Kensington Windows & Doors Ltd are committed to complying with the General Data Protection Regulation and the Data Protection Act 2018, once enacted. Looking after the personal information you share with us is very important, and we want you to be confident that your personal data is kept safely and securely and to understand how we use it to offer you a better and more personalised shopping experience.
We have published this notice to help you understand
• How and why we collect information from you;
• Who we share your information with, why and on what basis; and
• What your rights are.
If we make changes to this notice we will notify you by updating it on our website. Kensington will be what is known as the ‘Data Controller’ of the personal data you provide to us, and we will sometimes refer to ourselves in this notice as “we” or “us”. By Data Controller, this means Kensington determines the purposes and way in which any personal data are, or will be, processed.
Should you need to contact us please write to:
Data Protection Officer
Kensington Windows & Doors Ltd
What information we collect when you register and why?
When you buy goods from us, you are entering into a contract with us. You will need to set up an Account before ordering from us, so we can set this up we will ask you to provide some personal information such as;
• full name
• contact numbers
• email address
When you apply for a credit account, we get information about you from credit reference agencies. This is covered in more detail in the section, who we share your information with and why.
When you visit Kensington we use CCTV for security monitoring purposes.
How do we use your information?
Data Protection says that we are allowed to use and share your personal data only where we have a proper reason to do so. The law says we must have one or more of these reasons and these are:
• Contract - your personal information is processed in order to fulfil a contractual arrangement e.g. in order to deliver your goods.
• Consent – where you agree to us using your information in this way e.g. for storing your contact details
• Legal Obligation – where there is statutory or other legal requirement to share the information e.g. when we have to share your information for law enforcement purposes.
Here is a list of the ways that we may use your personal information, and which of the reasons described above we rely on to do so. Where we list legitimate interests as a reason, we also describe below what we believe these legitimate interests are.
What we use your information for
Our reasons (legal basis)
Our explanation of legitimate interests
|Set up your account||Legitimate interest||Process efficiency in dealing with such activity|
|Process your orders||Fulfilling a contract||N/A|
|Notify you of your order status||Legitimate interests||Process efficiency in dealing with such activity, and to make improvements to our services|
|Manage your account/ provide customer services to you||Legal obligation/legitimate interests||Keeping our records up to date, handling our customer contact efficiently and effectively|
|To detect, investigate and report financial crime||Legal obligation/legitimate interests||Developing and improving how we deal with financial crime. Complying with any legal obligation placed on us|
|Maintaining network and data security||Legitimate interests||To maintain the security of our network this in turn helps us to maintain the safety and confidentiality of your information|
Who we share your information with and why
Kensington works with a number of trusted suppliers who supply products or services on our behalf. All partners are subject to thorough security checks, and will only hold the minimum amount of personal information needed in order to fulfil the orders you place or provide a service on our behalf.
Credit Reference Agencies
When you apply for credit with us we will make searches about you with credit reference agencies. We do this to make sure customers who apply for credit accounts are able to manage the level of credit offered and not committing fraud by providing false or inaccurate information.
In order to process your application we will supply your personal information to credit reference agencies (CRA’s) and they will give us information about you, such as your financial history. We do this to assess your creditworthiness and product suitability, check your identity, manage your account, trace, recover debts, and prevent criminal activity.
We will also continue to exchange information about you with the CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. Your data will be linked to the data of your spouse, any joint applicants or other financial associates.
The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at:
Credit safe https://www.creditsafe.com/gb/en/product/privacy-policy.html
Debt recovery and fraud prevention services
Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.
The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.
Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, and employment details.
We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
We process your personal data on the basis that it is necessary in the public interest or in exercising official authority for us to prevent fraud and money laundering, and to verify identity, in order to protect ourselves and to comply with laws that apply to us.
Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data; request that your personal data is erased or corrected; request access to your personal data.
For more information or to exercise your data protection rights, please contact us using the contact details above. You also have a right to complain to the Information Commissioner’s Office, which regulates the processing of personal data.
How long we keep your information
If we collect your personal information, the length of time we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws.
We may need your personal information to establish, bring or defend legal claims. For this purpose, we will always retain your personal information for 7 years after the date it is no longer needed by us for any of the purposes listed under how we use your information above. The only exceptions to this are where:
• the law requires us to hold your personal information for a longer period, or delete it sooner;
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law;
• we bring or defend a legal claim or other proceedings during the period we retain your personal information, in which case we will retain your personal information until those proceedings have concluded and no further appeals are possible; or
• In limited cases, existing or future law or a court or regulator requires us to keep your personal information for a longer or shorter period.
What are your rights?
You are entitled to request the following from Kensington, these are called your Data Subject Rights and there is more information on these on the Information Commissioners website www.ico.org.uk
• Right of access –to request access to your personal information and information about how we process it
• Right to rectification –to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
• Right to erasure (also known as the Right to be Forgotten) – to have your personal information erased.
• Right to restriction of processing – to restrict processing of your personal information
• Right to data portability - to electronically move, copy or transfer your personal information in a standard form
• Right to object - to object to processing of your personal information
• Rights with regards to automated individual decision making, including profiling –rights relating to automated decision making, including profiling
If you have any general questions about your rights or want to exercise your rights please contact firstname.lastname@example.org
You have the right to lodge a complaint with a data protection regulator in Europe, in particular in a country you work or live or where your legal rights have been infringed. The contact details for the Information Commissioner’s Office (ICO), the data protection regulator in the UK, are available on the ICO website www.ico.org.uk where your personal information has or is being used in a way that you believe does not comply with data, however, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.