how customers use our products/services, to develop them, to grow our business and to decide our marketing strategy.
We may use Customer Data, User Data, Technical Data and Marketing Data to deliver relevant website content and advertisements to you (including Facebook adverts or other advertisements) and to measure or understand the effectiveness of the advertising we serve you. Our lawful ground for this processing is legitimate interests which is to grow our business. We may also use such data to send other marketing communications to you. Our lawful ground for this processing is either consent or legitimate interests (namely to grow our business).
We do not collect any Sensitive Data about you. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not collect any information about criminal convictions and offences.
How we collect your personal data
You may provide data by filling in forms on our site or communicating with us by post, phone, email or social media, including when you:
- order our products;
- create an account at EmbellishBox.co.uk;
- subscribe to our service at EmbellishBox.co.uk;
- request resources or marketing be sent to you at EmbellishBox.co.uk;
- enter a competition, giveaway or survey;
- or give us feedback.
Technical Data from the following parties: Cratejoy, Etsy, MailChimp, GoogleDrive, analytics providers such as Google based outside the EU; advertising networks such as Facebook based [inside OR outside] the EU]; and Identity and Contact Data from publicly availably sources such as Companies House and the Electoral Register based inside the EU.
Our lawful ground of processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely to grow our business).
Under the Privacy and Electronic Communications Regulations, we may send you marketing communications from us if
1. you made a purchase
2. you agreed to receive marketing communications and in each case you have not opted out of receiving such communications since.
You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or OR by emailing us at email@example.com at any time.
If you opt out of receiving marketing communications this opt-out does not apply to personal data provided as a result of becoming a customer, but it may mean that you won’t receive customer emails.
Disclosures of your Personal Data
- Analytics tracking
- User authentication
- Advertising and promotion
- Email marketing
- Payment processing
These services may access our data solely for the purpose of performing specific tasks on our behalf. We do not share any personally identifying information with them without your explicit consent. We do not give them permission to disclose or use any of our data for any other purpose.
We may, from time to time, allow limited access to our data by external consultants and agencies for the purpose of analysis and service improvement. This access is only permitted for as long as necessary to perform a specific function. We only work with external agencies whose privacy policies align with ours.
We will refuse government and law enforcement requests for data if we believe a request is too broad or unrelated to its stated purpose. However, we may cooperate if we believe the requested information is necessary and appropriate to comply with legal process, to protect our own rights and property, to protect the safety of the public and any person, to prevent a crime, or to prevent what we reasonably believe to be illegal, legally actionable, or unethical activity.
We do not otherwise share or supply personal information to third parties. We do not sell or rent your personal information to marketers or third parties.
Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to your personal data, so European law has prohibited transfers of personal data outside of the EEA unless the transfer meets certain criteria.
Many of our third parties service providers are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data out of the EEA, we do our best to ensure a similar degree of security of data by ensuring at least one of the following safeguards is in place:
- We will only transfer your personal data to countries that the European Commission have approved as providing an adequate level of protection for personal data by; or
- Where we use certain service providers, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe; or
- If we use US-based providers that are part of EU-US Privacy Shield, we may transfer data to them, as they have equivalent safeguards in place.
If none of the above safeguards is available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When deciding what the correct time is to keep the data for we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.
For tax purposes, the law requires us to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers. Bespoke cuts often include personal data (names) and whilst we do not retain the original cuts we do hold photographs of them which we will keep indefinitely to show as examples of what can be created and market the business.
Your Legal Rights
Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.
You can see more about these rights at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you wish to exercise any of the rights set out above, please email us at firstname.lastname@example.org
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you. If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.
Third Party Links
We maintain security measures to protect your personal information from unauthorised access, misuse or disclosure. However, no exchange of data over the Internet can be guaranteed as 100% secure. While we make every effort to protect your personal information shared with us through our Site, you acknowledge that the personal information you voluntarily share with us through this Site could be accessed or tampered with by a third party. You agree that we are not responsible for any intercepted information shared through our Site without our knowledge or permission. Additionally, you release us from any and all claims arising out of or related to the use of such intercepted information in any unauthorised manner.
Where password access is required for certain parts of the Website, you are responsible for keeping this password confidential.
Sharing. Please be aware that when you use our Site to post comments and share other information, any information that you provide may not be secure and can be collected and used by others. As a result, you should exercise caution before you make such disclosures.
This Website may place the following Cookies:
Strictly necessary cookie
These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
How to Update Your Information
If you opt-in to our mailing list, the option to unsubscribe or update will be included in every email. You may also access and correct your personal information and privacy preferences by contacting us with your request at email@example.com
Notification of Changes to this Policy
You acknowledge and agree that it is your responsibility to review this Site and this Policy periodically and to be aware of any modifications. Updates to this Policy will be posted on this page.