Last modified: January 31, 2020
This policy applies to information we may collect:
This Policy does not apply to information collected by:
Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Websites. By accessing or using our Websites, you agree to this Policy. This Policy may change from time to time. Your continued use of our Websites after we make changes to this Policy is deemed to be an acceptance of those changes, so please check the Policy periodically for updates.
“Personal data” means any information which relates to a living, identifiable person. It can include names, addresses, telephone numbers, and email addresses, but it is wider than that and includes any other information relating to that person or a combination of information which, if put together, means that the person can be identified.
“Special category data” means personal data about a person’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.
“Processing” covers all activities relating to the use of personal data by an organization, from its collection through to its storage and disposal and everything in between.
“Data subject” means the person whose personal data is being processed.
“Data controller” means the organization which is responsible for processing data and ensuring that personal data is processed in accordance with data protection law.
Consistent with the guiding principles of GDPR, Personal data shall be: (a) processed lawfully, fairly and in a transparent manner; (b) collected for specified, explicit and legitimate purposes and not further processed; (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (d) accurate and, where necessary, kept up to date; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
SECTION 1 – WHAT INFORMATION WE COLLECT AND HOW IT IS COLLECTED AND PROCESSED
Your IP address is automatically assigned to your computer by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses a Website, along with the time of the visit and the page(s) that were visited. Collecting IP addresses is standard practice and is done automatically by many websites, applications and other services. We use IP addresses for purposes such as calculating usage levels, diagnosing server problems and administering the Websites. We may also derive your approximate location from your IP address.
While registration is not required for you to use our Websites, there may be circumstances in which you choose to register for our services, to attend our events or to receive ongoing updates from us, or to apply for employment with us. In these cases, BHB International may contact registrants to invite them to our events, provide them with information about our services, publications and products, or for other marketing purposes.
For example, you may choose to register for Email alerts, in which we send subscribers email updates when new information is added to our Websites. If you decide to subscribe, we will collect basic contact information about you, such as your name and email address.
When you make purchases from our Websites, we collect certain information from you, including, without limitation: Personal data such as your name, address, and date of birth; and financial information such as payment and financial institution information (see “THIRD PARTY SERVICES” below for additional information on the financial information we or a third party may collect). This information may also be secured from the sources described below and is subject to the conditions stated below.
If you have applied for employment with us, your information submitted with your job application will be added to our recruitment system and used for recruitment and other customary human resources purposes.
If you have registered on our Websites, your information, including any Personal data you provide, will be stored in our third-party customer relationship management (CRM) systems. Data of registrants who have been out of active use for 24-months will be deleted from our CRM systems. Other retention periods may vary depending upon the purpose for your registration. Please see “THIRD PARTY SERVICES” below for more information.
If you have opted out from receiving communications from us, your contact details will remain on our opt-out list to prevent you from receiving any further publications, invitations or communications from us. This does not apply to any communications we may be required to provide.
Your Personal data referenced in this Policy may be secured or received from sources such as (i) your inquiries by mail, telephone, email or face-to-face conversations; (ii) interviews with us with respect to employment opportunities; (iii) agreements, applications, forms, statements, and other documents received from you; and (v) any other information you submit voluntarily to us.
SECTION 2 – CONSENT
When you provide us with personal information to complete a transaction, verify your credit card, place an order, arrange for a delivery or return a purchase, we imply that you consent to our collecting it and using it for that specific reason only. If we ask for your personal information for a secondary reason, like marketing, we will either ask you directly for your express consent, or provide you with an opportunity to say no.
After you opt-in, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at any time, by contacting us at email@example.com
SECTION 3 – LEGAL BASIS FOR USAGE AND DISCLOSURE
Set out below is a description of the ways we intend to use your personal data and the legal grounds on which we will process such data. We have also explained what our legitimate interests are where relevant. We may process your personal data for more than one lawful ground, depending on the specific purpose for which we are using your data. Please email us at firstname.lastname@example.org if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
|Purpose/Activity||Type of data||Lawful basis for processing|
|To register you as a new customer||(a) Identity (b) Contact||Performance of a contract with you|
|To process and deliver your order including: (a) Manage payments, fees and charges(b) Collect and recover money owed to us||(a) Identity (b) Contact(c) Financial(d) Transaction(e) Marketing and Communications||(a) Performance of a contract with you (b) Necessary for our legitimate interests to recover debts owed to us|
|To enable you to sign up for e-mails||(a) Identity (b) Contact(c) Profile(d) Usage(e) Marketing and Communications||(a) Performance of a contract with you (b) Necessary for our legitimate interests to study how customers use our products/services, to develop them and grow our business|
|To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)||(a) Identity (b) Contact(c) Technical||(a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganization or group restructuring exercise (b) Necessary to comply with a legal obligation|
|To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising||(a) Identity (b) Contact(c) Profile(d) Usage(e) Marketing and Communications(f) Technical||Necessary for our legitimate interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy|
|To use data analytics to improve our website, products/services, marketing, customer relationships and experiences||(a) Technical (b) Usage||Necessary for our legitimate interests to define types of customers for our products and services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy|
|To make suggestions and recommendations to you about goods or services that may be of interest to you||(a) Identity (b) Contact(c) Technical(d) Usage(e) Profile||Necessary for our legitimate interests to develop our products/services and grow our business|
Please note that in certain cases, if you do not provide Personal data which we require, we will not be able to provide certain products or services to you.
SECTION 4 – YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA
We will only send you marketing communications if you “opted in” to receiving such communications. You have the right to “opt out” of receiving marketing communications, whether by email or otherwise, at any time. You can do this by (i) clicking the unsubscribe link displayed in any of the marketing e-mails you receive, (ii) emailing to indicate you no longer wish to receive marketing communications, or (iii) writing to us at the address set out in “HOW TO CONTACT US” below.
If you are a “data subject” under applicable EU data protection law, you will have the following rights in relation to personal data that we hold about you:
To exercise your rights as set out above or to make a complaint or submit an inquiry about our privacy practices, please contact us at email@example.com
To help protect your privacy and maintain security, we may take steps to verify your identity before we can act on your request.
SECTION 5 – RETENTION
We will retain your Personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained.
The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the Websites or offerings to you (for example, for as long as you have an account with us or keep using the Websites or offerings); (ii) whether there is a legal or business obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or (iii) whether retention is advisable in light of our legal position.
SECTION 6 – THIRD PARTY SERVICES
In general, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us. However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers. In particular, remember that certain providers may be located in or have facilities that are located a different jurisdiction than either you or us. So if you elect to proceed with a transaction that involves the services of a third-party service provider, then your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located. As an example, if you are located in Canada and your transaction is processed by a payment gateway located in the United States, then your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the USA PATRIOT Act. Once you leave our Websites or are redirected to a third-party website or application, you are no longer governed by this Policy or our Website Terms of Service. When you click on links on our Websites, they may direct you away from our Website. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.
Our store is hosted on WooCommerce (“WC”). They provide us with the online e-commerce platform that allows us to sell our products and services to you.
SECTION 7 – SECURITY
To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed. If you provide us with your credit card information, the information is encrypted using secure socket layer technology (SSL) and stored with a AES-256 encryption. Although no method of transmission over the Internet or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional generally accepted industry standards. We are not responsible for circumvention of any privacy settings or securities measures contained on our website.
SECTION 8 – DATA TRANSFERS
We may transfer to, and store the data we collect about you in, countries other than the country in which the data was originally collected, including the United States, Canada or other destinations outside the European Economic Area (“EEA”). Those countries may not have the same data protection laws as the country in which you provided the data. When we transfer your data to other countries, we will protect the data as described in this Policy and comply with applicable legal requirements providing adequate protection for the transfer of data to countries outside the EEA.
If you are located in the EEA, we will only transfer your personal data if:
You may request more information about the safeguards that we have put in place in respect of transfers of personal data by contacting us as described below.
SECTION 9 – AGE OF CONSENT
We reserve the right to modify this Policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the Websites. If we make material changes to this Policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it. The date this Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Websites and this Policy to check for changes.
HOW TO CONTACT US
If you would like to: access, correct, amend or delete any personal information we have about you, register a complaint, or simply want more information, contact our Data Protection Officer at firstname.lastname@example.org In the unlikely event that you wish to lodge a complaint about our collection, transfer or processing of your personal data, you can lodge a complaint with the UK Data Commissioner’s Office which is the Supervisory Authority of BHB International with respect to data protection.