Privacy Policy

1. INTRODUCTION

The following definition applies in this policy/notice:

“Group”: in relation to a company, that company, any subsidiary or any holding company from time to time of that company, and any subsidiary from time to time of a holding company of that company. Each company in a Group is a member of the Group.

A reference to a holding company or a subsidiary means a holding company or a subsidiary (as the case may be) as defined in section 1159 of the CA 2006 [and a company shall be treated, for the purposes only of the membership requirement contained in sections 1159(1)(b) and (c), as a member of another company even if its shares in that other company are registered in the name of: (a) another person (or its nominee), by way of security or in connection with the taking of security; or (b) its nominee.

WYLD Holdings Ltd is made up of a number of brands and trading names: WYLD Holdings Ltd, Wayland Games, Wayland Games Centre, Warcradle Studios, and Red Beam Designs.

For simplicity throughout this notice, ‘we’ and ‘us’ means WYLD Holdings Ltd, all members of its Group and their respective brands.

At WYLD Holdings Limited, we are real people, just like you. So we're committed to safeguarding your privacy. The following policy outlines how we treat your personal information and the security measures which we have put in place. This policy also explains in detail the types of personal data we may collect about you when you interact with us.

We know that there’s a lot of information here, but we want you to be fully informed about your rights regarding how WYLD Holdings Limited uses your data; for example we will explain things such as how we combine data to build a picture of you.

We may collect, store and use the following kinds of personal data:

Information about your computer, your visits to and your use of our websites. This also includes information that you provide to us for the purpose of subscribing to our website services, email notifications and newsletters. Plus, any other information that you choose to send to us.

We do not store Credit Card/Debit Card information.

We hope the following sections will answer any questions you have but, if not, please do get in touch with us.

It’s likely that we’ll need to update this Privacy Notice from time to time. We’ll notify you of any significant changes, but you’re welcome to come back and check it whenever you wish.

When you are using WYLD Holdings websites, WYLD Holdings Ltd is the data controller.
 

2. WHY DO WE HAVE THIS PRIVACY NOTICE?

Treating individuals and their personal information with respect reflects our core values and the values of our brand(s). So, we want you to know as much as possible about what we do with your personal information. You and your personal information are protected by various laws and guidance and we are committed to upholding these and respecting your privacy and keeping your information safe.

In this privacy notice any reference to "us", "we", "our" or "ourselves" as well as “WYLD Holdings Ltd” is a reference to WYLD Holdings Ltd, a company limited by shares and incorporated in England and Wales with company number 16568727, with a registered office of Unit 3a London Brentwood Commercial Park, Tilbury Road, West Horndon, Brentwood, Essex, United Kingdom, CM13 3LR, with and any reference to "you", "your" and "yourself" is a reference to you as an individual who has a relationship with us or is in contact with us.

For the avoidance of doubt, unless a member of our Group has its own privacy notice, this privacy notice applies to each and every member of our Group and their corresponding websites/policies, so that you are bound by these terms and conditions regarding any member of our Group that you have any dealings with whatsoever. 

This privacy notice applies to everyone who interacts with us as a customer who has purchased any of our products or services (whether in store or online), anyone who has signed up to receive marketing materials from us, anyone who enters any of our promotions/competitions or who interacts on social media with us, except to the extent that the reason you interact with us is already covered by another of our privacy notice(s).

This privacy notice provides details in accordance with applicable data protection laws about how we collect and use personal information about you during and after your relationship with us, including but not limited when you use our website, purchase a product or service or otherwise interact/engage with us.

As this privacy notice covers a range of individuals and different types of relationships and interactions with us, not all aspects of this privacy notice will apply to you. The aspects of this privacy notice that will apply to you will depend upon the nature of your relationship and interactions with us. If you are unsure, then you can always ask us by contacting us through enquiries@wyldholdings.co.uk.

It is important that you read this privacy policy together with any other privacy policy or related policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

3. COOKIES

What is a cookie? Basically, it's a piece of tracking software which allows you to use all the features of an online retail website, like adding products to your shopping basket. Meanwhile, the online retailer is able to identify and track your activity, but only on their website. Not anywhere else.

We make use of both “session” cookies and “persistent” cookies. We use the session cookies to keep track of you while you navigate the website. Meanwhile, the persistent cookies enable our website to recognise you when you visit. So if you left something in your shopping basket last time you visited, it should still be there waiting for you when you return.

Session cookies will be deleted from your computer when you close your browser.

Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.

We use Google Analytics to collect and understand data about our website, including everything from user behaviour to our most popular pages and which product ranges generate the most revenue. Google Analytics is able to do this through the use of cookies. However, it is Google who stores this information. For more information about the data that Google stores and how we are able to access it, please read Google's privacy policy.

Our advertisers and payment services providers may also send you cookies to track your online activity. But once again, this will only track your activity on their websites and our website.

Where you submit personal information for publication on our website, we will only ever publish and use that information in accordance with the license you grant to us.

Similarly we will not, without your express consent, share your personal information with any third parties for the purpose of direct marketing.
 

4. THE CONTROLLER OF YOUR PERSONAL INFORMATION

For the purposes of data protection laws and this privacy notice, the controller of your personal information is whichever part of WYLD Holdings Ltd including but not limited to any companies within its group such as holding companies or subsidiary companies is processing your personal information. This will usually be the part of the WYLD Holdings Ltd that you interact with or have a relationship with. Being a controller of your personal information means that we are responsible for deciding how we hold and use your personal information. Our main trading entity is WYLD Holdings Ltd which is incorporated in England and Wales. 

This privacy policy is issued on behalf of the Group so when we mention “WYLD Holdings Ltd”, "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the Group responsible for processing your data. 

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Contact details. If you have any questions about this privacy policy or our privacy practices, please contact our DPO in the following ways:

• Full name of legal entity: WYLD Holdings Ltd
• Email address: enquiries@wyldholdings.co.uk

5. YOUR DUTY TO INFORM US OF CHANGES

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the period of your interactions with us.

6. WHAT IF YOU DO NOT PROVIDE PERSONAL INFORMATION?

Failing to provide some of the personal information we require may have an adverse impact on our ability to interact with you, for example we may not be able to provide you with products or services you would like to receive. However generally you are not obliged to provide us with any of your personal information. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

7. IF YOU HAVE QUERIES OR CONCERNS JUST ASK!

If you have any questions about this privacy notice or how we handle your personal information, please contact enquiries@wyldholdings.co.uk

8. CHANGES TO THIS NOTICE

We keep all of our privacy notices under regular review, and we may update this privacy notice at any time. If there are any material changes to this privacy notice in the future we will let you know, usually by updating the version on our website. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

9. DATA PROTECTION PRINCIPLES

We are committed to being transparent about how we collect and use your personal information and in meeting our data protection obligations. Data protection laws say that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

To make sure this happens we are required under applicable data protection laws to notify you of the information contained in this privacy notice. It is important that you read this document before you begin interacting with us so that you understand how and why we will process your personal information.

10 . WHAT PERSONAL INFORMATION DO WE COLLECT?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details – although we do not store payment card information for the avoidance of doubt.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

In connection with your relationship or interactions with us, we may collect and process a wide range of personal information about you. This includes:

• Personal contact details such as name, title, address (including billing address and delivery address), email address and telephone number(s).
• Information about your date of birth, age, gender, marital status, and the name of any delivery recipient.
• Details regarding or connected to products or services that you have ordered from us.
• Profile data including your username, purchase history, your interests, preferences, feedback and responses and any inferences drawn from any of personal data to create a profile about you to reflect your preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, and aptitudes.
• Financial transactions, and refunds.
• Any terms and conditions relating to your relationship with us.
• Any communications between ourselves and you.
• Your social media handles, social media posts, information about your social media followers, information about any product/services endorsements by you and other aspects of your social media activity.
• Publicly available personal information, including any which you have shared via a public platform, online or on social media.
• Personal history and information including hobbies, interests, and your preferences.
• Responses and results of surveys.
• Fraud prevention related information which may include details of other transactions you have been involved in.
• Applications to enter or attend competitions, promotions or events, attendance at events and promotions and any results or other related personal information.
• How you use our website as we collect information about the pages you look at and how you use them, usernames, account details and passwords, entry and exit data when you look at or leave our website, details of products, events and materials that may be interest to you, online subscription information, for example, when you subscribe to one of our updates, blogs or other materials, browser related information, cookies that are set on your device by our website
• Your usage of the IT systems we make available to visitors to our premises such as any visitor internet facilities at our premises.
• IP address information which allows us to track your usage of our website.
• Identification information including your driving licence and/or passport and background checks.
• Vehicle registration number, make and model if you are driving to visit us at our premises.
• Details of any queries, complaints, claims and cases involving both us and you including any related communications.
• CCTV footage and other information obtained through electronic means such as swipe card records and access control systems if you visit our premises.
• Photographs, video footage, audio recordings and other content, for example any created as part of our marketing or promotion campaigns, which are taken at events we hold, when you enter a competition, posts made on social media or when you are on our premises or which you provide to us.
• Any other personal information you provide to us.

If you are providing us with details of any other individuals, for example a friend of yours that you ask us to deliver our products to where you have ordered them as a present, they have a right to know and to be aware of what personal information we hold about them, how we collect it and how we use and may share that information. Please share this privacy notice with them. They also have the same rights as set out in this privacy notice in relation to their personal information that we collect.

11. WE AIM NOT TO COLLECT PERSONAL INFORMATION ABOUT CHILDREN

Our supply of products or services (whether in store or online), our apps, our website, events, promotions, social media, content, blogs, materials and other services we provide are not intended for use by anyone under the age of 18 years and we do not knowingly collect personal information relating to anyone under the age of 18 years old.

We may in some cases collect limited personal information related to children where they are connected to someone who is 18 or older whom we have a relationship with, for example a child may attend an event or our premises when accompanied by a responsible adult who has won a competition or who is entitled to attend one of our events.

12. WHERE DO WE COLLECT YOUR PERSONAL INFORMATION FROM?

WYLD Holdings Ltd collects your personal information in a variety of ways and from a variety of sources as set out below:

• Most of your personal information is collected directly from you, for example through contact with you, through information you input into your account on our website or where you otherwise create an account, from orders placed by you, from correspondence with you, through your applications, entries to competitions/promotions, entries to events, attendance at events or promotions, subscriptions, memberships, from correspondence with you or through other interactions with us, when you visit our premises or other personal information you provide to us.
• From other individuals known to you who may have given us your personal information so that we can send you any of our products as a gift.
• From websites, the internet, social media or other platforms including public sources of information.
• From our website, apps and information technology and communications systems, access control systems and CCTV and suppliers we use in connection with them.
• Automated technologies or interactions. As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our cookie policy for further details which is available within this policy.
• Technical data from the following parties: analytics providers such as Google based outside the UK; advertising networks based inside or outside the UK; and search information providers based inside or outside the UK.
• Contact, financial and transaction data from providers of technical, payment and delivery services based inside or outside the UK.
• Identity and contact data from data brokers or aggregators based inside or outside the UK. Identity and contact data from publicly available sources such as Companies House and the Electoral Register based inside or outside the UK.
• From third parties appointed by you, for example any financial or legal advisors.
• From third parties appointed by us, for example legal advisors appointed by us, identity or background check providers, fraud prevention organisations, data cleansing service providers or market/data research and analysis service providers.
• From government or government related bodies, regulators, the police, law enforcement authorities or the security services.
• We store personal information relating to you in our information technology systems (including our email system and our in-store monitoring and CCTV systems).

13. WHAT ARE OUR BASES FOR PROCESSING YOUR PERSONAL INFORMATION?

We will only use your personal information when the law allows us to. This means we must have one or more legal bases to use your personal information. Most of these will be self-explanatory. The most common legal bases which will apply to our use of your personal information are set out below:

• Where we need to perform the contract, we have entered into with you which covers your relationship with us or to take steps to enter into that contract.
• Where we need to comply with a legal obligation which applies to us, for example complying with laws relating to the sale of products to consumers or complying with data protection laws.
• Where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests. We have set out in the section below how we use your personal information together with more details on our legitimate interests.
• You have given your consent. Generally, we do not rely on or need your consent for most uses we make of your personal information, but we will need your consent to directly market our products and services to you by electronic communications channels such as email or SMS/MMS.
• We may in limited circumstances process sensitive special category personal information about you (for example personal information revealing racial or ethnic origin, religious or philosophical beliefs, or data concerning health). Where we do we also need to have one or more of the following legal bases for using your personal information.
• Where we have your explicit consent to do so.
• Where it is necessary for us to comply with our obligations and exercising our rights in the field of employment law, social security law and social protection law, for example making sure it is safe for you to participate in one of our events or promotions or making any adjustments necessary for you to attend our premises.
• Where we need to protect your vital interests (or someone else's vital interests).
• Where you have already made public the personal information.
• In establishing, exercising or defending legal claims, whether those claims are against us or by us.
• Where it is necessary in the public interest.
• In some cases, more than one legal basis may apply to our use of your personal information.

14. HOW WILL WE USE YOUR PERSONAL INFORMATION?

There are many ways we will need to use your personal information in the context of your relationship with us. We have set out the main uses below and indicated the main applicable legal bases of processing, but there may be other specific uses which are linked to or covered by the uses below. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the below.

• We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

We will process your personal information to perform our relationship with you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.

We will process your personal information to handle any order you (or an individual known to you where the delivery is to be made to you) has placed with us, and to pick, pack, despatch, ship and track that order to make sure it arrives safely. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.

We will process your personal information to provide any services you have asked to receive from us. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.

We will need to process your personal information to send to you any direct marketing materials about our products or services that you have asked to be sent to you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We also need you to give consent if we are going to market to you by electronic channels such as email or SMS/MMS.

We will process your personal information to build and develop a profile for you as a customer or potential customer of our products, services, apps and to aim to send or show you content, advertisements or marketing materials which are most likely to be of interest to you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We also need you to give consent if we are going to market to you by electronic channels such as email or SMS/MMS.

We also need to monitor and manage our relationship with you, which may involve communications with you, decisions regarding your relationship with us and in some cases meeting with you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests.

We may need to process your personal information in order to hold or conduct events, promotions or campaigns. This will be in our legitimate interests, and in some cases, we may rely on your consent to do this, for example if you provide us with a photograph to use.

We may need to process your personal information to manage our social media or online relationship with you. This will be in our legitimate interests, and in some cases, we may rely on your consent to do this, for example if you provide us with a video, photograph or content to use.

We may need to process your personal information in order to hold or conduct events, promotions, campaigns and visits to our premises and manage your involvement in them. This may relate to the entry into or performance of a contract with you either directly or indirectly, it may also be in our legitimate interests, or we may have a legal obligation to do so.

We may need to process your personal information to help train our staff, and make sure they deliver the high standards expected in relation to our brand. This will be in our legitimate interests.

In some cases, we may need to carry out background, identity, fraud prevention or other checks in relation to you to decide whether to enter into or to enforce a relationship we have with you. This will be in our legitimate interests, and in some cases, we may have a legal obligation to do so.

As a business we may have many legal obligations connected to our relationship with you or connected to visiting our premises which we need to comply with, for example, to comply with consumer protection laws or to comply with data protection laws or to comply with health and safety laws so we can ensure it is safe for you to visit our premises.

We will also need to keep and maintain proper records relating to your relationship with us and information about you which is relevant to that relationship. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations to do this.

In some cases, we may need to process your personal information to prevent, detect or prosecute criminal activity. This will also be in our legitimate interests; we may also have legal obligations or be exercising a legal right to do this and it will also be in the public interest.

You may have contacted us about a query, complaint or enquiry and we need to be able to respond to you and deal with the points you have raised. This will also be in our legitimate interests; we may also have legal obligations or be exercising a legal right to do this.

We may need to gather evidence for and be involved in possible legal cases. As well as relating to the entry into of a contract with you either directly or indirectly, this will also be in our legitimate interests, we may also have legal obligations or be exercising a legal right to do this and it may also be needed to establish, bring or defend legal claims.

To manage and keep a record of our relationship with you and any associated information It may relate to the entry into or performance of a contract with you either directly or indirectly, it will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this.

To ensure effective general business administration and to manage our business. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this.

To monitor any use you make of our website, apps and information and communication systems and social media accounts to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution and also to protect your personal information. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this. In relation to social media you may also have already made the personal information public.

To conduct data analytics and analysis studies to review and better understand trends and improve our business, use of our website, apps and social media which relates to us, and those same things in relation to our competitors. This will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this. We may sometimes anonymise and aggregate personal information for insight and research purposes, but this information will not identify you.

We may be carrying out market and/or product research, for example so that we can improve our offering and range of products or improve our use of our website, apps or social media. This will be in our legitimate interests.

We always aim to use your personal information in an ethical and non-intrusive way. Your security as a customer or potential customer is very important to us. We will not use your personal information to target, segment, or profile individuals based on their health (including pregnancy), negative financial status or condition, political affiliation or beliefs, racial or ethnic origin, religious or philosophical affiliation or beliefs, sex life or sexual orientation, data relating to an alleged or actual commission of a crime, for any unlawful or discriminatory purpose or in any other manner that would be inconsistent with your reasonable expectation of privacy.

During the process on our website when your personal data is collected, you will be asked to indicate your preferences for receiving direct marketing communications and in the absence of this you will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes

15. CHANGING MARKETING PREFERENCES

You have the right to opt out of receiving marketing communications from us at any time by:

Updating your preferences in your account on our website.

Informing us that you wish to change your marketing preferences by contacting our customer support team at enquiries@wyldholdings.co.uk.

Making use of the simple “unsubscribe” link in emails or any other electronic marketing materials we send to you.

Contacting us via email at enquiries@wyldholdings.co.uk or by post to My Data Queries, WYLD Holdings Ltd, Unit 3a London Brentwood Commercial Park, Tilbury Road, West Horndon, Brentwood, Essex, CM13 3LR.

The measures listed above do not apply to service messages such as order updates/ tracking and other non-marketing communications from us. They also don’t apply to advertising that may appear on our website, other websites or our apps. Please see the below section entitled 'Automated Decision Making' for more information on how we use cookies to advertise to you.

CHANGE OF PURPOSE

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you by updating this privacy notice on our website, so please check back regularly for any updates.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. We will rarely need to rely on your consent to process any of your personal information.

16. AUTOMATED DECISION-MAKING

Automated decision-making takes place when an electronic system uses personal information to make a decision about that person without any human intervention which produces legal effects concerning them or similarly significantly affects them. We do not currently use this type of automated decision making in our business in relation to you.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making unless we have a lawful basis for doing so and we have notified you.

However we do use automated processing so that we can show you personalised advertisements whilst browsing our website or those of other companies and to build a customer profile for you. Any advertisements you see may relate to your browsing activity on our website from your computer or other devices. 

These advertisements are provided by us via external market leading specialist providers using techniques such as pixels, web beacons, ad tags, mobile identifiers and ‘cookies’ placed on your computer or other devices (some of which are subject to your prior consent). For further information on the use of cookies, or for details of how you can remove or disable cookies at any time - see our Cookie Policy within this document.

We may analyse your browsing and purchasing activity online and your responses to marketing communications. The results of this analysis, together with other demographic data, allow us to decide what advertisements are suitable for you and to ensure that we draw to your attention products, services, events and offers that are tailored and relevant to you. To do so, we use software and other technology for automated processing. This allows us to provide more personalised services and experience.

We may review personal information held about you by external social media platform providers, such as the personal information available on social media platforms such as Twitter, Instagram, YouTube, Twitter and Facebook.

We aim to update you about products and services which are of interest and relevance to you as an individual. To help us do this, we process personal information by profiling and segmenting, identifying what our customers like and ensuring advertisements we show you are more relevant based on demographics, interests, purchase behaviour, online web browsing activity and engagement with previous communications.

17. WHO HAS INTERNAL ACCESS TO YOUR PERSONAL INFORMATION?

Your personal information may be shared internally with our staff (including with our customer support, order fulfilment, loyalty and retention, customer relationship management, media, insights, events, campaign, technical and legal teams) where access to your personal information is necessary for the performance of their roles. We only provide access to your personal information to those of our staff who need to have access to your personal information.

18. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH EXTERNALLY?

When using your personal information we may share it with third parties, but we will only do so when it is appropriate, and we have a lawful basis for doing so. Third parties that we may share your personal information with include:

• Any third party approved by you.
• Any internal third parties and/or any external third parties.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
• Service or product providers to our business, for example information technology services suppliers, logistics and warehousing providers, delivery and shipping providers, fraud prevention organisations, marketing and public relations service providers, market research and analysis providers, data cleansing providers.
• Third parties that process personal information on our behalf and in accordance with our instructions.
• Another company within our group of companies, especially if you have a relationship with that part of our group.
• Purchasers, investors, funders and their advisers if we sell all or part of our business, assets or shares or restructure whether by merger, re-organisation or in another way.
• Our legal and other professional advisers, including our auditors or any professional advisors appointed by you, for example a legal advisor.
• Social media and other online platforms where relevant to our relationship with you.
• Governmental bodies, HMRC, regulators, police, law enforcement agencies, security services, courts/tribunals.

We also use Google Analytics which sets cookies to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website and blog, where visitors have come to the website from and the pages they visited. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

We do not disclose personal information to anyone else except as set out above unless we are legally entitled to do so. We may provide third parties with aggregate statistical information and analytics about users of our products and services but we will make sure no one can be identified from this information before we disclose it. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We may share your personal data where necessary for the purposes set out in the table Purposes for which we will use your personal data above. Those parties are third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

19. INTERNATIONAL TRANSFERS

We share your personal data within our Group. This will involve transferring your data outside the UK to our overseas offices.

It is sometimes necessary to share your personal information outside of the UK and the European Economic Area (the EEA) or it will be collected outside of the UK and the EEA. This will typically occur when service providers to our business are located outside the EEA or if you are based outside the EEA. These transfers are subject to special rules under applicable data protection laws. We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

The same applies to any transfer of personal information to another part of our group of companies based outside of the UK and the EEA. We also apply the same standards to any transfer of personal information between members of our group, regardless of where the group company is based.

If we transfer your personal information outside of the UK and/or the EEA, we will ensure that the transfer will be compliant with applicable data protection laws and all personal information will be secure. Our standard practice is to assess the laws and practices of the destination country and relevant service provider and the security measures that are to be taken as regards the personal Information in the overseas location; alternatively, we use standard data protection/contractual clauses. This means that when a transfer such as this takes place, you can expect a similar degree of protection in respect of your personal information.

Whenever we transfer your personal data out of the UK to countries which have laws that do not provide the same level of data protection as the UK law, we always ensure that a similar degree of protection is afforded to it by ensuring that the following safeguards are implemented.

We ensure your personal data is protected by requiring all our group companies to follow the same set of rules when processing your personal data. These rules are called "binding corporate rules" (BCR). 

We use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement.

Our directors and other key staff working for us may in limited circumstances access personal information from outside of the UK and/or the EEA if they are outside of the UK or EEA. If they do so they will be using our security measures and the same legal protections will apply that would apply to accessing personal information from our premises.

In limited circumstances, the people to whom we may disclose personal information may be located outside of the UK and/or the EEA and we will not have an existing relationship with them, for example a foreign police force outside of the UK and/or the EEA. In these cases we will impose any legally required protections to the personal information as required by law before it is disclosed.

Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:

• We will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data; or
• We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement. 
   

If you would like any more details about how we protect your personal information in relation to international transfers then please contact enquiries@wyldholdings.co.uk.

20. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to keeping your personal information safe and secure and so we have numerous security measures in place to protect against the loss, misuse, and alteration of information under our control. We will always aim to use best in class security systems implemented across our networks and hardware to ensure access and information are protected. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Our security measures include:

• Encryption of personal information where appropriate.
• Regular cyber security assessments of all service providers who may handle your personal information.
• Regular planning and assessments to ensure we are ready to respond to cyber security attacks and data security incidents.
• Regular penetration testing of systems.
• Security controls which protect our information technology systems infrastructure and our premises from external attack and unauthorised access.
• Regular backups of information technology systems data with functionality to correct errors or accidental deletion/modification to data.
• Internal policies setting out our information security rules for our staff.
• Regular training for our staff to ensure staff understand the appropriate use and processing of personal information.
• Where we engage third parties to process personal information on our behalf, they do so on the basis of our written instructions, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of personal information.
• We take information security very seriously and will use all reasonable endeavours to protect the integrity and security of the personal information we collect about you.

21. FOR HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We will hold your personal information for the duration of your relationship with us and then usually for a further period. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Where you are a customer, this will usually be for a period of up to 6 years after you last purchased or ordered any products or services from us or last used our apps. If you have only signed up to receive online marketing communications from us, and you have never ordered or purchased anything from us, then we will only retain your personal information for 2 years after you last used any account you have with us or from when you last consented to receive direct marketing from us. In certain, limited cases, it may be necessary to keep your personal information for longer, for example if the information is relevant to a dispute or legal case or claim. By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

We will not retain your personal information for longer than necessary for the purposes for which it was collected and is being used.

22. YOUR RIGHTS

As an individual whose personal information we collect and process, you have a number of rights under data protection laws in relation to your personal data. You may:

• Withdraw any consent you have given to us, although this will only be relevant where we are relying on your consent as a lawful basis to use your personal information, but it is an absolute right. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes for which you originally gave your consent, unless we have another lawful basis for doing so. If you withdraw your consent, we may not be able to provide certain products or services to you.
• Request details about how your personal information is being used. This right is linked with the right of access mentioned below.
• Request access and obtain details of your personal information that we hold (this is commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal information. This means that you can ask us to delete, remove or stop processing your personal information, for example where we no longer have a reason to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (set out below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. The right to have data erased does not apply in all circumstances and as a result, we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to the processing of your personal information where we are relying on a legitimate interest (ours or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Object to direct marketing where we are processing your personal information for direct marketing purposes, for example contacting you about products that might interest you. This is an absolute right.
• Request the restriction of processing of your personal information/data. This enables you to ask us to stop processing your personal information in the following scenarios:
  • If you want us to establish the data's accuracy.
  • Where our use of the data is unlawful but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal information to another party in certain circumstances. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Object to certain automated decision-making processes using your personal information.
• You should note that some of these rights, for example the right to require us to transfer your personal information to another service provider or the right to object to automated decision making, may not always apply as they have specific requirements and exemptions which apply to them, and they may not apply to personal information recorded and stored by us. Also, for example we do not use automated decision making in relation to your personal information which has legal or other significant effects for you, but we do use automated processing to show you relevant advertisements. However, some of your rights have no conditions attached, so your right to withdraw consent or object to processing for direct marketing are absolute rights.
• No fee usually required. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
• What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
• Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
• We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person or dealt with by a person who has no right to do so.
• Whilst this privacy notice sets out a general summary of your legal rights in respect of personal information, this is a complex area of law. More information about your legal rights can be found on the ICO’s website at https://ico.org.uk/for-the-public/.

23. COMPLAINTS

We hope you don’t have any reason to complain, and we will always try to resolve any issues you have. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

If you are based in the UK, you have the right to make a complaint at any time to the ICO (the UK data protection regulator) about how we deal with your personal information or your rights in relation to your personal information.

You can make a complaint in writing to the ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom or you can go to https://ico.org.uk/make-a-complaint/. 

If you are based outside of the UK, you may have the right to complain to your local data protection regulator – we recommend checking your rights on the website of your local data protection regulator.

24. THIRD PARTY LINKS

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

25. CHANGES TO THE PRIVACY POLICY AND YOUR DUTY TO INFORM US OF CHANGES

We keep our privacy policy under regular review. This version was last updated on the date set out at the outset of this policy document above. Historic versions can be obtained by contacting us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

26. CONTACTING US

If you have any queries regarding our use of your personal information or this privacy notice then please contact enquiries@wyldholdings.co.uk or write to DPO, WYLD Holdings Ltd, Unit 3a London Brentwood Commercial Park, Tilbury Road, West Horndon, Brentwood, Essex, CM13 3LR.

27. GLOSSARY

The following are explanations of terms used in this privacy policy/notice:

legitimate interest(s) means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Internal third parties means other companies in the WYLD Holdings Ltd group and who are based in the United Kingdom and provide IT and system administration services and undertake leadership reporting or related services. 

External third parties means any of the following:

• Service providers based in the United Kingdom who provide IT and system administration services.
• Professional advisers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.