Data controller

Supremo Leisure Ltd is the controller for the personal information we process, unless otherwise stated. 

Processing Information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• where we need to perform the contract we are about to enter into or have entered into with you

• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and

• where we need to comply with a legal obligation

We have set out below, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out below.

Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal data are set out below.

We use a third-party providers, Ionos Cloud Limited, to supply and support our website forms. If you use the forms on our website we will collect your name, email address, the contents of the form and any files you submit. We generally keep this information for up to two years. If we require sensitive personal data, then we will ensure that the collection and use are in strict accordance with the UK Data Protection Act 2018 and the retained EU law version of the General Data Protection Regulation ((EU) 2016/679).

The legal basis for processing this data is based on consent as per article 6, paragraph 1 A of the General Data Protection Regulation.

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used as they make websites work, or work more efficiently, as well as to provide statistics to the site owner.

Most web browsers allow some control of most cookies through the browser settings, to find more information on this visit the browser developer’s website. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org

We use Security cookies to authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorised parties. Process and Session cookies help make the website work, like navigating around web pages or accessing secure areas of the website. Without these cookies, the website cannot function properly, and they therefore are required.

We use Session and Information cookies to allow the site to remember how you have answered a question to change the content displayed to you. They are used by our web application in order to maintain the information relating to your transaction from page to page following any input, such as when a form is completed over several screens.

Membership cookies used to provide you with access to membership services you have subscribed to. They are ‘persistent’ meaning they are not deleted when the browser is closed and expire after a period of 2 months.

The legal basis for processing this data is based on legitimate interests as per article 6, paragraph 1 F of the General Data Protection Regulation.

As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

We use the following cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.

Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests.

When you visit any of our websites, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the website. This information is only processed in a way that does not identify anyone.

Google Analytics Tracking

We have enabled the following Google Analytics advertising features:

• Remarketing with Google Analytics

• Google Display Network Impression Reporting

• Google Analytics Demographics and Interest Reporting

• Integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers.

This allows reports to be created that contain information on the age, gender and interests of site visitors. This data comes from interest-related advertising by Google and from visitor data from third-party providers. This data cannot be assigned to a specific person. You can disable this feature at any time from your Google Account ad preferences or opt-out of Google Analytics collecting your information as described in the “Opt-out of data collection” section.

Remarketing

We also use re-marketing technologies by Google & Facebook Advertising to market our website throughout the Internet. These companies may use cookies or similar technologies on your browser to collect or receive information from our website and other websites to provide measurement services and ad targeting.

Facebook and Google provide detailed information on the scope, type, purpose and further processing of your data on their websites. You can opt out of the collection and use of information for ad targeting by following:

Facebook: Settings > Ads > Ad Settings

Google Analytics: Google Analytics Opt-out Add-on Tool

Google Ads: Ads Settings > Ads Personalisation

Here you will also find further information on your rights and setting options to protect your privacy.

Privacy policy of Facebook: https://www.facebook.com/about/privacy

Google’s privacy policy: https://www.google.com/intl/en/policies/privacy

Links to other websites

Our websites contain links to websites owned by other companies and organisations. This privacy notice does not cover how those other websites process your information, and we therefore urge you to review their privacy policies.

Our main business function is distributing garden furniture and accessories to registered stockists. We hold and process names and contact details of individuals acting in their capacity as representatives of their organisations. The legal basis for processing this data is established in contractual obligation as per article 6, paragraph 1 B of the General Data Protection Regulation.

We provide a delivery service on behalf of selected stockists and in that capacity, we receive and process consumer information across the business, including names, contact details and delivery information. In these instances, we are identified as the data processer and the legal basis for processing this data is established in contractual obligation as per article 6, paragraph 1 B of the General Data Protection Regulation.

Other Contracts

In instances where interactions relate to suppliers, contracts, buildings management, IT services etc., the legal basis for processing this data is based on legitimate interests as per article 6, paragraph 1 F of the General Data Protection Regulation.

When you contact us

We will not share your information with any third parties for the purposes of direct marketing unless you have specifically asked us to do so.

Phone Calls

When you call our main phone number (01952 671100), we hold a log of the phone number, date, time and duration of the call, but do not audio-record the call itself. We hold this information for 180 days.

We use this information to understand the demand for our services and to improve how we operate. We may also use the number to call you back if you have asked us to do so; if your call drops, or if there is a problem with the line. We don’t audio record any calls, but we might make notes.

The legal basis for processing this data is established in consent as per article 6, paragraph 1 A of the General Data Protection Regulation.

We also hold statistical information about the calls we receive for a number of years, but this does not contain any personal or identification data.

Social Media

If you send us a private or direct message via social media, it will be stored by us for two years. It will not be shared directly with any other organisations.

We see this information and decide how we manage it on a case by case basis. For example, if you send a message via social media that needs a response from us, we may process it in our internal system as an enquiry or a complaint.

The legal basis for processing this data is based on legitimate interest as per article 6, paragraph 1 F of the General Data Protection Regulation.

We also retain statistical information on our social media interaction to help us monitor and improve our communications, but this does not contain any personal or identification data.

Emailing

We also monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send to us is within the bounds of the law.

When you email us, you have given consent for us to use the information you have supplied only for the purpose you have supplied it for. Due to the ambiguous nature of email content and to ensure we comply with UK legislation, we retain these communications after they have been processed.

For example, if you email our customer services with a request for us to change a delivery address, you are giving consent for us to:

• Email you back regarding your order and its delivery

• Use your address to deliver your order

The legal basis for processing this data is based on consent as per article 6, paragraph 1 A of the General Data Protection Regulation.

We will not share your information with any third parties for the purposes of direct marketing unless you have specifically asked us to do so.

We do use data processors (third parties) who provide elements of services for us and we have contracts in place with all of them, which means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period of time we instruct.

In some circumstances, we are legally obliged to share information, for example under a court order or as part of an information request. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and we will document our decision making.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right to access

You have the right to ask us for copies of your personal information. This right always applies, however, there are some exemptions, which means you may not always receive all the information we process. You can read more about this right on the Information Commissioner’s Office website

Your Right to Erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right on the Information Commissioner’s Office website.

Your Right to Restriction of Processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right on the Information Commissioner’s Office website.

Your right to object to processing

You have the right to object to the processing of your information in certain circumstances. You can read more about this right on the Information Commissioner’s Office website

Your right to data portability

This only applies to the information you have given us directly. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under contract and the processing is automated. You can read more about this right on the Information Commissioner’s Office website.

Contact us using the details below if you wish to exercise any of these rights and please be aware we may request additional information by return email or letter. You are not required to pay a charge for exercising your rights. We have one month to respond to you.

Information requests

To contact us about the data we hold please contact us via one of the below

Email: marketing@supremouk.com

Phone: 01952 671100

Address: Unit 1-2a Kendall Business Park, Stafford Park 6, Telford, TF3 3AT

When we receive a request from you, we’ll set up an electronic case file containing the details of your request. This normally includes your contact details and any other information you have given us. We’ll also store on this case file a copy of the information that falls within the scope of your request.

If you are making a request about your personal data or are acting on behalf of someone making such a request, then we’ll ask for information to satisfy us of your identity. If it’s relevant, we’ll also ask for information to show you have the authority to act on someone else’s behalf.

We’ll use the information supplied to us to process your information request and check on the level of service we provide.

If the request is about information we have received from another organisation – regarding a complaint, for example – we’ll routinely consult the organisation(s) concerned to seek their view on disclosure of the material.

In this instance our purpose for processing your personal data is so we can fulfil your information request to us. The legal basis for this is article 6, paragraph 1 C of the General Data Protection Regulation, which relates to processing necessary to comply with a legal obligation to which we are subject.

We will retain the information supplied by yourself as part of this information request for up to 2 years.