Privacy Policy

Introduction

Welcome to Aprirose Trading Limited’s privacy notice. Aprirose respects your privacy and is committed to protecting your personal data. This notice explains how Aprirose looks after personal data, your privacy rights and how the law protects you.

Purpose of this privacy notice

This notice explains how Aprirose collects and processes personal data that you provide directly, data received through a third party, and data collected through use of the website, including information entered through website forms.

Aprirose does not knowingly collect data relating to children. This notice supplements other privacy or fair-processing notices provided for specific occasions and does not override them.

Controller and contact details

Aprirose Trading Limited is the controller responsible for your personal data. Its Data Protection Officer is the Legal and Transaction Manager.

Email: dpo@aprirose.com. Postal address: Aprirose House, 48A High Street, Edgware, Middlesex HA8 7EQ.

You may complain to the Information Commissioner’s Office, the UK supervisory authority for data protection issues. Aprirose asks that you contact the DPO first so it has an opportunity to address your concerns.

The version published on the current website states that it was last updated on 12 June 2019. Please keep Aprirose informed if your personal data changes during your relationship with the company.

Third-party links

The website may include links to third-party websites, plug-ins and applications. Those third parties may collect or share data. Aprirose does not control third-party websites and is not responsible for their privacy statements. Read the privacy notice of each website you visit.

The data Aprirose collects

Personal data means information from which a person can be identified. Anonymous data is not personal data.

• Identity Data, including first name, maiden name and last name.
• Contact Data, including email address and telephone numbers.
• Financial Data, including payment details such as bank account, sort code or payment-card details.
• Transaction Data, including details of funds transferred to or from Aprirose.
• Technical Data, including IP address, login data, browser type and version, time zone and location, plug-ins, operating system, platform and device technology.
• Usage Data, including information about how you use the website or Wi-Fi facilities.
• Marketing and Communications Data, including marketing and communication preferences.

Aprirose may use aggregated statistical or demographic data. If aggregated data is combined with personal data so that it can identify you, the combined data is treated as personal data.

The current policy states that Aprirose does not collect special categories of personal data or information about criminal convictions and offences.

If you fail to provide personal data

Where Aprirose needs personal data by law or under a contract and you do not provide it, Aprirose may be unable to perform the contract or provide a service. If that happens, Aprirose will notify you at the time.

How personal data is collected

• Direct interactions, including forms and correspondence by post, phone, email or the website contact page.
• Automated technologies or interactions, including cookies, server logs and similar technologies that collect technical data about equipment, actions and patterns.
• Third parties or public sources, including analytics providers, advertising networks, search-information providers, data brokers, Companies House and the Electoral Register.

How Aprirose uses personal data

Aprirose states that it uses personal data only where the law allows it, most commonly where necessary for legitimate interests, to meet a legal or regulatory obligation, or where you have requested contact through the website.

• Administer and protect the business and website, including troubleshooting, analysis, testing, maintenance, support, reporting and hosting.
• Use data analytics to improve the website, products and services, marketing, customer relationships and experiences.
• Make suggestions and recommendations about services that may be of interest.

Aprirose may process personal data on more than one lawful ground depending on the purpose. Generally it does not rely on consent except for third-party direct marketing by email or text. You may withdraw marketing consent at any time by contacting dpo@aprirose.com.

Marketing, cookies and change of purpose

Aprirose may use Identity, Contact, Technical and Usage Data to decide which services may be relevant. You may ask Aprirose to stop marketing messages at any time. Opting out does not affect data provided because of a service already supplied.

You can set your browser to refuse some or all cookies or to alert you when sites set or access cookies. Disabling cookies may make parts of the website unavailable or prevent them from working correctly.

Aprirose will use personal data for the purpose for which it was collected unless another compatible reason applies. If an unrelated purpose is required, Aprirose states it will explain the legal basis. Processing without knowledge or consent may occur where the law requires or permits it.

Disclosure of personal data

Aprirose may share personal data with internal companies in the Aprirose group and external parties where needed for the purposes described in the policy.

• Service providers supplying IT and system administration.
• Professional advisers, including lawyers, bankers, auditors and insurers.
• HM Revenue & Customs, regulators and other authorities where reporting is required.
• Third parties involved in a sale, transfer, merger, acquisition or restructuring of the business or its assets.

Aprirose requires third parties to respect personal-data security, use it only for specified purposes and process it in accordance with Aprirose’s instructions.

International transfers

Some external third parties may be based outside the European Economic Area. The policy states that Aprirose seeks a similar degree of protection through safeguards such as adequacy decisions and approved contractual mechanisms. Contact dpo@aprirose.com for information on a specific transfer mechanism.

Data security

Aprirose states that it has measures designed to prevent personal data from being accidentally lost, used, accessed, altered or disclosed without authorisation. Access is limited to people with a business need who are subject to confidentiality duties. Aprirose has procedures for suspected data breaches and will notify affected people and regulators where legally required.

Data retention

Personal data is retained only as long as necessary for the purpose for which it was collected, including legal, accounting and reporting requirements. It may be kept longer in the event of a complaint or anticipated litigation. Retention considers amount, nature, sensitivity, harm risk, purpose, alternatives and legal requirements. Data may be anonymised for research or statistical use.

Your legal rights

Depending on the circumstances, data-protection law gives you rights in relation to your personal data.

• Request access to the personal data Aprirose holds about you.
• Request correction of incomplete or inaccurate personal data.
• Request erasure where there is no good reason for continued processing, subject to legal exceptions.
• Object to processing based on legitimate interests or for direct marketing.
• Request restriction of processing in specified circumstances.
• Request transfer of eligible automated personal data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where consent is the basis for processing.

To exercise a right, contact dpo@aprirose.com. Usually no fee is required, although Aprirose may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive or excessive.

Aprirose may request information to confirm identity and the right to access data. It aims to respond to legitimate requests within one month, but may take longer for complex or multiple requests and will provide an update if so.