Under data protection law, we can only use your personal data if we have a proper reason, eg:

where you have given consent;
to comply with our legal and regulatory obligations;
for the performance of a contract with you or to take steps at your request before entering into a contract; or.
for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Providing products and services to you	To perform our contract with you or to take steps at your request before entering into a contract
Preventing and detecting fraud against you or us	For our legitimate interest, ie to minimise fraud that could be damaging for you and/or us
To enforce legal rights or defend or undertake legal proceedings	Depending on the circumstances: —to comply with our legal and regulatory obligations; —in other cases, for our legitimate interests, ie to protect our business, interests and rights
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies	To comply with our legal and regulatory obligations
Ensuring business policies are adhered to, eg policies covering security and internet use	For our legitimate interests, ie to make sure we are following our own internal procedures so we can deliver the best service to you
Operational reasons, such as improving efficiency, training and quality control	For our legitimate interests , ie to be as efficient as we can so we can deliver the best service to you
Ensuring the confidentiality of commercially sensitive information	Depending on the circumstances: —for our legitimate interests, ie to protect trade secrets and other commercially valuable information; —to comply with our legal and regulatory obligations
Statistical analysis to help us manage our business, eg in relation to our financial performance, customer base, product range or other efficiency measures	For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you
Preventing unauthorised access and modifications to systems	Depending on the circumstances: —for our legitimate interests, ie to prevent and detect criminal activity that could be damaging for you and/or us; —to comply with our legal and regulatory obligations
Protecting the security of systems and data used to provide our products and services	To comply with our legal and regulatory obligations We may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests, ie to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us
Updating and enhancing customer records	Depending on the circumstances: —to perform our contract with you or to take steps at your request before entering into a contract; —to comply with our legal and regulatory obligations; —for our legitimate interests, eg making sure that we can keep in touch with our customers about existing orders and new products
Statutory returns	To comply with our legal and regulatory obligations
Marketing our products and services to: —existing and former customers; —third parties who have previously expressed an interest in our products and services;	For our legitimate interests, ie to promote our products and services to potential, existing and former customers or where we have obtained your express consent.
External audits and quality checks, eg for ISO and B Corp and the audit of our accounts	Depending on the circumstances: —for our legitimate interests, ie to maintain our accreditations so we can demonstrate we operate at the highest standards; —to comply with our legal and regulatory obligations
To share your personal data with members of our group and third parties that will or may take control or ownership of some or all of our business (and professional advisors acting on our or their behalf) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary	Depending on the circumstances: —to comply with our legal and regulatory obligations; —in other cases, for our legitimate interests, ie to protect, realise or grow the value in our business and assets

Privacy Notice