GROUP PRIVACY NOTICE FOR WORLD OF BOOKS AND ZIFFIT
LIST OF RECIPIENTS OF PERSONAL DATA AND INTERNATIONAL TRANSFERS OF DATA

v1.0 | 25/03/2022

keyboard_arrow_left Back to the Privacy Notice

keyboard_arrow_up Who we share your personal data with — in more detail

More details about who we share your personal data with and why are set out in the table below.

Recipient Processing operation (use) by recipient Relevant categories of personal data transferred to recipient

Checkout Ltd — a company incorporated in England with registered number 08037323, whose registered office is at 54 Portland Place, London W1B 1DY, United Kingdom

We use Checkout to provide card payment services on our Websites.

—your name, address and contact information, including email address and telephone number;
—contact history and purchase history;
—your account details (username)
— your billing information, transaction information and some payment card information
—location data, including IP address, and device information

Digital Genius Limited — a company incorporated in England with registered number 09024313, whose registered office is at 2 Underwood Row, London, United Kingdom, N1 7LQ

We use Digital Genius to assist with dealing with customer queries. Digital Genius uses APIs to perform the role of a customer service operative by accessing your personal information and providing an appropriate response to your query.

—your name, address and contact information, including email address and telephone number;
—contact history and purchase history;
—your account details (username)

Hotjar UK Limited — a company incorporated in England with registered number 13462764, whose registered office is at 5 Fleet Place, London, England, EC4M 7RD

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices.

This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. We will always seek your express consent to use this technology. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

Royal Mail Group Limited — a company incorporated in England with registered number 04138203, whose registered office is at 185 Farringdon Road, London, United Kingdom, EC1A 1AA

We use Royal Mail to assist us with delivering your order.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Drop and Collect Limited trading as Collect+ — a company incorporated in England with registered number 06593233, whose registered office is at Atlantic Pavilion, Albert Dock, Liverpool, United Kingdom, L3 4AE

We use Collect+ to assist us with receiving your orders or trades on the Ziffit Website.

We act as joint controller with Collect+. You can find a link to their privacy notice here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

DPDGroup UK Ltd — a company incorporated in England with registered number 00732993, whose registered office is at Roebuck Lane, Smethwick, West Midlands, B66 1BY

We use DPD to assist us with receiving your orders or trades on the Ziffit Website.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Trustpilot A/S — a company incorporated in Denmark with registered number 30 27 65 82, whose registered office is at Pilestraede 58, 5th floor, 1112 Copenhagen, Denmark

We use Trustpilot to monitor and respond to customer reviews.

—your name, address and contact information, including email address and telephone number;
—your account details (username);
—your purchase history

Google Cloud UK Limited — a company incorporated in England with registered number 10009361, whose registered office is at 5 New Street Square, London, United Kingdom, EC4A 3TW

We use Google Cloud to host our Websites and store your personal data. Further information about Google Cloud’s services can be found here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)
— location data, if you choose to give this to us your contact history, purchase history and saved items

Microsoft Limited, trading as Bing — a company incorporated in England with registered number 01624297, whose registered office is at Microsoft Campus, Thames Valley Park, Reading, Berkshire, RG6 1WG

We use Microsoft Bing to bring you targeted advertising about our services and improve your experience on our website. To do this, we provide them with IP addresses.

—Your IP address, if you choose to allow us to collect this.
—Information about how you interact with our sites, if you choose to allow us to collect

Meta Platforms Ireland Limited, trading as Facebook — a company incorporated in Scotland with registered number SC719039, whose registered office is at 1/3 16 Deanston Drive, Glasgow, Scotland, G41 3AE

We use Facebook to bring you targeted advertising about our services and improve your experience on our website. To do this, we provide them with a list of email addresses and / or IP addresses and they confirm if they operate accounts with those email and / or IP addresses.
If the platform does not have an account with a matching address, the contract terms under which they act as our processor for this purpose does not permit them to make any further use of the address we provided.

—your name, address and contact information, including email address and telephone number;
—your account details (username)
—location data, if you choose to give this to us

HubSpot Inc. — a company incorporated in the United States of America, whose registered office is at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA

We use Hubspot to process business and charity contact information and personal data from third party suppliers in the US. Business and charity contact personal data is stored by Hubspot in accordance with their Data Processing Agreement which can be found here.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Mailgun Inc — a company incorporated in the United States of America, whose registered office is at 112 East Pecan Street Suite 1135 San Antonio, TX 78205 USA

We provide Mailgun Inc with customer information including name and email address to send service emails on our behalf, for example to confirm a purchase or trade.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Where you pay for your order using a debit or credit card, third-party payment processors such as PayPal, GooglePay or ApplePay will process your personal and financial data. For example, if you choose to make payment for your order via PayPal, we will need to provide PayPal with your email address and the terms of their privacy policy will apply. Where you choose to pay using Mastercard, Mastercard will process your data in accordance with their Binding Corporate Rules (BCRs), as updated from time to time. A copy of the Mastercard BCRs is available here. You have certain third-party beneficiary rights to enforce these BCRs and you should read the BCRs carefully and contact Mastercard with any questions.

In these cases, you should read and understand each party’s privacy notice as that will apply.

Please refer to each party’s respective privacy notice

Red Eye International Limited — a company incorporated in England with registered number 04035064, whose registered office is at Oak House, Crewe Hall Farm, Crewe, Cheshire, CW1 5UE

We use Redeye to assist us with analysing your personal data to provide targeted marketing communications.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

Exponea Ltd, trading as Bloomreach, — a company incorporated in England with registered number 10383607, whose registered office is at 79-81 Borough Road, London, England, SE1 1DN

We use Bloomreach to assist us with analysing your personal data to provide targeted marketing communications.

—your name, address and contact information, including email address and telephone number;
—your account details (username)

InPost UK Limited, Unit C Boundary Park, Boundary Way, Hemel Hempstead, Hertfordshire, HP2 7GE

We use InPost UK Limited to assist us with receiving your orders of trades on the Ziffit Website and App.

Your contact details including, as applicable, name, address, postcode, phone number, email address, account number, services required, description, weights and dimensions of your parcels, unique order number, selected delivery or collection date and Automated Parcel Machine location.

keyboard_arrow_up International transfers of your personal data outside the UK — in more detail

More details about the countries outside the UK to which your personal data is transferred are set out in the table below.

Recipient country Recipient Processing operation (use) by recipient Lawful safeguard

Belgium

Google Cloud UK Limited — a company incorporated in England with registered number 10009361, whose registered office is at 5 New Street Square, London, United Kingdom, EC4A 3TW

Web and data hosting services, ie stores a copy of your personal data on computer equipment so it can be accessed by us and permitted third parties online in order to run our business and provide services.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Germany

Digital Genius Limited — a company incorporated in England with registered number 09024313, whose registered office is at 2 Underwood Row, London, United Kingdom, N1 7LQ

Digital Genius assist us with dealing with customer queries. Digital Genius uses APIs to perform the role of a customer service operative by accessing your personal information and providing an appropriate response to your query.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Ireland, Germany and United States

Hotjar UK Limited — a company incorporated in England with registered number 13462764, whose registered office is at 5 Fleet Place, London, England, EC4M 7RD

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Standard contractual clauses

United States

HubSpot Inc. — a company incorporated in the United States of America, whose registered office is at 25 First Street, 2nd Floor, Cambridge, MA 02141 USA

Hubspot process business and charity contact information and personal data from third party suppliers in the US. Business and charity contact personal data is stored by Hubspot in accordance with their Data Processing Agreement which can be found here.

Standard contractual clauses

Hungary

World of Books Limited

World of Books has a development team to assist the business with software development, testing and administration.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Germany

Commercetools GmbH, — a company incorporated in Germany, whose registered office is at Adams-Lehman-Str. 44 in 80979 Munich, Germany

Commercetools is a third-party e-commerce system, enabling us to manage stock, price, customer, and sale information.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

United States

Twilio Inc — a company incorporated in the United States of America, whose registered office is at 375 Beale Street, Suite 300 San Francisco, CA 94105

We use Twilio who provide the SendGrid product by processing customer information including name and email address to send service emails on our behalf, for example to confirm and purchase or trade.

Twilio’s Binding Corporate Rules

United States

Sprout Social Inc — a company incorporated in the United States of America, whose registered office is at 131 S. Dearborn St. Suite 700, Chicago, IL 60603

We use Sprout Social for social media posting and to provide insights into those who interact with our social media channels and posts.

Standard Contractual Clauses

Ireland

Checkout Ltd — a company incorporated in England with registered number 08037323, whose registered office is at 54 Portland Place, London W1B 1DY, United Kingdom

We use Checkout to provide card payment services on our Websites.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018