GROUP PRIVACY NOTICE FOR WORLD OF BOOKS AND ZIFFIT
LIST OF RECIPIENTS OF PERSONAL DATA AND INTERNATIONAL TRANSFERS OF DATA

Checkout Ltd — a company incorporated in England with registered number 08037323, whose registered office is at 54 Portland Place, London W1B 1DY, United Kingdom

We use Checkout to provide card payment services on our Websites.

—your name, address and contact information, including email address and telephone number;
—contact history and purchase history;
—your account details (username)
— your billing information, transaction information and some payment card information
—location data, including IP address, and device information

Digital Genius Limited — a company incorporated in England with registered number 09024313, whose registered office is at 2 Underwood Row, London, United Kingdom, N1 7LQ

We use Digital Genius to assist with dealing with customer queries. Digital Genius uses APIs to perform the role of a customer service operative by accessing your personal information and providing an appropriate response to your query.

—your name, address and contact information, including email address and telephone number;
—contact history and purchase history;
—your account details (username)

Hotjar UK Limited — a company incorporated in England with registered number 13462764, whose registered office is at 5 Fleet Place, London, England, EC4M 7RD

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices.

This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. We will always seek your express consent to use this technology. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

Royal Mail Group Limited — a company incorporated in England with registered number 04138203, whose registered office is at 185 Farringdon Road, London, United Kingdom, EC1A 1AA

We use Royal Mail to assist us with delivering your order.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Drop and Collect Limited trading as Collect+ — a company incorporated in England with registered number 06593233, whose registered office is at Atlantic Pavilion, Albert Dock, Liverpool, United Kingdom, L3 4AE

We use Collect+ to assist us with receiving your orders or trades on the Ziffit Website.

We act as joint controller with Collect+. You can find a link to their privacy notice here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

DPDGroup UK Ltd — a company incorporated in England with registered number 00732993, whose registered office is at Roebuck Lane, Smethwick, West Midlands, B66 1BY

We use DPD to assist us with receiving your orders or trades on the Ziffit Website.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Trustpilot A/S — a company incorporated in Denmark with registered number 30 27 65 82, whose registered office is at Pilestraede 58, 5th floor, 1112 Copenhagen, Denmark

We use Trustpilot to monitor and respond to customer reviews.

—your name, address and contact information, including email address and telephone number;
—your account details (username);
—your purchase history

Google Cloud UK Limited — a company incorporated in England with registered number 10009361, whose registered office is at 5 New Street Square, London, United Kingdom, EC4A 3TW

We use Google Cloud to host our Websites and store your personal data. Further information about Google Cloud’s services can be found here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)
— location data, if you choose to give this to us your contact history, purchase history and saved items

Microsoft Limited, trading as Bing — a company incorporated in England with registered number 01624297, whose registered office is at Microsoft Campus, Thames Valley Park, Reading, Berkshire, RG6 1WG

We use Microsoft Bing to bring you targeted advertising about our services and improve your experience on our website. To do this, we provide them with IP addresses.

—Your IP address, if you choose to allow us to collect this.
—Information about how you interact with our sites, if you choose to allow us to collect

Meta Platforms Ireland Limited, trading as Facebook — a company incorporated in Scotland with registered number SC719039, whose registered office is at 1/3 16 Deanston Drive, Glasgow, Scotland, G41 3AE

We use Facebook to bring you targeted advertising about our services and improve your experience on our website. To do this, we provide them with a list of email addresses and / or IP addresses and they confirm if they operate accounts with those email and / or IP addresses.
If the platform does not have an account with a matching address, the contract terms under which they act as our processor for this purpose does not permit them to make any further use of the address we provided.

—your name, address and contact information, including email address and telephone number;
—your account details (username)
—location data, if you choose to give this to us

HubSpot Inc. — a company incorporated in the United States of America, whose registered office is at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA

We use Hubspot to process business and charity contact information and personal data from third party suppliers in the US. Business and charity contact personal data is stored by Hubspot in accordance with their Data Processing Agreement which can be found here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Mailgun Inc — a company incorporated in the United States of America, whose registered office is at 112 East Pecan Street Suite 1135 San Antonio, TX 78205 USA

We provide Mailgun Inc with customer information including name and email address to send service emails on our behalf, for example to confirm a purchase or trade.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Where you pay for your order using a debit or credit card, third-party payment processors such as PayPal, GooglePay or ApplePay will process your personal and financial data. For example, if you choose to make payment for your order via PayPal, we will need to provide PayPal with your email address and the terms of their privacy policy will apply. Where you choose to pay using Mastercard, Mastercard will process your data in accordance with their Binding Corporate Rules (BCRs), as updated from time to time. A copy of the Mastercard BCRs is available here. You have certain third-party beneficiary rights to enforce these BCRs and you should read the BCRs carefully and contact Mastercard with any questions.

In these cases, you should read and understand each party’s privacy notice as that will apply.

Please refer to each party’s respective privacy notice

Exponea Ltd, trading as Bloomreach, — a company incorporated in England with registered number 10383607, whose registered office is at 79-81 Borough Road, London, England, SE1 1DN

We use Bloomreach to assist us with analysing your personal data to provide targeted marketing communications.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

InPost UK Limited, Unit C Boundary Park, Boundary Way, Hemel Hempstead, Hertfordshire, HP2 7GE

We use InPost UK Limited to assist us with receiving your orders of trades on the Ziffit Website and App.

Your contact details including, as applicable, name, address, postcode, phone number, email address, account number, services required, description, weights and dimensions of your parcels, unique order number, selected delivery or collection date and Automated Parcel Machine location.

AppsFlyer UK LTD, a company incorporated in England, whose registered office is located at 87-91 Newman St., London, W1T 3EY, United Kingdom

We use AppsFlyer to help us collect information and insights on customers who use our Ziffit App

—Technical identifiers such as your IP address, Android ID, Google Advertiser ID and Google Analytics ID
—Technical information such as they operating system version, WIFI status, system language and browser type.
—Engagement information which includes information about how you engage or reach our site, for example your interactions with our online adverts that direct you to our site and information about how you interact with our site once you are there.

Dovetail Research Pty. Ltd. a proprietary limited company registered in Australia with Australian Business Number (ABN) 84 615 270 025 whose registered office is Level 1, 276 Devonshire Street, Surry Hills, 2010, NSW, Australia.

We use Dovetail to store and analyse the data of customers who have taken part in customer research.

—your name, address and contact information, including email address, video conferencing username, and telephone number;
—Information relating to your purchasing preferences, social and professional background, interests
—Data may include special categories of data including race or ethnic origin, political opinions, religious or philosophical beliefs, tradeunion membership, health, sex life, and sexual orientation.

Freshworks Inc, a company incorporated in the USA whose registered office is Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403

We use Freshworks Inc to assist us with our customer services operations

—your name, address and contact information, including email address and telephone number;
—contact history and purchase history;
—your account details (username)

3CG CHANNELREPLY LLC, a company incorporated in the USA whose registered office is 16192 Coastal Highway Lewes, Delaware 19958.

We use Channel Reply to assist us with out customer services operations.

—your name and address
—contact history and purchase history;
—your marketplace account details (username). This includes for example, your amazon or ebay username when you use that account to buy a product from us.

Zoom Communications Inc. a company incorporated in the USA whose registered office is 5 ALMADEN BOULEVARD, 6TH FLOOR. SAN JOSE CA 95113

We use Zoom to undertake customer research interviews

—Video recordings of research interviews
—Zoom account identifiers which may include your email address

Mention Me Limited, incorporated and registered in England and Wales with company number 08382730 whose registered office is at 20-22 Wenlock Road, London, N1 7GU, UK.

We use Mention Me to assist us with our customer referral campaigns.

—Your Email address
—Your Name
—Your customer or Trade ID

TikTok Information Technologies UK Limited, a company registered under the laws of England with registered number 10165711 and registered address WeWork, Aviation House, 125 Kingsway, London, England, WC2B 6NH; and TikTok Technology Limited, a company incorporated under the laws of Ireland with registered number 635755 and having its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

We use TikTok to bring you targeted advertising about our services and improve your experience on our website

—Your Device ID
—Device related information (type, operating system)
—Your IP addresses
—Information on who has and hadn’t interacted with our adverts
—Pixel data – this is data that allows us to measure the effectiveness of advertising campaigns by recording the actions that you take on our websites

CHEQ AI TECHNOLOGIES (2018) LTD, a company registered in Israel whose registered office is 23, Yehuda Halevi St Tel Aviv, 65136 Israel.

We use CHEQ to provide us with security software solutions

—IP addresses

Sky TV Limited, Grant Way, Isleworth, Middx, TW7 5QD, a company incorporated and registered in England and Wales with company number 02906991

We use Sky TV Limited to provide us with advertising and web attribution services.

—IP addresses, unique user IDs, Cookie IDs, and website/app usage and marketing profiles

Belgium

Google Cloud UK Limited — a company incorporated in England with registered number 10009361, whose registered office is at 5 New Street Square, London, United Kingdom, EC4A 3TW

Web and data hosting services, ie stores a copy of your personal data on computer equipment so it can be accessed by us and permitted third parties online in order to run our business and provide services.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Germany

Digital Genius Limited — a company incorporated in England with registered number 09024313, whose registered office is at 2 Underwood Row, London, United Kingdom, N1 7LQ

Digital Genius assist us with dealing with customer queries. Digital Genius uses APIs to perform the role of a customer service operative by accessing your personal information and providing an appropriate response to your query.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Ireland, Germany and United States

Hotjar UK Limited — a company incorporated in England with registered number 13462764, whose registered office is at 5 Fleet Place, London, England, EC4M 7RD

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Standard contractual clauses

United States

HubSpot Inc. — a company incorporated in the United States of America, whose registered office is at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA

Hubspot process business and charity contact information and personal data from third party suppliers in the US. Business and charity contact personal data is stored by Hubspot in accordance with their Data Processing Agreement which can be found here.

Standard contractual clauses

Hungary

World of Books Limited

World of Books has a development team to assist the business with software development, testing and administration.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Germany

Commercetools GmbH, — a company incorporated in Germany, whose registered office is at Adams-Lehman-Str. 44 in 80979 Munich, Germany

Commercetools is a third-party e-commerce system, enabling us to manage stock, price, customer, and sale information.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

United States

Twilio Inc — a company incorporated in the United States of America, whose registered office is at 375 Beale Street, Suite 300 San Francisco, CA 94105

We use Twilio who provide the SendGrid product by processing customer information including name and email address to send service emails on our behalf, for example to confirm and purchase or trade.

Twilio’s Binding Corporate Rules

United States

Sprout Social Inc — a company incorporated in the United States of America, whose registered office is at 131 S. Dearborn St. Suite 700, Chicago, IL 60603

We use Sprout Social for social media posting and to provide insights into those who interact with our social media channels and posts.

Standard Contractual Clauses

Ireland

Checkout Ltd — a company incorporated in England with registered number 08037323, whose registered office is at 54 Portland Place, London W1B 1DY, United Kingdom

We use Checkout to provide card payment services on our Websites.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

United States

AppsFlyer UK LTD, a company incorporated in England, whose registered office is located at 87-91 Newman St., London, W1T 3EY, United Kingdom

We use AppsFlyer to helps us collect information and insights on our customers use of our products and services.

Standard Contractual Clauses

Australia

Dovetail

We use Dovetail to store and analyse the data of customers who have taken part in customer research.

Standard Contractual Clauses

United States

Freshworks Inc, a company incorporated in the USA whose registered office is Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403

We use Freshworks Inc to assist us with our customer services operations.

Standard Contractual Clauses

United States

Zoom Communications Inc. a company incorporated in the USA whose registered office is 5 ALMADEN BOULEVARD, 6TH FLOOR. SAN JOSE CA 95113

We use Zoom to undertake customer research interviews.

Standard Contractual Clauses

United States

Mention Me Limited, incorporated and registered in England and Wales with company number 08382730 whose registered office is at 20-22 Wenlock Road, London, N1 7GU, UK.

We use Mention Me to assist us with our customer referral campaigns.

Standard Contractual Clauses

Singapore
United States

TikTok Information Technologies UK Limited, a company registered under the laws of England with registered number 10165711 and registered address WeWork, Aviation House, 125 Kingsway, London, England, WC2B 6NH; and TikTok Technology Limited, a company incorporated under the laws of Ireland with registered number 635755 and having its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

We use TikTok to bring you targeted advertising about our services and improve your experience on our website.

Standard Contractual Clauses

Ireland

CHEQ AI TECHNOLOGIES (2018) LTD, a company registered in Israel whose registered office is 23, Yehuda Halevi St Tel Aviv, 65136 Israel.

We use CHEQ to provide us with security software solutions

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Ireland, United States, Germany, The Netherlands, Poland, France, and Luxembourg

Exponea Ltd, trading as Bloomreach, —a company incorporated in England with registered number 10383607, whose registered office is at 79-81 Borough Road, London, England, SE1 1DN

We use Bloomreach to assist us with analysing your personal data to provide targeted marketing communications.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018
Standard contractual clauses