Witch is the controller of your personal data via our Website.
Categories of data we collect
We collect personal data from you such as identity data (including name and title), contact data (including postal address, email address and telephone numbers) and profile data (including your interests, preferences, feedback and survey responses).
The data we collect may be data which you provide to us directly or through companies or agents we work with, as well as data which we collect when you use our Website and services.
How is your personal data collected?
We may use and process your personal data when you submit it to us in the following ways:
- Communications via our Website: We collect personal data when you provide it to us through communications via our Website. This includes where you contact us through the channels listed on the Contact Us page on our Website and similar situations in which you have chosen to provide your data to us, including for customer service support.
- Automated technologies or interactions: As you interact with our Website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookies Policy for further details.
- Third Party or publicly available sources: We may receive personal data about you from various third parties and/or public sources, for example providers of technical payment and delivery services.
Purposes for processing your personal data
We process any personal data you provide to us to enable us to perform the contract we are about to enter into or have entered into with you, to ensure compliance with local legal and regulatory requirements and for the purposes of our legitimate business interests.
We also use your personal data:
- to provide you with the information that you request from us. If you do not provide us with the information we need, we will not be able to provide you with the information that you request from us;
- to enable us to respond to an enquiry or other request you make when you contact us via our Website or otherwise, including for customer services support;
- to enable us to issue a notice or corrective action to you in relation to any of our products or services, if required;
- to better understand how you interact with our Website, including its functionality and features, and to ensure that content is presented in the most effective manner;
- to enable us to send you direct marketing that you have consented to receive; and
- where permitted by law, to provide you with information about other products and services we offer that are similar to those that you have already purchased or enquired about and we feel may interest you, as described in the “Marketing” section below.
Retention of your personal data
We will only retain your personal data for as long as you wish to be kept up to date with Witch promotions where you have asked us to do so, to provide you with the best experience possible or to fulfil any other purposes your personal data was collected for.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and applicable legal requirements.
We may contact you to provide you with information about products and services similar to those which were the subject of a previous enquiry or preference by you. You may also be contacted by one of our selected partners, in each case where you have consented to receive these communications.
You may opt out of receiving our marketing communications at any time by contacting us at Customer Service: firstname.lastname@example.org or by using the unsubscribe link in any of our communications.
We will continue to contact you for non-marketing purposes where we need to issue a corrective or safety notice, or where we need to send certain information to you under a legal, regulatory, or ethical requirement.
How do we use the data that you provide to us?
Broadly speaking, we use personal data for purposes of administering our business activities, providing customer service and making available other products and services to our customers and prospective customers. Occasionally, we may also use the data we collect to notify you about important changes to our Website.
Where you have consented or we are permitted to do so by law, we will occasionally notify you about new services and special offers we think you will find valuable.
The lists used to send you product and service offers are developed and managed under our traditional corporate standards designed to safeguard the security and privacy of our customers’ personal data. As a customer, you will be given the opportunity, at least once per contact, to notify us that you want to opt out of receiving non-service related emails.
Who else may have access to your personal data
To best serve you, we may share your personal data with:
- our selected commercial partners and sponsors where you have chosen to participate in surveys, opinion groups or other marketing-related initiatives relating to your use of our products and services;
- our service providers that we engage to provide services for us. Where we provide your personal data to third party services providers, they are required to keep your personal data confidential and secure and must only use your personal data as instructed by us; and
- our distributors, business partners or other service providers, including for marketing purposes or where you have chosen to share your personal data through various features and functionality provided via our Website.
We may also disclose your personal data where we are required to respond to authorized requests from government authorities or where required by law.
International Transfers: Applies only to EEA personal data
Witch is based in the United Kingdom and will store your personal data in the UK. If you are located in the European Economic Area (“EEA”) this means we are transferring your data outside of the EEA.
Most of our external third party services providers are also based outside of the EEA so their processing of your personal data will also involve transferring it outside of the EEA. Whenever we transfer your personal data outside of the EEA, we ensure a similar degree of protection is afforded to it. For example:
- we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries;
- where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries; and
For further information on the specific mechanism used by us when transferring your personal data outside of the EEA, please send your request to email@example.com. We will process any request in line with any local laws and our policies and procedures.
If you are a UK or EEA resident, you have the right to:
- be informed about the personal data we collect from you;
- obtain confirmation from us that your personal data is being collected and used by us and to access the personal data held about you by us;
- request that we correct any inaccurate or incomplete personal data we hold about you;
- request that we delete any personal data we hold about you and to inform other controllers who are processing your data accordingly (the right to be forgotten);
- request that we restrict the processing of personal data we hold about you, which means we can continue to store your personal data but we cannot further collect or use it in any way;
- revoke the consent once given regarding the processing of your personal data;
- object to the processing of personal data we hold about you where this objection is based on: (i) a legitimate interest or the performance of a task in the public interest; or (ii) direct marketing; and/or
- receive any personal data we hold about you in a structured and commonly used machine-readable format or have such personal data transmitted to another company.
To exercise any of your rights in connection with your personal data, please contact firstname.lastname@example.org. When you request to exercise any of your rights we may ask you for additional information to confirm your identity and for security purposes, before disclosing information requested to you.
We will process any request in line with any local laws and our policies and procedures. If you are located in the UK or EEA, we will confirm any requests relating to your rights above within one month of receipt of your request, or within two months of receipt of your request where this request is more complex.
We do not knowingly collect any data from anyone under 16 years of age. If you are under 16, do not use or provide any data on this Website or on or through any of its features/register on the Website, make any purchases through the Website or provide any data about yourself to us, including your name, address, telephone number or email address.
If we learn we have collected or received personal data from a child under 16, we will delete that data.
If you believe we might have any personal data from or about a child under 16, please contact us at email@example.com.
We shall implement appropriate technical and organisational measures to ensure a level of security appropriate to potential risks, including:
- the pseudonymization and encryption of your personal data where appropriate;
- ensuring ongoing confidentiality, integrity, availability and resilience or processing systems and services;
- ensuring we can restore access to personal data in a timely manner if a physical or technical incident occurs; and
- regular testing, assessment and evaluation of the effectiveness of our technical and organisational measures to ensure your personal data is secure.
We maintain physical, electronic and procedural safeguards to protect the confidentiality and security of our personal data transmitted to us using our Website. Please note that email is not encrypted and is not considered to be a secure means of transmitting credit card information.
Contests and Sweepstakes
When we run a contest or sweepstakes relating to this Website, it will be accompanied by a set of rules and/or guidelines. The rules for each contest or sweepstakes will specify how the data gathered from you for entry will be used and disclosed.
Links to other websites
Your data your choice
To update us with your data sharing preferences, you may contact us using one of the following methods:
Making a complaint
If you would like to make a complaint about the way we have collected or used your personal data, please contact us at firstname.lastname@example.org
If you are unhappy about the way we have handled your complaint and/or you would like to take the mater further to make a complaint directly to our regulator without contacting us first, you can do so by contacting the Information Commissioner’s Office (“ICO”) by following this link: https://ico.org.uk/concerns/ or telephoning the ICO helpline, which is 0303 123 1113.
If you have any questions about the processing of personal data via this Website, please contact us by email at email@example.com.
If you contact us, we will do our best to address any concerns you may have about our processing of your personal data.