Privacy notice

Our relationship with you is that of a Data Controller and not a data processor. CraignDave Ltd are Data Controllers because we are determining the purpose and means of processing personal data. We are not processing your data on your behalf.  We make reference to the Information Commissioner's Office guidance and examples on this: ICO: What are ‘controllers’ and ‘processors’? We are registered with the Information Commissioner’s Office. ico.org.uk The full details of the data controller are: CRAIGNDAVE LTD 12 Tweenbrook Avenue Gloucester Gloucestershire GL1 5JY   We are registered with the Information Commissioner’s Office. www.ico.org.uk Registration number: ZA462469

Craigndave LTD is a private company registered in England and Wales with company number 10442992. Our registered office is: 12 Tweenbrook Avenue Gloucester Gloucestershire GL1 5JY If you have any questions about how we look after your personal data, you can contact us:

• In writing, at the address above. Please mark your letter for the attention of the Data Protection Officer
• By email to this address: admin@craigndave.co.uk
• By telephone on 020 4519 3010

You can manage your marketing preferences by contacting us as above or via the newsletter link at the bottom of the email. We will update your preferences as soon as we can but it may take up to 2 weeks.

We will not keep your personal data for longer than is necessary for the purposes described in this policy. As a guide:

• we will keep personal data while your account is active
• we may keep certain categories of personal data after your account is closed in order to meet any legal or regulatory requirements, or to resolve a legal dispute
• and, because of this, we may keep different types of personal data for different lengths of time (for instance, we may need to keep certain personal data relating to your purchases in order to comply with HMRC's VAT reporting requirements)

When a Trust, Academy or school invests in a new product, service or project that requires the handling of personal data, the Data Protection Officer at the Trust, Academy or school should undertake a data protection impact assessment. A Data Protection Impact Assessment (DPIA) is a process to help you identify and minimise the data protection risks of a project. To complete this assessment the Trust, Academy or school may choose to enlist the help of other people within their own organisation. To assist Data Protection Officers in conducting this assessment, CraignDave Ltd supply this privacy policy. CraignDave Ltd is a limited company within the UK and complies with all legal responsibilities under the Data Protection Act 2018, incorporating EU GDPR. It is not the position of CraignDave Ltd to complete a Trust, Academy or school’s internal paperwork for impact assessments because we should not be judging ourselves, this is often referred to ‘poacher turned gamekeeper’. All the information required for a Data Protection Officer to complete an impact assessment can be found within our privacy policies.

We use certain external companies to process our data. 1&1 - This company supplies the data centre used to host Craigndave LTD which is with in the UK. Their privacy Policy can be viewed here. Stripe - We use Stripe INC to process the payments you make through our store.  Their privacy Policy can be viewed here. Zoho.eu – We use this company to host our cloud based premium members database.  Their GDPR Policy can be viewed here.  Their privacy Policy can be viewed here. Dactyl Publishing  -  These are the suppliers and senders of our Cornell Notebooks. Their Privacy Policy can be viewed here. Intuit QuickBooks - Your details will be processed by our online invoicing, credit control and order processing provider in order to complete and process any order from you. Their privacy policy can be viewed at: here.

Our contact promise is a summary of how we look after your personal data. We collect, use and store your personal data so that we can offer you the products and services you expect from us. We see your personal data as just that: it's yours. So we will always be clear and upfront with you about what we do with your personal data, and (of course) you have control over it. We collect your personal data for two main reasons:

1. To process any orders you make and to deliver those orders to you
2. With your permission, to send you special offers, often tailored to what you have told us you would like to hear about

We promise:

• That you can control the personal data you provide us with and that we will always be transparent about how we collect and use it
• We will always tell you what personal data we are collecting from you, the means by which we will collect it and how we will use it. We will only use your personal data for the purposes we originally told you about.
• We will only send you marketing communications if you have agreed that we can do so and we will always offer you a clear and simple means of changing your preferences whenever you want to

We collect your personal data in two main ways: (1) When you give it to us directly When you communicate with us or purchase our products or services, you may choose to give us certain information. For example, when you give us your name and address or when clicking on active buttons such as 'Place Order & Pay'. (2) When our systems collect information or personal data as you use our website. Whenever you use a website, app or other internet service, information gets recorded automatically by the IT systems used to operate that website, app or service. The most common type of information collected is in the form of cookies (small text files sent by your computer each time you visit our website) but can also include personal data transferred by the electronic device you use to access our website and its settings. The manufacturer of your device, or the provider of the operating system, will have details about what information your device shares with us.

We may collect the following information about you: • Your name and contact details This can include your postal, billing and delivery addresses; your telephone number(s), including, if you provide it, your mobile number; and your email address • Purchases and orders made by you • When you set up an account with us, your password (which we encrypt) • Your correspondence with us In some instances, we may need to collect additional personal data for the purposes set out in this privacy policy.

We will need to process some of your personal data to fulfil any orders you place and to comply with the law. For example:

• We will share your (or your recipient's) name, address and, where applicable, telephone number with our carriers
• Occasionally with the police, for the purposes of preventing and investigating fraud

So that we can provide you with our products and services, we have to share some of your personal data with certain third parties. When we share your personal data, we make sure that it remains secure:

• We ensure that all out third parties we share your personal data with have an up to date privacy policy an to ensure that they will keep your personal data secure and confidential to the standards you and we would expect
• We will only send to third parties the personal data that is necessary for the purposes it is required for.

We share your data as follows: With core service providers to enable our business to function We rely on a set of external companies to provide us with services that enable our business to run properly. Our core service providers include the courier companies we use to deliver our products to you.  We will provide them with the contact name, address of the institution and order details. Banks and clearing houses to process your payments; IT services providers and companies to help us with our marketing.   With regulators and law enforcement agencies when required to do so by law We are required to co-operate with regulators (like the Information Commissioner's Office or HMRC) and law enforcement agencies (like the police or the Serious Fraud Office) in every country we operate in. Although it does not happen often, regulators and law enforcement agencies can require us to share information with them as part of an investigation; this may include your personal data. We would have to disclose your personal data where we believe that disclosure is reasonably necessary to comply with the regulator or crime enforcement agency's demand. When we think it is reasonably necessary to protect you or us Occasionally businesses are subject to attempted criminal activities; this can affect both us and you. We will take all reasonable steps to protect you and our business but sometimes we may need to share your personal data where we think it is reasonably necessary to:

• Detect, monitor, investigate or prevent any suspected illegal activities, fraud or security issues
• Enforce our terms and conditions and to protect your and our rights and property
• Investigate and defend any third party claims or allegations

As part of a business sale or purchase, merger or reorganisation From time to time we may look to purchase another business or sell or re-organise parts of our business to ensure that we remain in strong shape. Sometimes these types of corporate transactions involve the transfer of your personal data solely for the purposes of assessing the transaction. In the event that we sell or buy any business or assets, personal data which we hold about you may be one of the transferred assets. In aggregated format Strictly speaking this is not personal data, but on occasions we will use data from which you cannot be personally identified but which does include information that relates to you (such as a testimonial).

We do not have any systems, procedures or third parties who operate outside the EEA.

We use your personal data:

• To send you the products and services you have purchased
• To allow you to post links to our products on social media
• To manage any accounts you have registered with us so that (i) we can provide you with products and services; (ii) you can place orders; and (iii) we can fulfil those orders and communicate with you about them
• To verify your identity
• To detect and prevent fraud and other illegal activities (and to assist regulators, trade bodies and law enforcement agencies in relation to the same)
• To carry out research to better understand your views on our products and services

Our legitimate interests When we send you news of our latest products and updates, we will do so on the basis that we have your permission (i.e. consent). However, to allow us to run our business we believe we have a legitimate interest to process your personal data so that we can:

• Improve our existing range, associated products and services, and develop new ones
• Provide you with a quality customer service experience
• Protect you, our employees and our business
• Understand your likes and dislikes, what products you want to hear about and how best to contact you to inform you about them
• Taking legal action against any party in breach of its obligations to Craigndave LTD, and handling any legal claims or regulatory enforcement actions taken against Craigndave LTD.

You have a number of rights under data protection laws; these are summarised below.

• the right to be informed

We need to be clear with you about how we process your personal data. We do this through our Contact Promise and this Privacy Policy, which we will keep as up to date as possible.

• the right of access

You can access the personal data we hold on you by contacting us on 03330 164 059 or admin@craigndave.co.uk. To process your request, we will ask you to send us two forms of proof of identity so that we can be sure we are releasing your personal data to the right person. We will process your request within one month or, if the request is particularly complex, two months. We can provide you with a copy of your personal data in electronic format or hard copy. If we consider the frequency of your requests is unreasonable, we may refuse to comply with your request. In those circumstances, we would notify you of your right to complain to the Information Commissioner's Office.

• the right to rectification

We welcome feedback from you to ensure our records are as accurate and up-to-date as possible. If you think that the information we hold about you is inaccurate or incomplete please ask us to correct it by contacting us on 03330 164 059 or admin@craigndave.co.uk or by updating your details at any time through the My Account section in your online account. We will process your request as soon as we receive it or within one month of receipt at the latest.

• the right to erasure

You can ask us to delete your personal data; however, this is not an absolute right. We can refuse to erase personal data which we need to keep (i) to comply with a legal obligation (for instance, we are required by HMRC to keep certain personal data for up to 6 years for VAT reporting purposes); and (ii) in relation to the exercise or defence of any legal claims. When you ask us to delete your personal data, we assume that you do not want to hear from us again. To ensure that we do not send you any special offers in the future, we will retain just enough of your personal data solely for suppression purposes. Other than as described above, we will always comply with your request and do so promptly. We would also notify any third parties with whom we have shared your personal data (for instance, our carriers for the purposes of delivering your order to you) about your request so that they could also comply. Some customers would still like to order our products but do not want to receive any marketing communications from us. This is not a problem as you can simply update your marketing preferences by contacting us on 03330 164 059 or admin@craigndave.co.uk.

• the right to transfer your personal data (known as data portability)

You have the right to move, copy or transfer your personal data from one organisation to another. We hold little information that would be much use to another resource supplier, but if you do wish to transfer your personal data we would be happy to help. If you ask for a data transfer, we will give you a copy of your personal data in a structured, commonly used and machine-readable form (for instance, in a CSV file format). We can provide the personal data to you directly or, if you request, to another organisation. Please note that we are not required to adopt processing systems that are compatible with another organisation, so it may be that the recipient organisation cannot automatically use the personal data we provide. When making a transfer request, it would be helpful if you can identify exactly what personal data you wish us to transfer. We will comply with your request within one month or, if the request is complex or there are a number of requests from you, within two months.

• the right to object

If you would like us to stop processing your personal data for marketing purposes simply let us know by contacting us on 03330 164 059 or admin@craigndave.co.uk.

We may update this policy from time to time to take account of any new business activity or to reflect any changes in law or best practice in relation to data protection. We will notify you if we do so. This policy was last updated on 23 September 2020.

Cookies are tiny text files stored on your computer when you visit certain web pages. At craigndave.org and all it's sub domains (shop) we use cookies to keep track of what you have in your basket, and to remember you when you return to our site. To order products on shop.craigndave.org, you need to have cookies enabled. If you don't wish to enable cookies, you'll still be able to browse the site and use it for research purposes. Please note that cookies can't harm your computer. We don't store personally identifiable information such as credit card details in cookies we create, but we do use encrypted information gathered from them to help improve your experience of the site. For example, they help us to identify and resolve errors, or to determine relevant related products to show you when you're browsing. We're giving you this information as part of our initiative to comply with recent legislation, and to make sure we're honest and clear about your privacy when using our website. We know you'd expect nothing less from us, and please be assured that we're working on a number of other privacy and cookie-related improvements to the website. For more information on cookies, visit the official ICO website at ico.org.uk or whatarecookies.com.

Types of Cookies

Strictly necessary cookies - These cookies enable you to navigate our site and gain full access to its features and secure areas. Without these cookies essential services you have asked for like 'Your Basket' cannot be provided. Performance cookies - These cookies remember information about how you and other customers use our website. This gives us vital information such as which pages are visited most often and if customers are receiving error messages from certain pages. The role of these cookies is to allow us to analyse and improve the performance of our website ensuring you receive a consistent look, feel and shopping experience. Performance cookies (often known as web analytic cookies) don't collect any information that identifies the customer and all information collected is aggregated and therefore anonymous. Functionality cookies - These cookies remember choices you made on previous visits to our site such as your username, language or region so we can provide enhanced, more personal features. They can also be used to remember changes you've made to text size, fonts and other parts of web pages you can customise. Functionality cookies can also be used to provide services you have previously asked for such as watching videos or commenting on a blog. The information collected by these cookies may be anonymised and they cannot track your browsing activity on other sites. Targeting or advertising cookies - These cookies are used to deliver adverts more relevant to your personal interests. Alongside this they limit the amount of times you see an advert and measure the effectiveness of adverts. This means you won't keep seeing irrelevant adverts or the same adverts over and over. These cookies are usually placed by advertising networks with the website operator's permission. They remember that you have visited a website and the information is shared with other organisations such as advertisers. Quite often targeting or advertising cookies will be linked to site functionality provided by the other organisations that generate the advert. When one of these adverts is presented to you on a site there will be a quick and easy way to click in and opt out of receiving further adverts.

Cookies we use

Please click HERE for the list More information about Google’s cookie policy can be read at www.google.com/intl/en/analytics/privacyoverview.html In addition to the cookies we set when you visit our websites, third parties may also set cookies when you visit our sites. In some cases, that is because we have hired the third party to provide services on our behalf, such as site analytics. In other cases, it is because our web pages contain content from third parties. Because your browser connects to those third parties’ web servers to retrieve that content, those third parties are able to set or read their own cookies on your device and may collect information about your online activities across websites or online services. How to Control Cookies Most web browsers automatically accept cookies but provide controls that allow you to block or delete them. Most browsers allow you to refuse to accept cookies, however, blocking cookies will have a negative impact upon the usability of some websites. Certain features of our websites depend upon cookies. Please be aware that if you choose to block cookies, you may not be able to sign in or use those features, and preferences that are dependent on cookies may be lost. If you choose to delete cookies, the settings and preferences controlled by those cookies will be deleted and may need to be recreated.

In the unlikely event that you require a refund we will need a written request by you or your organizations finance department.  Refunds will be processed back onto the original payment card/ method only, we will not accept any other cards/ methods.  We will process your refund within 7 business days. Should you wish to cancel your subscription we require a written letter.  If your account has yet to expire, it will run until the subscription expires.  No partial refunds shall be given, except in exceptional circumstances.

We accept credit/debit card payments via our online store (stripe).  If you are unable to use Stripe we also accept BACS and Cheque payments and purchase orders from your organisation. We do not process or store your card details on our site, this is solely done via Stripe from their plugin.

On occasion we include links to third parties on this website. Where we provide a link it does not mean that we endorse or approve that site’s policy towards visitor privacy. You should review their privacy policy before sending them any personal data.