How we use your personal information
Here at Imagine Shisha Vaping (“Shisha Vaping”, or “we”, “us”) we pride ourselves on the importance of our customer relationships. This also extends to the way in which we handle personal information about our customers. We are committed to being transparent about the ways in which we intend to use your information, to provide you with choices about how we use it and fundamentally to ensure the security of your information.
1.1 Scope of this policy
1.2 Policy updates
2.1 Who are we?
We are Beart and Gibson Limited ( trading as Imagine Shisha Vaping), a company incorporated in England and Wales under company number 03465344, with our registered address as set out below. Beart and Gibson Limited Fletcher Way Hemel Hempstead HP2 5SE
2.2 Who’s the Data Controller?
2.3 How to contact us
The Data Protection Officer
Beart and Gibson Limited
Hemel Hempstead HP2 5SE
3.1 What types of information do we collect about you?
The types of information we collect about you depends on the nature of your interactions with us. Depending on the circumstances, we might collect any of the following types of information:
- Details about you. Your name, email address, address, telephone number, language selection.
- Details about the products you purchased with us. Your Invoice details, including any special delivery you might need from us and any other information relevant to enable us to provide you with the products or other services that you have arranged with us
- Financial information. If you are using the website to purchase products from online store, your payment details, which may include billing addresses, credit/debit card details and bank account details
- Your interactions with us or our partners. Information about your interactions or conversations with us and our people, including when you make enquiries, comments, complaints or submit feedback to us (whether formally via email or our website, over the phone or simply verbally to our people), when you get in touch via social media, when you attend any events we host or details of your preferences or attributes based on your interactions with our website or our goods or
services. In addition, we receive details of your preferences or behaviours based on your use of, or interactions with, our partners and their business offerings;
- Your use of our systems and services. Details of the way in which you use our site, app and/or social media pages (please see the “OUR SITE, APP AND COOKIES” section below for further details).
4.1 Information that you provide to us:
- When you browse our site or mobile application;
- When you purchase or search for a product or other service via our site, app or via our Customer Centre
- When you manage your invoices online
- When you contact us via email, social media, website or Live Chat
- When you ‘follow’, ‘like’, post to, or interact with our social media accounts
- When you participate in any of our competitions, promotions (for example via any social media channels or email) surveys or market research
- When you make a complaint via a third party (such as your amazon or ebay)
- When you attend any events, we might host
4.2 Information that we get from third parties, including:
- A person making a purchase on your behalf. We will receive personal information in the form of delivery details where, for instance, a family member or friend or employer who may be based inside or outside the EU makes a purchase on your behalf
- Partner agents. We will receive purchase information from partners Amazon and Ebay, together and delivery information.
- Service providers. We may collect or receive personal information from delivery agents (who may be based inside or outside the EU);
- Social media plugins. We currently use social media plugins from the following service providers who are based both inside and outside the EU: Facebook, Twitter, LinkedIn Instagram and YouTube. By providing your social media account details you are authorising that third-party provider to share with us certain information about you
- Government bodies. Where required to supply them a Government bodies may demand information on the purchases made including Customs Declaration of Content and Value.
- Referrals We might also receive information about you from third parties if you have indicated to such third party that you would like to hear from us.
5.1 For what purposes do we use your information?
We will use your information for a variety of different purposes some of which will be dependent on the services that you engage us for. This includes:
- To send you service communications and support services. We will use your information to send you any communications relevant to the services or products you have requested or purchased from us. This includes sending you an email to notify you of changes to your purchase details, schedule delivery date and the courier being used. We will also provide you with customer service and support, deal with your enquiries, complaints, comments or observations shared with us and monitor your order progress (on the basis of performing our contract with you or on the basis of our
legitimate interests to provide you with customer service)
- To send you marketing communications. We will use your information to keep you up to date with our latest news, offers and competitions, unless you have told us that you would prefer not to hear from us. We (or our partners or service providers on our behalf) may do this using analysis compiled from information we have collected from you or which we have generated about you or which we have lawfully received about you from our partners (on the basis of our legitimate interests to provide you with marketing communications where we may lawfully do so or where you have provided your consent). Please see the “MARKETING” section below for more
- To provide you with suggestions and recommendations. To share your information with selected third parties such as suppliers and partners, to enable them to contact you with information about things that may interest you.
- To process and facilitate transactions with us. We will use your information to process transactions and payments, e.g. for purchases on our online store, and to collect and recover money owed to us (on the basis of performing our contract with you and on the basis of our legitimate interest to recover debts due)
- To personalise and improve your customer experience. We will use your information to provide you with a more personalised service. For example, tailoring the communications we send to you with your preferred routes, serving you only with advertising that we think you might like (on the basis of our legitimate interests to present
you with the right kinds of products and)
- To improve our customer service. We will record calls to our call centre and/or monitor calls for the purposes of improving our customer service, ensure quality assurance, training, security and for general business purposes (on the basis of our legitimate interest in improving our customer service)
- To enable us to interact with you on social media platforms. These include Facebook, LinkedIn, Twitter, Instagram and YouTube, for example, posting status updates, responding to comments and messages, posting, ‘retweeting’ and ‘liking’ posts (on the basis of our legitimate interest in promoting our brand and communicating with interested individuals)
- To optimise our site and app. We will use your information to provide you with access to our site and application in a convenient and optimal matter, and with personalised content relevant to you, using site analytics and research and in certain circumstances combining that with other information we know about you (on the basis of our legitimate interests to operate and present an effective and convenient website to our website users)
- To ensure security and protect our business interests. We will use your information to ensure the security of our services, buildings, and people, including to protect against and investigate and deter against fraud, unauthorised or illegal activities, systems testing, maintenance and development (on the basis of our legitimate interests to operate a safe and lawful business, where we have a legal obligation to do so, for establishing exercising or defending legal claims or for reasons of substantial public interest);
- To conduct research. We will use your information to carry out aggregated and anonymised research about general engagement with our services and systems, or if you chose to participate in customer surveys, consumer focus groups and research (on the basis of our legitimate interests to improve our products, services and customer service);
- To detect fraud and unlawful activities. To protect against, investigate, and deter fraudulent, unauthorised, or illegal activity, including identity fraud and other types of unlawful conduct (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so)
- To comply with our legal obligations, policies and procedures. We will use your information to enable us to:
– Comply with our policies and procedures, and our legal obligations (for example adhering to court orders)
– To enforce our legal rights
– To protect the rights, property and safety of staff and others
This includes sharing your information with our lawyers, technical advisors, law enforcement and other regulatory bodies where necessary. Occasionally we will use your information to make decisions about what communications you would like to receive from us in order to improve your customer experience.
5.2 On what grounds will we process your information?
We will use your information for the purposes listed above, either:
- For the performance of your contract with us and the provision of our contract with you
- To comply with a legal obligation
- For our legitimate interests (we explain what we mean by this below)
- To protect your or another person’s life
- With your consent
- For establishing, exercising or defending legal claims; or
- For reasons of substantial public interest.
5.3 What do we mean by “legitimate interests”?
As outlined above, in certain circumstances we (or partners on our behalf) may use your personal information to pursue legitimate interests of our own or that of third parties, but this is provided your interests and fundamental rights do not override those interests. By “legitimate interests” we mean our interests in conducting and managing our business activities and to ensure that we are guaranteeing the best service and experience for you, our customers.
- Providing you with and improving our customer service (including sharing data with our service providers and partners for the purposes of providing you with our goods and services)
- Determining the effectiveness of our site/tools/services and improving the security and optimisation of our network, sites and services
- Personalising, enhancing, modifying or otherwise improving the services and/or communications that we provide to you, such as sending you marketing in certain circumstances, and serving you with advertising that is relevant and likely to be of interest to you;
- Detecting, monitoring and preventing fraud or other unlawful acts, and operating a safe and lawful business Where we use your information for our legitimate interests, we make sure that we take into account any potential impact that such use may have on you. We will not use your information if we believe your interests should override ours, unless we have other lawful grounds to do so (such as your consent or if we have a legal obligation). If you have any concerns about our processing please refer to details of “YOUR RIGHTS” section below.
As we outline in “YOUR RIGHTS” section below, you will have the right to object to our using your information for our legitimate interests. However, please keep in mind that your objection to this sort of processing may affect our ability to carry out the tasks that we have set out above.
6.1 Who do we share your information with?
In connection with the purposes and on the lawful grounds described above, we share your personal information with the following third parties:
- Third party providers, subcontractors and suppliers that we work with. We share your information with third party suppliers that provide us with services in connection with our business and the provision of our services to you. This includes: marketing agencies and/or companies that run our marketing or research campaigns, IT developers, service providers and hosting providers, loyalty partners and service providers, analytics service providers, third parties that manage promotions or competitions that we may run, third party software companies that provide us with applications on a white label basis, advertising providers and networks, site analytics providers, fraud detection agencies and credit card screening companies based in both inside and outside of the EU;
- Third parties for marketing. We share your information with any selected third party that you consent to our sharing your information with for marketing purposes;
- Regulators and governmental bodies. Where necessary, we share your information with regulators and governmental bodies including HM Revenue & Customs, regulators, governmental bodies and other authorities acting as processors or joint controllers based inside and outside the EU, who require reporting of processing activities in certain circumstances;
- Prospective sellers and buyers of our business. We may share your information with prospective sellers or buyers of such business or assets, only in the event that we decide to sell or buy any business or
- Courts or advisors. Any other third parties (including legal, accountants or other advisors, regulatory authorities, courts and government agencies) where necessary to enable us to enforce our legal rights, or to protect the rights, property or safety of our employees or where such disclosure may be permitted or required by law.
7. 1 When you will hear from us
We will keep you up to date with our latest news, offers and competitions if you have indicated that you are happy to receive marketing communications from us
7. 2 Opting out of marketing
If you no longer want to hear from us, you can opt-out or unsubscribe by:
- Following the unsubscribe’ link contained in any email marketing communications that you receive from us
- By contacting us using the details in the ‘ABOUT US’ section above. Third parties and marketing We might rely on third parties under contract to help us manage our marketing communications but we will not share your information with any third parties for their marketing purposes unless you agree to our doing so.
8.1 What we collect when you interact with our sites and apps
As you may already know, most sites and apps collect certain information automatically in log files about the way in which you interact with them. This includes your IP address, geographical location, device information (such as your hardware model, mobile network information, unique device identifiers), browser type, referral source, length of visit to the site or app, number of page views, the search queries you make, and similar information. This information will be collected by us or by a third party site analytics service provider and will be collected using cookies.
As we have described above, we use this information to help improve our functionality and services, run diagnostics, analyse trends, track visitor movements, gather broad demographic information and personalise our services.
8.2 What do we mean by ‘cookies’?
Cookies are small amounts of information in the form of text files, which we store on the device you use to access our site or our marketing communications. Cookies allow us to monitor your use of our services and improve them. For example, a temporary cookie is also used to keep track of your ‘session’. Without that temporary cookie, you would not be able to purchase products from our site.
change the settings on your browser or device to reject cookies. For more information about how to reject cookies using your internet browser settings please consult the ‘Help’ section of your internet browser (or visit http://www.aboutcookies.org). Please note that, if you do set your internet browser to reject cookies, you will not be able to access all of the functions of our site.
9.1 Overview of your rights
You have certain rights in respect of the personal information that we hold about you, including:
- The right to ask us not to process your information for marketing purposes
- The right to request access to the information that we hold about you
- The right to request that we correct or rectify any information that we hold about you which is out of date or incorrect
- In certain circumstances, the right to ask us to stop using information about you
- The right to withdraw your consent for our use of your information in reliance of your consent
- The right to object to our using your information on the basis of our legitimate interests (see paragraph 5.3 above for information about legitimate interests) or the legitimate interests of a third party and there is something about your particular situation which makes you want to object to us using it on this ground
- The right to receive a copy of any information we hold about you in connection (or request that we transfer this to another service provider) in a structured, commonly-used, machine readable format, in certain circumstances
- The right to ask us to limit or cease processing or erase information we hold about you in certain circumstances
- The right to lodge a complaint about us to the UK Information Commissioner’s Office (https://ico.org.uk/) or the relevant authority in your country of work or residence;
- Please note that, notwithstanding these rights, we reserve the right to retain certain information for our own record-keeping and research purposes, and to defend ourselves against any legal claims. We will also need to send you service-related communications relating to your site user account even when you have requested not to receive marketing communications.
9.2 How to exercise your rights
- Contacting us. You can exercise your rights by contacting us using the details in the “ABOUT US” section above. Or, if you wish to stop receiving marketing communications, by checking the applicable boxes on forms that we use to collect your information to tell us that you do not want to participate in marketing, clicking on the ‘unsubscribe’ link in marketing emails
- Updating your own details. Depending on the nature of your request, you may also be able to do update your details yourself. For example:
- You may update some of the details we hold about you by logging into your account and following the instructions to edit your details, or contact us to change details of your account
- Requesting information we hold about you. You are entitled to receive information we hold about you. You can submit a Subject Access Request by printing off, completing and sending in the Customer Access Request Form or write to us using the details in the ‘ABOUT US‘ section above. To help us confirm your identity and to ensure your personal data is not disclosed to anyone who does not have a right to receive it, please enclose a photocopy of your passport, or any other official document upon which your signature is present (or in the case of third party requests their official document and signature) with your request. Without this documentation, we may not be able to process your request.
- Requesting Proof of Travel. We are happy to provide Proof of Travel letters as requested. Simply submit a signed written request including the following information:
- – Your full name – including any former names by which you may have been known;
– Your full address – including any former address or addresses, atwhich you may have been resident at the time the booking was made;
– Booking reference or flight number, route and date of travel;
– A photocopy of any official document on which your name, address and usual signature appear – i.e. your Driving Licence or Passport Please send your request to us at the following address:
Customer Relations – Imagine Shisha Vaping
Fletcher Way, Hemel Hempstead, HP2 5SE
We will comply with your requests unless we have a lawful reason not to do so.
- You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated
10.1 Our service providers and suppliers
We are based within the European Economic Area (EEA). However, in certain circumstances, information that we collect about you will, during our relationship, be sent to and held by us in countries based outside of the EEA where we work with suppliers and service providers that are either based outside of the EEA, or have servers
based outside of the EEA. Countries based outside of the EEA protect information differently, and so where we do transfer your information to suppliers based outside of the EEA and countries that the European
11.1 Our security measures
We strive to constantly keep our security practices under review to ensure that we are keeping your information as safe as possible. We use a variety of different technical and operational security measures to protect your information against unauthorised access or unlawful use. By way of example we:
- Ensure the physical security of our offices, warehouses and other sites
- Ensure the physical and digital security of our equipment, devices and systems by mandating appropriate password protection, encryption and access restrictions
- Ensure that our cloud digital service and their security systems are secure by mandating appropriate password protection, encryption and access restrictions
- Are a company compliant with the Payment Card Industry Data Security Standard ‘PCI DSS’, which means high standards of security in respect of your payment information
- Ensure appropriate access controls so that access to your information is only granted to those of our people that need to use it in the course of their work
- Carry out regular penetration testing of our systems and third party reviews of our software
- Maintain internal policies and deliver data protection and confidentiality training to ensure our people also understand their responsibilities in looking after your information and commit to taking appropriate measures to enforce these responsibilities.
11.2 How you can help ensure the security of your information?
You too can play a part in helping to keep your information safe, including:
- Choosing strong passwords
- Keeping your passwords confidential, avoid sharing them with anyone else or using your password for multiple accounts
- Limiting the information you share on social media and be conscious of using public WiFi
- Ensuring that you log out of your account or profile with us after each session if you are using a shared computer
- Informing us immediately if you know or suspect that your password has been compromised, or if someone may have accessed your account
- Keeping your devices protected by ensuring that you are using the most up to date version of your operating system and have suitable anti-virus software if applicable
- Keeping alert to any fraudulent emails that, although are not, might appear to be from us.
11.3 Links to other sites and resources
We keep your information for as long as is reasonably necessary to enable us to provide you with the services that you have requested from us, to comply with any legal obligations that require us to keep information, or for as long as we reasonably require for our legitimate interests, including for example for the purposes of exercising our legal
rights or defending ourselves against claims. We operate a data retention policy and look to find ways to reduce the amount of information we hold and the length of time that we need to keep it. For example:
- We try to adopt a paperless approach wherever possible and securely destroy any paper correspondence we receive on a regular basis unless we are required to retain it for evidential or legal purposes;
- We retain a suppression lists of individuals who no longer wish to be contacted by us indefinitely. We need to keep this information to comply with their wishes not to contact them
13.1 Not happy?
However, if you wish to make a formal complaint or have concerns regarding the ways in which we use your information, you may do so by contacting the Information Commissioner’s Office (also known as the “ICO”). The ICO is an independent authority and the UK’s supervisory authority for information rights.
You can register your concerns on the ICO site