- Why this Privacy Notice is important to 'You', 'Your'.
- UK Data Protection Law.
- Who We are - 'We', 'Us', 'Our'.
- Our ethos.
- What information do You hold about Me?
V10, 11 March 2020
This Privacy Notice is important because it explains to You how we may use the personal Information We collect and hold about You. Should you have any questions about this Privacy Notice please see the contact details at the bottom of the Notice.
Throughout this Privacy Notice we will talk about UK Data Protection Law, this predominantly means the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 as well as the EU GDPR regulations which came into force on 25th May 2018.
The Original Data Company Ltd is a company registered in England & Wales under company number 09509986. Our registered office is: Suite 42, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN. The Original Data Company Ltd are Data Controllers of the Personal Information held about You and accordingly are registered with the Office of the Information Commissioner (ICO) under the Data Protection Act 2018. Our registration number is ZA116547.
Our Data Protection Officer is Paul Golding. He can be contacted by Email: firstname.lastname@example.org or Write to: The Data Protection Officer, The Original Data Company Ltd, Suite 42, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN.
The Original Data Company Ltd owns and operates a number of websites which include, but are not limited to: www.surf4hub.com / www.surf4prizes.com / www.surf4cover.com / www.surf4surveys.com / www.fashionforensics.com for a full list please visit: www.surf4group.com
We want this Privacy Notice to be honest, open and transparent because We know that Your privacy, and the protection of Your Personal Information is important to You. We take every reasonable precaution to ensure compliance with UK Data Protection Law. Further information about Your rights under UK Data Protection Law is available from the Office of the Information Commissioners (ICO) Website. If You wish to find out more please visit: www.ico.org.uk We do not want to collect or hold any Personal Information about You that You do not wish or intend to give. That is why it is important that You read this Privacy Notice carefully.
We collect three categories of Personal Information about You; Identifiable Information, Anonymous Information and Lifestyle Information.
- 'Identifiable Information' means any information about You from which You can be personally identified, common examples include (but are not limited to); Your name, address, date of birth and email address.
- 'Anonymous Information' means information that does not identify You personally but categorises You into certain groups or categories. Commonly this is demographic information such as; age group, gender, marital status and income. Anonymous Information is useful because it allows Us to build statistical and analytical information about You which means We can better identify products and services that are relevant to You.
- 'Lifestyle Information' means information about Your way of life and interests. Like anonymous information it does not identify You personally but helps Us understand You better. Together We call this 'Personal Information'.
We do not collect or hold any health, financial or credit details pertaining to You or any individual, adverse or otherwise.
The Personal Information We collect will be held by Us on Our database which is hosted on secure servers based in the European Economic Area ("EEA"). We use a variety of physical and network security technologies and procedures to help protect Your information from unauthorised access, use, or disclosure. We also operate stringent people processes which means that only a limited number of people in our organisation have access to the information contained in the database. We have established procedures to cope with events that happen that are beyond Our control. We are also certified as meeting the requirements of ISO 27001:2013 in the provision of data cleansing and the management of consumer lists.
We collect Personal Information about You in several ways including the following:
- when You enter one of Our competitions or prize draws;
- when You complete one of Our lifestyle questionnaires or surveys;
- when You complete Our unsubscribe form;
- when You submit a Data Protection Enquiry or Subject Access Request (SAR);
- when We purchase or license Your information from other suppliers.
When You are entering Personal Information onto Our website it is not until You click the submit button that Your Personal Information is transferred to Us. Unfortunately, the internet is not a 100% secure medium and We cannot guarantee or accept any liability for any loss or damages in relation to information that You submit that is lost in transit. We also purchase &/or license Personal Information from other third parties. We call these third parties Data Contributors. Your Personal Information may be collected by Data Contributors if You have submitted information to a website, (for example when entering a prize draw), completed a telephone survey or lifestyle questionnaire or when buying goods and services from third parties. Regardless of the way Your Personal Information is collected Our Data Contributors warrant to Us that You have consented to Your Personal Information being passed to Us and that the consent is current. We call this permission Opt-In. We only ever work with Data Contributors that operate within UK Data Protection Law and are registered with the ICO at the time of purchase.
You have the right under UK Data Protection Law to Opt-Out of receiving marketing material at any time and more information is shown about this in section 11 and 12 below.
Data, like many other products and services can be sold or licensed. When We license data to third parties We call them Clients. We work hard to ensure that We only deal with reputable Clients who like Us operate in accordance with UK Data Protection Law. We enforce this through Our contractual relationships with Our Clients in which they undertake to operate in accordance with the UK Data Protection Law and continue to enforce the rights You have. More information about those rights is set out in this Privacy Notice. Sometimes Our Clients operate in countries outside of the European Economic Area (EEA) who operate under different data protection laws. Where this happens We enforce additional contractual provisions to ensure they provide an adequate level of protection as required by UK Data Protection Law.
Here is a list of business categories in which Our Clients operate. Depending on what personal information We hold about You Our Clients may contact You by post or email for direct marketing, debt collection and tracing.
For a more detailed list of the types of companies that fall into each business category please click on the category name.
|Category||Description and examples of the business types within each category (Please click on the Categories to see companies.)|
From 18/6/2018 we will not supply data to any company within the Gambling category or these business types:
|General & lifestyle||
- Pass your details on to selected Clients who will contact You with offers and promotions;
- Help other companies to profile and extend their personal databases;
- Provide You with information about the products and services We offer;
- Conduct market research;
- To unsubscribe You from Our databases;
- To add You to Our suppression file/Do not contact file;
- Send You newsletters with news items and blogs from our websites including competitions and promotions;
- To communicate with You about an enquiry You have made;
- To wealth screen You to ascertain that You are likely to have sufficient financial capability to support specific fundraising or other activity;
- Help Clients who undertake online marketing to help provide online advertisements that are relevant to You. You may be contacted by post or email only;
- To make a profile of You. We use some of the information You provide to match with Our clients data so that they will better understand the characteristics of their customers, such as age and interests. This only happens when You are both on Our and Our clients databases. We do not give them specific information about You but We will tell them how many of their customers fall into a specific criteria such as in a certain postcode or have a pet. We will also help identify whether or not You have similar attributes to a typical customer of Our client so that they can target You with tailored offers of goods and services. We will never profile You on the basis of ethnicity, religion, politics or health as these are not valid reasons for which You should be targeted for marketing purposes, we also do not hold or collect this information. We also do not make automated decisions about You which have a negative impact on Your rights. Marketing Services Providers we share Your data with can also use profiling to target You for marketing purposes.
We will share your data with the Marketing Services Providers listed here, who will use it as an input to products and services to help organisations better understand the likely characteristics of their customers; communicate with them more effectively; and find others like them across a range of marketing channels. In sharing your data with them, we rely on a lawful ground called 'legitimate interest', as our business depends on our ability to partner with third parties who process personal data for marketing-related reasons. They will also share your data with their customers which may mean that you receive tailored advertising via direct mail or when you visit a website. To understand more, including how to exercise your data protection rights in relation to their use of your data, please click through to the websites of the companies listed.
We process data under the following lawful basis’:
Consent: where we have Your consent to receive marketing communications for compatible products and services through specified channels.
Legitimate Interest: there is a legitimate interest for ourselves and our clients in processing data to provide products and services to consumers through marketing campaigns. On a case by case basis, a balancing test is performed to ensure that we balance the potential impact of the campaign on the consumer and their rights of processing data, with the interests of ourselves and our clients.
Legal Obligation: we may need to process data under this basis, for example where a Subject Access Request (SAR) is made to remove or amend details, this data will be processed under the lawful basis of Legal Obligation.
We will use the following legal basis for each activity listed:
|Purpose||For use by ourselves||For use by third parties|
|Marketing – by email||Consent||Consent where organisation is in named business category listed in Section 8.|
|Marketing – by post||Legitimate Interest (If you are registered on the Mailing Preference Service we will not use your personal data.)||Legitimate Interest (If you are registered on the Mailing Preference Service we will not use your personal data.)|
|Tracing, ID verification and credit reference||Legitimate Interest||Legitimate Interest|
|Profiling and analytics||Legitimate Interest||Legitimate Interest|
You can opt out anytime from Us holding Your Personal Information on Our database by unsubscribing here. We call this process suppression. This is standard marketing industry practice approved by the ICO and means that just enough information about You is retained to ensure that Your wishes are respected. Suppressing, rather than deleting, Your details has the objective of preventing Your records being reintroduced into Our database in the future. Following suppression of Your details, marketing communications should stop within a maximum period of twenty eight days for electronic communications and two months for postal communications.
You have the right to withdraw consent to the processing of Your information at any time. This includes the right to withdraw processing based on legitimate interests.
You have the right to be forgotten / total erasure. This gives You the right to request Your information be removed completely. We would not recommend this but would strongly suggest the action referred to above in point 10 as complete erasure of Your data could lead to Us loading Your information again.
You have the right to know what Personal Information We hold about You on Our database. If You would like to know more about this process and what We need from You to meet Your request please follow the link here.
You have the right to request that Your data be transmitted directly to another data controller (Known as right to data portability).
You have the right to lodge a complaint with a supervisory authority, if You are not satisfied with the way we have dealt with your complaint: The Information Commissioners Office
- We will hold information about You on Our database until such time as You ask Us to suppress Your information.
- Once You have clicked 'submit ' on Our website You consent to The Original Data Company Ltd, being able to send You communications via post or email until such times as You exercise Your right to unsubscribe from receiving such communications.
- We will share information about You with Clients and Sponsors. Information about You may be held and used by Clients and Sponsors on their websites and/or on databases owned and controlled by them.
- You consent to Our Clients and Sponsors sending You communication via post or email until such times as You withdraw your consent for sending such communications.
- Our Data Retention Policy:
The Original Data Company Ltd will retain Your details for as long as they are required for the purposes for which they were collected. In addition only while Your data is valid, accurate and up to date or until such time that You choose to unsubscribe directly with Us or via one of our partners who are making use of Your details provided by Us.
As an absolute maximum we will only hold Your data which is used under the legal basis of ‘Legitimate Interests’ for a maximum of ten years. If Your data is held under the legal basis of ‘Consent’ it will also be held for a maximum of ten years. However, where We hold an email address for You We will maintain regular contact and will ensure that You have the opportunity to opt out at least once every six months.
You can opt out anytime from Us holding Your Personal Information on Our database by unsubscribing here.
Our backup policy is to backup data daily, overwriting the previous days back up. One backup each month will then be held offsite for a period of six months before being securely deleted.
Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. The table below explains the cookies we use, why we use them, and how to change your cookie settings.
Essential cookies are required for normal operations of a website, for example submitting a form. For non-essential cookies, the basic operations of a website could function without them but some features would be missing. First party cookies are cookies which relate to the website you are visiting, whilst third party cookies may carry information with you as you visit other websites.
|Basic website operations|
Used when you submit a form on our website to display related messages back to you on another page. For example to display an error message if the form has been completed incorrectly, or to repeat your submitted information back to you afterwards, and thank you for submitting. We may collect IP addresses from Form submissions (registration or contact forms for example) and in this case we will only use these for identifying and restricting spam or robot submissions to our website. Depending on its content, most form data we collect is cleared from our servers within 2 days, and up to a maximum of 1 month.
This cookie is essential and will not be disabled unless you have disabled cookies entirely in your web browser’s settings.
No information is collected, a page views counter is simply incremented. The cookie sets a random ID for your browser to prevent the counter accidentally duplicating the count, if you reloaded the page for example. This ID expires each minute.
This cookie will not be disabled unless you have disabled cookies entirely in your web browser’s settings.
|Traffic analytics (not used here, but used on our other websites)|
These cookies are first party cookies and do not carry over when you visit other websites. Information we collect with these services relate to webpage traffic analytics. They do not personally identify individual visitors.
Information may include the URLs of web pages visited, any referring URLs to those web pages, the number and time of previous visits, the start and end of a session, the IP addresses and browser information, such as browser type, browser engine, operating system, and version, of website visitors, and a unique identifier for each website visitor.
|_ga and _gid||
Used with Google analytics to collect anonymous information about how visitors use our websites and from which websites we are being referred from, to help us improve our content. Data is deleted at 26 months.
Privacy statement at Google (general)
Privacy statement at Google (Relating specifically to ga.js and its cookies)
As an alternative to blocking cookies from your web browser, you can opt out of google analytics for all websites with a browser extension: https://tools.google.com/dlpage/gaoptout
This website does not use Google Analytics, however, if visiting our other websites and they do use Google Analytics, you may also find a further link to opt out of Google Analytics tracking specifically for that website, in a similar cookies section of the privacy notice at those websites.
|_asc and _auc||
Used with Alexa analytics to collect anonymous information about page views, page loading times, and visitor durations. We are using Alexa to see how we rank against similar websites, and find areas of improvement for our websites. All user-level data collected by the Certify pixel is aggregated within 10 days.
As an alternative to blocking cookies from your web browser, you can opt out of Alexa for all websites by modifying your computer's hosts file: https://support.alexa.com/hc/en-us/articles/200685410-Opting-Out-of-Alexa-Measurement-Pixel
|Advertisements (not used here, but used on our other websites)|
These cookies are third party cookies from Awin, a service providing affiliate advertisements, and they can carry over to third party websites. The cookies are used to track our webpages as a referrer, should someone visit an Awin advertiser’s site, so that we may receive a commission if a visitor makes a transaction.
Personally identifiable information on the user are neither collected nor processed nor used in tracking. The cookies will assign an ID to the browser, an ID for the advertisement, an ID for our website as the referrer, and the time of any adverts which are clicked.
Privacy statement at Awin (specifically 2.3.1 for domain awin1.com)
(Awin advert's link URL’s begin with https://www.awin1.com/cread.php). Aside from blocking from your web browser, please avoid clicking advertisements if you do not wish for your clicks to be tracked. (We are currently working on an update to our website which will additionally disable tracking consent unless "OK" is clicked from our website's cookie banner).
|Social media & video (not used here, but used on our other websites)|
We occasionally embed videos from YouTube using YouTube’s privacy-enhanced mode. This mode may set cookies on your computer once you click on the YouTube video player, but YouTube will not store personally-identifiable cookie information for playbacks of embedded videos using the privacy-enhanced mode.
|Email newsletter analytics|
Our emails track if you have opened the email, which links you’ve clicked within the email, your IP address and browser type.
You can unsubscribe from these emails at any time from the Remove My Details page, any unsubscribe link on our websites, or the link at the top and/or bottom of our emails.
Email campaign data is deleted within 2 months of sending. Afterwards, the links and tracking for the email will no longer function.
- Disabling cookies
Cookies help you get the most out of our website. However, you may set up your browser to delete or block some or all of them or to notify you when you are sent a cookie.
Further methods for blocking specific cookies are detailed within the table above.
Please remember, if you do delete or block the use of some or all of the cookies described above, some features of our websites, such as submitting forms, will not work and your experience may be affected. If you do not adjust your settings to delete or block cookies, then they will be placed on your browser when you visit our websites. You can adjust your settings at any time.
Find out how to manage cookies in popular browsers:
To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org
If The Original Data Company Ltd or any of its assets are acquired by or merged with another entity, your Personal Information may be one of the transferred assets. If We choose to sell or transfer Our assets, We may choose to retain a copy of Your information post sale or merger.
We will occasionally update this Privacy Notice. We will tell You about these changes by posting a notification at the foot of Our websites. If the changes We make to the Privacy Notice in any way affect Your rights under UK Data Protection Law, especially in relation to how We collect and hold information about You We will contact You to explain the changes and obtain Your permission to do so.
If You have any comments or queries in connection with this Privacy Notice, please contact The Original Data Company Ltd by: Email at email@example.com; or Write to: The Data Protection Officer, The Original Data Company Ltd, Suite 42, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN.
If you have any queries about data usage please email us at firstname.lastname@example.org.
Privacy Notice - version 10 - Updated 11th March 2020 - Improved clarity on our Data Retention Policy & Usage of Data.
Privacy Notice – Version 8 – Updated 18th June 2018 – We will no longer supply data to companies within the business types listed in our Gambling category (section 8).
Privacy Notice – Version 7 – Updated 14th June 2018 – Update to section 9 – clarification of lawful basis.
Privacy Notice – Version 6 – Updated 11th June 2018 – Data Protection Act 2018 replaces Data Protection Act 1998 (section 2).
Privacy Notice – Version 5 – Updated 10th May 2018 – List of companies which we may share your personal information with updated (section 8).
Privacy Notice – Version 4 – Updated 30th April 2018 – Additional rights added to Section 11.
Privacy Notice – Version 3 – Updated 5th February 2018 – Marketing category separated from General & lifestyle category for increased clarity; new companies added to the list of companies which we may share your personal information with.
Privacy Notice – Version 2 – Updated 11th October 2017 – We now fully list all companies which we may share your personal information with.