Last Updated: January 2022
This Privacy Notice describes how any personal data that Huckletree Ltd (the ‘Controller’), its affiliates and subsidiaries (collectively and individually, ‘we’, ‘us’ or ‘our’) collect from you (the ‘Data Subject’), or that you provide to us, will be processed by us.
In the course of interacting with you and/or providing you with our services, we collect certain personal data about you. This data may be contained in applications and other forms you submit to us. We are therefore providing you with this notice to explain our approach for collecting, using and, where necessary sharing this data with others.
Our Data Protection Principles
We process your personal data in compliance with the Data Protection Act 2018 (UKGDPR), and the Privacy and Electronic Communications Regulations 2003 (“PECR”) and all other applicable legislation.
We process all data lawfully, fairly and in a transparent manner in relation to you and we will only collect data that is strictly necessary for the purposes that we have stated in this Privacy Notice or where legally required to do so.
We maintain physical, electronic and organisational safeguards to protect your data.
We permit only authorised personnel, who are trained in the proper handling of your data, to have access to it.
We take all reasonable steps to maintain the accuracy of the data and will act on any instance where we are notified of an error or omission.
We contractually require any person or organisation providing products or services to customers on our behalf to protect the privacy and confidentiality of your data.
We limit the storage period for your data in accordance with legal and regulatory requirements and will delete it when it is no longer relevant, or when our lawful purpose for processing it has expired.
We do not knowingly collect data relating to children or young persons under the age of 18.
Personal data we collect
Personal data is data that can be used to identify you, directly or indirectly and includes ‘pseudonymised’ data that is linked to data that can be used to directly or indirectly identify you. Personal data does NOT include data that has been irreversibly anonymised or aggregated so that it can no longer enable us, whether in combination with other data or otherwise, to identify you.
We may collect, use, store and transfer different kinds of personal data about you, which falls into the following categories:
Other than a copy of your photograph, we do not collect any other special categories of personal data about you which include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, data about your health, or genetic data.
We will only collect and use data which is necessary to comply with our legal obligations and assist us to administer our business and to provide you with the services you request. We may collect personal data about you (or your business) from other companies and certain third-party sources where we have a legitimate interest to do so.
We use surveillance systems to monitor all reception areas and other public or sensitive areas of Huckletree Ltd properties. Video and audio surveillance cameras are used for security purposes and to protect us, our customers and employees against potential violations of criminal or civil laws. Surveillance camera output is monitored by our employees and may be viewed by law-enforcement and regulatory authorities.
Data that you provide when you use our services and products, including, but not limited to:
When you complete our membership or application forms. The types of data we collect can include: your date of birth, first name, last name, address, phone number, email address, gender, occupation, and other data as shown on the form, as well as your passport, driver’s licence or some other official documents with or without a photograph;
Anti-Money Laundering (AML) / Know Your Customer (KYC) Data, such as source of funds, wealth and proof of occupation;
In verbal or written communications between us and you;
In other third-party documents sent on your behalf, such as insurance or legal documents;
When you use our websites, mobile phone applications and WiFi services;
When you take part in our competitions or promotions;
If you participate in surveys.
Data about your transactions with us, including your payment history and details of location occupation, attendance with us;
Data we collect from third parties, including, but not limited to:
Data we receive from Central Credit, our business partners and other third parties such as ID data, criminal history, creditworthiness and insolvency records;
Public data sources such as HM Land Registry, Companies House and Interpol; and Social networks.
Where we store your data
The data that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom as well as the European Economic Area (“EEA”). It may also be processed by employees operating outside the United Kingdom and the EEA who work for us. Such employees may be engaged in, among other things, the provision of any requested services, the processing of your payment details and the provision of support services.
All data you provide to us is stored on secure servers. If you use our site to send personal data to us, your transmission will be protected by Secure Socket Layer (SSL). SSL is a technology that encrypts your data during transmission. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. You must not share your password with anyone.
The transmission of data via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your data, we will use strict procedures and security features to try to prevent unauthorised access.
Lawful Basis for the Processing of your Personal Data
The processing of your personal data will be based on the various lawful basis described in the ‘Uses made of the data’ or as otherwise disclosed to you at the time of collection, and as otherwise permitted by law.
Uses made of this data
We may use your personal data for the following purposes:
Huckletree Ltd will not sell or rent to any third party any of the personal data that we collect in relation to you.
Please note that, where you have given your consent to the processing of your personal data, you may withdraw your consent at any time. Any such withdrawal will not affect the lawfulness of any processing previously made on the basis of your prior consent.
How do we share your data
We may disclose and transfer your personal data to any entity, affiliate and subsidiary of Huckletree Ltd including those based outside of the EEA. Where your personal data is transferred to a country outside the EEA, we will enter into model contractual clauses as adopted by the European Commission, will rely on individual country adequacy status or binding corporate rules where our service providers have adopted such internal policies approved by the UK and EU data protection authorities.
We may also disclose data that we collect from or about you with non-affiliated third parties as permitted or required by law, including those based outside of the EEA:
Third-Party service providers - We work with many different service providers and other third parties who process your personal data on our behalf. We only do business with companies that meet our standards on the processing of data and security, and we only share data that is necessary for the service.
Business transfers; bankruptcy - If Huckletree Ltd or substantially all of its assets are acquired by a third party or in the event of a merger, reorganisation, joint venture, assignment, spin- off, transfer, or sale or disposition of all or any portion of our business, including in connection with any bankruptcy or similar proceedings, we may transfer any and all personal data to the relevant third party.
Compliance with legal obligations - We may disclose personal data if we are under a duty to disclose or share your personal data in order to comply with any legal obligation or process; or to comply with any legal requirements of any governmental authority, including regulators and other agreements.
Protection of our business and customers – We may disclose personal data to protect the rights, property or safety of Huckletree Ltd, our customers or others. This includes exchanging data with other companies and organisations for the prevention and detection of crime
Fraud prevention - As part of our registration ID and verification process, we may conduct identity verification using a recognised fraud prevention agency.
External Website Links
Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. We do not expressly or impliedly endorse the materials disseminated at those websites, nor does the existence of a link to another site expressly or impliedly mean that the organisation or person publishing at that site endorses any of the materials on our site. Links to other websites are provided only as a convenience to our users and for data only. We have no control over the contents of those sites or resources and accept no responsibility for them or for any loss or damage that may arise from your use of them.
If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.
Huckletree Ltd websites
How long do we store your data for?
We will process your personal data for as long as it is necessary to fulfil the purposes outlined in this Data Processing Notice after which it will be retained for a defined period as stipulated in the Huckletree Ltd Data Retention Policy. Once this period, or any subsequent change in the retention period has expired, it will be securely deleted.
You have the right to ask us not to use your personal data for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes. You can exercise your right to prevent such processing by leaving certain boxes unticked on the forms we use to collect your data. You can also exercise the right at any time by contacting us to opt out of direct marketing communications at email@example.com.
If you prefer not to receive emails or SMS messages from Huckletree Ltd, you can click on the ‘unsubscribe’ option found on the bottom of all our email and SMS marketing communications.
Your data protection rights for UK and other EEA residents
In certain circumstances, you have the following legal rights in relation to your personal data (to the extent consisting of “personal data” in the EEA and countries with similar data protection laws, and so we use that term in the rest of this paragraph). We may ask you for additional data, so that we take reasonable steps to check that – for example – we only provide personal data to the person to whom the data relate.
Requests for access to your personal data should be made by completing and sending to us a Data Subject Access Request form (Click here to download a copy). You will also need to send us two documents to verify your identity. Further details are provided on the form.
If you would like to exercise one of your rights as set out above, or you have a question about, the way your personal data is processed, please contact our Data Protection Officer by one of the following means:
By email: firstname.lastname@example.org
The Data Protection Officer
18 Finsbury Square
London EC2a 1AH
Further, you may alternatively contact the Information Commissioner’s Office on their website https://ico.org.uk or in writing to:
Information Commissioner’s Office
Telephone number 0303 123 1113.