We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on (i) who we are and (ii) how and why we collect, store, use and share your personal information. It also explains the rights that you have and how to contact us, or our supervisory authority, in the event that you have a complaint.
We collect, use and are responsible for certain personal information about you. As such, we are subject to the General Data Protection Regulation (the GDPR), which applies across the European Union (including in the United Kingdom) and we are responsible as a ‘controller’ of that personal information for the purposes of the GDPR.

KEY TERMS
In this policy:

we or us:
means Leona Hussey a sole trader, trading as LFH Digital whose business address is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (and our will be construed accordingly).

personal information:
means information relating to an identified or identifiable individual.

special category personal information:
means personal information revealing (i) racial or ethnic origin (ii) political opinions (iii) religious beliefs (iv) philosophical beliefs (v) trade union membership (vi) genetic and biometric data and (vii) data concerning health, sex life or sexual orientation.

2 CUSTOMER PERSONAL INFORMATION
If you are one of our customers, we may collect and use the following personal information about you:
a) your name and contact information including (without limitation) your email address, telephone number, fax number, delivery address and billing address;
b) information to enable us to check and verify your identity (e.g. your date of birth);
c) your billing information, transaction, VAT (where required) and payment card information;
d) any further relevant delivery information, to enable us to deliver our products to you; and
e) information about how you use our website, through the use of cookies, IT, communication and other systems.

We may also collect personal information about you, that cannot be used to personally identify you, for your reference, this would include:
a) anonymous usage data;
b) general demographic information; and
c) browsing information (i.e. URLs, platform types and preferences based on clicks).
This personal information is required to provide our products and services to you. If you do not provide the personal information that we ask for, it may delay or prevent us from providing our products and services to you.

3 SUPPLIERS AND PRINTERS PERSONAL INFORMATION
If you are one of our suppliers, we may collect and use the following personal information about you:
a) your name and contact information including (without limitation) your email address, telephone number, company details and forwarding address;
b) the name and contact information of our main point(s) of contact, including (without limitation) their email address and telephone number;
c) the name and contact information of your company directors where necessary, including (without limitation) their email address and telephone number;
d) information to enable us to check and verify your identity (e.g. your date of birth and other information contained in any identification documents that we hold);
e) your billing information, transaction, VAT and payment information;
your insurance information and the necessary policies which are specified in our contract with you; and
g) information to enable us to collect the relevant supplied products or materials, where applicable.
This personal information is required by us in order to receive the products, materials and services that are provided by you and to pay you for them. If you do not provide the personal information that we ask for, it may delay or prevent us receiving the relevant products and services, and/or delay or prevent us paying for them.

4 COLLECTION OF INFORMATION
We collect most of this personal information directly from you i.e. in person, by telephone, text, email and/or via our website. However, we may also collect information:
a) from publicly accessible sources such as Etsy;
b) directly from a third party e.g. our chosen delivery provider and Etsy.
from a third party with your consent e.g. from professional advisers and/or third party suppliers; and
c) via our IT systems e.g. through automated monitoring of our website(s) and other technical systems, such as our computer networks, and through the use of cookies, communication systems and email.

5 USE OF PERSONAL INFORMATION
Under data protection law, we can only use your personal information if we have a proper reason for doing so. These reasons include:
a) to comply with our legal and regulatory obligations;
b) for the performance of our contract with you (or to take steps at your request before entering into a contract with you);
c) for our legitimate interests or those of a third party; or
d) if you have given us your explicit consent.
A legitimate interest is when we have a business or commercial reason to use your information, as long as this is not overridden by your own rights and interests.
The information below explains what we use/process your personal information for and our reasons for doing so:


USE OF YOUR PERSONAL INFORMATION
REASON(S)

USE OF YOUR PERSONAL INFORMATION
To provide products and services to you or (as applicable) to receive products/materials and services from you. This may include liaising with, and passing your personal information to, third parties i.e. passing delivery information between our customers and our chosen delivery provider.
REASON(S)
For the performance of our contract with you or to take steps at your request before entering into a contract.

USE OF YOUR PERSONAL INFORMATION
To detect and prevent fraud against you or us.
REASON(S)
For our legitimate interests or those of a third party i.e. to minimise fraud that could be damaging for us and for you.

USE OF YOUR PERSONAL INFORMATION
Conducting checks to identify our suppliers, and to verify their identity.
Screening for financial and other sanctions, in relation to our suppliers.
Other processing necessary to comply with legal and regulatory obligations that apply to our business e.g. under health and safety regulations or safe working practices.
REASON(S)
To comply with our legal and regulatory obligations.

USE OF YOUR PERSONAL INFORMATION
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies.
REASON(S)
To comply with our legal and regulatory obligations.

USE OF YOUR PERSONAL INFORMATION
Ensuring business and regulatory policies are adhered to e.g. policies covering health and safety, security and internet use.
REASON(S)
To comply with our legal and regulatory obligations.
For our legitimate interests or those of a third party, i.e. to ensure we follow our own internal procedures so that we can deliver the best service to you and improve our relationships with our suppliers and printers.

USE OF YOUR PERSONAL INFORMATION
Operational reasons, such as improving efficiency, training and quality control.
REASON(S)
To comply with our legal and regulatory obligations.
For our legitimate interests or those of a third party, i.e. to be as efficient as we can so that we can deliver the best service to you at the best price and/or improve our relationships with our suppliers and printers.

USE OF YOUR PERSONAL INFORMATION
Statistical analysis to help us manage our business e.g. in relation to our financial performance, customer base, supplier base, range of available products and services, and/or other efficiency measures.
REASON(S)
For our legitimate interests or those of a third party i.e. to be as efficient as we can so that we can deliver the best products and service to you at the best price and/or improve our relationships with our suppliers.

USE OF YOUR PERSONAL INFORMATION
Preventing unauthorised access and modifications to our systems.
For our legitimate interests or those of a third party i.e. to detect and prevent criminal activity that could be damaging for us and for you.
To comply with our legal and regulatory obligations.

USE OF YOUR PERSONAL INFORMATION
Updating and enhancing our records.
REASON(S)
For the performance of our contract with you or to take steps at your request before entering into a contract.
To comply with our legal and regulatory obligations.
For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch you about the products and services that we provide.

USE OF YOUR PERSONAL INFORMATION
Statutory returns.
REASON(S)
To comply with our legal and regulatory obligations.

USE OF YOUR PERSONAL INFORMATION
Marketing our products and services to:
existing and former customers;
third parties who have previously expressed an interest in our products or services; and
third parties with whom we have had no previous dealings.
REASON(S)
For our legitimate interests or those of a third party i.e. to promote our business and any products or services that may be of use or interest to existing/former customers and third parties.

USE OF YOUR PERSONAL INFORMATION
External audits and quality checks and the audit of our accounts.
REASON(S)
For our legitimate interests or those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards.
To comply with our legal and regulatory obligations.

USE OF YOUR PERSONAL INFORMATION
To settle any disputes and provide customer supports.
REASON(S)
For the performance of our contract with you or to take steps at your request before entering into a contract.
To comply with our legal and regulatory obligations.
For our legitimate interests or those of a third party i.e. to resolve any issues and settle any disputes you or a third party may have.

The above information does not apply to special category personal information, which we will only process with your explicit consent.

6 MARKETING AND PROMOTION
We may use your personal information to send you updates (by email, text message, telephone or post) about our services, including (without limitation) exclusive offers, promotions or new products and services.
We have a legitimate interest in processing your personal information for promotional purposes (see paragraph 5 above, ‘Use of Personal Information’). This means we do not usually need your consent to send you promotional communications.
However, where your consent is needed, we will ask for your explicit consent separately and clearly.
We will always treat your personal information with the utmost respect and we will never share it with other organisations for marketing purposes.
You have the right to opt out of receiving promotional communications at any time by:
a) contacting us at digitallfh@gmail.com;
b) adjusting your preferences on the Etsy site; or
c) using the ‘unsubscribe’ link in emails or ‘STOP’ number in texts.
We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are any changes to the law or in the structure of our business.

7 INFORMATION SHARING
We routinely share personal information with:
a) third parties we use to help deliver our products and services to you e.g. sharing information with Etsy in order to provide my services and products to you and sharing information between our chosen delivery provider and customers;
b) other third parties we use to help us run our business, e.g. Paypal, Weebly Inc (a website hosting company), professional printing & production companies and other IT service providers;
c) our insurers and insurance brokers; and
d) our bank.
We only allow our service providers and other third parties to handle your personal information if we are satisfied that they take appropriate measures to protect your personal information.
We impose contractual obligations on third parties and service providers to ensure they can only use your personal information to provide services to us and to you. We may also share personal information with external auditors e.g. in relation to the audit of our accounts.
We may disclose and exchange information with law enforcement agencies and regulatory bodies in order to comply with our legal and regulatory obligations.
We may also need to share some personal information with other parties, such as potential buyers of our business (or any part thereof) or during any restructuring of our business. Usually, the information provided will be anonymous, but this may not always be possible. However, the recipient of the information will always be bound by confidentiality obligations.
We will not share your personal information with any other third party.

8 HOLDING INFORMATION
Information may be held at our offices, on our IT systems and on those of our third party service providers, representatives and agents as described above (see paragraph 7 above, ‘Information Sharing’).
Some of these third parties may be based outside the European Economic Area (EEA). For more information, including on how we safeguard your personal information when this occurs, see paragraph 9 below, ‘Data Transfers’.
We will keep your personal information while we are providing any products or services to you, or (as applicable) receiving any products/materials or services from you. Thereafter, we will keep your personal information for as long as is necessary:
a) to respond to any questions, complaints or claims raised or made by you (or on your behalf);
b) to show that we treated you fairly;
c) to keep records as required by law.
We will not retain your personal information for longer than necessary for the purposes set out in this policy.
Different retention periods apply for different types of personal information:
a) Customer data will be held for 6 years following the end of our contractual relationship with you.
b) Potential customer data will be held until the potential customer changes their marketing preferences or where the potential customer exercises their rights to ‘object’ or ‘to be forgotten’.
c) Supplier and Printers data will be held for 6 years after the end of the relevant contract.
d) Company records and data (i.e. statutory books, board minutes, company resolutions etc) will be held for 10 years from the date of the creation of such records or data.
When it is no longer necessary to retain your personal information, we will either delete the information or make the information anonymous.

9 DATA TRANSFERS
We do not routinely transfer your data outside of the European Economic Area (EEA). However, there may be some circumstances when it is necessary for us to do so, in order to deliver services to you, for example:
a) when relevant third parties (including customers, suppliers or service providers) are located or operate outside the EEA;
b) where website servers (or other items of IT hardware) are located outside the EEA;
c) if you are based outside the EEA; or
d) where there is an international dimension to the services we are providing to you.
These transfers are subject to special rules under European and UK data protection law.
Non-EEA countries do not have the same data protection laws as the United Kingdom and the EEA. We will, however, ensure that any such transfer of data complies with applicable data protection law and that all personal information is secure. Our standard practice is to use template data protection clauses, that have been approved by the European Commission, in our contracts with the relevant third parties.
If you would like further information, please contact us (see paragraph 15 below, ‘Contact’).

11 YOUR RIGHTS
You have the following rights, which you can exercise at no cost:

Access:
The right to be provided with a copy of your personal information (the right of access).

Rectification:
The right to require us to correct any mistakes in your personal information.

To be forgotten:
The right to require us to delete your personal information, in certain situations.
NB: we are not required to delete your personal information if this is held (i) for the performance of a contract (during the term of the contract) or (ii) to comply with a legal obligation. 

Restriction of processing:
The right to require us to restrict the processing of your personal information in certain circumstances e.g. if you contest the accuracy of the personal information.

Data portability:
The right to receive the personal information you have provided to us, in a structured, commonly used and machine-readable format, and/or to transmit that personal information to a third party, in certain situations.

To object:
The right to object:
at any time to your personal information being processed for direct marketing purposes (including profiling); and
in certain other situations, to our continued processing of your personal information e.g. where such processing is carried out for the purpose of our legitimate interests.
NB: as above, we are not required to delete your personal information if this is held (i) for the performance of a contract or (ii) to comply with a legal obligation.

Not to be subject to automated individual decision-making:
The right not to be subject to a decision which is based solely on automated processing (including profiling) and that produces legal effects concerning you or otherwise significantly affects you.

For further information on each of these rights, including the circumstances in which they apply, please contact us or see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
If you would like to exercise any of these rights, please:
a) email, call or write to us (see paragraph 15 below, ‘Contact’);
b) let us have enough information to identify you (e.g. your full name, address and any applicable reference/reference number);
c) let us have proof of your identity and address (e.g. a copy of your driving license or passport and a recent utility bill); and
d) let us know what right you want to exercise and the information to which your request relates.

12 SECURITY
We have implemented appropriate security measures to prevent your personal information from being lost or used/accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you, and any applicable regulator, of any suspected data security breach where we are legally required to do so.

13 COMPLAINTS
Should you have a complaint about our use of your personal information, please contact us (see paragraph 15 below, ‘Contact’).
We hope that we can resolve any query or concern that you may raise about our use of your personal information. However, the General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of the relevant data protection laws has occurred.
The supervisory authority in the UK is the Information Commissioner who can be contacted at https://ico.org.uk/concerns or 0303 123 1113.

14 CHANGES TO THIS PRIVACY POLICY
This privacy policy was amended and published on 20 August 2018.
We may change this privacy policy from time to time. We will inform you via our website, or by email, as and when any changes are made.

15 CONTACT
Please contact us by post, email or telephone if you have any questions about this privacy policy or the information that we hold about you.

Our contact details are:
Address:
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email:
digitallfh@gmail.com
Telephone:
020 3290 5252