Heartlands Business Gifts Ltd trading as The Workwear Lab is responsible for deciding how and why your personal information is processed for the purposes described in this policy.

Where another organisation processes personal information on our behalf, it may act as a Data Processor. In some circumstances another organisation may be an independent Data Controller in respect of the information it receives.

We collect personal information that is reasonably required to operate our business, supply products and services and manage our relationship with customers and prospective customers.

Information you provide directly

• Your name and job title.
• Company or organisation details.
• Email address and telephone number.
• Billing and delivery addresses.
• Account login and registration details.
• Order history and product requirements.
• Artwork, logos, branding instructions and personalisation details supplied for an order.
• Quotation requests and correspondence with our team.
• Information supplied when applying for a corporate or credit account.
• Marketing preferences.

Information collected when you use our website

Depending on the technologies enabled on our website, we may collect technical and usage information such as IP address, device information, browser type, operating system, pages visited, referring pages, session information and interactions with our website.

Information obtained from other sources

We may receive information from organisations involved in processing or fulfilling your order, including payment providers, delivery partners, suppliers, business partners and fraud-prevention or verification services where appropriate.

UK data protection law requires us to have a lawful basis for processing personal information. The basis we rely upon depends on why the information is being used.

Where we rely on legitimate interests, we consider the business need for the processing alongside its potential impact on your privacy and rights.

We do not sell your personal information. We may share information where reasonably necessary to operate our business and provide products or services.

This may include:

• Payment processors and payment service providers.
• Couriers, carriers and delivery partners.
• Product suppliers and fulfilment partners where necessary to complete an order.
• Website hosting, IT, software and technical service providers.
• Professional advisers including accountants, insurers and legal advisers.
• Marketing and communications providers where appropriate.
• Fraud-prevention, security or verification providers.
• Government bodies, regulators, law-enforcement agencies or courts where disclosure is legally required.

Where an organisation processes information on our behalf, we expect appropriate contractual, organisational and security arrangements to be in place.

When you make an online payment, payment information is processed using our appointed third-party payment service provider.

The information required to authorise and process your transaction may be provided directly to that payment provider and will be handled in accordance with the provider's own security and privacy arrangements.

We may receive information relating to the status of a payment, such as confirmation that a transaction has been authorised, declined, refunded or otherwise processed, together with information needed to administer your order and financial records.

Some of the organisations that provide services to us may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we take steps intended to ensure that an appropriate level of protection is in place. Depending on the destination and circumstances, this may include relying on an adequacy regulation, approved contractual safeguards or another lawful transfer mechanism.

The exact arrangements depend on the service providers used by us from time to time.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, contractual and operational requirements.

Different types of information may therefore be kept for different periods. Factors we consider include:

• How long we need the information to provide our products and services.
• Whether you maintain an active customer or corporate account.
• Legal and accounting record-keeping requirements.
• The need to establish, exercise or defend legal claims.
• The sensitivity and volume of the information.
• Whether the information can instead be deleted or anonymised.

We use reasonable technical and organisational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include access controls, account permissions, password protection, secure systems, supplier controls, backups and staff procedures appropriate to the nature of the information and the risks involved.

No internet or electronic storage system can be guaranteed to be completely secure, but we take the protection of customer information seriously and review our arrangements as appropriate.

We may use contact information to communicate with you about products, services, offers or information that we believe may be relevant to you where we are permitted to do so.

We will distinguish marketing communications from service messages that are necessary to administer an enquiry, quotation, account or order.

You can ask us to stop sending marketing communications at any time by using an unsubscribe option included in the communication where available or by contacting Customer Support.

Withdrawing from marketing does not prevent us from sending transactional or service communications that are necessary in connection with your account or orders.

Depending on the circumstances and the legal basis for processing, UK data protection law may give you rights including:

• The right to be informed about how your information is used.
• The right to request access to personal information we hold about you.
• The right to ask us to correct inaccurate or incomplete information.
• The right to request deletion of personal information in certain circumstances.
• The right to request restriction of processing in certain circumstances.
• The right to data portability where the legal requirements apply.
• The right to object to certain processing, including direct marketing.
• The right to withdraw consent where processing is based on consent.

These rights are not absolute and exemptions may apply. We may need to confirm your identity before dealing with a request.

To exercise a right, contact us using the details shown in this Privacy Policy.

Our website may use cookies and other storage and access technologies. These can include cookies, scripts, tags, local storage and similar technologies that store information on, or access information from, your device.

These technologies may be used to operate the website, maintain security, remember preferences, understand website performance and, where enabled, support marketing or advertising activities.

Some storage and access technologies can legally be used without consent where a specific statutory exception applies and its conditions are met. Other technologies will only be used where the required permission has been obtained.

Where our website asks for your consent to use optional cookies or similar technologies, you can choose whether to allow those technologies and can change your choices using the cookie controls made available on the website.

You can also use your browser settings to block or delete cookies. Blocking certain technologies may affect the operation or functionality of parts of the website.

For technologies used under an applicable statistical or appearance/functionality exception rather than consent, we will provide the information and objection mechanism required by law where that exception applies.

If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to make a complaint to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Further information about your data protection rights and how to contact the ICO is available from the Information Commissioner's Office.

We may update this Privacy Policy from time to time to reflect changes to our services, systems, suppliers, legal requirements or the way we use personal information.

When we make changes, the revised policy will be published on this page and the last-updated date will be changed.

Where a change materially affects how we use personal information, we will take appropriate steps to bring that change to the attention of affected individuals where required.