3rd Party Privacy Policy

1. Privacy Notice for Third Parties Download Policy

Scan‐Thor ("We") are committed to protecting and respecting your privacy.

This privacy notice sets out the basis on which any personal data we collect from you will be

processed by us. Please read the following carefully to understand our views and practices

regarding your personal data and how we will treat it.

For the purpose of the General Data Protection Regulation, the data controller is Scan‐Thor of

35a Keighley Road, Silsden, Keighley, West Yorkshire, BD20 0EB.

Personal data we may collect from you

We collect the following information from customers and suppliers:

Your name

Your email address

Your telephone numbers

Your correspondence address

Your bank details

Why we collect personal data from you and the lawful basis for doing so

Your personal data is processed so that we can conduct business as a furniture designer and

importer. This includes communicating with potential customers, existing customers, potential

suppliers and existing suppliers regarding the services we provide. We may also directly market

ourselves to suppliers and customers.

Personal data not submitted to us directly may be submitted by customers, suppliers and affiliates.

Where this is the case we have categorised the personal data as contact details.

We have identified the lawful basis¹ for the above purposes of processing as:

‘processing is necessary for the purposes of the legitimate interests pursued by the

controller or by a third party, except where such interests are overridden by the interests or

fundamental rights and freedoms of the data subject which require protection of personal

data.’

The legitimate interest identified is that of conducting direct marketing and of conducting business

as a furniture designer and importer.

If you do not provide us with the information we require to complete a transaction, then we will be

unable to provide a service to you if you are a customer or to purchase goods or services from you

if you are a supplier.

If you are an existing customer or a potential customer we may also use your personal data to

directly market our products, including similar products to which you have already purchased.

We have identified the lawful basis for the above purpose of processing as:

‘the data subject has given consent to the processing of his or her personal data for one or

more specific purposes.’

¹ See http://gdpr‐legislation.co.uk/lawful‐processing and https://ico.org.uk/media/fororganisations/

documents/1551/direct‐marketing‐checklist.pdf for further information on the

options for lawful basis of processing

We will only conduct this marketing activity where you have specifically ‘opted‐in’ to receive such

marketing material. Even if you consent to this marketing activity, you have the right to withdraw that consent at any time, in which case we will stop sending you marketing material without any effect on your relationship with us or any product we may already supply to you. You can withdraw your consent by writing to us at the address provided at the top of this privacy notice.

Disclosure of your personal data

Customer and supplier personal data stored on our customer relationship management system is

stored on IT systems hosted by an external provider in the UK. Documents held on IT systems and

email are also saved to back up systems provided by an external provider, which are also hosted in

the UK.

Transfer to countries outside of the European Union

We confirm that no personal data will be transferred to countries outside of the European Union.

How long we will keep your personal data

Your personal data will be kept on our financial accounting and customer service systems for 6

years after our relationship with you ends or 6 years from the date of our latest, signed, audited,

accounts. Any email correspondence will be kept for 6 years in line with our email retention period.

Personal data used for direct marketing purposes to potential customers will be kept for 6 years

after the end of the marketing campaign, unless you ask us to erase your data.

Your rights as data subjects

The General Data Protection Regulation provides data subjects certain rights relating to the

processing of their personal data. Given the nature of the processing carried out by us, and the

lawful basis we have identified for that processing, you have the following rights:

You may request from us access to the personal data we process concerning you through

making a subject access request (or SAR).

You may request rectification of the personal data we process concerning you where it is

incomplete or inaccurate.

You may request, subject to certain criteria, the erasure of the personal data we process

concerning you.

You may request that we restrict the processing of personal data concerning you.

Restriction means that we will only store the personal data and not further process it.

You have the right to object to your personal data being processed. If we receive such an

objection, we will, where required under the General Data Protection Regulation stop

processing your personal data.

You have the right to data portability whereby we will provide you your personal data in a

structured, commonly used and machine‐readable format.

You can make a request expressing your rights by writing to us at the address above.

Lodging a complaint with the Information Commissioner’s Office

If you feel that your personal data has been, or is being, processed in an inappropriate manner; or you feel that your rights, as described above have been infringed, you may lodge a complaint with the

Information Commissioner’s Office (ICO). The ICO is the UK’s supervisory authority regarding data

protection matters and has a responsibility to act on complaints made to it. You may lodge a complaint

by visiting the website below or calling the ICO’s helpline on 0303 123 1113.

https://ico.org.uk/concerns/