Privacy Policy

---

SECURITY & PRIVACY

Our Privacy Policy sets out how we look after your personal data. Your personal data belongs to you and we respect that. We collect, store and use your personal data so that we can offer you the products and services you expect from us. We aim to be clear and straightforward with you about what we do with your personal data, and you have control over it.

It is important that you read and understand this privacy policy as it will explain how De Castro & Co collects and uses your personal information and why. This policy relates to your use of this website and data gathered. All personal information is kept on a secure server.

We collect your personal data for three main reasons:

1. To process your orders you make with us and to deliver these to you
2. To personalise, report on and improve the products and services we      provide to you
3. To send you promotions and offers, tailored your past purchases and      to what you may have expressed an interest in.

WHAT IS PERSONAL DATA?

Personal data, or personal information, refers to any information about an individual from which that person can be identified, also known as Personal Identifying Information (PII). It does not refer to anonymous data. Anonymous data is information where any personal identifying information has been removed.

OUR PERSONAL DATA COMMITMENT:

• You can control the personal data you provide us with and we will  be transparent about how we collect and use it
• We will tell you what personal data we are collecting from you, and  how we collect it and use it. We will only use your personal data for the  purposes we originally told you about.
• We use market-leading technology to ensure that your personal data  is secure. When we ask partner organisations to provide services to us  which involve sharing your personal data with them, we will always make  sure they have appropriate security measures
• We will send you marketing communications as we believe we have a      legitimate interest in doing so; however, we will always offer you a clear  and simple means of changing your preferences whenever you want to      (including when you first become a customer).

DATA PROTECTION

For the purposes of data protection this policy refers to the 1998 Data Protection Act until 25th May 2018 and thereafter the EU General Data Protection Regulation (GDPR) or any subsequent, and successor, legislation. De Castro & Co is the Data Controller of the personal information we hold about you.

If you have questions about how we look after your personal data, you can contact us as follows:

• or by phone 07966 365382 

You can manage your marketing preferences (call you on the phone, email you or share your personal data with third parties) by contacting us as above. We will update your preferences as soon as we can. It may take up to 2 months for the process to be completed and for emails it may take up to 2 weeks.

HOW DO WE COLLECT YOUR PERSONAL DATA?

We collect your personal data in two main ways:

• When you give it to us directly -      When you create a customer account, visit our website, communicate with us  or purchase our products or services, you may choose to give us certain  information. For example, when you give us your name and address, tell us  about your preferences or when clicking on active buttons such as our 'Pay  now and place order'.
• When our systems collect information or personal data as you use      our website, or websites or apps that are connected to our website - Whenever you use a website, app or other internet service,  information gets recorded automatically by the IT systems used to operate  that website, app or service. The most common type of information  collected is in the form of cookies (small text files sent by  your computer each time you visit our website) but can also include  personal data transferred by the electronic device you use to access our   website and its settings. The manufacturer of your device, or the provider      of the operating system, will have details about what information your  device shares with us.

WHAT CATEGORIES OF PERSONAL DATA DO WE COLLECT?

We may collect the following information about you:

• Your name and contact details. This can include your postal,  billing and delivery addresses (which would include the addresses of any  family or friends you choose to send De Castro & Co products to); your  telephone number(s), including, if you provide it, your mobile number; and  your email address
• Purchases and orders made by you
• Your payment card details (which we securely encrypt) when you  purchase our products or services, This information is not stored on our  systems but transferred directly to our payment card provider.
• When you set up an account with us, your password (which we  encrypt) and your marketing preferences
• Your preferences, favourites, ratings and reviews
• Your on-line browsing history on our website
• Your correspondence and calls with us

In some instances, we may need to collect additional personal data for the purposes set out in this privacy policy.

PERSONAL DATA WE WILL PROCESS TO FULFIL YOUR ORDERS AND TO COMPLY WITH THE LAW

We will need to process some of your personal data to fulfil any orders you place and to comply with the law. For example:

• We will share your payment details with our bank or clearing house  so that we can process payment for your order.
• Occasionally with the police, or our trade body, for the purposes  of preventing and investigating fraud

HOW AND WHY DO WE USE YOUR PERSONAL DATA?

We use your personal data:

• To send you the furniture and other products and services you have      purchased.
• To improve the range of furniture, offers and associated products  we offer you and to help identify new products and services in the future.
• To profile your online browsing, your marketing responses and your      purchasing to present you with products and offers that are relevant to  you.
• To present you with personalised offers on our website, through  social media channels such as Facebook and Instagram and by placing banner      advertisements on third party websites, and in our printed and email      communications.
• To allow you to post links to our products on social media.
• To manage any accounts you have registered with us so that (i) we  can provide you with products and services; (ii) you can place orders; and  (iii) we can fulfil those orders and communicate with you about them.
• To detect and prevent fraud and other illegal activities (and to  assist regulators, trade bodies and law enforcement agencies in relation  to the same).
• To carry out research to better understand your views on our  products and services.
• To allow you to continue enjoying our award-winning customer  service.
• To comply with the law.

OUR LEGITIMATE INTERESTS

"Legitimate Interests" means the interests of our company in conducting and managing our business to enable us to give you the best products and services, and the best and most secure experience.

• For example, we have an interest in marketing our products and  services to you, and making sure our marketing is relevant for you.  Therefore, we may process your information to send you marketing that is  tailored to your interests.
• It can also apply to processing that is in your interests as well.  For example, we may process your information to protect you against fraud  when transacting on our website, and to ensure our websites and systems  are secure.
• When we process your personal information for our legitimate  interests, we make sure to consider and balance any potential impact on  you (both positive and negative), and your rights under data protection  laws. Our legitimate business interests do not automatically override your  interests - we will not use your personal data for activities where our  interests are overridden by the impact on you (unless we have your consent  or are otherwise required or permitted to by law).
• Where we rely on our legitimate interests to send you marketing      communications, we shall tell you when you become a customer how we would      like to market our products and services to you, and offer you a means of      opting out of those communications. You can opt out of our marketing      communications at any time by contacting us on 07966 365382 

In addition to sending you marketing communications, we rely on our legitimate interests to process your personal data so that we can:

• Improve our existing furniture range, associated products and  services, and develop new ones.
• Provide you with a quality customer service experience.
• Protect you, our employees and our business.
• Understand your likes and dislikes, what products you want to hear  about and how best to contact you to inform you about them.
• Manage insurance and warranty claims made by our customers.
• Take legal action against any party in breach of its obligations to  De Castro & co, and handling any legal claims or regulatory  enforcement actions taken against De Castro & Co

WHEN DO WE SHARE YOUR PERSONAL DATA?

So that we can provide you with our products and services, we have to share some of your personal data with certain third parties.

When we share your personal data, we make sure that it remains secure:

• We have contracts with each external company which clearly  describes how they keep your personal data secure, the purposes for which  they can use your personal data and which holds them fully responsible for  meeting those expectations.
• We will only send to third parties the personal data that is  necessary for the purposes it is required for.

WHEN DO WE SHARE YOUR PERSONAL DATA?

So that we can provide you with our products and services, we have to share some of your personal data with certain third parties.

WE SHARE YOUR DATA AS FOLLOWS:

With service providers to enable our business to function - We rely on a set of external companies to provide us with services that enable our business to run properly. Our service providers include the courier companies we use to deliver our products to you; banks and clearing houses to process your payments; finance companies to provide you with finance; companies we use to carry out fraud protection and address checks; IT services providers; companies to help us with our marketing; and partners through which we provide our website partners.

With other partners when you have opted to share your personal data - We work with a number of other third-party companies to provide value to our business and to you. These companies include our marketing partners and social media partners (for instance you can publish a link on Facebook or Twitter to any products of ours that you have enjoyed).

We will only partner with a company that meets our own high standards and that we think is a good fit for our business and our customers. Each of these third parties is required by the terms of the contract we have agreed with them to use your personal data only as we instruct it and to ensure that your personal data is secure.

We may also on occasions share your data with trusted retail partners either directly or through data-cooperatives operated by third parties. The companies we share your data with directly and the retailers participating in these alliances are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, and home interiors categories.

These data-cooperatives work by each trusted retailer sharing information on what their customers buy. This information is analysed to help the retailers understand consumers’ wider buying patterns. As a result, the retailers can tailor their communications, sending suitable offers that should be of interest, based on what they like to buy.

If you would rather not receive marketing offers from third party companies you can withdraw your permission whenever you want by contacting us on 07966 365382 

With regulators and law enforcement agencies when required to do so by law - We are required to co-operate with regulators (like the Information Commissioner's Office or HMRC) and law enforcement agencies (like the police or the Serious Fraud Office). Although it does not happen often, regulators and law enforcement agencies can require us to share information with them as part of an investigation; this may include your personal data. We would have to disclose your personal data where we believe that disclosure is reasonably necessary to comply with the regulator or crime enforcement agency's demand.

When we think it is reasonably necessary to protect you or us - Occasionally businesses are subject to attempted criminal activities; this can affect both us and you. We will take all reasonable steps to protect you and our business but sometimes we may need to share your personal data where we think it is reasonably necessary to:

• Detect, monitor, investigate or prevent any suspected illegal  activities, fraud or security issues.
• Enforce our terms and conditions and to protect your and our rights  and property.
• Investigate and defend any third-party claims or allegations.

As part of a business sale or purchase, merger or reorganisation - From time to time we may look to purchase another business or sell or re-organise parts of our business to ensure that we remain in strong shape. Sometimes these types of corporate transactions involve the transfer of your personal data solely for the purposes of assessing the transaction. In the event that we sell or buy any business or assets, personal data which we hold about you may be one of the transferred assets.

In aggregated format - Strictly speaking this is not personal data, but on occasions we will use data from which you cannot be personally identified but which does include information that relates to you (such as your purchase history). This data is combined with data from other customers to provide general trends on customers preferences, ratings and reviews and general buying habits.

WHEN DO WE SEND YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA AND WHY DOES IT MATTER?

From time to time we may use service providers outside the European Economic Area ("EEA"), in particular for the provision of IT services.

If we do share your personal data with service providers outside the EEA we will ensure reasonable safeguards are put in place to protect your personal data.

HOW LONG DO WE HOLD YOUR PERSONAL DATA FOR?

We will not keep your personal data for longer than is necessary for the purposes described in this policy. As a guide:

• we will keep personal data while your account or your contact with  us is active. The longest we will normally hold any personal data for is 7  years after your last contact with us.
• we may keep certain categories of personal data after your account  is closed in order to meet any legal or regulatory requirements, or to  resolve a legal dispute.
• and, because of this, we may keep different types of personal data  for different lengths of time (for instance, we may need to keep certain  personal data relating to your purchases in order to comply with HMRC's  VAT reporting requirements).

YOUR RIGHTS

You have a number of rights under data protection laws; these are summarised below. You can contact us:

• by phone: 07966 365382 

We will process your request within one month or, if the request is particularly complex, two months. We can provide you with a copy of your personal data in electronic format or hard copy. If we consider the frequency of your requests is unreasonable, we may refuse to comply with your request. In those circumstances, we would notify you of your right to complain to the Information Commissioner's Office.

The right to be informed: we keep you informed through this Privacy Policy, which we will keep as up to date as possible.

The right of access: you can access the personal data we hold on you. We will ask you to send us two forms of proof of identity so that we can be sure we are releasing your personal data to the right person.

The right to rectification or erasure: if you think that the information we hold about you is inaccurate or incomplete please ask us to correct it. You can ask us to delete your personal data; however, this is not an absolute right. We can refuse to erase personal data which we need to keep (i) to comply with a legal obligation (for instance, we are required by HMRC to keep certain personal data for up to 6 years for VAT reporting purposes); and (ii) in relation to the exercise or defence of any legal claims.

When you ask us to delete your personal data, we assume that you do not want to hear from us again. To ensure that we do not send you any special offers in the future (for example, if we purchased your details from a third-party list), we will retain just enough of your personal data solely for suppression purposes.

Other than as described above, we will always comply with your request and do so promptly. We would also notify any third parties with whom we have shared your personal data (for instance, our carriers for the purposes of delivering orders to you) about your request so that they could also comply.

Some customers would still like to order our products but do not want to receive any marketing communications from us. This is not a problem as you can simply update your marketing preferences by contacting us on 07966 365382 

The right to transfer your personal data (known as data portability): you have the right to move, copy or transfer your personal data from one organisation to another. If you ask for a data transfer, we will give you a copy of your personal data in a structured, commonly used and machine-readable form (for instance, in a CSV file format). We can provide the personal data to you directly or, if you request, to another organisation.

Please note that we are not required to adopt processing systems that are compatible with another organisation, so it may be that the recipient organisation cannot automatically use the personal data we provide.

When making a transfer request, it would be helpful if you can identify exactly what personal data you wish us to transfer.

The right to object: if you would like us to stop processing your personal data for marketing purposes simply let us know.

UPDATE

We may update this policy from time to time to take account of any new business activity or to reflect any changes in law or best practice in relation to data protection. We will notify you if we do so. This policy was last updated on 1st June 2023.