PRIVACY POLICY

This Privacy Policy sets out how OnceOk Limited will process your personal data that you may provide to us or that we may collect from you when you visit our website OnceOk.com. This Policy applies to our use of any and all Data collected by us in relation to your use of the Web Site and any Services or Systems therein.

OnceOk is committed to ensuring that your privacy is protected and will only process personal data in accordance with this Privacy Policy. Our website is not intended for children and we do not knowingly collect data relating to children. This Privacy Policy supplements the other policies (including our terms of use (Terms)) and is not intended to override them.

How we collect your information
Voluntary Information
You may provide us this information when completing various forms and contracts, corresponding via the telephone, e-mail or live chat, or we may meet you at an event or exhibition. Some information you give us directly, such as when you open an online account with us, when you pay for goods online. You may also give us your personal information when you contact customer services, engage with our social media channels, enter competitions, respond to surveys or provide feedback or product reviews on our website. This may include your name, contact details and usernames, and your marketing preferences.

Involuntary information when you visit our website
As you interact with our website(s), we may automatically collect technical data about your equipment, browsing actions and patterns. We may gain information that we gather through our monitoring of visits to our website. We use a variety of analytics tools like Google Analytics and cookies in order to improve our service, user experience and to analyse how the website is used. Aside from the approximate location (IP address), the information collected is mostly anonymous traffic data including browser information, device information and language. We do not collect any additional information which could be classified as personal via these means.

We collect this personal data by using cookies, server logs and other similar technologies. We may receive technical data about you if you visit other websites employing our cookies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

Information we collect from third parties
We may receive personal data about you from third parties, such as:

  • Technical Data from the following parties:
    • analytics providers such as Google;
    • advertising networks; and
    • search information providers.
  • Information from providers of technical, payment and delivery services such as Mastercard, Barclaycard, American Express, Experian based inside and outside of the EEA.

We may use data from third parties to assist in our data accuracy. We may use Experian’s Mosaic customer classification, which places you into one or more defined behavioural and socio-economic groups, to understand our customer database and to assist in location planning and purchasing decisions. We may use UK Changes, for the limited purposes of removing deceased individuals from our database and for removing incorrect home addresses.

Occasionally, we may obtain lists of potential customers from companies that collate these details and make them commercially available for marketing purposes. We only deal with reputable companies that take privacy as seriously as we do and will only ever use this information in a way which you would expect based on what you were told by the organisation who collected your data. You will always be able to opt out of receiving further marketing from us.

The information we collect
We process personal data including and not limited to:

  • Name
  • Contact information including e-mail address and telephone number
  • Invoice and delivery addresses
  • Demographic information such as postcode and preferences

How we will use information about you/Legal grounds for processing your information
We use your personal information in a number of different ways and rely on the following legal bases under GDPR to process your personal data which will always fall under one of these categories:

  • When you consent to us doing so;
  • Where we need to in order to perform the contract we have entered into with you;
  • Where we have to comply with a legal obligation;
  • Where it is necessary for our legitimate interests, and your interests and fundamental rights do not override those interests. We do not use your personal data for activities where our legitimate interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
  • Public interest or exercise of official authority.
  • Legitimate interest pursued by OnceOk, as a data controller, or a 3rd party.

How we process your information
We collect and process data for the following reasons:

  • to ensure we can fulfil our service levels to a high standard
  • internal record keeping
  • to improve our products and services
  • to ensure that our website is presented in the most effective manner
  • to meet our legal requirements as a UK registered business
  • to communicate with our partners
  • to market our products and services (see Marketing further below)

We will also provide information to 3rd parties, when it is necessary for us to fulfil your service requirements. These include, but are not limited to, 3rd party carriers for the delivery of goods and secure payment gateway services.

We will only process your data in the UK. In all circumstances, the information obtained will be retained and utilised in accordance with all relevant laws, in particular the Data Protection Act 2018 and GDPR.

Purpose/ activity, type of data and lawful basis for processing
We have set out below, in a table format, a description of all the ways we may use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Activity Lawful basis for processing including basis of legitimate interest
To register you as a new customer Performance of a contract with you. Your consent
To process and deliver your order including:(a) Manage payments, fees and charges(b) Collect and recover money owed to us Performance of a contract with you. Necessary for our legitimate interests (to fulfil your order or recover debts due to us)
To manage our relationship with you which may include:(a) Notifying you about changes to our terms or privacy policy(b) Asking you to leave a review or provide feedback(c) Responding to your queries and comments, social media posts and questions(d) marketing. Performance of a contract with you. Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)Your consent (for electronic marketing)
To enable you to partake in a prize draw, competition or complete a survey Your consent
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)

Disclosure of personal data
With external third parties
On occasion we may share your personal data with organisations who work with us, to support the activities listed above. We make sure that these companies enter into contracts which require them to protect your privacy and respect data protection laws. We do not allow third parties to use your personal information for their own purposes. These organisations include:

  • IT and system administration service providers.
  • Professional advisers (including legal, audit, compliance and insurance).
  • Web hosting, online content services and data storage.
  • Market research and collecting or analysing customer feedback
  • Payment Service Providers.
  • Other people who help us provide our websites, mobile apps, etc.
  • Credit reference agencies for fraud prevention.
  • Social media companies.

International transfers
Some of our external third parties are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • transferring your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission, including the Privacy Shield in the US.
  • using specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

Please contact us if you want further information on how we transfer your personal data out of the EEA.

Data retention
We collect and store data for the purposes of all our business operations and to provide service to our customers.

How long will we keep personal data/Information For?
To make sure we meet our data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it for in the first place which includes providing you with the services you have requested, meeting our legal and regulatory obligations, resolving disputes and enforcing our agreements.

In most cases, this means we will keep your information for as long as you remain active, continue to shop with us or use our services, and for a period of time afterwards for tax purposes and just in case you begin shopping with us again.

For inactive customers we will either delete it or retain data for marketing purposes; however we will anonymise your personal data so that it can no longer be associated with you, and in such case we may use such information without further notice to you

On request of an ‘unsubscribe’ or a specific request not to be contacted, personal data will be transferred to a suppression list. We will keep personal data in our database for our own internal records.

In some circumstances you can ask us to delete your data: see Request erasure below for further information.

Your rights
You have the right to:

  • Receive disclosure of any of your personal data that we store and process
  • Update/amend inaccuracies or changes to your data
  • Opt out of e-mail marketing by clicking the unsubscribe link at the bottom of any OnceOk email communication
  • Request for processing of your personal data to be restricted
  • Be informed of what lawful basis we are relying on for the processing of your personal data
  • Be forgotten (have your personal data deleted); however we would recommend that we supress you from future communications, rather than delete your data from our database

If you wish to review, verify, correct or request the erasure of your personal data, object to the processing of your personal data, withdraw the consent to the processing of your personal data or request that we transfer a copy of your personal data to a 3rd party, please contact our Data personnel on info@OnceOk.com. We will respond to the request as soon as we can. Generally this will be within one calendar month from when we receive your request but on occasions it may take longer to deal with your request and in such circumstances we will let you know.

Rights of access, correction, erasure, and restriction
Informing us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes by keeping your details up to date on your online shopping accounts.

Your rights in connection with your personal information
Under certain circumstances, you have the right to:

Request access
To your personal information (commonly known as a “subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also ask you for further information in relation to your request to speed up our response.

We will respond to all requests within one month. Occasionally it may take us longer than a month to provide your personal data if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Request correction
Of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. We may need to verify the accuracy of any new data you provide to us.

Request erasure
Of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. We may not always be able to comply with your erasure request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing
Of your personal information where we are relying on a legitimate interest and you want to object to processing on this ground. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which means we can continue to process your personal information. You also have the right to object where we are processing your personal information for direct marketing purposes and if your personal information is automatically processed or profiled. You can ask us to stop sending you marketing messages at any time by contacting us directly.

Request the restriction of processing
Of your personal information. This enables you to ask us to suspend the processing of your personal data.

Request the transfer
Of your personal information to another party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent at any time
Where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent

Data security
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure your information.

A lot of the information we receive reaches us electronically, originating from your devices, and is then transmitted by your telecoms network provider. Where it’s within our control, we put measures in place to ensure this ‘in flight’ data is as secure as it possibly can be. Once it arrives to us, you can be sure we take the security of your information very seriously.

We use appropriate procedures and technical security measures (including strict encryption, anonymization and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices and stores.

In particular, we follow internationally recognised security standards including the Payment Card Industry’s Data Security Standards (PCI-DSS).

How do we protect your personal data?

  • We treat your data with care and take all steps to protect it
  • Access to our websites is password protected
  • Sensitive data is secured by SSL encryption
  • Our systems have a very high level of security
  • We carry out regular penetration testing to identify ways to further strengthen our security
  • We monitor our systems for any intrusions
  • We will notify you and any applicable regulator of a suspected breach as required by law
  • Marketing
  • We may from time to time contact you to make you aware of new products and services, unless you explicitly request us not to do so.

If you are a new customer, you can opt out of email communications at the new customer billing stage of the basket. This will ensure we do not send you promotional material via email.

We will never share your name and contact details with 3rd parties for marketing purposes. We do use 3rd party service providers to send out marketing material but only allow them to use that information on our instructions and where they have agreed to treat the information confidentially and to comply with data protection legislation.

Links to other websites
Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement.

Questions regarding our policy?
Contact details are as follows:

OnceOk Limited
272 Bath Street, Glasgow, G2 4JR, UK
E-mail: info@onceok.com

Data Personnel
The Data Personnel oversees compliance with this privacy notice. If you have any questions or concerns about this Privacy Notice, how we handle your personal information, or would like to exercise any of your rights under the GDPR, please contact them at info@OnceOk.com. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) https://ico.org.uk/, the UK supervisory authority for data protection issues.

Changes to this Privacy Policy
We reserve the right to update this Privacy Policy at any time. Any changes we make to our Privacy Policy in future will be posted on our website and where appropriate notified to you by e-mail or otherwise. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this Privacy Policy, please contact the Data Personnel info@OnceOk.com