Eden Fine Wines Customer Data Privacy Notice

Overview

Eden Fine Wines (“we” or “us”) holds personal data on its customers, and their employees to provide its services. This Customer Data Privacy Notice details the personal data Eden Fine Wines may retain, process and share with third parties relating to your business and its employees. Eden Fine Wines is committed to ensuring that your information is secure, accurate, and relevant. To prevent unauthorized access or disclosure, we have implemented suitable physical, electronic, and managerial procedures to safeguard and secure the personal data we hold.

Introduction

We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. This notice sets out the personal information that we collect and process as a data processor, the purposes of the processing and the rights connected with it. Eden Fine Wines are also considered a Data Controller for some personal data, including data we store in relation to the creation and access of customer accounts and the administration of the services we provide.

If you are in any doubt regarding this notice, please contact:

Eden Fine Wines:

Unit 7, Scandinavia Court, Chain Bar Road, Cleckheaton, Bradford, West Yorkshire, BD19 3QW

Email: info@edenfinewines.com

It is important that the information we hold about you is accurate and up to date. Please let us know at any time if your personal information changes by emailing us at: info@edenfinewines.com

Types of personal data we collect

During your engagement with Eden Fine Wines, we may process personal data about you and your employees whose personal data has been provided to us.

The types of personal information we may process include but are not limited to:

• Company registration number

• Company registered address

• Company delivery address

• Company employee contact names, telephone numbers and email addresses

• Company contact details such as telephone numbers and email addresses

• Company financial information for credit account purposes

Sensitive personal data (‘special categories of personal data’ under the General Data Protection Regulation) includes any information that reveals your racial or ethnic origin, religious, political or philosophical beliefs, genetic data, biometric data for the purposes of unique identification, trade union membership, or information about your health/sex life. We do not to collect or process any sensitive personal information about you, unless authorised by law or where necessary to comply with applicable laws.

Purposes for processing personal data

How we use your personal data

We will only use your personal data when legally permitted. The most common uses of your personal data are:

• Where we need to perform the contract and provision of services between us

• Where it is necessary for legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with legal or regulatory obligation

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you or your employer (i.e. provision of services), where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interest or those of another person.

Contractual purposes

We use this personal information when it is necessary for the provision of our services, in line with the purposes agreed upon between our customers and Eden Fine Wines.

Legal purposes

We may also use your personal data where we consider it necessary for complying with laws and regulations, including collecting and disclosing employee personal information as required by law, under judicial authorisation, or to exercise or defend our legal rights.

Who we share your personal data with

We take care to allow access to personal data only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. Whenever we permit a third party to access personal information, we will implement appropriate measures to ensure the data is used in a manner consistent with this notice and that the security and confidentiality of the data is maintained.

Transfers to third-party service providers

In addition, we make certain personal data available to third parties who provide services to us. We do so on a "need to know basis" and in accordance with applicable data protection and data privacy laws. A list of key service providers can be found in Annex A.

Transfers to other third parties

We may also disclose personal data to third parties on other lawful grounds, including:

• To comply with our legal obligations, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative or judicial process

• In response to lawful requests by public authorities (including for national security or law enforcement purposes)

• As necessary to establish, exercise or defend against potential, threatened or actual litigation

• Where necessary to protect the vital interests of our employees or another person

• In connection with the sale, assignment or other transfer of all or part of our business; or

• With your freely given and explicit consent

Transfer of personal data abroad

We may need to transfer personal data to countries outside of the United Kingdom. When we export your personal data to a different country, we will take steps to ensure that such data exports comply with applicable laws. For example, if we transfer personal data outside the European Economic Area (EEA), such as to the United States, we will implement an appropriate data export solution such as entering into contracts with the data importer that contain EU model clauses or taking other measures to provide an adequate level of data protection.

Data retention

Personal data will be stored in accordance with applicable laws and kept for as long as needed to carry out the purposes described in this notice or as otherwise required by law. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being an Eden Fine Wines customer for tax purposes.

Your rights

You may exercise the rights available to you under data protection law as follows:

• The right to be informed

• The right of access

• The right to rectification

• The right to erasure

• The right to restrict processing

• The right to data portability

• The right to object

• Rights in relation to automated decision making and profiling

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. You can read more about these rights at:

https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

To exercise any of these rights, please contact:

Eden Fine Wines:

Unit 7, Scandinavia Court, Chain Bar Road, Cleckheaton, Bradford, West Yorkshire, BD19 3QW

Email: info@edenfinewines.com

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we my charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you informed.

Updates to this notice

This notice may be updated periodically to reflect any necessary changes in our privacy practices. In such cases, we will inform you by email, internal notice board and or in writing. We encourage you to check this notice periodically to be aware of the most recent version.

Contact details

Please address any questions or requests relating to this notice to:

Eden Fine Wines:

Unit 7, Scandinavia Court, Chain Bar Road, Cleckheaton, Bradford, West Yorkshire, BD19 3QW

Email: info@edenfinewines.com

Annex A – Third-party processors

Key third-party processors

The following are Eden Fine Wines key third-party processors in relation to customer data.

Nevis Computers

Nevis Computers is our outsourced IT management company and hosts a number of technical operational facilities such as Microsoft email and One Drive document storage.

They also manage the server and storage for our internal operating system – Vintner Systems

Vintner Systems

Vintner Systems is the internal operating platform we use to process all customer information, including names, addresses, contact details, purchase orders and transactional data.

Data is only stored with the EEA (European Economic Area)

UK fast managed by DNA Digital

UK Fast is our outsourced IT data storage and server management hosting company managed by DNA Digital. They host a number of technical operational facilities such as the Magento2 Eden Fine Wines website platform and Business to Business Portal.

Additional third-party processors

Data may be shared with other third-party processors to meet legal requirements, where Eden Fine Wines outsources aspects of its processes or when providing specific services relating to maintaining our services. These companies may include, but are not limited to the following:

• Credit Safe (Customer Credit Information)

• Sales - I (Customer Relationship Management)

• Global Payments (Credit Card Payment Facility)

• Stripe (Credit Card Payment Facility)

• Wilkinsons & Partners Accountants (Accounting Information)

• HMRC

Where the above third-party processors transfer data overseas outside of the EEA (European Economic Area), appropriate safeguards are in place to protect the data transferred.