Key details

• Document prepared by Julia Coxon

• The Data Protection Lead is Julia Coxon, Managing Director

• Requests for information can be emailed to: julia@chestnutbooks.co.uk

Introduction

Chestnut Books need to gather and use certain information about individuals as both a Controller and Processer of data.

These details can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.

This document describes how this data is collected, handled and stored to meet the company’s data protection standards and to comply with the law.

The company does not share information it holds on individuals with any third parties unless legally obliged to do so or where it has written, prior consent.

What data we may collect

We may collect the following information:

• Name and job title

• Contact information including email address

• Financial information allowing us to make or receive payment

• Demographic information such as postcode, preferences and interests

• Search information – what users are searching for on the website

• School details including improvement priorities, curriculum, intake demographics and results

What we do with the information we gather

We are committed to ensuring that your personal data is processed in accordance with GDPR requirements. We will make our best efforts to always ensure that the personal data we hold about you is up-to-date and only retained as long as is necessary.

We will use this information for the following reasons:

• Internal record keeping

• Fulfilment of our legal obligations as a company, for example tax and audit purposes. In these cases, different rules may apply regarding the length of time that personal data should be retained

• We may use the information to improve our products and services

• We may periodically send promotional emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided. This will be done in accordance with the Legitimate Interest lawful basis of data processing under GDPR and you will always be given the option to unsubscribe if you do not wish us to contact you anymore. We use Squarespace & Mailchimp to send these emails.

• We keep a record of the products and services you have bought.

• Information collected for Pupil Premium collections is kept to a minimum. We will never ask for children’s names. As children leave your school, all their previous book selections will be erased. If you choose to opt out of this service, we will remove all data collected within 6 months.

We are committed to ensuring that the information we collect is appropriate for this purpose and does not constitute an invasion of your privacy.

Legitimate interests - the legal basis for gathering information

The law allows personal data to be legally collected and used if it is necessary for a legitimate business interest of the organisation – as long as its use is fair and balanced and does not unduly impact the rights of the individual concerned.

The processing of data is necessary so that we can deal with an enquiry or process any orders received from an educational establishment, school library service or private individual.

We also provide educational establishments, school library services and private individuals with information about the products and services that we offer which are of benefit to them for them to support their pupils and customers with reading and the teaching of English.

The benefits from the processing mean that we can give our prospective customers and customers the best possible service.

Educational establishments, school library services and private individuals require our products and services to support their pupils with reading and to improve the teaching of English and children’s outcomes. We provide expert advice and support so that we can provide the right books to our customers so that they can ensure all pupils reach their potential.

Who we share the data with

We will not sell, distribute or lease your personal information to any third parties for marketing purposes.

However it may be necessary for us to pass your personal data on to third party service providers, such as freight companies used to deliver your goods, in order to meet our contractual obligations to you. We may ask if you would like your details passed to our partner, InCube. We will only pass on your details with your explicit permission.

Any third parties will be legally obliged to keep your details securely and to dispose of them once they no longer have a lawful basis for retaining them

Subject access requests - How do I find out what personal data is held about me?

We can supply the following information if requested:

• The type of data we process

• How the data was obtained

• How the data is processed (stored, retained and disposed of)

• The purpose and lawful basis of the processing

• Details of any third parties to whom the data has been provided and the reasons for this

• Details of how you can correct, withdraw or delete your data from our records

• How to contact the Data Protection Officer in case of query or complaint

If you wish to make a subject access request, please make that request in writing to julia@chestnutbooks.co.uk

Right to rectification and data quality. How do I ask for the data to be amended?

If you wish to have the data amended or rectified, please make that request in writing to julia@chestnutbooks.co.uk

Right to erasure, including retention and disposal. How do I ask for my data to be removed

If you wish to have the data removed, please make that request in writing to julia@chestnutbooks.co.uk

Where requested, data will be disposed of and destroyed in line with the current legislation.  Data will be deleted from both live and archived or back-up copies of our systems.

Squarespace Data Collection

Your privacy is important to us. It is Chestnut Book’s policy to respect your privacy regarding any information we may collect from you across our website, www.chestnutbooks.co.uk

We primarily use your personal information for the purposes of processing your orders of products and services, delivering those products and services to you (or your nominated recipient), and granting you access to engage with certain areas of our site.

This website collects personal data to power our site analytics, including:

·        Information about your browser, network, and device

·        Web pages you visited prior to coming to this website

·        Your IP address

This information may also include details about your use of this website, including:

·        Clicks

·        Internal links

·        Pages visited

·        Scrolling

·        Searches

·        Timestamps

We share this information with Squarespace, our website analytics provider, to learn about site traffic and activity.

This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.

·        These functional and required cookies are always used, which allow Squarespace, our hosting platform, to securely serve this website to you.

·        These analytics and performance cookies are used on this site, as described below, only when you acknowledge our cookie banner. We use analytics cookies to view site traffic, activity, and other data.

If you create a customer account on this website, we collect personal information to improve our checkout experience and customer service.

This information may include your:

·        Billing and shipping address(es)

·        Details about your orders (for example, your shirt size)

·        Email address

·        Name

·        Phone number

We share this information with Squarespace, our website hosting provider, so they can provide website services to us.

You’ll receive an automated email within 24 hours after you abandon your shopping cart, if all of the following occur:

1.      You enter your email address at checkout, or are logged into your Customer Account.

2.      You add a product which is in stock to your shopping cart.

3.      You close your browser or leave this website without completing your purchase.

You can unsubscribe from these messages at the bottom of the email.

The email will link back to this website, where you can pick up where you left off and complete your purchase.

We may send you marketing emails, which you can unsubscribe from by clicking the link at the bottom of the email. We share your contact information with Squarespace & Mailchimp, our email marketing provider, so they can send these emails on our behalf.

We may email you with messages about your order or account activity. For example, we may email you to tell you that:

·        You’ve created a Customer Account

·        Your Customer Account password has been reset or updated

·        You’ve made a purchase

·        Your order has shipped

It’s not possible to unsubscribe from these messages.

We share your contact information with Squarespace, our website hosting provider, so they can send these emails to you on our behalf.

This website uses font files from Google Fonts and Adobe Fonts. To properly display this site to you, servers where the font files are stored may receive personal information about you, including:

·        Information about your browser, network, or device

·        Your IP address

When you buy something on this website, we collect personal information from you to fulfill the order. We may collect information like your:

·        Billing and shipping address

·        Details relating to your purchase (for example, your shirt size)

·        Email address

·        Name

·        Phone number

We share this information with Squarespace, our online store hosting provider, so that they can provide website services to us.

As you go through checkout, this site may auto-complete your shipping and billing address by sharing what you type with the Google Places API and returning suggestions to you to improve your checkout experience.

This website is hosted by Squarespace. Squarespace collects personal data when you visit this website, including:

·        Information about your browser, network and device

·        Web pages you visited prior to coming to this website

·        Your IP address

Squarespace needs the data to run this website, and to protect and improve its platform and services. Squarespace analyzes the data in a de-personalized form.

We only retain personal information for as long as necessary to provide a service, or to improve our services in future. While we retain this data, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification. That said, we advise that no method of electronic transmission or storage is 100% secure, and cannot guarantee absolute data security.

If you request your personal information be deleted, or where your personal information becomes no longer relevant to our operations, we will erase it from our system within a reasonable timeframe.

Changes to this policy

At our discretion, we may change our privacy policy to reflect current acceptable practices. We will take reasonable steps to let users know about changes via our website. If you are a registered user on 

www.chestnutbooks.co.uk, we will notify you using the contact details saved in your account. Your continued use of this site after any changes to this policy will be regarded as acceptance of our practices around privacy and personal information.

Your rights and responsibilities

As our user, you have the right to be informed about how your data is collected and used. You are entitled to know what data we collect about you, and how it is processed. You are entitled to correct and update any personal information about you, and to request this information be deleted. You may amend your account information at any time, using the tools provided in your account control panel.

You are entitled to restrict or object to our use of your data, while retaining the right to use your personal information for your own purposes. You have the right to opt out of data about you being used in decisions based solely on automated processing.