At SPAR we are committed to protecting and respecting your privacy. We will never share your data with any other party outside of our group, without your prior consent. You can change your contact options at any time.
The legal stuff:
SPAR (UK) Limited of Mezzanine Floor Hygeia Building, 66-68 College Road, Harrow, Middlesex, HA1 1BE (we, our, or us) are committed to protecting and respecting your privacy.
This policy is intended to be compliant with the General Data Protection Regulation 2016 (GDPR) and any enabling UK legislation (the Data Laws).
For the purpose of the Data Laws, we are the data controller. This means that we are responsible for determining when, why and how to process personal data.
Our Data Manager is Jackie Mackenzie and she has overall responsibility within SPAR (UK) Ltd for data protection. She may be contacted by emailing firstname.lastname@example.org or by writing to: Jackie Mackenzie, SPAR (UK) Ltd of Mezzanine Floor Hygeia Building, 66-68 College Road, Harrow, Middlesex, HA1 1BE.
- Information we may collect from you
Personal data means any information about an individual from which that person can be identified.
We may collect and process the following personal data about you:
Information you give us: You may give us information about you by filling in forms on our website or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register to use our website, subscribe to our service, search for a product, participate in discussion boards or other social media functions on our website, enter a competition, promotion or survey, and when you report a problem with our website. The information you give us may include (but is not limited to) your name, address, e-mail address and phone number, financial and credit card information, personal description and photograph.
Information we collect about you: With regard to each of your visits to our website we may automatically collect the following information:
Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, location (if this has been enabled on your computer or smart phone or other device), operating system and platform and other devices you use to access our website;
- Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
Information we receive from other sources: We may receive information about you if you use any of the other websites we operate or the other services we provide or where you interact with us on social media (e.g. Facebook, Twitter, You Tube etc) and join our community via the SPAR Social Hub.You may follow us on social media in which event we may collect information regarding your posts or communications with us. We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
- Uses made of the information
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data:
- Where we need to perform the contract we are about to enter into or have entered into with you.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal or regulatory obligation
Generally we do not rely on consent as a legal basis for processing your personal data other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw your consent to marketing at any time by contacting us.
Examples of the way in which we may use your information is set out below:
Information you give to us: We will use this information:
- To register you as a new customer or subscriber to our newsletters or other services (to perform our contract with you and as part of our legitimate interests in growing and developing our business, including our products and services);
- To enable you to take part in a prize draw, competition or to take part in a survey (as part of our legitimate interests to engage you as a customer and to understand your views of our service standards and product offering);
- to carry out any obligations arising from any correspondence entered into between you and us and to provide you with the information, products and services that you request from us (to perform our contract with you);
- to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about and to make recommendations to you (as part of our legitimate interests in growing and developing our business, including our products and services and understanding our customer’s buying preferences so that we can secure the right products);
- to provide you, or permit selected third parties (if we have your permission) to provide you, with information about goods or services we feel may interest you. If you are an existing customer, we will only contact you by electronic means (e-mail or SMS) with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you (as part of our legitimate interests in serving you as a customer (including the interests of authorised third parties). If you are a new customer, and where we permit selected third parties to use your data, we (or they) will contact you by electronic means only if you have consented to this. If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, you can withdraw your consent at any time by contacting us by email or post (see details at the end of this Policy);
- to notify you about changes to our service (to comply with our legal obligations);
- to ensure that content from our website is presented in the most effective manner for you and for your computer or other device (as part of our legitimate interests to ensure that we can communicate our business, products and services to you in the most effective manner).
Information we collect about you: We will use this information:
- To administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes (as part of our legitimate interests to ensure that we communicate our business, products and services to you in the most effective manner and that we record customer feedback and preferences to enable us to grow and develop our business);
- To improve our website to ensure that content is presented in the most effective manner for you and for your computer/device or browser (as part of our legitimate interests to ensure that we communicate our business, products and services to you in the most effective manner);
- To allow you to participate in interactive features of our service, when you choose to do so (as part of our legitimate interests to enhance the customer experience of our services and business);
- As part of our efforts to keep our website safe and secure (as part of our legitimate interests to keep your data safe and to comply with our legal obligations under the GDPR);
- to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you (as part of our legitimate interests to grow and develop our business, products and services);
- To make suggestions and recommendations to you and other users of our website about goods or services that may interest you or them (as part of our legitimate interests to further develop our business, products and to meet our customers’ needs).
- Disclosure of your information
We may share your personal information with any member of our group. This will include our corporate shareholders who together own SPAR (UK) Ltd. Those companies comprise:
- CJ Lang & Son Ltd – Scotland region;
- James Hall & Co Ltd – North of England region;
- AF Blakemore & Son Ltd – Central and South East England and Wales region.
- Appleby Westward Group Ltd – South West England region.
- Henderson Wholesale Ltd – Northern Ireland region.
Each of the above companies will have their own privacy policies that explain how they use your personal data. It is important that you read these.
Once we have your consent, we may share your information with other selected third parties including:
Business partners, distributors, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others.
Analytics and search engine providers that assist us in the improvement and optimisation of our website.
In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets.
If Spar (UK) Limited or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice or policy of every website you visit.
We require all third parties that process personal data with our permission and on our behalf to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
- Where we store your personal data
Some personal data that we collect from you may be transferred to the following entities who are based outside the European Economic Area:
MailChimp, for the purposes of sending newsletters via email.
Virtual Academy, for the purposes of managing access to an informational website for our retailers.
MailChimp are based in the US and is signatory to the EU/US Privacy Shield framework which provides a mechanism to comply with EU data protection requirements which is deemed adequate by the European Commission. Virtual Academy is based in Canada but there is in place an adequacy decision of the European Commission in respect of Canada confirming that it offers an adequate level of data protection.
These entities only use the personal data we transfer to them on our instruction and for our stated purposes and we understand that appropriate technical and organisational measures are in place to keep your personal data secure.
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Data we collect from you will be stored for the following retention periods:
- Newsletter sign up: Data entered during the sign up process for the newsletter will be stored for as long as you are subscribed to our emails.
- Competition entry: As standard, we will keep your details on file for up to a year after the winner is announced. Please see individual entry terms and conditions for specifics for each competition.
- Unsolicited emails: We will retain your details for up to a year after we receive an email unless there is a specific requirement to keep this for longer (e.g. to defend legal proceedings). Please be aware that we may need to pass your details to a third party or one of our corporate shareholders where a request needs to be fulfilled or a complaint addressed which relates to their region of operation.
- Social media communication: If you contact us using social media, we may forward communications to internal authorities (e.g. relaying a complaint to an internal regional distributor). We will not pass on personal details unless requested. Any posts you produce online are subjected to the GDPR guidelines for that specific platform.
- Other forms of personal data: in accordance with our policies of retention of personal data. Criteria considered for determining retention periods will include:
- The amount, nature and sensitivity of the personal data
- The potential risk of harm from unauthorised use or disclosure of your personal data
- The purposes for which we process your personal data;
- What alternatives there are to achieving our purposes
- Applicable legal requirements
- The limitation periods applicable for bringing certain claims against us.
As you are no doubt aware, the transmission of information via the Internet is never completely secure. Although we will do our upmost to protect your personal data, we cannot guarantee the security of your data transmitted to our website, by email or via other social channels; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
- Your rights
Under the GDPR, you have a number of individual rights in connection with your personal data. Those rights are as follows:
Right to be informed: You have the right to be informed of the personal data we collect about you and the reasons for this. This Policy seeks to provide this information.
Right to access: You have the right to request a copy of the personal data we hold about you and to check that we are lawfully processing it.
Right to rectification: You have the right to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: You may ask us to delete your personal data where there is no good reason for us continuing to process it or you have successfully objected to our processing (see below), where we are unlawfully processing or are required to delete your personal data by law. This is a limited right and we may not agree to your request if we consider that we have a compelling legal reason for continuing to process your personal data.
Right to object: You have the right to object to our processing of your personal data where we are relying on a legitimate interest and you consider that your rights and freedoms override such interests. You have the right to object where we are processing your personal data for direct marketing purposes. In some instances we may be able show that we have compelling legal reasons for continuing to process your personal data notwithstanding your objection.
Right to restrict: You can ask us to suspend the processing of your personal data: (1) if you want us to establish the data’s accuracy; (2) where our use of such data is unlawful but you do not want us to erase it; (3) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (4) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Right to Data Portability: You have the right to request the transfer of the personal data we hold for you to a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Right to withdraw consent at any time: Where we rely on consent as a legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can withdraw your consent by emailing the Privacy Team at SPAR (UK) Ltd and asking us. The email address is set out at the end of this policy.
You will not have to pay a fee to exercise any of these individual rights unless we consider that your request is clearly unfounded, repetitive or excessive. We may also refuse to deal with your requests in these circumstances.
We may seek to verify your identity first before responding to any of your individual requests.
We may revise this policy at any time by amending this page.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) at www.ico.org.uk. We would however appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.