Who are we? 

#SBS Small Business Sunday is committed to protecting and respecting your privacy.

This notice (together with any terms of use on our website, any contracts between us and any other documents referred to in this notice) sets out the basis on which any personal data we collect from you, that you provide to us, or that we obtain about you from other sources, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting any of our websites, or by providing us with any information about yourself, you are accepting and agreeing to the practices described in this notice.

For the purpose of and thereafter the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) as amended, supplemented or replaced from time to time (“Data Protection Law”), the data controller is Theo Paphitis Small Business Sunday Limited, with registered company number 08540787 and registered address Kindred House, `17 Hartfield Road, London, United Kingdom, SW19 3SE.

We have appointed a Data Protection Officer for the purpose of Data Protection Law who is contactable at: Sixth Floor, Kindred House, 17 Hartfield Road,  London SW19 3SE or by email at sbs@tpretailgroup.com

When do we collect information from you?

• When we contact you via Instagram or Twitter to congratulate you on your win, the #SBS Crew @thesbs_crew, asks for your email to send through all your details on how to get the most out of your win, including the #SBS Code of Conduct, the overall winner’s document, details on any relevant partner discounts and a link to the Closed Facebook group.
• When you visit the website and create an account with us 
• When you engage with us on social media, discussion boards etc. or enter prize draws or competitions or participate in surveys or polls..
• When you contact us by any means with queries, complaints etc.
• When you fill in any forms.
• When you are enrolled into the newsletter as part of winning the SBS, you are always welcome to opt out
• When you’ve given a third-party permission to share with us the information they hold about you.

What information do we collect about you (from you and from third parties)?

• Personal Identification: Personal details such as your name, address, date of birth, email address, phone number. The data could also include your age, place of birth, gender, and nationality.
• Account information: Your username, password, website, social media handles and other identifiers you use to access your account. 
• Marketing information: Your marketing preferences, open rates, click through rates on email marketing campaigns using Pixels.
• Information obtained from your interactions with us: Details of your interactions with us, your social media username if you interact with us through those channels or closed Facebook or LinkedIn groups, to help us respond to your comments, questions or feedback.
• Technical information: To deliver the best possible web experience, we collect technical information about your internet connection and browser as well as the country where your computer is located, the web pages viewed during your visit, the advertisements you clicked on, and any search terms you entered.
• Third party information: We may use personal data from other sources, such as specialist companies, media partners, retail partners and public registers (such as the electoral register). When we work with specialist companies that provide us with personal data about you, they’ll have told you about this data sharing at the time it was collected. We use this and our own data to better understand our winners. We also use this personal data to make sure we have up-to-date details about you. We don’t give personal data we’ve collected or created from you back to these companies.
• Special categories of personal data: If you provide us with any of the special categories of personal data (that is to say information as to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, sex life or sexual orientation or genetic or biometric data) 

Why do we need this information and how do we use it?

To ensure you know what is on offer as a #SBS winner

• How to create your winner profile on the #SBS website and winner’s directory
• Preferences for when we run #SBS events to ensure you can access it as you need to, and also find the content as useful as possible.
• To contact #SBS winners via the monthly #SBS newsletter
• To ensure you have all the details about key #SBS and partner offers, opportunities available as part of winning #SBS, and date of the annual #SBS event, including the agenda and content.
• To add you to closed social media #SBS groups.
• To ensure winners are upholding and meeting the #SBS code of conduct.

To deliver our services

• Better experience: We want to ensure you have a positive experience every time you engage with us, to do this we need to communicate with you about key information directly related to the service we are providing you with. We may do this via email, SMS or post.
• Winner service: Provide and manage our service relationship with you, for example, when you communicate with the #SBS Crew via social media or email.
• Winner feedback: Invite you to provide feedback on the service you have received at events, then use your feedback to understand your views on future events.

To understand you better

• Your needs: We want to ensure we’re constantly delivering the very best for you, to achieve this, we may use information to understand how our services are performing, and what changes we should make, who our winners are, and what kinds of things they like, how different groups engage with us, how to best meet and exceed your expectations etc.
• Improve our partnerships: We partner with other retail stores, companies within the TPRG group (further information provided in the privacy notice about the companies that form part of the group) etc, to provide you with offers, services that we may not directly provide but think could be useful to you. We’re always looking to understand how we can make these partnerships better.

To market relevant products & services

• Personalised marketing: We may contact you with personalised offers about products and services from our partners that we think you’ll love by email.

• Understanding & improving our marketing: We want to understand the effectiveness of our marketing, for example to know what types of winners have responded well to a particular event, or whether winners responded to an offer, so we can market the right product and services to our winners.

To manage and improve our operations

• System maintenance: To ensure that our systems and websites are helpful to engage with.
• To provide useful content to you as a business owner.

To manage safety, security, and our legal obligations

• Legal obligations: We may need to process information to comply with a legal obligation, or defend, manage, or process legal claims.

Security or other incidents

• In the unlikely event if you are involved in a safety or security incident, we collect information to allow us to investigate and record the incident.

How do we justify the collection of this information?

Data Protection Law requires us to meet at least one “legal ground” for processing, currently set out in Article 6 of the General Data Protection Regulation. The grounds applicable to the personal data to which this notice relates are:

Performance of a contract

• Where the processing is necessary for us to perform a contract that you are party to, or to take steps at your request prior to entering a contract, example we use your personal information to inform you about the terms and conditions and code of conduct in the winner pack

Legal obligation

• Where the processing is necessary for compliance with a legal obligation to which we are subject for example we need to identify you when you contact us, verify the accuracy of data that we hold about you or assist the Police and/or other regulatory bodies in relation to an investigation by a public authority. 

Consent

• If you have given your consent to our processing data for example we use email, text messages and post to communicate with you about our or our partners products and services, competitions, offers, promotions or special events.

Legitimate interest

• Where processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party. As a Company we are often required to process your personal data in order to carry out certain tasks relating to our business activities. In such cases, processing of personal data can be justified on grounds of legitimate interest.
• Communications
  • To provide winner support and to respond to, and communicate with you about your requests.
  • To contact you if we need to obtain or provide additional information.

• To check our records are right and to check every now and then that you’re happy and satisfied (e.g., winner surveys).
• For marketing activities (other than where we rely on your consent) e.g., personalising marketing messages through social media and other third-party platforms.
• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this to be able to comply with your request).
• To interact with you through social media.

• Personalise & Improve our Service
  • To personalise your experience on our online services.
  • To help us understand more about you as a winner, the products, and services you use, the way you use them and how you shop across the group.
  • Improve the content and appearance of the Website(s), and to make sure that content is presented in the most effective manner for you.
  • To operate, evaluate and improve the #SBS network, including the development of new products and services; to determine the effectiveness of our sales, marketing, and advertising; and the analysis and improvement of our products, offers, and promotions.
  • To show you relevant ads by using data collected from your devices, including your searches, location, ads that you have seen and personal information that you have given us, such as your age range, gender, and topics of interest. Depending on your Ads Settings, this data informs the ads that you see across your devices. So, if you visit our website on your computer at work, you might see ads about our products or services on your phone later that night.
  • Provide you with a seamless experience across all our services and channels. This means a more joined up winner experience whether you are online or at a physical event., including those held via a third party, or partner.

Who do we share this information with and why?

To achieve the purposes mentioned in this Privacy and Cookies Policy, we must give access to your personal data to members of the #SBS Crew and to other third parties that provide us with support or collaborate in delivering the services that we or our partners offer you.

Selected third parties including:

• Analytics and search engine providers that assist us in the improvement and optimisation of our site.
• Marketing partners to send emails on our behalf, and/or for co-branded and/or co-sponsored marketing and promotional events (such as conference events) offered in conjunction with another company or companies. If you register for or participate in such marketing and promotional events, we and the relevant partner companies may receive information collected in conjunction with the co-branded and/or co-sponsored marketing and promotional events. Our Privacy Notice will apply to our use of your personal information. We have no control over any other companies’ privacy practices, so please read their applicable privacy policy.

• If required by law, under any code of practice by which we are bound by, or we’re asked to do so by a public or regulatory authority such as the Police or the Department for Work and Pensions.
• Information may also be shared with fraud prevention agencies to prevent fraudulent claims.
• If we need to do so in order to exercise or protect our legal rights, users, systems and services.
• In response to requests from individuals (or their representatives) seeking to protect their legal rights or the rights of others.
• With emergency services (if you make an emergency call), including your approximate location.
• Companies that enable us to collect your reviews and comments, both online and offline.
• Third party vendors who help us to manage and maintain the Group IT infrastructure.
• In some cases, we may enter into partnerships or collaborations with other businesses. When such partnerships involve the sharing of personal information, we will ensure that your data is treated with the same level of care and protection as outlined in this Privacy Policy.

Additionally, we may disclose your personal information to third parties:

• If we outsource any aspect of our business or systems, then we may disclose your personal data to our service provider(s).
• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If we or a substantial part of our assets are acquired by a third party, in which case personal data held by us about our winners may be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply the terms of any agreement or policy to which we are a party, or to protect the rights, property, or safety of our business, our winners, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

How do we secure this information?

We know how important it is to protect and manage your personal data. We use technical and organisational security measures to protect the personal information supplied by you against loss, destruction, and any unauthorised access by third parties. This section sets out some of the measures we have in place:

• We make sure staff are trained and rules are in place to make sure that data is used in line with our data protection and information security policies.
• We have physical protections and digital/electronic systems in place to keep what we hold secure.
• When data is moved or transferred, we make sure it’s encrypted.
• We use computer safeguards such as firewalls and data encryption to keep this data safe when it’s not being moved.
• We only allow access to colleagues and trusted partners.
• Systems are proactively monitored for possible weaknesses, and we carry out tests (penetration testing) to see what can be improved.
• We ask for proof of identity before we share your personal data with you.
• All appropriate organisational and security measures have been implemented to prevent unauthorised access and to ensure transmission of information is secure. As information is transmitted via the internet, any transmission is at your own risk.

Where do we store this information & international transfers?

The data that we collect from you will be stored on our servers or those of our service providers in the UK/EEA. From time to time, we may transfer your personal information to our suppliers, service providers and other company offices based outside of the European Economic Area (EEA) for the purposes described in this privacy policy. 

If we do transfer information to our suppliers, agents or advisers outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. We’ll use one of these safeguards:

• We’ll transfer it to a non-EEA country with privacy laws that give the same protection as the EEA i.e., the country in question has been deemed by the European Commission to provide an adequate level of protection for personal data. Learn more on the European Commission Justice website. 
• We’ll put in place a model contract with the recipient that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website.

How long do we store the information for?

Our policy is to ensure that personal data is only stored for as long as is necessary for the purposes set out in the section titled “Why do we need this information and how do we use it?”. This may vary according to the type of information and the specific applicable purpose(s). We have a detailed data retention and destruction policy which governs the length of time for which we hold your data in personally identifiable form. The timing of our retention, anonymisation and/or destruction of your personal data is determined according to the criteria set out in that policy. We can provide you with relevant details applicable to your data on request – please see the section below to understand how to request this information.

What are your rights and how do you exercise these?

You have various rights under Data Protection Law. These include:

• The right to ask us not to process your personal data for direct marketing purposes, even if you have given consent; You can click onto the “unsubscribe” link in any communication that we send to you by email which will automatically unsubscribe you from that type of communication. Each “unsubscribe” link only relates to that specific type of communication. Please also note that you may continue to receive Service communications in relation to the product and services we have sold to you.
• If our processing is based on your consent, the right to withdraw any consent you may have given for our processing of your data – if you exercise this right, we will be required to stop such processing if consent is the sole lawful ground on which we are processing that data;
• The right to ask us for access to the data we hold about you also known as Subject Access Request;
• The right to ask us to rectify any data that we hold about you that is inaccurate or incomplete;
• The right to ask us to delete your data in certain circumstances;
• The right to ask us to restrict our processing of your data in certain circumstances;
• The right to object to our processing of your data in certain circumstances; Where we rely on our legitimate interests, as set out under “How do we justify the collection of this information?”, you may object to us using it for these purposes. If we agree that your objection is justified in accordance with your rights under data protection laws, we’ll permanently stop using your data for those purposes. Otherwise we’ll provide you with our justification as to why we need to continue using your data.
• In certain circumstances, the right to require us to give you the data we hold about you in a structured, commonly used and machine-readable format so that you can provide the data to another data controller.
• You have the right not to be subject to a decision based solely on automated processing. 

You can exercise any of the rights set out above, free of charge, by clicking here. 

In respect of certain of the rights referred to above, we may need more information from you, which we will ask you. We are required by law to confirm your identity before sharing any data with you as such please make sure you provide one proof of identity (we suggest either a utility bill in your name or your driver’s licence, but other similar formal documents may be accepted, please note the documents cannot be older than 6 months) as part of your request.

Under certain circumstances, we may be required by law to retain certain information. 

Please also note that if you submit unfounded or excessive (for example repetitive) requests to exercise any of these rights, we reserve the right to make a reasonable charge for providing the requested information or taking the requested action, or to decline your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk) if you are concerned that we are not respecting your rights under Data Protection Law. The Information Commissioner’s Office is the authority in the UK which is responsible for overseeing the application of, and enforcing, Data Protection Law.

Accessing your data

You have the right to obtain from us:

• Confirmation as to whether we are processing (including holding) personal data about you; and if we are processing personal data about you, you are entitled to be provided with:
  • Information as to the purposes for which we process the data;
  • Information as to the categories of the data that we are processing;
  • Information as to the recipients or categories of recipients to whom the data has or will be disclosed;
  • Information as to the envisaged period for which we will store the data, or the basis on which that period will be determined;
• A copy of the data (further copies are available at a reasonable charge, which we will inform you of should you request further copies). Please note that this right is subject to the rights of others in relation to their own personal data, meaning that we cannot disclose data to you if it would involve disclosing data about someone else.

Please see the section above as to how to exercise your rights under this section. Section above applies in full to the exercise of these rights.

How do we use cookies?

Our website uses cookies and similar industry standard tracking technologies (collectively “Cookies”) to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our site. For detailed information on the cookies and similar tracking technologies we use and the purposes for which we use them see our Cookie policy

Other websites

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites

Changes to this privacy notice

Any changes we make to our privacy notice in the future will be posted on this page, in case of significant changes we will email you the relevant information. 

This notice was last updated on 04-04-2023

Contact

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to #SBS 1 ST George’s Road, Wimbledon, SW19 4DR or via email to sbs@tpretailgroup.com