01 — Introduction
Purpose of this notice
This privacy notice aims to give you information on how Hotset UK collects and processes your personal data.
Personal data means information relating to an identified or identifiable individual. We handle personal data lawfully, fairly and transparently; collect it only for clearly explained and valid purposes; limit it to what is relevant; keep it accurate, retain it only as long as necessary and protect it appropriately.
Please read this notice so that you understand how and why we use your data. If you have any questions, contact our Data Privacy Manager using the details below.
Changes to this notice and your information
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your details change during your relationship with us.
02 — Who we are
Hotset UK contact details
Data Privacy Manager: David Wayte
Email: dwayte@hotset.com
Unit 1, Penallta Industrial Estate
Ystrad Mynach, Hengoed
Mid Glamorgan, CF82 7QZ
Telephone: 01443 813500
03 — Your information
The data we collect
We may collect, use, store and transfer the following categories of personal data:
- Identity data: first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
- Contact data: billing address, delivery address, email address and telephone numbers.
- Financial data: bank account, payment-card details and payroll data.
- Transaction data: details of payments to and from you and products or services purchased from us.
- Technical data: IP address, login data, browser information, time-zone setting, location, operating system, platform and other technology used to access our website or intranet.
- Profile data: usernames and passwords, purchases or orders, preferences, feedback and survey responses.
- Usage data: information about how you use our website, intranet, products and services.
- Marketing and communications data: your preferences for receiving marketing and other communications.
Aggregated data
We may use aggregated statistical or demographic data for any purpose. Aggregated data is not personal data where it does not directly or indirectly reveal your identity. If it is combined with other data in a way that identifies you, we treat the combined information as personal data under this notice.
Special-category data
We do not normally collect special categories of personal data, such as information about race, ethnicity, beliefs, health, sex life, sexual orientation, political opinions, trade-union membership, genetics or biometrics. Nor do we normally collect information about criminal convictions or offences, other than where relevant to employees or applicants for employment. Where special-category data must be processed, we will obtain explicit consent or rely on another lawful basis where applicable.
04 — Collection
How we collect personal data
Direct interactions
You may provide identity, contact and financial data by completing forms or corresponding with us by post, telephone, email or otherwise. This includes when you apply for products, services or employment; create an account; subscribe to a service or publication; request information or marketing; enter a promotion; complete a survey; provide feedback; or send us other information.
Automated interactions
When you interact with our website or intranet, we may automatically collect technical data about your equipment, browsing actions and patterns using cookies or similar technologies.
Third parties and public sources
We may receive technical data from analytics, advertising or search providers; contact, financial and transaction data from payment, delivery or technical-service providers; identity and contact data from data brokers, aggregators or recruitment agencies; and identity or contact information from public sources such as Companies House and the Electoral Register.
05 — Processing
How we use personal data
We use your personal data only where the law allows us to, most commonly to perform a contract with you, comply with a legal or regulatory obligation, or pursue our legitimate interests where your interests and fundamental rights do not override them. In limited cases, we may use it to protect your vital interests or where required in the public interest.
We generally rely on consent only for direct marketing by email or text. You may withdraw marketing consent at any time by contacting us.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Registering you as a client or customer | Identity and contact data | Performance of a contract |
| Processing and delivering an order or service, managing payments and recovering money owed | Identity, contact, financial, transaction, marketing and communications data | Performance of a contract and our legitimate interest in recovering debts |
| Managing our relationship with you, including policy updates, reviews and surveys | Identity, contact, profile, usage, financial, marketing and communications data | Performance of a contract, legal obligations and our legitimate interests in maintaining records and understanding use of our products and services |
| Enabling promotions, competitions or surveys | Identity, contact, profile, usage, marketing and communications data | Performance of a contract and our legitimate interests in understanding customers and developing our business |
| Administering and protecting our business, intranet and website | Identity, contact, profile, technical and usage data | Our legitimate interests in operating the business, administration, IT, network security, fraud prevention and restructuring, and compliance with legal obligations |
| Delivering relevant website content and advertising and measuring its effectiveness | Identity, contact, profile, usage, marketing, communications and technical data | Our legitimate interests in understanding customers, developing our services and informing our marketing strategy |
| Using analytics to improve our website, products, services, marketing and customer relationships | Technical and usage data | Our legitimate interests in maintaining and developing our website and business |
| Suggesting goods or services that may interest you | Identity, contact, technical, usage and profile data | Our legitimate interests in developing our products, services and business |
If you do not provide personal data
Where we must collect personal data by law or under a contract, failure to provide it may mean we cannot perform that contract or supply the requested products or services. We may therefore need to cancel the relevant product or service.
Change of purpose
We use personal data for the purpose for which it was collected unless we reasonably consider another use to be compatible with the original purpose. If we need to use it for an unrelated purpose, we will notify you and explain the lawful basis. We may process personal data without your knowledge or consent where the law requires or permits this.
06 — Your choices
Marketing and cookies
We may use identity, contact, technical, usage and profile data to understand which products, services or offers may interest you. You will receive marketing communications where you have requested information or purchased products or services and have opted in to receiving that marketing.
We will obtain express opt-in consent before sharing personal data with an organisation outside Hotset UK for its own marketing. You can ask us or third parties to stop marketing messages at any time by telephone, email or by using an unsubscribe link. Opting out does not affect information supplied in connection with a purchase, warranty, product or service experience, or another transaction.
The website uses essential and preference cookies. With your permission, we also use Google Analytics to understand website usage. Analytics cookies remain disabled unless you accept them, and we do not use advertising or remarketing cookies. For the current cookie list, purposes and retention periods, please read our cookie policy.
07 — Disclosure
Sharing your personal data
Where necessary for the purposes described above, we may share personal data with:
- departments or companies within Hotset UK providing IT, administration or leadership reporting;
- external providers of IT, learning, training, system administration, payment, delivery or related services;
- professional advisers including lawyers, bankers, auditors, pension advisers, insurers, accountants and payroll providers;
- HM Revenue & Customs, regulators and other authorities where reporting is required; and
- third parties involved in a sale, transfer, merger, acquisition or reorganisation of all or part of our business or assets.
We require third parties to respect the security of personal data and handle it in accordance with the law. Service providers may process it only for specified purposes and in accordance with our instructions.
08 — Overseas processing
International transfers
Some service providers may process personal data outside the UK or European Economic Area. Where this occurs, we use appropriate safeguards recognised by applicable data-protection law, such as an adequacy decision or approved contractual protections, to provide a comparable level of protection.
09 — Protection
Data security and retention
Security
We use appropriate measures to prevent personal data from being accidentally lost, used, accessed, altered or disclosed without authorisation. Access is limited to employees, agents, contractors and other third parties with a business need to know, who must follow our instructions and observe confidentiality. We maintain procedures for suspected data breaches and will notify you and the relevant regulator where legally required.
Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting and reporting requirements. The retention period reflects the amount, nature and sensitivity of the data, the risk arising from unauthorised use or disclosure, the processing purpose, whether that purpose can be achieved in another way and applicable legal requirements.
We may anonymise personal data for research or statistical purposes. Once it can no longer be associated with you, we may use that anonymous information indefinitely.
10 — Your rights
Your legal rights
Depending on the circumstances, data-protection law may give you the right to request:
- access to your personal data;
- correction of inaccurate or incomplete personal data;
- erasure of your personal data;
- objection to processing;
- restriction of processing;
- transfer of your personal data; and
- withdrawal of consent previously given.
To exercise a right, contact us using the details above. You may also contact the Information Commissioner’s Office for information, advice or to make a complaint.
You will not normally pay a fee to exercise these rights. We may charge a reasonable fee, or refuse a request, where it is clearly unfounded, repetitive or excessive.
Information we may need
We may request information to confirm your identity and ensure personal data is not disclosed to someone who has no right to receive it. We may also ask for further details to help us respond efficiently.
Time to respond
We aim to respond to legitimate requests within one month. A complex request, or several requests made together, may take longer; if so, we will notify you and keep you updated.