General Data Protection Regulation (GDPR)

Background

The GDPR is the biggest change to data privacy laws in the last 20 years and came into force on 25th May 2018.

The new regulation is focused on you the individual and how data is used and processed. As an existing or potential customer it is important that we let you know the rights you have under the new regulation and these are described below.

If you have any specific concerns or queries regarding the privacy of your personal data or require further information about how we manage your personal information, please contact us at info@walks4all.co.uk.

How we collect data

We collect personal data about you in connection with our products and services in the following ways:

From your application or purchase of a product or service.
From your interactions with us whether over the telephone, in person, in writing, via our websites or by email.
Through analysis of your interactions and activities with us.
From third parties, such as social networks, agents working on your behalf, government and law enforcement agencies.

How the law protects you

Data Protection law says that we are allowed to use personal information only if we have a proper reason to do so. The law says we must have one of the following reasons:

To fulfil a contract we have with you.
When it is our legal duty.
When it is in our legitimate interest.
When you consent to it.

A legitimate interest is when we have a business or commercial reason to use your information including but not limited to internal administrative purposes, product development and enhancement, preventing fraud, ensuring system and information security.

How we use your personal data

The main ways in which we may use your personal information are to:

Process and dispatch goods which you have purchased.
Communicate with you and to provide information and assistance when you request it.
Help us to prevent, detect, and investigate fraud and other financial crimes.
Meet our legal obligations.
Maintain the security of our services, as well as to detect and investigate activities that may be illegal or prohibited.

Sharing your personal information

We may share your personal information with:

Our service providers and third parties who provide services on our behalf, including but not limited to:
- Our mailing agents - typically Royal Mail.
- Our payment handling agents - typically PayPal.
- Our website hosts and email service provider.
- Our newsletter service provider - Mailchimp.
Fraud prevention and law enforcement agencies.
Regulators, governments, courts, dispute resolution bodies and auditors.

We will do this to:

Satisfy our responsibilities in relation to the supply of goods and services to you.
Respond to enquiries and complaints.
Undertake transactional analysis.
Create statistical and trend analysis.
Support the provision of our services.
Prevent fraud and other financial crimes.
Comply with legal obligations, court orders, laws and regulations.

Your data may be transferred outside of the EEA to trusted service providers and third parties. Where this is the case, we will ensure that suitable protection is maintained at all times by ensuring that appropriate safeguards are in place.

In some countries the law may require us to share certain information. In these cases, we will share data only with people and organisations that have the right to see it.

Retaining your personal information

We will retain your personal information for as long as is necessary for the purposes described above. Typically, we will retain your data for a minimum of seven years to:

Fulfil our business purposes.
Comply with legal and regulatory requirements.
Support or investigate any legal claims.

We may keep your data for longer where this is necessary for statistical and historical research purposes however we will ensure all personally identifiable information is removed where technically feasible. We will maintain the security and protection of any information we hold.

Your data subject rights

As well as our obligations and commitment to respect the privacy of your information, you also have certain rights relating to the personal information we hold about you which are outlined below. None of these are absolute and are subject to various restrictions and limitations. You can exercise these rights at any time by contacting us at info@walks4all.co.uk.

You have the rights to:

Request access to the information we hold about you (Data Access Request)

You may request access to a copy of the personal information we hold about you. We can refuse to provide information where to do so may reveal another person's personal data or would otherwise negatively impact another person's rights or privacy.

Object to processing (Right to object)

You may object to us using your personal data, except where used to detect, prevent and investigate fraud and other financial crimes. You may also object to us using your personal data for direct marketing purposes. Once we receive and have processed your objection, we will stop using your personal data for this purpose.

Request a copy of your data (Data Portability)

Where you gave us the information directly or via a contract you have with us, and it was processed electronically, you can request the data we hold about you in a commonly used machine-readable format.

Request that your data is deleted (Right to be forgotten)

You can ask us to delete the personal information we hold about you when it is no longer required for a legitimate business need, legal or regulatory obligations or for the purpose it was collected for.

Amend or correct your information (Right to rectification)

If you believe that the personal information we hold about you is inaccurate, incorrect or incomplete, please contact us as soon as possible so we can update it.

Restrict the processing of your information (Right to restrict)

You may ask us to restrict our processing of your data whilst we resolve any complaints you have about the way your data is used, require it for a legal claim or if you think our processing is unlawful but you do not want us to delete your data.

Rights in relation to consent (Right to withdraw)

Subject to use and retention conditions, you may at any time withdraw the consent you granted for your personal information to be used for direct marketing or other specific purposes. When you withdraw your consent it will not affect the lawfulness of any past activities we have undertaken based on the previous consent.

How we respond to your rights

You can exercise these rights at any time by contacting us at info@walks4all.co.uk.

We may need to validate your identity before we can respond to your request. If we are unable to confirm your identity, or have strong reasons to believe that your request is unreasonably excessive or unfounded, we may deny it.

Once we have validated your identity we aim to respond to your request within 30 days and no later than three months for complex requests. We will let you know if we need additional time to complete.

We will let you know whether we accept or refuse your request.

Security

We take all reasonable precautions to keep your personal information secure, including safeguards against unauthorised access, use, or data loss. This includes ensuring our staff, partners and any third parties who perform work on our behalf comply with security standards as part of their contractual obligations.

Making a data protection complaint

If you have any concerns about the use of your personal data or the way we handle your requests relating to your rights, you can raise a complaint directly with us at info@walks4all.co.uk.

If you are not satisfied with the way we handle your complaint, you are entitled to raise a complaint directly with the UK Information Commissioner's Office via the details on their website at www.ico.org.uk.