In this Privacy Policy the terms, ‘we’, ‘us’ or ‘our’ is Xpress Signs.

Your privacy is important to us and we are committed to keeping your information secure and managing it in accordance with our legal responsibilities under applicable data protection laws.

 

Please read this Privacy Statement carefully as it contains important information to help you understand how and why we process any personal information that you give to us.

What Information We Collect

We process personal information which you give us:

• Whilst servicing your account through our website, in writing or over the phone.
• If you request information or assistance from us.

 

As an essential part of our business, we collect and manage customer data. In doing so, we observe all relevant data protection legislation, and are committed to protecting and respecting customers’ privacy and rights. Specifically, Xpress Signs Limited act as “Data Controller” in respect of the information gathered and processed by our website or when customers visit our warehouse or office.

In order that you are reliably informed about how we collect, process, store and share your information, we have developed this Privacy Statement. This Statement also advises how you can have control over our use of your data.

If you have any comments or queries regarding our use of your data, please contact our Data Protection Officer by email at accounts@xpresssigns.co.uk or by post at Data Protection Officer, Xpress Signs Ltd, Units 3, Kangley Business Centre, Kangley Bridge Road, London SE22 5AQ.

1. What information do we collect about you?

In general terms, we collect information about you so that we can:

• fulfil product orders that you may make via our website, which you can subsequently collect from our warehouse, or which may be delivered and/or installed at your home or work;
• provide services and products applicable to you;
• deliver high-levels of customer care and support; and
• communicate with you effectively regarding your order, or so that you do not miss out on great promotions, offers and helpful reminders.

Collecting information from you

The information that we collect from our customers is known as “personal data”. This includes customers’ names, home or business addresses and e-mail addresses. We collect this in a number of different ways. For example, customers may provide this data to us directly when filling in forms on our website, or when corresponding with us by telephone, e-mail or letter.

We also take customers’ credit/debit card details: however, we do not save this information on any of our systems. Equally, we do not collect any special category data about our customers (i.e. information about their ethnicity, religion, health etc).

Please also be advised that when you visit our website, cookies will be used to collect information about you such as your Internet Protocol (IP) address which connects your computer or mobile device to the internet. You can manage your cookies via the banner on the home page).

Information sourced from third parties

We also use a qualified third-party provider in order to gain additional information about our customers so that we can best support them, namely:

• Credit Focus

We only collect a limited amount of personal data (applying the rules of data minimisation), and ensure that customers can exercise their legal rights at any time (see section 5 below).

 

2. How will we use this information?

We use the data collected from you for the specific purposes listed in the table below. Please note that this table also explains:

• the lawful basis for processing your data, linked to each processing purpose;
• in what circumstances, if appropriate your personal data will be shared with a third-party organisation; and
• for how long we keep customer data.

Data that is collected by cookies is not included in the table below, but is explained in section 3 of our Cookies Policy.

Purpose for processing data		Lawful basis for processing data	Third party organisations with  whom data is shared	Data retention period
Data processing related to a purchase
To fulfil purchases and orders which you may make via our website		To meet the requirements of contract law	Credit Focus	6 years following the customer’s last transaction
To fulfil purchases and orders which we make in our warehouse		To meet the requirements of contract law	Not appropriate	6 years following the customer’s last transaction
To process customer requests for finance and/or credit (please note that this includes processing for the purposes of fraud prevention)		Customers will be asked to provide informed consent before their data is processed for the purposes of applying for finance	Credit Focus	6 years following expiry of the finance agreement
To process credit / debit card payments, and communicate with you if there are any issues		To meet the requirements of contract law	For payment in our office, data will be shared with Barclays, our payment gateway and payment acquirers. For payments online, data will be shared with Barclays, our payment gateway and acquirer. In processing this data, customer details will also be automatically checked for fraud prevention purposes. If a payment online is not approved, then Credit Focus will be used For payments made over the phone, we use PCI of Barclays to ensure security.	Xpress Signs does not record credit / debit card information: however, anonymised token data  is retained for 6 years following  the transaction
To communicate with you via email, SMS text or telephone in order to update you as necessary about your specific order or purchase		To meet the requirements of contract law	Sales activities will be recorded on SQL Database and Sage Accounting Software. Additionally, we will use SQL Database to help send these emails.	6 years following the customer’s last transaction. Data used by Cheetah Digital will be retained for 19 months
After-sales data processing
To provide customer services support by telephone, email or letter: this includes the recording of telephone conversations for monitoring and quality purposes		This is deemed legitimate as it is in customers’ interest that we can access their data in order to resolve any queries, questions, concerns or complaints	Customer services information will be recorded on SQL Database, our Customer Relationship Management System. Telephone calls are recorded using the Siemens telephony system.	6 years following the customer’s last transaction. However customer services call recordings will be kept for no more than 90 days
To process a refund, for which we require the customer’s name and address irrespective of circumstance or refund value		To perform a task carried out in the public interest and/or in the exercise of official authority vested in the controller (i.e. to identify criminal / fraudulent activity)	This data is captured within our Sage Accounting Software
	Data processing for online services
	To enable you to set up an online account	This is deemed legitimate as it is in customers’ interest to set up an online account (if they choose) to manage their transactions	By setting up an online account, customers’ details will be held on our SQL Database and will not be shared with any other 3rd party	6 years following the customer’s last transaction

 

 

3. Your rights

Under the terms of data protection legislation, you have the following rights as a result of using our website:

3.1 Right to be informed

This Privacy Statement, together with our Cookies Policy, fulfils our obligation to tell you about the ways in which we use your information as a result of you using our website.

3.2 Right to access

You have the right to ask us, in writing, for a copy of any personal data that we hold about you. This is known as a “Subject Access Request”. Except in exceptional circumstances (which we would discuss and agree with you in advance), you can obtain this information at no cost. We will send you a copy of the information within 30 days of your request.

To make a Subject Access Request, please write to our Data Protection Officer at Xpress Signs Limited, Unit 3, Kangley Business Centre, Kangley Bridge Road, London SE26 5AQ.

 

3.3 Right to rectification

If any of the information that we hold about you is inaccurate, you can either:

• visit the “My Account” section of the website where you can make changes to some of the information that we hold about you; or
• contact our Data Protection Officer at accounts@xpresssigns.co.uk. Any corrections that you request will be made as soon as possible, and certainly no later than 30 days following your notification.

3.4 Right to be forgotten

You can ask that we erase all personal information that we hold about you. Where it is appropriate that we comply, your request will be fully actioned within 30 days. For further information, please contact our Data Protection Officer at accounts@xpresssigns.co.uk.

 3.5 Right to object

You have the right to object to:

• the continued use of your data for any purpose listed in section 3 of this Privacy Statement for which consent is identified as the lawful basis of processing (i.e. you have the right to withdraw your consent at any time); or
• the continued use of your data for any purpose listed in section 3 of this Privacy Statement for which the lawful basis of processing is that it has been deemed legitimate.

In some circumstances (i.e. consent to marketing communications), you can exercise your objection by updating your preferences within the “My Account” section of this website. For all other circumstances, you can contact our Data Protection Officer at accounts@xpresssigns.co.uk.

Please note that you can also exercise your right to object to our use of cookies by following the guidance in section 4 of our Cookies Policy.

3.6 Right to restrict processing

If you wish us to restrict the use of your data because (i) you think it is inaccurate but this will take time to validate, (ii) you believe our data processing is unlawful but you do not want your data erased, (iii) you want us to retain your data in order to establish, exercise or defend a legal claim, or (iv) you wish to object to the processing of your data, but we have yet to determine whether this is appropriate, please contact our Data Protection Officer at accounts@xpresssigns.co.uk.

3.7 Right to data portability

If you would like us to move, copy or transfer the data that we hold about you to another organisation, please contact our Data Protection Officer at accounts@xpresssigns.co.uk.

Please be advised that this only applies to certain data which has been submitted by you electronically for specific purposes only. Our Data Protection Officer can provide further advice.

 

4.  Data privacy and security

At Xpress Signs, we maintain a comprehensive data management work programme, which includes processes for ensuring that data protection is a key consideration of all new and existing IT systems that hold customers’ personal data. Where any concerns, risks or issues are identified, we conduct relevant impact assessments in order to determine any actions that are necessary to ensure optimum privacy.

We also maintain an active information security work programme which seeks to protect the availability, confidentiality and integrity of all physical and information assets. Specifically, this helps us to:

• protect against potential breaches of confidentiality;
• ensure all IT facilities are protected against damage, loss or misuse;
• increase awareness and understanding of the requirements of information security, and the responsibility of our colleagues to protect the confidentiality and integrity of the information that they handle; and
• ensure the optimum security of this website.

We recognise that the security of data and transactions on our website is of primary importance. We therefore ensure that all connections to secure parts of the website (such as when you login) are encrypted and authenticated using strong protocols, key exchanges and ciphers.

 

5. Card payment security

We are proud to be a part of the Payment Card Industry Data Security Standard (PCI-DSS), which recognises the robust processes that we apply when handling card transactions from the major card schemes. This independent standard agency gives our customers assurance that our transactional systems protect your data with appropriate levels of security.

 

6. Disclaimers

Every effort is made to ensure that the information provided on this website, and in this Privacy Statement, is accurate and up-to-date, but no legal responsibility is accepted for any errors or omissions contained herein.

We cannot accept liability for the use made by you of the information on our website or in this Privacy Statement, nor do we warrant that the supply of the information will be uninterrupted. All material accessed or downloaded from this website is obtained at your own risk. It is your responsibility to use appropriate anti-virus software.

This Privacy Statement applies solely to the data collected by us, and therefore does not also apply to data collected by third party websites and services that are not under our control. Furthermore, we cannot be held responsible for the Privacy Statements on third party websites, and we advise users to read these carefully before registering any personal data.

 

7. Accessibility

We are committed to providing a website in which content is accessible to everyone. We therefore update our website regularly in order to make it as adaptable as possible.

For example, users can control the text size of each page within their browser. On a PC, holding the “Ctrl” key while pressing the “+” (plus) key will increase text size, and holding the “Ctrl” key while pressing the “-” (minus) key will decrease the text size.

 

8. General

Questions and comments regarding this Privacy Statement are welcomed, and should be sent to our Data Protection Officer at accounts@xpresssigns.co.uk.

You can also contact our Data Protection Officer if you have any concerns or complaints about the ways in which your personal data has been handled as a result of you using this website.

Alternatively, you have the right to lodge a complaint with the Information Commissioner’s Office (“ICO“) who may be contacted at Wycliffe House, Water Lane, Wilmslow SK9 5AF or https://ico.org.uk (for details on how your data will be managed by the ICO, please refer to https://ico.org.uk/global/privacy-notice/