This section sets out the circumstances in which will disclose information about you to third parties and any additional purposes for which we use your information.
Disclosure of your information to service providers
We use a number of third parties to provide us with services which are necessary to run our business or to assist us with running our business and who process your information for us on our behalf. These include the following:
Telephone provider(s), including BT & TalkTalk. Their privacy policy is available here:https://www.bt.com/privacypolicyandhttps://www.talktalk.co.uk/legal/privacy-policy/Email provider(s), including Gmail. Their privacy policy is available here:https://policies.google.com/privacyHosting provider(s), including AWS.Their privacy policy is available here:https://aws.amazon.com/privacy/Credit provider(s), including Klarna.
Your information will be shared with these service providers where necessary to provide you with the service you have requested, whether that is accessing our website or ordering goods and services from us.
We do not display the identities of [all of] our service providers publicly by name for security and competitive reasons. If you would like further information about the identities of our service providers, however, please contact us directly via our contact form and we will provide you with such information where you have a legitimate reason for requesting it (where we have shared your information with such service providers, for example).
Legal basis for processing: legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest relied on: where we share your information with these third parties in a context other than where is necessary to perform a contract (or take steps at your request to do so), we will share your information with such third parties in order to allow us to run and manage our business efficiently.
Legal basis for processing: necessary to perform a contract and/or to take steps at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract: we may need to share information with our service providers to enable us to perform our obligations under that contract or to take the steps you have requested before we enter into a contract with you.
Disclosure of your information to other third parties
We disclose your information to other third parties in specific circumstances, as set out below.
Providing information to third parties such as Google Inc., Google collects information through our use of Google Analytics on our website. Google uses this information, including IP addresses and information from cookies, for a number of purposes, such as improving its Google Analytics service. Information is shared with Google on an aggregated and anonymised basis. To find out more about what information Google collects, how it uses this information and how to control the information sent to Google, please see the following page: https://www.google.com/policies/privacy/partners/
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s): meeting our contractual obligations to Google under our Google Analytics Terms of Service (https://www.google.com/analytics/terms/us.html)
You can opt out of Google Analytics by installing the browser plugin here: https://tools.google.com/dlpage/gaoptout
Transfer and storage of your information
Information collected by Google Analytics is stored outside the European Economic Area on Google’s servers in the United States of America.
For further information about the safeguards used when your information is transferred outside the European Economic Area, see the section of this privacy policy below entitled Transfers of your information outside the European Economic Area.]
Sharing your information with third parties, which are either related to or associated with the running of our business, where it is necessary for us to do so. These third parties include our accountants, advisors, independent contractors, HMRC. Further information on each of these third parties is set out below.
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest: running and managing our business efficiently.
Accountants
We share information with our accountants for tax purposes. For example, we share invoices we issue and receive with our accountants for the purpose of completing tax returns and our end of year accounts.]
Our accountants are located in the United Kingdom
Advisors
Occasionally, we obtain advice from advisors, such as lawyers and public relations professionals. We will share your information with these third parties only where it is necessary to enable these third parties to be able to provide us with the relevant advice.
Our advisors are located in the United Kingdom.
Independent contractors
Occasionally,] we use independent contractors in our business. Your information will be shared with independent contractors only where it is necessary for them to perform the function we have hired them perform in relation to our business.
Our independent contractors are located in the United Kingdom.
Insurers
We will share your information with our insurers where it is necessary to do so, for example in relation to a claim or potential claim we receive or make or under our general disclosure obligations under our insurance contract with them.]
Our insurers are located in the EEA.
Discount Affiliate
[We make use of Discount Affiliates. Your information and student status is shared with Discount Affiliates only when it is necessary for them to perform the function for which they are contracted.
Our Discount Affiliate is located in the United Kingdom.
Payment Processor
We make use of Payment Processors and Merchant Banks. Your information & payment information is shared with Payment Processors only when it is necessary for them to perform the function for which they are contracted; namely approving and capturing a purchase.
Our Payment Processor is located in the United States.
Sharing your information within our business’ group of companies, including Oh Polly USA Inc, and G4k Fashion Ltd, for internal administrative purposes, including client, customer and employee information.
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest: running and managing our business effectively.
Sharing your information with a prospective or actual purchaser or seller in the context of a business or asset sale or acquisition by us, a merger or similar business combination event, whether actual or potential.
Legal basis for processing: legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s): sharing your information with a prospective purchaser, seller or similar person in order to allow such a transaction to take place.
We do not display the identities of the other third parties we may share information with by name for security and competitive reasons. If you would like further information about the identities of such third parties, however, please contact us directly[via our contact form or by email and we will provide you with such information where you have a legitimate reason for requesting it (where we have shared your information with such third parties, for example).
Disclosure and use of your information for legal reasons
Indicating possible criminal acts or threats to public security to a competent authority
If we suspect that criminal or potential criminal conduct has been occurred, we will in certain circumstances need to contact an appropriate authority, such as the police. This could be the case, for instance, if we suspect that we fraud or a cybercrime has been committed or if we receive threats or malicious communications towards us or third parties.
We will generally only need to process your information for this purpose if you were involved or affected by such an incident in some way.
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interests: preventing crime or suspected criminal activity (such as fraud).
In connection with the enforcement or potential enforcement our legal rights
We will use your information in connection with the enforcement or potential enforcement of our legal rights, including, for example, sharing information with debt collection agencies if you do not pay amounts owed to us when you are contractually obliged to do so. Our legal rights may be contractual (where we have entered into a contract with you) or non-contractual (such as legal rights that we have under copyright law or tort law).
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest: enforcing our legal rights and taking steps to enforce our legal rights.
In connection with a legal or potential legal dispute or proceedings
We may need to use your information if we are involved in a dispute with you or a third party for example, either to resolve the dispute or as part of any mediation, arbitration or court resolution or similar process.
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s): resolving disputes and potential disputes.
For ongoing compliance with laws, regulations and other legal requirements
We will use and process your information in order to comply with legal obligations to which we are subject. For example, we may need to disclose your information pursuant to a court order or subpoena if we receive one.
Legal basis for processing: compliance with a legal obligation (Article 6(1)(c) of the General Data Protection Regulation).
Legal obligation(s): legal obligations to disclose information which are part of the laws of, Scotland, England and Walesor if they have been integrated into the United Kingdom’s legal framework (for example in the form of an international agreement which the United Kingdom has signed).
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest: where the legal obligations are part of the laws of another country and have not been integrated into the United Kingdom’s legal framework, we have a legitimate interest in complying with these obligations.
