1. Important Information and who we are
- any employee, officer, agent or independent contractor of any of our corporate customers who has been given access to the web portal we might agree to provide to such customers from time to time to enable them to purchase products ("Managed Users") and
- any key contacts of such corporate customers who have been designated with the ability to manage Managed Users permissions in relation to any such web portal ("Key Web Contacts").
2. The data we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity Data includes first name, last name, marital status, title and gender.
- Contact Data includes billing address, delivery address, email address and telephone numbers.
- Financial Data includes bank account details.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location (this would typically be used for a reverse IP address look-up approximately at city-level to ensure that the correct cookie banner is displayed to users depending on their location), browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
- Profile Data includes your password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
Usage Data includes information about how you use our website, products and services (including search history whether on our website or a third party website such as YouTube).
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences (as well as information demographic and social data including age, language spoken, gender, profession, marital status and income).
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
Where we need to collect personal data by law, under the terms of a contract, or to provide a product or service to you (for example, so that you can place and receive an order for products from our website), and you fail to provide that data when requested, we may not be able to provide the product or perform the service.
3. How your personal data is collected
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us your personal information by filling in forms or by corresponding with us by post, phone, email, social media or otherwise.
- Third parties or publicly available sources. We will receive personal data about you from various third parties as set out below.
We may combine information that you give us or we collect from you via our website with information received from another source. This helps us keep organised and allows us to provide a better service.
We may receive Technical Data, Usage Data and Marketing and Communication Data from analytics providers such as Google based outside the UK.
4. How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal obligation.
We do not sell your personal information.
Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email. You have the right to withdraw consent to marketing at any time by contacting us (please see section 6 for further details).
5. Purposes for which we will use your personal data
We have set out below in table format a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
When we rely on legitimate interests we make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us. We may also process your personal data to establish, exercise or defend legal claims or as necessary to comply with our legal obligations.
Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please email [email protected] if you need details about the specific legal basis we are relying on to process your personal data where more than one basis has been set out in the table below.
|Type of data
|Lawful basis for processing including basis of legitimate interest
To register you as a Managed User or Key Web Contact on our website
|Necessary for our legitimate interests (to provide a web portal for the purposes of customers to place orders, where Managed Users / Key Web Contacts are representatives of those customers)
Where you are a consumer, to manage your product warranty (if applicable)
Necessary for our legitimate interests (to administer your warranty)
To process and deliver your order including to:
(a) manage payments, fees and charges
(b) collect and recover money owed to us
(e) Marketing and Communications
(a) Performance of a contract with you(b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include:
(b) Asking you to leave a review or take a survey;
(c) running promotions from time to time to which you might respond;
(d) respond to interactions from you on any of our social media channels.
(d) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests:
|To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
(b) Contact(c) Technical
(a) Necessary for our legitimate interests:
(b) Necessary to comply with a legal obligation
|To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
(e) Marketing and Communications
(a) Necessary for our legitimate interests:
|To use data analytics to improve our website, products/services, marketing, customer relationships and experiences including the use of anonymised or pseudonymised (or hashed) customer profiles to help generate insight and identify similar prospective customers (such as the creation of a Facebook custom audience)
(c) Marketing and Communications
(a) Necessary for our legitimate interests;
|To make suggestions and recommendations to you about goods or services that may be of interest to you and to send you our newsletters.
(e) Profile(f) Marketing and Communications
Necessary for our legitimate interests to develop our products/services and grow our businessYour consent (where you have opted in to receive marketing information)
|To provide you with personalised advertising on third party websites and other of your devices, where you have provided a gmail email address and also consented to Google's Personalised Ads).
(c) Technical(d) Marketing and Communications
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please email [email protected].
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We carry out marketing to business customers as well as to consumers. For corporate email customers we rely on the lawful basis of legitimate interests, as indicated in the table above.
You have the right to withdraw consent to any marketing at any time by contacting us, simply email us at [email protected] or call us on +44 (0) 1279 427001. Alternatively, you can update your preferences by clicking the link at the bottom of our emails which will take you to the Astro Lighting subscription management page.
7. Disclosure of your personal data
We will never sell personal data to third parties (though may transfer personal data to third parties in the event of restructuring, as explained below). We may disclose your personal information to the third parties set out below for the purposes set out in the table above:
- Vendors, service providers and agents. We provide information to vendors, service providers and agents who support our respective operations, such as by providing IT services, marketing services or other services.
- Professional advisers and other external parties. We may provide information to professional advisers and other external parties, including lawyers, bankers, auditors and insurers, who provide professional services to us.
- Legal, supervisory, and regulatory authorities. We may share information with legal, supervisory and regulatory authorities and any government agencies and law enforcement bodies if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or to protect the rights, property, or safety of Astro Lighting, our customers, or others. This may also include exchanging information with other companies and organisations for the process of fraud protection and credit risk reduction.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
8. International transfers
Whenever we transfer your personal data out of the UK and the EEA (including to the US and Canada, where some of our service providers are based), we ensure a similar degree of protection is afforded. We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. We may alternatively use specific contracts approved for transferring personal data outside of the UK and the EEA.
Please email [email protected] if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
9. Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
10. Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances you can ask us to delete your data: see your legal rights below for further information.
In some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
11. Your legal rights
Updating and accessing your information (this section only applies if you are in the UK or EEA or if you have the rights we describe here under laws that apply to you)
If you are in the UK or the EEA, you have the right under UK/EEA data protection laws to access personal information held about you, subject to certain conditions, and to ask for it to be changed or deleted.
If you would like to access or amend the personal information which we hold about you, or if you would like us to stop using your personal information, please email [email protected].
To learn more about the rights you may have in relation to your personal information see 'Your rights'.
Where UK or EEA data protection laws apply to you, you have the following rights with regard to your personal information (and you may also have these rights under other laws):
- Access. You have the right to obtain confirmation as to whether or not your personal information is being processed, and, if it is, request access to that personal information (commonly known as a "data subject access request"). We will need you to prove your identity before we release any personal information to you.
- Correction or deletion. You have the right to ask us to correct or delete any personal information that we hold about you (unless we have the legal right to retain it). You also have the right to ask us to delete your information where you have exercised your right to object to processing (see below).
- Objection. You have the right to object to processing of your information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your information for direct marketing purposes.
- Restriction. You also have the right to restrict us from processing your personal information. You can ask us to temporarily stop processing information about you, for example if you want us to establish that it is accurate or the reason for processing it.
- Change of preferences. You can change your information processing preferences at any time. For example, if you have given your consent to us to send you marketing material in a particular way, but have changed your mind, you can contact us or click the relevant link in any communication you receive (where this specifically relates to marketing messages, see Marketing).
- Data portability. In some circumstances, you have the right to ask us transfer a copy of the personal information we hold about you to someone else.
Please note that if you ask us to stop processing your personal information in a certain way or if you ask us to delete your information, and we need to use that information to provide our website to you, then you may not be able to continue to use it. This does not include your right to object to direct marketing, which can be exercised at any time without restriction. If you would like to exercise any of the rights mentioned above, please email [email protected].
The above rights do not apply to anonymised personal information. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Where you have consented to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us using the contact details provided below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you would like to exercise any of the rights mentioned above, please get in touch by emailing [email protected] or calling +44 (0)1279 427001.
If, for any reason, you are not happy with the way that we have handled your personal information, please contact us using the details provided above.
If you are still not happy, you have the right to make a complaint to your local data protection regulatory authority.
If you are based in the UK, you can contact the Information Commissioner's Office using the link here: https://ico.org.uk/global/contact-us/.
Last updated 08/01/2024