Privacy Policy

This Privacy Policy (“Privacy Policy”) explains how we collect, use and share your personal data. It also explains the rights you have over your personal data under data protection law.

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to consumer@care.perlz.co.uk, by phone on 0800 169 2891 or by writing to Customer Contact Centre using Freepost CUSTOMER CONTACT CENTRE, PO Box 8, Crewe, CW1 6GF.

1.0 - Data Collection

This Privacy Policy (together with our [Terms & Conditions ] and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the applicable data protection law, including the UK General Data Protection Regulation, and any subsequent data protection legislation, the controller of your personal data is specified below and may be Gallaher Limited (trading as JTI UK) with company registration number 01501573 with registered offices at 1 Werter Road, Putney, SW15 2LL England ("JTI”) acting as an independent controller, or Flavour Warehouse Limited with company number 08791964 with registered offices at Global Way, Darwen, Lancashire, England, BB3 0RW (“Flavour Warehouse”) acting as an independent controller, or both JTI and Flavour Warehouse acting as joint controllers (together “we”, “our”, “us”).

Where JTI and Flavour Warehouse act as joint controllers, we have entered into an arrangement under Article 26 UK GDPR which determines our respective responsibilities for compliance with data protection law. Information of this arrangement is available on request. You may exercise your data protection rights in respect of your personal data against either controller.

We do not sell products or provide services to children, nor do we market to children. If you are under the age of 18 you are not permitted to use our website, or access our products or services through any other available channel. You will need to confirm your age before you are able to purchase from perlz.co.uk when creating an account. For more information on our age verification process, please see our Age Verification Policy.

We may collect and process the following data about you:

1.1 Information you give us

Information that you provide by filling in forms on our site perlz.co.uk, or information provided to us by you via phone, e-mail or otherwise. This includes information provided at the time of registering to use our site, logging in to an account, subscribing to our service, surveys, placing an order with us, any feedback you provide to us, when you report a problem with our site, and any details of transactions you carry out through our site and of the fulfilment of your orders. This will typically include name, email, address, comments, date of birth, gender, feedback, advertising and marketing preferences opinions, your responses to market research, or competition entries. 

We do not store or have sight of payment information. For more information, please read checkout.com’s privacy notice and PayPal’s privacy policy. 

1.2 Information we collect about you

We collect information when you interact with us, including when you visit our website, visit our store or in correspondence with us. In particular, we collect the following data: 

Details of your visits to our site including the full Uniform Resource Locators (URL), but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

Internet protocol (IP) address used to connect your computer to the Internet. Including where available your IP address, operating system and browser type and time zone setting.

Cookies. Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our site. Cookies are pieces of data stored on your hard drive and, you may deactivate cookies in your web browser or clear them from your browsing data.

CCTV. We use CCTV in our premises for the prevention and detection of crime and for safety and security reasons.

If there is an incident, we log information about it

If you post information online about us or provide feedback, we keep a record of this.

1.3 - Information from Third Parties

We also work closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, analytics providers, search information providers, credit reference agencies) and may receive information about you from them. We use information available from certain third parties as detailed in this policy and please refer to their privacy policies to learn more.

We may also receive information about you (e.g. consumer account information, including name and contact details) if you use any of the other websites we operate or the other services we provide. We need this information to identify you across our different platforms to provide you with the agreed services (e.g. rewards).

2.0 - Data Use

We will only use your information where the law allows us to. Most commonly, we will use information held about you in the following ways:

2.1 - To fulfil a contract we have with you

When you buy or request something from us, we will use your information to fulfil our contract with you. This includes processing your order.

This will include, undertaking searches with third party age verification service for the purposes of verifying your identity and age. To do so other third party age verification service may check the details you supply against any particulars on any database (public or otherwise to which they have access) and may use automated processes to determine whether you may access our services. They may also use your details in the future to assist other companies for verification purposes. These processes do not produce legal or similarly significant effects beyond determining eligibility and a record of the search will be retained. For more information on our age verification process, please see our Age Verification Policy.

We will also use your data to notify you about changes to our products or service, changes to our site or others changes which might otherwise affect you.

2.2 - To pursue our legitimate interest

We may use your data where we (or a third party) have a legitimate interest and your interests and fundamental rights do not override those interests. Our legitimate interests include keeping our records up to date, working out which of our products and services may interest you, improving our site and apps, and services, developing new products and services, and telling you about them and conducting market research or certain marketing activities. To run and promote our business, we use your information

• To provide and improve our products and services and to respond to you if you contact us.
• To record communications including incoming and outgoing calls and emails, for staff training, quality improvement and establishing facts to deal with complaints or issues that you may raise.
• To provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about.
• To identify visitors to our sites including any social media platforms or online services including capturing information where you post any comments in order to contact you and to use it to improve our products or services.
• To understand you better as a customer by analysing your transactions and other information you provide to us or which we learn through your interactions with us.
• To provide you, or permit selected third parties acting on our behalf, to provide you with information about goods or services we offer which we feel may interest you. If you are an existing customer, we will only contact you by electronic means (e-mail) with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you.
• To administer our site and for internal operations, including troubleshooting, data analysis, testing, market research, statistical and survey purposes.
• To allow you to participate in interactive features of our service, when you choose to do so.

2.3 - When you consent to it

If you are a new customer, we (or selected third parties) will contact you by electronic means only where you have given your consent.

We use cookies or similar technologies on the website and in digital marketing, including analytic cookies. For more details on our use of such technologies, click here to see our Cookie Policy.

We use data for other purposes and, where this applies, we will explain the purpose at the time that we ask for your consent.

When you give consent, you are able to withdraw consent at any time by sending an email to consumer@care.perlz.co.uk, calling 0800 169 2891 or by writing to Customer Contact Centre: Freepost CUSTOMER CONTACT CENTRE, PO Box 8, Crewe, CW1 6GF, or by updating your Contact Preferences in your account. Please note it may take up to 30 days for us to process your request. If you do so we can only continue to use your data if another legal basis applies, such as when we’re required to do something by law.

2.4 - To comply with the law

When the law requires us to process your data, we will do so. This can include:

• Legal, compliance, regulatory and investigative purposes, including for government agencies and law enforcement.
• When you exercise your rights under data protection legislation, including when you ask to unsubscribe from our marketing communications.

To prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime. This may include:

• Monitoring transaction, reviewing CCTV, recording communications including incoming and outgoing calls and emails.
• Using other organisations to review information such as the validity of card/payment information and/or age verification.

To comply with the law, assess and uphold legal or contractual rights and claims, and for monitoring and auditing, This may include:

• Passing information to our insurers.
• Monitoring transactions, reviewing CCTV, recording communications including incoming and outgoing calls and emails.
• Verifying identity including age.
• Keeping records to comply with health and safety legislation. including logging incidents.

3.0 - Data Transfer

We hold your data within the United Kingdom and the European Economic Area (EEA), but we may need to transfer your personal information outside of the UK or EEA, including to international organisations. Your data may also be processed by staff operating outside the UK or EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.

Where we transfer your personal information outside the UK or EEA, we will ensure that the transfer is lawful and that appropriate safeguards are in place. This may include:

• UK adequacy regulation or an EU adequacy decision (where applicable)
  
• Standard data protection clauses adopted by the European Commission together with the UK Addendum, or the UK International Data Transfer Agreement (IDTA)
• Where you have given explicit consent to the proposed transfer, after having been informed of the possible risks of such transfer in the absence of adequate safeguards.
• Where the transfer is necessary for the conclusion or performance of a contract between us, or in your interest.
  
  

4.0 - Data Security and Retention

All information you provide to us is stored on our secure servers. We use reasonable efforts to ensure that data is accurate, complete, current and reliable for its intended use. We use appropriate technical and organisational measures and safeguards to help protect your personal data from unauthorised access, misuse, alteration or loss, which will include but is not limited to: Physical measures such as locking away of confidential material and IT equipment, secure offices, key card access etc., and I.T. measures such as password access to hardware and systems. Our internal policies and procedures are designed to help ensure we safeguard the privacy and accuracy of all data we collect or process. To the extent that we disclose personal data to clients or third parties, we request that they properly protect the security and confidentiality of such information and otherwise process such data in accordance with applicable law.

Any payment transactions will be made using checkout.com or PayPal.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

We will keep your personal data only as long as necessary for the purpose for which it was collected, including to meet legal, financial, or reporting requirements, after which it will be destroyed if it is no longer required. CCTV data is typically stored for a period of up to 30 days unless required for longer due to an incident.

5.0 - Links to Other Websites

Our site may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over other websites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Privacy Policy. You should exercise caution and read the Privacy Policy applicable to the website in question before proceeding to use that website.

6.0 - Disclosure of Your Information

We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006. Any such disclosure will only be so that we can process your personal data for the purposes set out in this Privacy Policy.

We may share your information with third parties including:

• Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
• Our suppliers, reward partners, and sub-contractors that help us deliver you our marketing and any rewards schemes and contact you about products that might be of interest to you.
• Analytics and search engine providers that assist us in the improvement and optimisation of our site.
• In the event of an acquisition or sale.
• To external professional advisors such as accountants, bankers, insurers, auditors, and lawyers. 

7.0 - Your Rights

This policy provides you with information about how we use your data. You have the right to:

• Right of access – to obtain access to your personal data (including for the purpose of portability and transfer to another entity) and information on how we process it. 
• Right of rectification - to have your data updated or corrected if it is inaccurate or incomplete.
• Right to restrict processing - to request that we limit how we process your personal data.
• Right to withdraw consent - to withdraw consent that has previously been provided. 
• Right to erasure - To request the deletion of your personal data, subject to certain exemptions. When asked to delete your personal data from our database, we will retain minimal information to ensure we do not contact you or collect such information again. Whilst every effort will be made to not contact you under these circumstances, where your information is available from a third party we cannot guarantee this.
• Right to object – to object to the processing of your personal data, including for direct marketing purposes or where we rely on legitimate interests. 
• Right to lodge a complaint – you also have the right to complain to us if you consider that there has been an infringement of your rights in relation to your personal data. You can submit a complaint via email on consumer@care.perlz.co.uk, via phone using 0800 169 2891, or post addressed to Customer Contact Centre, PO Box 8, Crewe, CW1 6GF. When we receive a data protection complaint, we will acknowledge receipt no later than 30 days from receiving it, take appropriate steps to respond without undue delay, which may include making enquiries into the subject matter of the complaint and, where appropriate, keeping you informed about the progress of our handling of the complaint, and inform you of the outcome without undue delay. You also have the right to make a complaint to the Information Commissioner's Office (ICO), whose contact details are available from the ICO's website (www.ico.or.uk). The ICO is the authority in the UK which is tasked with the protection of personal data and privacy. 

8.0 - Statement Updates

We may occasionally update this statement and any updates we make to our privacy statement in the future will be posted on this page.