H E Phillips Ltd Privacy Policy

Our Promise to You: Your Privacy at H E Phillips Ltd

At H E Phillips Ltd, we build lasting relationships with our clients based on trust and respect. Your privacy is paramount. When you visit us, speak to us online, or interact in person, we collect personal information to manage our business efficiently, legally, and to provide you with a truly personalised experience.

We will never sell your personal information.

This Privacy Policy explains how we collect, use, store, and share your personal data. We've highlighted key sections to help you understand our practices and your rights more clearly.

This policy was most recently updated on [Insert Current Date, e.g., May 24, 2025].

Who We Are and Who Controls Your Data

In this policy, 'we', 'our', or 'H E Phillips Ltd' refers to H E Phillips Ltd, including any subsidiaries, affiliates, and joint ventures.

Our registered address is: 19 Fore Street, Totnes, Devon, TQ9 5DA

Under UK data protection law, H E Phillips Ltd is the 'data controller' responsible for your personal data. We are registered with the Information Commissioner's Office (ICO).

Understanding Data Protection Law (UK & EU)

When we refer to 'data protection law' in this policy, we mean the laws currently applicable in the UK and Europe. This includes:

• The UK Data Protection Act 2018
• The UK General Data Protection Regulation (UK GDPR)
• The EU General Data Protection Regulation (GDPR) where applicable (e.g., if processing data of EU citizens)
• The Privacy and Electronic Communications Regulations (PECR)
• All other applicable supporting laws and regulations.

How to Contact Us

If you have any concerns about how H E Phillips Ltd handles your personal information, or if you wish to exercise any of your data protection rights, please contact our Data Protection Officer:

• Email: golduwant@aol.com

The Personal Information We Collect About You and Where It Comes From

We collect personal information about you whenever you interact with us, whether in person or online. This data comes both directly from you and is sometimes collected indirectly throughout your relationship with us.

Building a Personalised Relationship

To provide you with a truly unique and personalised experience, we aim to understand your preferences and interests. We may collect information from:

• Direct Interactions: Conversations in our showrooms, at events, and chats with our team via messaging, social media, email, or phone.
• Preferences & Interests: This includes your favourite brands, personal style, items you're interested in, and details about your watch collection (if you're an enthusiast).
• Lifestyle & Milestones: We may note information you share about your lifestyle, family, hobbies, work, aspirations, birthdays, anniversaries, and other significant events.
• Publicly Available Information: Occasionally, we might add to this with information from publicly available sources like social media, for instance, if we learn of special work or personal achievements you've mentioned.

Purpose: We use this information to offer a personalised service, suggest items or events you might like, celebrate your life's milestones, and deliver the unique client experience we pride ourselves on.

Note: We do not use this detailed information for 'profiling' you for direct marketing purposes, unless you have specifically consented to marketing.

High-Value Purchases: Money Laundering & Fraud Prevention

When you purchase high-value items, we are legally required to collect additional information to satisfy money laundering and fraud prevention requirements. This includes your date of birth and identification details, such as a passport or driving licence.

We may also verify this information through commercially or publicly available sources like Companies House, the Land Registry, the Electoral Roll, insolvency registers, and relevant industry or professional bodies. Although some of this information is publicly available, we remain mindful of your privacy and use it strictly for this necessary purpose.

Legal Basis: Fulfilling a legal obligation (e.g., Anti-Money Laundering (AML) regulations).

Our Legal Basis: How and Why We Use Your Personal Data

Under data protection law, we must have a valid legal basis to use your personal data. Our use of your data falls into four main categories:

1. Essential for Products & Services (Contractual Necessity):

   • Purpose: Processing sales, refunds, repairs, complaints, answering queries, maintaining interest registers for high-demand products, and ensuring our websites function properly.
   • Meaning for You: This data use is essential to enable you to shop, browse, and communicate with us. You cannot opt-out of this processing and remain a client.

2. With Your Consent:

   • Purpose: Sending you marketing communications about our group companies or brands, and the use of non-essential cookies on our websites.
   • Meaning for You: You have full control. You can withdraw your consent at any time. For marketing, you can click the 'unsubscribe' link in our emails. For cookies, you can manage your preferences via our cookie banner/settings. We never sell or share your data for other organisations to use in their own marketing. Our Cookie Policy explains more about how we use cookies and how to exercise your choice over them.

3. To Meet Legal or Regulatory Obligations:

   • Purpose: Complying with legal requirements related to company and trading law, payment processing, complaint handling, tax and accounting, corporate governance, money laundering and fraud prevention, and requirements from regulatory bodies (e.g., FCA, where applicable to our business).
   • Meaning for You: This processing is necessary for us to operate legally and responsibly. You cannot opt-out of this processing and remain a client.

4. Based on Our Legitimate Interests:

   • Purpose: Activities that are in our 'legitimate business interests' and enable us to run our business effectively and efficiently. This includes improving our services, preventing fraud (beyond legal obligations), ensuring network security, and internal analytics.
   • Meaning for You: Data protection law gives you the right to object to or opt out of the use of your personal data for these purposes if your rights and freedoms outweigh our legitimate interests. The specific activities we carry out on this basis are outlined within this policy. Please review those sections before getting in touch to object.

Sharing Your Information

We will never share your personal data outside H E Phillips Ltd unless it is for the purposes outlined in this policy and where we have a valid legal basis for doing so.

Sharing with Public Bodies:

We may share your information with law enforcement and investigatory bodies, courts, HMRC, and other government or regulatory bodies upon receipt of valid proof of authority, or when compelled or permitted by law.

Sharing with Companies Providing Services on Our Behalf (Processors):

Some of our services are provided wholly or partly by external companies. We conduct thorough checks to ensure these companies provide your information with the necessary level of care and protection. Both we and these third parties have direct obligations under data protection law, reinforced by appropriate contractual measures (Data Processing Agreements).

The main functions that may involve sharing personal data with these trusted third parties are:

• Audit, legal, compliance, and tax-related services
• Call recording (if applicable)
• Credit checking and identity verification
• Data analytics and market research
• Document archiving and destruction
• Event management
• Independent valuation services
• Insurance and repair handling and claims management
• IT services, support, and data storage
• Mailing, delivery, and returns services
• Management of competitions, promotions, and offers
• Marketing services
• Online and physical security services and support
• Payment processing and verification
• Provision of consumer finance
• Provision of product care insurance
• Visitor management and footfall-counting (if applicable)
• Web hosting, online content services, and live engagement platforms

International Data Transfers:

Data protection laws and standards vary outside the UK and Europe. Some third-party providers we use are based, or carry out activities, in other countries. Where this is the case, we put in place legal mechanisms to ensure that our data transfers comply with UK and European data protection law. We generally do this using standardised contractual clauses (sometimes known as the 'EU model clauses' or 'International Data Transfer Agreements') that are approved by the European Commission and the UK and European privacy regulators. Other approved legal approaches may also be used.

Changes of Ownership or Business Restructuring:

If the ownership of all or part of our business changes, or we undergo a reorganisation or restructure, we will transfer your personal information to the new owner or successor company and its agents and advisors. This transfer facilitates the completion of the transaction, ensures a smooth handover, and enables us or the new entity to continue providing the services you have requested. The new data controller will contact you and provide you with its privacy policy.

How Long Do We Keep Your Information?

We hold your information for as long as we have a valid legal reason to do so. The exact timescales for different types of data may vary according to our reason for processing them and the legal, regulatory, or business requirements that apply.

We consider these factors when deciding how long to keep data. As a general guide, we typically retain most of your details for 10 years after your last interaction with us. This timeframe reflects the typical pattern of client engagement and the length of client relationships in our business and industry, and also aligns with common accounting and regulatory requirements.

Your Privacy Rights

Data protection law gives you certain rights over your personal data. Should you wish to exercise any of these rights, please contact our Data Protection Officer at golduwant@aol.com. In some circumstances, we may need to ask you for valid proof of identity before processing your request.

Your rights include:

• The Right to Opt Out of Direct Marketing: We only send direct marketing with your consent. You can withdraw this consent at any time by clicking the 'unsubscribe' link in any of our marketing emails.
• The Right of Access (Subject Access Request): You have the right to know what personal data we hold about you and to receive a copy of it. We will action your request within one month, or explain why if it's particularly complex. In some situations, the law may require or permit us to withhold some personal data (e.g., where it impacts another person's privacy rights, or involves legally privileged or commercially sensitive details). If this applies, we will explain at the time. Your right of access also includes knowing where we obtained your data, our legal basis for processing it, and how we use and share it, which this policy is designed to provide.
• The Right to Have Inaccuracies Corrected (Rectification): You can request corrections to your personal data if it's inaccurate or incomplete. For simple contact details, you may be able to make changes online if you have an account. For more substantial changes, please contact us, and we will action your request within a month. If we do not intend to make the requested correction (e.g., if it would render our records inaccurate), we will inform you why and note your request in our records.
• The Right of Objection: You have the right to object to activities involving your data that are based on our 'legitimate business interests', where your rights and freedoms outweigh those legitimate interests. The specific activities we carry out on this basis are set out in the "Our Legal Basis" section above. Please ensure you have read that section before getting in touch. We will action all valid requests within one month.
• The Right to Erasure ('Right to be Forgotten'): You can request the erasure of some of your personal data if:
  • We are found by the courts or a regulator to be processing it unlawfully (without a valid legal basis).
  • Our original purpose for processing the data has been completed.
  • We were processing the data on the basis of consent, and you have now withdrawn your consent.
  • We are processing data based on our 'legitimate interests' and we have upheld your objection to that processing, and we have no other valid legal basis for continuing to hold the data.
• The Right to Data Portability: This right allows you to reuse some of your information by requesting it in a commonly used, machine-readable format that can be passed to, and used by, other organisations. While this is of limited practical application in the retail sector, we may be able to provide your contact details and purchase history as a CSV file if you require it.
• The Right of Restriction: This is the right to have your personal data temporarily 'ring-fenced' from erasure, alteration, or other processing, pending a legal claim or while awaiting the outcome of an objection or rectification request.

Your Right to Complain to the Regulator

If you believe we have infringed your privacy rights, or you disagree with a decision we have made, you have the right to complain to the Information Commissioner's Office (ICO).

Changes to Our Privacy Policy

This Privacy Policy was last updated on [Insert Current Date, e.g., May 24, 2025], Version 1. We may update this policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this policy periodically.