LUDICROUS PRINTS PRIVACY POLICY

PROTECTING YOUR PERSONAL DATA (INFORMATION ABOUT YOU)
“LUDICROUS PRINTS” (“we” or “our” or “us”) know that you care how information about you is used and shared and we appreciate your trust in us to do that carefully and sensibly. This notice describes our privacy policy, sets out what information we collect from you, how we process that information, how long it’s kept for who we may disclose it to and what rights you have over your data.
YOUR RIGHTS
From the 25th of May 2018, the EU General Data Protection Regulations (GDPR) is introduced alongside UK Privacy Law. This gives you new rights in relation to the privacy of your personal information. GDPR simply put means that you have more control over how your personal information is used and makes it quicker and easier for you to check and update the information we hold on you.

You can request details on your personal data kept by us at any time. In the case of any request involving one of your rights (described below), we will respond to your request without delay and at most, within one month of receipt of your request. We are permitted to extend this time period by up to two months if your request is a particularly complex one.

OUR LEGAL BASIS
Ludicrous Prints has chosen ‘Legitimate interests’ as our legal basis unless otherwise stated. We rely on this basis when processing someone’s personal data so that we can;
• use your data in a way you would reasonably expect and which has minimal privacy impact, or where there is a compelling justification for the processing.
• Make sure we are pursuing a legitimate interest. Process information for a necessary purpose and if your interests override the legitimate interests.

INFORMATION WE COLLECT FROM YOU
We use the EU General Data Protection Regulation’s definition of personal data. This is any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such:

• Name or contact details
• Address
• Location Data
• Personal Identification Number
• Website, apps or software identifiers
• IP address
• CCTV footage on an individual

HOW WE STORE YOUR PERSONAL INFORMATION
We store information on you in a number of ways. We have taken great precautions to keep your information secure.
We use physical, technological and administrative safeguards to protect your personal information. All physical files and computer-based data are stored in secure locations, where use of alarms, locks, passwords and encrypted hardware and software are used in order to protect any personal data we hold about you.

HOW WE USE YOUR INFORMATION
The personal data we hold on you will be used in the following ways:
• Contact information including but not limited to; Name, address, email, telephone number and company details, will be used to correspond with yourselves regarding the processing and completion of the order. This information will be held for six months after the completion of the order.
• Financial information including but not limited to; Bank account details, payments and invoices, will be used to pay or receive payment and be held for up to seven years after the date. We rely on legitimate following HMRC’s rules and regulations on holding financial records. All data is kept on a secure encrypted server. However most, if not all of the financial information will be processed via Etsy and PayPal. Please make sure you read their privacy policies if you have any concerns.
• Contracts will be used to fulfil our contractual obligation to you, or you to us and will be retained for 12 months.

DATA SHARING
We may disclose your personal information to members of our staff whereby process your data on our behalf.
In addition we may share your details to a third party with your prior consent (for example, through online shopping sites you have signed up to when buying our products)
We may also share your personal data in order to comply with any legal obligations.

We may need to contact you regarding our legitimate interest with you using other means than face to face. Companies we use and where you can find their Privacy Policies are:
• The Royal Mail: https://www.royalmail.com/privacy-notice
• Microsoft Outlook 365 Email: https://privacy.microsoft.com/en-gb/privacystatement
• 3 Mobile: http://www.three.co.uk/mobile/Privacy_Cookies/Your_privacy
• Virgin Phone and Broadband: https://www.virgin.com/privacy-policy
• Etsy: https://www.etsy.com/uk/legal/privacy/
• Paypal: https://www.paypal.com/en/webapps/mpp/ua/privacy-full
• Gmail: https://policies.google.com/privacy
• Tumblr: https://www.tumblr.com/privacy/en_eu
• Facebook: https://www.facebook.com/policy.php
• Twitter: https://twitter.com/en/privacy
• Instagram: https://help.instagram.com/196883487377501
Ludicrous Prints does not accept responsibility or liability for the practices of such third party companies and we encourage anyone using them to carefully check their privacy statements.

DISPOSING OF YOUR DATA
When our data retention expires any physical data collected on you will be permanently destroyed using a GDPR compliant shredding company. All electronic data held on you will also be permanently deleted.

RIGHT TO BE INFORMED
Articles 13 and 14 of the GDPR specify that it is your right to be informed about how we collect and use your personal data. We have tried to make it as transparent as possible in our Privacy Policy about how we do this, in a way that is clear, concise and easily accessible. If the way we collect, store, use and retain your data changes you will be informed of this within one month of any policy alterations.

RIGHT OF ACCESS
You have a right to access the data we hold about you. Subject Access Requests give you the right to ask us to provide you with this information free of charge. Any Subject Access request can be made verbally or in writing to the Data Controller (Address and information in our contact information below)

RIGHT TO RECTIFICATION
You are entitled to have any information that we hold about you rectified if it is inaccurate or incomplete.
If you believe that the information we hold about you is inaccurate, incomplete or out of date then please let the Data Controller know, either verbally or in writing. We shall also inform any third parties of the rectification in order that they can update their records too.
We endeavour to rectify any incorrect information about you within one month of your request.

THE RIGHT TO ERASURE
You have the right to request that we delete the personal information we hold about you where we have no compelling or legitimate business reason for its continued processing. We will also inform any third parties of the request in order that they can erase their records too. Erasure request can be sent to the Data Controller.
This right will only apply if:
• The retention of the personal data is no longer necessary for the purpose which we originally collected or processed it for.
• Where you have withdrawn consent.
• Where you object to us processing the data and there is no overriding legitimate interest for us to continue to do so.
• When the data has been unlawfully processed.
• When we have to do it to comply with a legal obligation; or
• We have processed the personal data to offer information society services to a child.
The right will not apply if:
• We are exercising the right of freedom of expression and information;
• We are complying with a legal obligation
• For archiving data in the public interest, scientific research, historical research or statistical purposes.
• We need the data to exercise or defend any legal claims.
Ludicrous Prints will refuse to comply with a request for erasure if it is manifestly unfounded, excessive or repetitive in nature and may request a ‘reasonable fee’ to do so.

THE RIGHT TO RESTRIC PROCESSING
You have a right to request that information we hold about you is restricted or suspended. This may be due to exercising one of your other rights, where until your request has been dealt with we will suspend the processing of your data. We will inform any third party we have passed your information on to, to restrict processing your data. Restriction requests can be made verbally or in writing to the data controller. We will respond to your request within one month.

THE RIGHT TO DATA PORTABILITY
Information you have provided to us can be supplied to you in a portable format if requested. The format we supply your information will be posted as a printed document or .txt file via email. The right to data portability requests should be sent to our Data Controller. We will respond to your request within one month.

THE RIGHT TO OBJECT
You have a right to object how we use your personal information. You can make a verbal or written request to our Data Controller who will respond within one month. We may however continue processing your information if we can show we have compelling and legitimate grounds to do so that overrides your reasons. We will inform you of this decision however you maintain the right to make a complaint to the Information Commissioners Office.

RIGHTS IN RELATION TO AUTOMATED DECISION MAKING AND PROFILING
Ludicrous Prints do not profile or make automated decisions. If you feel we have done this please contact the Data Controller.

FRAUD PREVENTION
We may also exchange your information with other companies and organisations for the purposes of fraud protection and credit risk reduction. Where false information or fraud is suspected, we may pass this information to fraud prevention and law enforcement agencies.

RETENTION OF DATA
We retain your information for as long as we are working together. This enables us to maintain an on going relationship with you and allows us to complete the orders that you place with us. We follow a strict data retention schedule; this is has been put in place to ensure that we retain the minimum amount of personal data about you.

Any financial data we have on you, in accordance with HMRC will be retained for a maximum of 6 years. This information is kept on a secure and encrypted server that is only accessible by our Director and Accounts team.

WEBSITE PRIVACY
We use Tumblr and Etsy to run our online platforms. Their privacy policies are listed above in the section ‘Data Sharing’.

USE OF OUR SERVICES BY CHILDREN
Our company and our website is not intended for the use of children under the age of 16. We ask that children do not provide us with any of their personal information via email, post, telephone, social media pages or website unless they have express permission from a parent or guardian to do so. If we become aware that we have collected personal information from a child under the age of sixteen without prior consent from an adult, then we will delete that data from our records immediately.

SOCIAL MEDIA
We may from time to time advertise our business on Social Media such as Twitter, Facebook, Google+ and Instagram; along with images of works carried out, which could include yours. We do not publish your personal details on these posts. If you contact us via Social Media, we will only use your data for what it is intended, for example; you’ve requested a quote on a job or information on our company. We will only keep your information to follow through with the request and for any legitimate business reasons.

DIRECT MARKETING COMMUNICATIONS
We have never and don’t plan on directly marketing our services via email, post or telephone. We will only ever contact you regarding advertising our business to inform you of changes to our Privacy Policy that affect your personal data. If a decision is made to directly market our services you will be given the opportunity to opt-in and opt-out at any time.

ANONIMTY
Ludicrous Prints will respect a persons wish to remain anonymous however we will still need to process some of your data.

FINDING OUT MORE ABOUT YOUR RIGHTS UNDER GDPR
You can find out more about your rights here: https://ico.org.uk/

CONTACT AND COMPLAINTS
If you have any further questions about our updated Privacy Policy, the way in which we process your data or suspect a breach of your personal data and wish to lodge a complaint, please do not hesitate to contact us by emailing: ludicrousprints@gmail.com
or alternatively please write to:
The Data Controller
Ludicrous Prints, 39 Newbolt Avenue, SUTTON, SM3 8ED