PRIVACY POLICY

All the details on how we protect and use the information you provide us.

This privacy policy applies to use of www.hotchpotchlondon.com (the “Website”) and any products, services and material of any kind available through the Website. We are committed to respecting the privacy rights of our visitors and this policy explains how we collect, store and use personal data when you visit the Website. It provides details about the types of personal data we collect from you, how we use that personal data and the right you have to control our use of your personal data.

  • “Data Protection Legislation” shall mean the General Data Protection Regulation and any legislation implemented in connection with the General Data Protection regulation and any replacement legislation coming into effect from time to time.

  • “General Data Protection Regulation” (“GDPR”) shall mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

  • “Personal Data” shall mean any information relating to an identified or identifiable individual;

  • “Carte Blanche” shall mean all Companies who are part of the Carte Blanche Group, including but not limited to, Carte Blanche Greetings Limited and Is It Art Limited.

Collecting & Using Information

We are the controller of personal data obtained via our website, meaning we are the organisation legally responsible for deciding how and for what purposes it is used. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals in the European Economic Area (EEA).

We always look to provide the best possible service to you, our customer, we may need to collect personal data to do so. When handling this kind of personal data, we promise to keep all personal data safe and secure, and to always respect your privacy. Our privacy policy explains exactly how we handle and process personal data when you use our website.

What information about you do we collect?

The type of Personal Data we may collect and the purposes for which it is processed are set out below

  • Username & Password

  • First Name and Surname

  • Date of Birth

  • Billing and delivery addresses, email addresses & telephone number(s)

  • Payment method

  • Correspondence with and from Hotchpotch

  • Your preference about receiving communication from Hotchpotch

  • Information about your use of Hotchpotch, and your browsing and online purchasing activities.

How do we use your personal information?

Your personal data will be collected, processed, stored, and used by us. When you place an order with us you agree to our terms and conditions. We need to process certain data to allow us to:

  • Despatch the goods that you have ordered in accordance with our agreement

  • To associate your account and your product purchases with you and to verify your identity

  • To tailor aspects of Hotchpotch to you

  • To process payments you make for goods

  • To pass your product order for delivery by a third party, arranged by us

  • To provide customer support and improve your customer experience

  • To contact you by email or telephone in relation to the products you have purchased

  • Administration, support, improvement and development of Carte Blanche / Hotchpotch business generally

  • Marketing of new product ranges sold by Carte Blanche / Hotchpotch

How your personal data is collected

We collect this personal data directly from you via our website. We may also collect personal data from cookies on our website.

How and why we use your personal data

Create & manage an account with us- To perform our contact with you or to take steps at your request before entering into a contract
Providing products to you- To perform our contract with you or to take steps at your request before entering into a contract

Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us- For our legitimate interests or those of a third party, ie to minimise fraud that could be damaging for you and/or us

To enforce legal rights or defend or undertake legal proceedings- Depending on the circumstances: to comply with our legal and regulatory obligations. In other cases, for our legitimate interests or those of a third party, ie to protect our business, interests and rights or those of others

Retaining and evaluating information on your recent visits to our website and how you move around different sections of our website for analytics purposes. This helps us to understand how people use our website so that we can make it more intuitive or to check our website is working as intended- Depending on the circumstances: your consent as gathered by the separate cookies tool on our website, see ‘Cookies’ below; where we are not required to obtain your consent and do not do so, for our legitimate interests or those of a third party, ie to be as efficient as we can so we can deliver the best service to you at the best price

Communications with you not related to marketing, including about changes to our terms or policies or changes to the products or other important notices-Depending on the circumstances: To comply with our legal and regulatory obligations; in other cases, for our legitimate interests or those of a third party, ie to be as efficient as we can so we can deliver the best service to you at the best price.

Marketing our services to existing and former customers-For our legitimate interests or those of a third party, ie to promote our business to existing and former customers See ‘Marketing’ below for further information.

To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary-Depending on the circumstances: to comply with our legal and regulatory obligations; in other cases, for our legitimate interests or those of a third party, ie to protect, realise or grow the value in our business and assets.

Marketing

We may use your personal data to send you updates (by email, text message, telephone or post) about our products, including exclusive offers, promotions or new products.

You will be given an opportunity to tell Carte Blanche whether you wish to receive direct marketing materials and communications from Carte Blanche at the time that you provide Personal Data to Carte Blanche. This is not compulsory, and you are able to opt out at any time, by contacting us or using the 'unsubscribe' link in emails.

You acknowledge that it is within the legitimate interests of Carte Blanche to obtain, record and use Personal Data in connection with any orders placed.

How long your personal data will be kept

We will not keep your personal data for longer than we need it for the purpose for which it is used

Personal Data will be held for 7 years when an order has been placed to meet legal and regulatory obligations, such as addresses on invoices retained for HMRC requirements.

If no orders have been placed, we will look to remove your data within 5 working days.

Who we share your data with?

We routinely share personal data with:

• other members of the Carte Blanche group of companies;

• third parties we use to help deliver our products to you, eg payment service providers, warehouses and delivery companies; and

• other third parties we use to help us run our business, eg marketing agencies or website hosts and website analytics providers. We or the third parties mentioned above may occasionally also need to share personal data with:

• external auditors, eg in relation to the audit of our accounts, in which case the recipient of the information will be bound by confidentiality obligations

• professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations

• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations

• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

Transferring your personal data out of the UK

It is sometimes necessary for us to share your personal data to countries outside the UK and EEA. In those cases we will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.

Under data protection laws, we can only transfer your personal data to a country outside the UK or EEA where:

  • in the case of transfers subject to UK data protection law, the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR;

  • in the case of transfers subject to EEA data protection laws, the European Commission has decided that the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy decision’) further to Article 45 of the EU GDPR;

  • there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or

  • a specific exception applies under relevant data protection law. Where we transfer your personal data outside the UK we do so on the basis of an adequacy regulation or (where such is not available) ensure a legally compliant method of transfer is in place. We will not share any information with any third party outside the Carte Blanche Group without your consent. Where Carte Blanche transfers Personal Data to third parties to enable them to process it on Carte Blanche's behalf, it will ensure that the providers meet or exceed the relevant legal or regulatory requirements for transferring data to them and keeping it secure. Where Personal Data is transferred to a country or international organisation outside of the UK / EEA, it will also comply with the relevant legal rules governing such transfers. If you would like more information about who we share our data with and why, please contact us (see ‘Contact us’ below).For instance, we will share your data with our payment partner for payment of goods to be processed. We do not retain any payment information other than the shipping address.

Where Carte Blanche transfers Personal Data to third parties to enable them to process it on Carte Blanche's behalf, it will ensure that the providers meet or exceed the relevant legal or regulatory requirements for transferring data to them and keeping it secure. Where Personal Data is transferred to a country or international organisation outside of the UK / EEA, it will also comply with the relevant legal rules governing such transfers.

If you would like more information about who we share our data with and why, please contact us (see contact page). For instance, we will share your data with our payment partner for payment of goods to be processed. We do not retain any payment information other than the shipping address.

Security of your data

It is of utmost importance to us that the security of your information is to a high standard. This is why we use unique names and passwords for registration. You are responsible for ensuring that your password is known only to yourself. Whilst we do not guarantee that your information will not be accessed, altered, or destroyed by outside sources, we make sure your privacy is as secure as possible from breaches. If your information is breached, we will notify our customers via email as soon as possible to inform you about the situation.

Your Rights

You have certain rights in relation to your Personal Data, although those rights will not apply in all cases or to all Personal Data that Carte Blanche holds. For example, Carte Blanche may need to continue to hold and process Personal Data to establish, exercise or defend its legal rights. Alternatively, the rights may not be enforceable until the General Data Protection Regulation comes into force. You may have the right to request that Carte Blanche / Hotchpotch.

  • Provides a copy of Personal Data that it holds

  • Updates Personal Data where it is out-of-date or incorrect

  • Deletes personal information that it holds

  • Restricts the way in which Carte Blanche process Personal Data

  • Considers any valid objections to its processing of the Reseller's Personal Data

These rights, which you may exercise free of charge, are set out below:

Access to a copy of your personal data-The right to be provided with a copy of your personal data.

Correction (also known as rectification)-The right to require us to correct any mistakes in your personal data

Erasure (also known as the right to be forgotten)-The right to require us to delete your personal data—in certain situations

Restriction of use-The right to require us to restrict use of your personal data in certain circumstances, eg if you contest the accuracy of the data

Data portability-The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations

To object to use-The right to object:At any time to your personal data being used for direct marketing (including profiling); In certain other situations to our continued use of your personal data, eg where we use your personal data for our legitimate interests.

Not to be subject to decisions without human involvement-The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. We do not make any such decisions based on data collected by our website.

Carte Blanche will respond to any request from the you (including providing information on whether the rights apply in the circumstances) within the applicable statutory time period.

If you would like to exercise any of those rights, please email, call or write to us (see contact page for contact details)

When contacting us please:

• provide enough information to identify yourself (eg your full name, address and customer or matter reference number) and any additional identity information we may reasonably request from you; and • let us know which right(s) you want to exercise and the information to which your request relates.

Analytics

We may collect analytics data which helps us track traffic and usage of our website. The information collected includes browser device, page visits, visit duration and other information. We use this to improve our website and the ease of use. This information is collected and aggregated so that an individual user’s data is not used singularly.

What happens in the event of a change of control?

We may sell/transfer the company or any combination of its products, services, assets and/or businesses. Your information such as customer names and email addresses, user Content and other user information we might hold may be among the items sold or otherwise transferred in these types of transactions. This would be for your benefit, meaning you will not have to register your details with the site in the case of this happening. We may also sell, assign or otherwise transfer such information during corporate divestitures, mergers, acquisitions, bankruptcies, dissolutions, reorganisations, liquidations, similar transactions or proceedings involving all or a portion of the company.

Instances where we are required to share your information

We will disclose your information where required to do so by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce our Terms of Use or to protect the security, quality or integrity of our service; and/or (c) to exercise or protect the rights, property, or personal safety of our users, or orders.

Your choices about your information

You may update and edit your account information and email-communication preferences at any time by logging in to your account and changing your settings. You can also stop receiving promotional email communications from us if you wish to do so. Please allow 10 working days for data to be removed.

We make every effort to process all unsubscribe requests on a prompt basis. As noted above, you may not opt out of Service-related communications (e.g. account verification, purchase and billing confirmations and reminders, changes/updates to features of the Service, technical and security notices).

If you have any questions on how your data is being used, then please get in touch via our contact page.

Tracking

Please refer to your mobile device or browser’s technical information for instructions on how to delete and disable cookies, and other tracking/recording tools. Depending on your type of device, it may not be possible to delete or disable tracking mechanisms on your mobile device. Note that disabling cookies and/or other tracking tools prevents Hotchpotch from tracking your browser’s activities in relation to the Service, and for use in targeted advertising activities by third parties. However, doing so may disable many of the features available through the Service.

Marketing Preferences

You will be asked whether you want to receive marketing communication from us at the point of purchase. You can change your marketing preference at any time by going to your account page. Alternatively, you can unsubscribe from communication through the ‘unsubscribe’ link at the bottom of emails.

When you place an order with us, but do not opt in to receive marketing communications we will still contact your if there is important information to tell you about your account, your order, delivery, or personal data.

You may update and edit your account information and email-communication preferences at any time by logging in to your account and changing your settings. You can also stop receiving promotional email communications from us if you wish to do so. We make every effort to process all unsubscribe requests on a prompt basis. As noted above, you may not opt out of Service-related communications (e.g., account verification, purchase and billing confirmations and reminders, changes/updates to features of the Service, technical and security notices).

If you have any questions on how your data is being used, then please contact us.

Children's Privacy

We do not knowingly collect or solicit any information from anyone under the age of 16 or knowingly allow such persons to register as Users. The Service and its content are not directed at children under the age of 16. If we learn that we have collected personal information from a child under age 16 without verification of parental consent, we will delete that information as quickly as possible.

Links to other websites and services

We are not responsible for websites who link to us or may be linked to from our website. The content and validity of their website is their own responsibility. Our privacy policy applies only to Hotchpotch and the details within the policy will not apply if you move from our site to a third-party website. We do not condone or vouch for a third-party website by linking to it.

Phishing Emails & Calls

Phishing is the process of gaining someone’s personal data illegitimately. This is often done by email and telephone, with the phisher claiming to be from an official or legitimate source. Never share your personal information with someone claiming to be from us. If we need to legitimately contact you regarding your payment method or delivery (for example), we will ask you to call. If you believe someone is attempting to deceive you into passing your personal data over, please let us know as soon as possible. If you would like to learn more about phishing, please see the Action Fraud website.

Contact Us

If you have any questions on this policy, please feel free to get in touch through our contact page or e-mail GDPRenquiries@cbg.co.uk

We have appointed Paper Kisses Limited, based in Ireland to be our data protection representative within the EEA. Their contact details are info@paperkisses.ie. Individuals within the EEA can contact us direct (see above) or contact our European representative.

Complaints

Please contact us if you have any queries or concerns about our use of your information (see below contact page). We hope we will be able to resolve any issues you may have.

Complaints may be made

  • to the Information Commissioner's Office at www.ico.org.uk

  • you can contact us directly through our contact page

  • A relevant data protection supervisory authority in the EEA state of your habitual residence, place of work or of an alleged infringement of data protection laws in the EEA.