My Doris are committed to protecting your privacy and we take the protection of your privacy/data very seriously. We will only use your personal information to deliver the products and services you have requested from us, and to meet our contractual and legal responsibilities and obligations.
The Data Controller
My Doris Ltd is the Data Controller for the purposes of the Data Protection Act 2018 and in relation to all personal data provided to us. The primary legal basis for which we process this data is for the fulfilment of orders and the processing of contact enquiries.
How do we collect information from you?
We obtain information about you primarily when you engage us to deliver our products and services and during the administration of your relationship with us. Information is collected when you make a purchase from the website, complete forms, correspond with us, telephone us, or send us an email.
What type of information do we collect from you?
The personal information we collect from you will vary depending on which products or services you engage us to deliver. The personal information we collect can include all, or a combination of any of the following items: your name, address, telephone number, mobile telephone number, email address, date of birth, nationality, gender and any other financial details or personal information that we may require to carry out our contractual duties.
Certain types of personal information are classed as ‘sensitive’ under the Data Protection legislation, or otherwise referred to as ‘special categories’ of data. This includes information about your health, race, ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership and genetic or biometric data.
We do not need to collect your sensitive personal data during the normal course of our business. However, sometimes we may indirectly come across sensitive information. In order to be able to process any sensitive personal data, we will need your consent. In the event we are likely to (or do) come into possession of your sensitive personal data, we will contact you separately to seek your consent for its processing.
How is your information used?
In general terms, and depending on which products or services you engage us to deliver as part of our agreed contractual services, we may use your information to:
- allow us to perform our obligations under our Terms of Business
- contact you by post, email or telephone
- verify your identity where this is required
- understand your needs and how they may be met
- maintain our records in accordance with applicable legal and regulatory obligations
- process financial transactions
- prevent and detect crime, fraud or corruption
We are required by legislation, other regulatory requirements and our insurers to retain your data where we have ceased to act for you. The period of retention required varies with the applicable legislation but is typically five or six years. To ensure compliance with all such requirements it is the policy of the firm to retain all data for a period of up to 6 years from the end of the period concerned.
Disclosure of personal information
During the term of your relationship with us we may disclose your personal information to any of the following parties to allow us to properly manage our relationship with you:
- To credit reference agencies, fraud prevention agencies, credit brokers, loan companies, mortgage companies or independent financial advisors or similar should we need to contact them in relation to credit and background checks for the purposes of loan or mortgages as instructed by you
- To organisations who may record, use and give out information for accountants and auditors in order to complete our contracted work with you
- To the HMRC or any other relevant government or non-governmental body in the filing of accounts, taxation purposes, PAYE or similar and for the purpose of our contractual obligations
Back to you during the course of your relationship with us:
- If you are a current or former employee, to future employers who seek references about you (who will require your consent to do this); or
- To legal or regulatory bodies as required by law or regulation
Otherwise we will keep all of your personal information confidential unless you give us consent to transfer it to a third party.
It is not normally necessary during the usual course of business to transfer your personal data outside of the UK, however, in the event it is necessary, it will be done so in accordance with the requirements of Data Protection legislation. These requirements include the provision that the recipient of your personal data must have the same level of protection in place as you are entitled to in the UK. We will advise you in the event that your personal data is to be transferred in this manner.
The exception to this is, if you as a customer live outside the UK or the EEA and we are sending your personal information back to you, this will be necessary in order to communicate with you and for providing you with our goods and services. Our e-mails to you are subject to encryption and any sensitive documentation will be sent via registered mail.
Who has access to your information?
We will not sell or rent your information to third parties.
We will not share your information with third parties for marketing purposes.
Any staff with access to your information have a duty of confidentiality under the ethical standards that this firm is required to follow.
Third Party Service Providers working on our behalf
We may pass your information to our third party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf, for example to process an order. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own purposes.
Please be assured that we will not release your information to third parties unless you have requested that we do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention and detection of crime, fraud or corruption.
How you can access and update your information
Keeping your information up to date and accurate is important to us. We commit to regularly review and correct where necessary, the information that we hold about you. If any of your information changes, please email or write to us, or call us using the ‘Contact information’ noted below.
You have the right to ask for a copy of the information My Doris holds about you.
Security precautions in place to protect the loss, misuse or alteration of your information
Whilst we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.
Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given, or where you have chosen, a password which enables you to access information, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Your data will usually be processed in our offices in the UK. However, to allow us to operate efficient digital processes, we sometimes need to store information in servers located outside the UK, but within the European Economic Area (EEA). We take the security of your data seriously and so all our systems have appropriate security in place that complies with all applicable legislative and regulatory requirements.
We may occasionally contact you by post/email/telephone with details of any changes in legal and regulatory requirements or other developments that may be relevant to your affairs and, where applicable, how we may assist you further. If you do not wish to receive such information from us, please let us know by contacting us as indicated under ‘Contact information’ below.
Under Data Protection legislation you have the following rights free of charge:
- Access to your information:You have the right to request a copy of the personal information about you that we hold.
- Correcting your information:We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Deletion of your information:You have the right to ask us to delete personal information about you where:
- you consider that we no longer require the information for the purposes for which it was obtained
- you have validly objected to our use of your personal information – see ‘Objecting to how we may use your information’ below
- our use of your personal information is contrary to law or our other legal obligations
- we are using your information with your consent and you have withdrawn your consent – see ‘withdrawing consent to use your information’ below
- Restricting how we may use your information:In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information but you do not want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
- Objecting to how we may use your information:Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue. You have the right at any time to require us to stop using your personal information for direct marketing purposes.
- Withdrawing consent to use your information:Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
- Data Portability:You have a right to receive your personal information that you have provided to us, in a structured, commonly used and machine readable format. You also have a right to have this personal data transmitted to another data controller (i.e. another business), where technically feasible to do so.
- Right To Complain:If you have a complaint regarding the way we are processing your personal data, please address it with us in the first instance in the hopes that we will be able to resolve the matter with you. However, if you do not want to address your concerns to us, or we have failed to satisfactorily respond to your data protection complaint, you have the right to complain to the Data Protection Supervisor.
The contact details are below:
Information Commissioners Office,
Tel: +44(0) 303 123 1113
Please contact us in any of the ways set out in ‘Contact information’ below if you wish to exercise any of these rights.
Changes to our privacy notice
We keep this privacy notice under regular review and a copy can be found, printed or downloaded from our website at the following address: https://www.mydoris.co.uk
Paper copies of the privacy notice may also be obtained by using our ‘Contact information’ below.
This privacy notice was last updated on 10/05/2020.
If you have any questions or concerns regarding this notice or you wish to exercise your rights, please contact us, addressing your query to the Data Protection Officer:
The Old Bakery
6-9 St Andrews Street South
Bury St Edmunds
Tel: +44 (0) 1284 247 010