SAMS Ltd./CCAP is committed to protecting the privacy and security of your personal information.

This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulations (GDPR).

Under the terms of the GDPR, our reason for collecting data is ‘Consent’, whereby you consent to us collecting certain personal data in order for us to effectively meet our commitments of our service collection/supplier relationship.

SAMS Ltd./CCAP is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to current and former customers. This notice does not form part of any contract to provide services. We may update this notice at any time.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data protection principles

We shall comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about; and
• Kept securely.

The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which they are identifiable. It does not include data where the identity has been removed (anonymous data).

• Information relating to any purchases you make of our services or any other transactions that you enter into through our website or via other means of communication (including your name, address, telephone number, email address).
• Information contained in or relating to any communication that you send to use through our website or via other means of communication (including the communication content and metadata associated with the communication).
• Information about your computer and about your visits to and use of the CCAP website (including length of visit, page views and website navigation paths).
• Any other personal information that you choose to send to us.

How your personal information is collected

We typically collect personal information through the customer ordering process, and via applications to deposit strains etc.

Before you disclose to us the personal information of another person, you must obtain that person’s consent to both the disclosure and the processing of that personal information in accordance with this policy.

How we shall use information about you

We shall only use your personal information when the law allows us to. Most commonly, we shall use your personal information in the following circumstances:

• Where we need to perform the commitments we have made you.
• Where we need to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests and your interests and fundamental human rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.

Examples of circumstances under which we may use your personal information

• fulfilling and shipping orders.
  collecting and registering payments from you.
• conducting data analysis to review and better understand customer needs and feedback.
• dealing with enquiries and/or complaints made by you.

You can inform us at any time if you no longer wish to receive any or specific communication from us. [Please contact us by email at DPE@sams.ac.uk, or by writing to the Data Privacy Manager.]

We shall not, without your express consent, supply your personal information to any third party for the purpose of their own, or any third parties direct marketing.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the commitments of our service collection/supplier relationship with you.

Change of Purpose

We shall only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we shall notify you and we shall explain the legal basis that allows us to do so.

Data sharing: disclosing your personal information

We may disclose your personal information to any of our officers or agents insofar as reasonably necessary for the purposes set out in this notice.

We may have to share your data with third parties, including third-party service providers. If so, we require third parties to repect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

We may disclose your personal information:

• to the extent that we are required to by law;
• in connection with any ongoing or prospective legal proceedings;
• in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk); or
• to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such authority would be reasonably likely to order disclosure of that information.

Transferring information outside the EEA

We may transfer your personal information outside of the European Economic Area (EEA) for the purposes described in this policy. If we do this, we shall do so using one of the adequate safeguards permitted by regulators for transfers of personal data outside of the EEA. 

Personal information that you submit for publication on our website may be available, via the internet, around the world. We cannot prevent its use or misuse by others.

Third party websites

Our website includes hyperlinks to, and details of, third party websites, some of which may be hosted outside of the EEA. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

Data security

We have put in place measures to protect the security of your information. Details of these measures are available upon request from our Data Privacy Manager through DPE@sams.ac.uk

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and keep it secure.

Security of personal information

We shall take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

We shall store all the personal information you provide on secure (password- and firewall-protected) servers. A third party may operate these.

Transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

Financial transactions

Website financial transactions are handled through our payment services provider. You can review their privacy policy at: PayPal We shall share information with our payment services provider only to the extent necessary for the purposes of processing payments you make via our website, refunding such payments and dealing with complaints and queries relating to such payments and refunds.

We use cookies on our website to enable the use of a shopping cart for culture/media purchase, to improve the website’s useability, and to gather analytics on website visits. Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained by cookies. [If you block cookies, you may not be able to use all the features on our website.]

Where payment is made via bank transfer, details are held by the bank on the Bank of Scotland’s secure server. We do not have access to account details of any payees paying us through the bank.

Data retention

This section sets out our data retention policies and procedure. These are designed to help ensure that we comply with our obligations in relation to the retention and deletion of personal information.

How long your information will be retained for

We shall only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal (including fraud), accounting or reporting requirements. This will generally be for no more than seven years. 

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a ‘Data Subject Access Request’, DSAR). This enables you to receive a copy of the personal information we hold about you, to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to stop processing personal information where we are relying on a legitimate interest and there is something about your particular situation that makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you tl ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party. You can exercise these rights by contacting the data privacy manager in writing, DPE@sams.ac.uk

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

Your right of access

You have the right to access your personal data held by SAMS Ltd./CCAP. If you wish to receive a copy of your personal data, please submit a Data Access Form.

Your right for data to be corrected

One of the fundamental principles underpinning data protection is that the data that SAMS Ltd./CCAP processes about you will be accurate and up to date. You have the right to have your data corrected if it is inaccurate or incomplete. If you wish to have your data rectified, you should do so by completing the Data Rectification Form.

SAMS Ltd./CCAP will respond to a data rectification request within one month. Where the data rectification request is complex, SAMS Ltd./CCAP may extend the timescale for response from one month to three months. If this is the case, SAMS Ltd./CCAP will write to you within one month of receipt of the request explaining the reason for the extension.

If the response to your request is that SAMS Ltd./CCAP will take no action, you will be informed of the reasons and of your right to complain to the Information Commissioner’s Office (ICO).

Where any data that has been rectified was disclosed to third parties in its unrectified form, SAMS Ltd./CCAP will inform the third party of the rectification where possible. SAMS Ltd./CCAP will also inform you of the third parties to whom the data was disclosed.

 

Your right to have information deleted

You have the right to have your data deleted and removed from our systems where there is no compelling business reason for SAMS Ltd./CCAP to continue to process it. If you wish to make a request for data deletion, you should complete the Data Deletion Request.

Upon receipt of a request, SAMS Ltd./CCAP will delete the data unless it is processed for SAMS Ltd./CCAP to comply with a legal requirement or in the performance of a task carried out in the public interest or exercise of official authority.

Where the data which has been deleted has been shared with third parties, SAMS Ltd./CCAP will inform those third parties where this is possible. However, where this notification will cause a disproportionate effect on SAMS Ltd./CCAP, this notification may not be carried out.

Data Privacy Manager

SAMS has appointed a Data Privacy Manager to oversee compliance with this privacy notice. If you have any questions about how we handle your personal information, please contact the Data Privacy Manager: DPE@sams.ac.uk. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Privacy Manager, through DPE@sams.ac.uk. Once we have received notification that you have withdrawn your consent, we shall no longer process your information for the purpose(s) you originally agreed to, unless we have another basis for doing so in law.

If you have any questions about this privacy notice, please contact the Data Privacy Manager, through DPE@sams.ac.uk or in writing.

Last updated: 30 May 2018