privacy policy

Your Privacy

Our Website adheres to all legal requirements to protect your privacy. This Privacy Policy is a legal statement that explains when, where, why and how we collect, use and store your personal data when you view, use or interact with our website. This Privacy Policy is effective from 17th May 2022.

Definitions

You will see terms in our Privacy Policy that are capitalized. These terms have meanings as described in the definitions section below.

Personal Data: Any information regarding a natural person, a legal person, an institution or an association, which is, or can be, identified, even indirectly, by reference to any other information, including a personal identification number.

Usage Data: Information collected automatically from this website (or third-party services employed in this website), which can include: the IP addresses or domain names of the computers utilised by the Users who use this website, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilised to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilised by the User, the various time details per visit (e.g. the time spent on each page within the website) and the details about the path followed within the website with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.

User: The User is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.

Data Controller: Data Controller means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your data.

Data Processors (or Service Providers):
Data Processor (or Service Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.

Data Subject: Data Subject is any living individual who is the subject of Personal Data.

GDPR: General Data Protection Regulation Data Protection Directive. The current legislation – (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union. It addresses the export of personal data outside the EU.

Website: The hardware or software tool by which the Personal Data of the User is collected.

Cookies: Cookies are small pieces of data stored on a User’s device.

 

1. Summary

This section summarises as a general overview how we obtain, store and use information about you.

Data Controller:
Data Controller, Unit 4C, Bramfield Farm Place Buildings, Bramfield, Hertfordshire SG14 2FD.

How we collect or obtain information about you:
when you provide it to us (e.g. by contacting us, placing an order on our website, booking an appointment, using our chat system, browsing our products or by signing up to your e-newsletter).
from your use of our website, using cookies and occasionally from third parties.

Information we collect:
Name, contact details, payment information e.g. your credit or debit card details, usage data including IP address, information from cookies, information about your computer or device (e.g. device and browser type), information about how you use our website (e.g. which pages you have viewed, the time when you view them and what you clicked on, the geographical location from which you accessed our website (based on your IP address), company name or business name (if applicable), VAT number (if applicable).

How we use your information:

• For administrative and business purposes (particularly to contact you and process orders you place on our website), to improve our business and website, to fulfil our contractual obligations, to advertise our goods and services, to analyse your use of our website, and in connection with our legal rights and obligations;
• To notify you about changes to our business, products and services;
• To provide customer support;
• To gather analysis or valuable information so that we can improve our Web Service and products;
• To monitor the usage of our website;
• To detect, prevent and address technical issues;
• To provide you with news, offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information. You have the legal right to opt-in and opt-out. Opt-out is the default value in accordance to the GDPR.

Disclosure of your information to third parties:
Only to the extent necessary to run our business, to our service providers, to fulfil any contracts we enter into with you, where required by law or to enforce our legal rights:

• Business Transaction. If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.
• Disclosure for Law Enforcement. Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Do we sell your information to third parties (other than in the course of a business sale or purchase or similar event):
No

Are there consequences in not supplying your personal data:
To place an order with us we will require email address, billing address, shipping address, company name (if applicable), & VAT number (if applicable). Usage data to place an order is not mandatory.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

How long we retain your information:
For no longer than necessary, taking into account any legal obligations we have (e.g. to maintain records for tax purposes), any other legal basis we have for using your information (e.g. your consent, performance of a contract with you or our legitimate interests as a business) and certain additional factors described in the main section below entitled How long we retain your information. For specific retention periods in relation to certain information which we collect from you, please see the main section below entitled How long we retain your information.

How we secure your information:
Using appropriate technical and organisational measures such as storing your information on secure servers, encrypting transfers of data to or from our servers using Secure Sockets Layer (SSL) technology, encrypting payments you make on or via our website using Secure Sockets Layer (SSL) technology, only granting access to your information where necessary. This site uses a COMODO CA Limited to offer secure communications by encrypting all data to and from the site.

Use of cookies:
We use cookies on our website including essential, functional, analytical and targeting cookies. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

Like most sites, we use cookies for several reasons, the main reasons being:

• Analytics & Tracking – we use cookies to understand how the site is being used in order to improve the user experience. User data is anonymous.

For more information, please visit our cookies policy.

Transfers of your information outside the European Economic Area:
We will only transfer your information outside the European Economic Area if we are required to do so by law.

Profiling and automated decision-making:
Profiling is used to help promote our blog posts or products through social media paid adverts, web analytics and cookies. We do not make decisions by automated means.

GDPR Individual rights:

• to access your information and to receive information about its use;
• to have your information corrected and/or completed;
• to have your information deleted;
• to restrict the use of your information;
• to receive your information in a portable format;
• to object to the use of your information;
• to withdraw your consent to the use of your information;
• not to have significant decisions made about you based solely on automated processing of your information, including profiling;
• to complain to a supervisory authority.

Sensitive personal information:
We do not knowingly or intentionally collect what is commonly referred to as ‘sensitive personal information’. Please do not submit sensitive personal information about you to us. For more information, please see the main section below entitled Sensitive Personal Information.

Legal Basis for Processing Personal Data Under General Data Protection Regulation (GDPR):
If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

• We may process your Personal Data because:
• We need to perform a contract with you;
• You have given us permission to do so;
• The processing is in our legitimate interests and it’s not overridden by your rights;
• For payment processing purposes;
• To comply with the law.

2. Our data controller contact details

The data controller in respect of our website is Data Controller, Unit 4C, Bramfield Farm Place Buildings, Bramfield, Hertfordshire SG14 2FD. You can contact the data controller by writing to the business address above or sending an email to jac@theorieslandscapes.co.uk

If you have any questions about this Privacy Policy, please contact the data controller.

3. Information collected: Website visit

Legal basis for processing:
Compliance with a legal obligation to which we are subject (Article 6(1)(c) of the General Data Protection Regulation).

Legal obligation:
We have a legal obligation to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of our processing of information about individuals. Recording access to our website using server log files is such a measure.

Legal basis for processing:
Our interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interests:
We and our third party hosting provider have a legitimate interest in using your information for the purposes of ensuring network and information security.

Use of website server log information to analyse website use and improve our website:
We use the information collected by our website server logs to analyse how our website users interact with our website and its features for website performance reasons.

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest:
Improving our website for our website users and getting to know our website users’ preferences so our website can better meet their needs and desires.

Cookies:
Cookies are data files which are sent from a website to a browser to record information about users for various purposes.

We use cookies on our website, including essential, functional, analytical and targeting cookies. For further information on how we use cookies, please see our cookies policy.

You can reject some or all of the cookies we use on or via our website by changing your browser settings or non-essential cookies but doing so can impair your ability to use our website or some or all of its features. For further information about cookies, including how to change your browser settings, please visit www.allaboutcookies.org or see our Cookies Policy.

Analytics & Tracking:
We use cookies to understand how the site is being used in order to improve the user experience. User data is anonymous.

4. Information collected: Contact us

Email:
When you send an email to the email address displayed on our website we collect your email address and any other information you provide in that email (such as your name, telephone number and the information contained in any signature block in your email).

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.

Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.

Transfer and storage of your information:
We use a third party email provider to store emails you send us. Our third party email provider is either one or a combination of Google Mail. Their privacy policy is available here. Email by Microsoft. Their privacy policy is here. Webhosting UK COM Ltd and their privacy policy is here.

Emails you send us will be stored within the European Economic Area on Google’s servers in Belgium. For further information please see the section of this privacy policy entitled Data Transfers outside the European Economic Area.

Contact form:
When you contact us using our contact form, we collect mandatory information including your name, email address and IP address.

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.

Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.

Transfer and storage of your information:
Messages you send us via our contact form will be stored within the European Economic Area in the UK.

For information about the safeguards used when your information is transferred outside the European Economic Area, see the section of this privacy policy below entitled Data Transfers outside the European Economic Area.

Phone:
When you contact us by phone, we collect your phone number and any information provide to us during your conversation with us.

We do not record phone calls.

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.

Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.

Transfer and storage of your information:
Information about your call, such as your phone number and the date and time of your call, is processed by our third party telephone service provider which is located in the UK.

Information about your phone call will be stored by our third party telephone service provider within the UK (European Economic Area).

Post:
If you contact us by post, we will collect any information you provide to us in any postal communications you send us.

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.

Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so).

5. Information collected: Website interaction

Registering on our website:
When you register and create an account on our website, we collect the following information:

• Information about your computer and about your visits to and use of this website, such as your IP address, geographical location, browser type, referral source, length of visit and number of page views;
• Information relating to any transactions carried out between you and us on or in relation to this website, including information relating to any purchases you make of our goods or services (including name, e-mail address, postal address and phone number).
• Information that you provide to us for the purpose of subscribing to our e-mail notifications, placing reviews on our website, booking an appointment and when using our chat service.

If you do not provide the mandatory information required by the registration form, you will not be able to register or create an account on our website.

Legal basis for processing:
Necessary to perform a contract(Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Creating an account on our website is necessary to allow you to access the goods and services you have purchased from us.

Transfer and storage of your information:
Information you submit to us via the registration form on our website will be stored within the UK.

Our web server is located in the UK.

6. Information collected: Online Booking

Mandatory information:
When you place an order for goods or services on our website, we collect your name, email address, billing address, shipping address, company name (if applicable), & VAT number (if applicable).

If you do not provide this information, you will not be able to purchase goods or services from us on our website or enter into a contract with us.

Legal basis for processing:
Necessary to perform a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
We need the mandatory information collected by our checkout form or via email to establish who the contract is with and to contact you to fulfil our obligations under the contract, including sending you receipts and order confirmations.

Legal basis for processing:
Compliance with a legal obligation (Article 6(1)(c) of the General Data Protection Regulation).

Legal obligation:
We have a legal obligation to issue you with an invoice for the goods and services you purchase from us where you are VAT registered and we require the mandatory information collected by our checkout form for this purpose. We also have a legal obligation to keep accounting records, including records of transactions.

Optional information:
We also collect optional information from you, such as your phone number and information about how you heard about us.

7. Information collected: Third parties

Generally, we do not receive information about you from third parties.

It is also possible that third parties with whom we have had no prior contact may provide us with information about you.

Information we obtain from third parties will generally be your name and contact details, but will include any additional information about you which they provide to us. In certain circumstances (for example, to verify the information we hold about you or obtain missing information we require to provide you with a service) we will obtain information about you from certain publicly accessible sources, both EU and non-EU, such as online customer databases, business directories, media publications, social media, and websites (including your own website if you have one).

Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why necessary to perform a contract:
Where a third party has passed on information about you to us (such as your name and email address) in order for us to provide services to you, we will process your information in order to take steps at your request to enter into a contract with you and perform a contract with you. We will also obtain information about you from public sources in order to enable us to understand your business and provide services to you.

Legal basis for processing:
Consent (Article 6(1)(a) of the General Data Protection Regulation).

Consent:
Where you have asked that a third party to share information about you with us and the purpose of sharing that information is not related to the performance of a contract or services by us to you.

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interests:
Where a third party has shared information about you with us and you have not consented to the sharing of that information, we will have a legitimate interest in processing that information in certain circumstances. we will have a legitimate interest in obtaining information about you from public and private sources in order to investigate and pursue any potential infringement.

8. Profiling

Profiling is any form of automated processing of your information to evaluate personal aspects about you, in particular to analyse or predict things like your performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Use of profiling for web analytics:
Our web analytics service, Google Analytics collects information such as your location (based on your IP address) and your behaviour (based on cookies) when you access our website (such as the pages you visit and what you click on). We will only process information from cookies if you have consented to us setting cookies on your computer in accordance with our Cookies Policy.

Logic involved:
By automatically analysing and categorising information such as the location (based on IP address) as well as the behaviour and devices of visitors to our website (using cookies), we are able to gain a better understanding of what our website visitors want (in terms of the content of our website and our products), how to improve our website and how to advertise and market our services to them.

Reason:
Cookies will be used to track and store information about your behaviour and device on our website (unless you have opted out from receiving such cookies by following this guide) and your location will be analysed based on your IP address. We may target advertisements based on the level of interest we receive from certain visitors and their behaviour on our website.

9. Displaying content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of this Website and interact with them.

This type of service might still collect web traffic data for the pages where the service is installed, even when users do not use it.

Typekit (Adobe Systems):
Typekit is an online service which offers a subscription library of high-quality fonts. The fonts may be used directly on websites or synced via Adobe Creative Cloud to applications on the subscriber’s computers.

Personal Data collected: Usage Data and various types of Data as specified in the privacy policy of the service.

Place of processing: US – Privacy Policy.

YouTube video widget (Google Inc.):
YouTube is a video content visualisation service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

YouTube button and social widgets (Google Inc.):
The YouTube button and social widgets are services allowing interaction with the YouTube social network provided by Google Inc.
Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

Instagram widget (Instagram, Inc.):
Instagram is an image visualization service provided by Instagram, Inc. that allows this Application to incorporate content of this kind on its pages.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy

Pinterest and social widgets (Pinterest Europe Ltd):
Pinterest is a web and mobile application company that operates a software system designed to discover information online.

Personal Data collected: Cookies and Usage Data.

Place of processing: Ireland – Privacy Policy

Facebook Like button and social widgets (Facebook, Inc.):
The Facebook Like button and social widgets are services allowing interaction with the Facebook social network provided by Facebook, Inc.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

Twitter Tweet button and social widgets (Twitter, Inc.):
The Twitter Tweet button and social widgets are services allowing interaction with the Twitter social network provided by Twitter, Inc.

Personal Data collected: Cookies and Usage Data:

Place of processing: US – Privacy Policy.

LinkedIn button and social widgets (LinkedIn Corporation):
The LinkedIn button and social widgets are services allowing interaction with the LinkedIn social network provided by LinkedIn Corporation.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

Flickr button and social widgets (SmugMug, Inc.):
The Flickr button and social widgets are services allowing interaction with the Flicr image sharing social network provided by LinkedIn SmugMug, Inc..

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy.

Google Maps widget (Google Inc.) Google Maps is a maps visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.

Personal Data collected: Cookies and Usage Data.

Place of processing: US – Privacy Policy

10. Platform services

These services have the purpose of hosting and running key components of this Website, therefore allowing the provision of this Website from within a unified platform. Such platforms provide a wide range of tools to the Owner – e.g. analytics, user registration, commenting, database management, e-commerce, payment processing – that imply the collection and handling of Personal Data. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

WordPress.com (Automattic Inc.):
WordPress.com is a platform provided by Automattic Inc. that allows the owner to build, run and host this Website.

Personal Data collected: various types of Data as specified in the privacy policy of the service.

Place of processing: USA – Privacy Policy.

Your information will be shared with these service providers where necessary to provide you with the service you have requested, whether that is accessing our website or ordering goods and services from us.

Legal basis for processing:
Legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Google Inc:
Google collects information through our use of Google Analytics on our website. Google uses this information, including IP addresses and information from cookies, for a number of purposes, such as improving its Google Analytics service. Information is shared with Google on an aggregated and anonymised basis. To find out more about what information Google collects, how it uses this information and how to control the information sent to Google, please see the following page: https://www.google.com/policies/privacy/partners/

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest(s):
Meeting our contractual obligations to Google under our Google Analytics Terms of Service (https://www.google.com/analytics/terms/us.html)

You can opt out of Google Analytics by installing the browser plugin here: https://tools.google.com/dlpage/gaoptout

Transfer and storage of your information:
Information collected by Google Analytics is stored outside the European Economic Area on Google’s servers in the United States of America.
For further information, See the section of this privacy policy below entitled Data Transfers outside the European Economic Area

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest:
Running and managing our business efficiently.

11. Disclosure and additional uses of your information

Insurers:
Information is shared with our insurers upon an official claim against us

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest:
Running and managing our business effectively.

Disclosure and use of your information for legal reasons:

• Indicating possible criminal acts or threats to public security to a competent authority, such as the Police.
• In connection with a legal or potential legal dispute or proceedings to resolve the dispute.
• For ongoing compliance with laws, regulations and other legal requirements:

Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interests:
Preventing crime or suspected criminal activity (such as fraud) and taking steps to enforce our legal rights. Where the legal obligations are part of the laws of another country and have not been integrated into the United Kingdom’s legal framework, we have a legitimate interest in complying with these obligations.

12. Data retention: Personal data

We use your Personal Data to meet our contractual requirements to support us in providing a data protection service to you. We also use your Personal Data as required by law, such as for tax purposes. We also use your information to invoice you, and to keep track of payments that you make.

We will retain information about you for the duration of our relationship with you, then 2 years. We will retain financial records for 6 years, following the end of the current financial year for tax purposes.

Otherwise, we will retain your information for no longer than necessary, taking into account the following:

the purpose(s) and use of your information both now and in the future (such as whether it is necessary to continue to store that information in order to continue to perform our obligations under a contract with you or to contact you in the future);

• whether we have any legal obligation to continue to process your information (such as any record-keeping obligations imposed by relevant law or regulation);
• whether we have any legal basis to continue to process your information (such as your consent);
• how valuable your information is (both now and in the future);
• any relevant agreed industry practices on how long information should be retained;
• the levels of risk, cost and liability involved with us continuing to hold the information;
• how hard it is to ensure that the information can be kept up to date and accurate; and
• any relevant surrounding circumstances (such as the nature and status of our relationship with you).

13. Data security: Personal data

We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:

• only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
• verifying the identity of any individual who requests access to information prior to granting them access to information;
• using Secure Sockets Layer (SSL) software to encrypt any information you submit to us via any forms on our website and any payment transactions you make on or via our website.
• only transferring your information via closed system or encrypted data transfers.

Transmission of information to us by email:
Transmission of information over the internet is not entirely secure, and if you submit any information to us over the internet (whether by email, via our website or any other means), you do so entirely at your own risk.

We cannot be responsible for any costs, expenses, loss of profits, harm to reputation, damages, liabilities or any other form of loss or damage suffered by you as a result of your decision to transmit information to us by such means.

14. Data Transfers outside the European Economic Area

All of your information stored on the website is in the European Economic Area (EEA) country–UK

Other than to comply with any legal obligations, we do not intend to transfer your information outside the EEA or to an international organisation. In the unlikely event that we are required to transfer your information outside the EEA, we will ensure appropriate safeguards and protections are in place.

Contact Form:
Information you submit to us via our contact form is transferred inside the UK and stored on our store’s server. Our hosting provider is Webhosting UK COM Ltd. You can access their privacy policy here.

Email:
Information you submit to us by email is stored within the EEA -UK, Ireland or Belgium. Although due to resiliency and redundancy reasons using a network of data centres. Google mail and Microsoft may also store emails outside the EEA on their servers. You can access Google’s privacy policy here and Microsoft’s policy here.

Google Analytics:
Information collected by Google Analytics (your IP address and actions you take in relation to our website) is transferred outside the EEA and stored on Google’s servers. You can access Google’s privacy policy here: https://www.google.com/policies/privacy/

Country of storage:
United States of America. This country is not subject to an adequacy decision by the European Commission.
Safeguard(s) used: Google has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome. The EU-U.S. Privacy Shield is an approved certification mechanism under Article 42 of the General Data Protection Regulation, which is permitted under Article 46(2)(f) of the General Data Protection Regulation. You can access the European Commission decision on the adequacy of the EU-U.S. Privacy Shield here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm

15. GDPR Individual rights

Subject to certain limitations on certain rights, you have the following rights in relation to your information, which you can exercise by writing to Ian Ayliffe, Data protection lead. Address: Data Controller, Unit 4C, Bramfield Farm Place Buildings, Bramfield, Hertfordshire SG14 2FD. Phone: +44 (0) 2072 547282 or sending an email to jac@theorieslandscapes.co.uk

• to request access to your information and information related to our use and processing of your information;
• to request the correction or deletion of your information;
• to request that we restrict our use of your information;
• to receive information which you have provided to us in a structured, commonly used and machine-readable format (e.g. a CSV file) and the right to have that information transferred to another data controller (including a third party data controller);
• to object to the processing of your information for certain purposes;
• to withdraw your consent to our use of your information at any time where we rely on your consent to use or process that information. (lawfulness of use and processing still applies).

In accordance with Article 77 of the General Data Protection Regulation, you also have the right to submit a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation.

For the purposes of the UK, the supervisory authority is the Information Commissioner’s Office (ICO), the contact details of which are available here: https://ico.org.uk/global/contact-us/

The above rights are provided in summary form only and certain limitations apply to many of these rights. For further information about your rights in relation to your information, including any limitations which apply, please visit the following pages on the ICO’s website:

• https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/; and
• https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
• https://ico.org.uk/concerns/

You can also find out further information about your rights, as well as information on any limitations which apply to those rights, by reading the underlying legislation contained in Articles 12 to 22 and 34 of the General Data Protection Regulation, which is available here: http://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf

Verifying your identity where you request access to your information:
Upon a request to access your information, we are legally required to use all reasonable measures to verify your identity via existing information we have on file or we may ask for other forms of identity verification.

16. The right to restrict processing

You have the following rights in relation to your information, which you may exercise in the same way as you may exercise by writing to the Data protection officer: Data Controller, Unit 4C, Bramfield Farm Place Buildings, Bramfield, Hertfordshire SG14 2FD Phone: +44 (0)2072 547282. Or sending an email to jac@theorieslandscapes.co.uk in order to object to us using or processing your information. Where we use or process it in order to carry out a task in the public interest or for our legitimate interests, including ‘profiling’ (i.e. analysing or predicting your behaviour based on your information) based on any of these purposes; and

• to object to us using or processing your information for direct marketing purposes (including any profiling we engage in that is related to such direct marketing).

You may also exercise your right to object to us using or processing your information for direct marketing purposes by:

• clicking the unsubscribe link contained at the bottom of any marketing email we send to you and following the instructions which appear in your browser following your clicking on that link;
• sending an email to jac@theorieslandscapes.co.uk, asking that we stop sending you marketing communications or by including the words “OPT OUT”.

For more information on how to object to our use of information collected from cookies and similar technologies, please see the section entitled “How to accept or reject cookies” in our cookies policy.

17. Sensitive Personal Information

We do not knowingly or intentionally collect sensitive personal information from individuals.
‘Sensitive personal information’ data that consists of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.

If you have sent sensitive personal information to us, you will be considered to have explicitly consented to us processing that sensitive personal information under Article 9(2)(a) of the General Data Protection Regulation. This information will be deleted after data processing.

18. Privacy Policy Updates

We periodically update and amend our Privacy Policy.

Privacy Policy: Minor updates
Where we make minor changes to our Privacy Policy, we will update our Privacy Policy with a new effective date stated at the beginning of it.

Privacy Policy: Major updates
Upon major changes to our Privacy Policy or using your Personal Data for a new purpose, we will notify you by email or via a notice on our website, explaining the reason for the change.

19. External Links

We have no control or responsibilities on other websites not owned by us. If you click on a third party link, you will be directed to their website. It is recommended you review their privacy policy.

20. Children’s Data Privacy Compliance

Our company is compliant with the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA regulations protect the privacy of children using the internet. We do not contact or collect data for persons under the age of 18. However, if we did we immediately obtain the appropriate parental consent to use that information or, if not we will delete the information from our servers. If you would like inform us that persons under the age of 18 has engaged with us via the Internet, please send us an email.

21. DNT (Do Not Track) Disclosure: The California Online Privacy Protection Act

“Do Not Track” is a web browser privacy preference option. This will send a message to websites requesting that they do not track the user. For further information visit www.allaboutdnt.org
Currently, we do not respond to Do Not Track browser settings or signals. However, please note your internet activity may still be monitored via pixels and web beacons. To opt out of these please see our Cookies Policy.

22. How to contact us

If you want to request information about our privacy policy or discuss any data protection issues you can at privacy@promoteukltd.com or write to:

Data protection lead: Data Controller, Unit 4C, Bramfield Farm Place Buildings, Bramfield, Hertfordshire SG14 2FD.
Phone: +44 (0)2072 547282

23. Your right to complain

Your right to complain to a supervisory authority. You have the right to take any complaints about how we process your personal data to a supervisory authority.

The UK supervisory authority contact details:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113.

Further assistance in how to report a concern or a complaint https://ico.org.uk/concerns/