Privacy Policy

When sharing your personal information, we will ensure at all times that those with whom it is shared process it in an appropriate manner and take all necessary measures in order to protect it in accordance with the law.

Please be aware that, from time to time, we may be required to disclose your personal information to, and exchange information about you or relating to you with, government, law enforcement and regulatory bodies and agencies in order to comply with our own legal and regulatory obligations.

During the course of, and sometimes following the conclusion of, our provision of the Service to you we may need to share your personal information with other third parties, for example those involved in a relevant or related transaction. We will only share that information which is necessary and relevant to share.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business, or during a re-structuring. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

From time to time it may be necessary for us to share data for statistical purposes. We will always take steps to try to ensure that information shared is anonymised, but where this is not possible we will require that the recipient of the information keeps it confidential at all times.

Our Site and App may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy and, where relevant, the cookie policy of every website you visit.

8. How your personal information is kept

Your personal information will be kept secure at all times.

Your personal information may be held at our offices, at third party agencies and service providers, and by our representatives and those agents used by us.

Some of your data will be held outside the UK/EEA. Please see the provisions set out in Paragraph 9 below for more information.

We operate various security measures in order to prevent the loss of, or unauthorised access to, your personal information. We restrict access to your personal information to those with a genuine business need to access it, and we have procedures in place to deal with any suspected data security breach. We will notify you, and any applicable regulator, of a suspected data security breach where we are legally required to do so.

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Please note, that different periods for keeping your personal information will apply depending upon the type of data being retained and the purpose of its retention.

Where your personal information is retained after we have finished providing the Service to you, or where the contract with you has ended in any other way, then this will generally be for one of the following reasons:

• so that we can respond to any questions, complaints or claims made by you or on your behalf;
• so that we are able to demonstrate that your matter was dealt with adequately, and that you were treated fairly;
• in order to comply with legal and regulatory requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We generally retain information for period of 6 years from the end of the services for the reasons stated above however some information may be retained for a lesser period or a longer period depending on the nature of the information. For example we will delete sensitive personal information as soon after the end of the services unless it is required to be retained for any of the purposes stated above and we may retain transactional information for longer than 6 years as evidence of e-commerce transaction when detailing with possible Tax queries that the appropriate tax authorities may raise after the 6 year period.

We will irretrievably delete and/or anonymise any personal information which it is no longer necessary for us to retain.

9. Transferring your data out of the UK and EEA

When you purchase goods or a services from us by virtue of a subscription account the transaction will be handled by Apple (Apple devices) or Google (Android devices) and your information will be processed by them. Apple or Google may transfer your information to its group companies or third party sub processors. For more information on how data transfers comply with the GDPR, see Google’s Privacy Policy https://policies.google.com/privacy?hl=en-gb and Apple’s Privacy Policy https://www.apple.com/uk/privacy/.

In order for us to provide you with the Service, it may be necessary for us to share your personal information with those outside the UK/EEA where, for example, those persons have offices outside the UK/EEA, are based outside the UK/EEA, where electronic services and resources are based outside the UK/EEA, or where there is an international element to the instructions we have received from you. Where this is the case, special rules apply to the protection of your data.

We may also need to transfer your personal information to countries that have not been assessed by the Secretary of State or, where the EU GDPR applies, by the European Commission as providing adequate protection. In such cases we will always take steps to ensure that, wherever possible, the transfer complies with data protection law, and that your personal information will be secure. We use standard data protection contract clauses which have been approved by the Information Commissioners Office or the European Commission as applicable.

For further information please email us at dataprotection@mystreats.co.uk and/or utilise the contact details on our website on the “Contact Us” page (https://www.mystreats.co.uk/contact-us/).

10. Your rights in relation to your data

Data protection legislation gives you (as the data subject) various rights in relation to your personal information that we hold and process. These rights are exercisable without charge, and we are subject to specific time limits in terms of how quickly we must respond to you. Those rights are as follows:

• Right of access— the right to obtain, from us, confirmation as to whether or not personal information concerning you is being processed and, where that is the case, access to that personal information and various other information, including the purpose for the processing, with whom the data is shared, how long the data will be retained, and the existence of various other rights (see below).
• Right to rectification— the right, without undue delay, to have inaccurate personal information concerning you put right.
• Right to erasure— sometimes referred to as the ‘right to be forgotten’, this is the right for you to request that, in certain circumstances, we delete data relating to you.
• Right to restrict processing— the right to request that, in certain circumstances, we restrict the processing of your data.
• Right to data portability— the right, in certain circumstances, to receive the personal information which you have provided to us in a structured, commonly used and machine-readable format, and the right to have that personal information transmitted to another controller.
• Right to object— the right, in certain circumstances, to object to personal information being processed by us where it is in relation to direct marketing, or in relation to processing supported by the argument of legitimate interest.
• Right not to be subject to automated decision making— a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Full details of these rights can be found in the UK/EU GDPR or by reference to guidance produced by the Information Commissioner’s Office.

In the event that you wish to exercise any of these rights you may do so by:

• Contacting us by email.
• By completing a form which we can supply to you for this purpose.
• Through a third-party whom you have authorised for this purpose.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated

11. Keeping your data secure

In order to ensure that data is kept secure, and to prevent there being any breach of confidentiality, we have put in place security measures which are intended to prevent your personal information from being accidentally lost or used or accessed unlawfully. Access to your personal information is restricted to those with a need to access it, and regard will be had to the need for confidentiality when that personal information is processed.

Our systems are subject to rigorous testing, and we are ISO 27001 certified, meaning that we observe industry standards for information security.

In the event that there is a suspected data security breach you will be notified. We will also inform the appropriate regulator (including the Information Commissioner’s Office) of a suspected data security breach, where we are legally required to do so.

12. Contact us

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager at miles@mystreats.co.uk utilise the contact details on our website on the “Contact Us” page (https://www.mystreats.co.uk/contact-us/).

13. Making a complaint

Notwithstanding our best efforts, inevitably sometimes things do go wrong. If you are unhappy with any aspect of the use and/or protection of your personal information, and you are in the UK, you have the right to make a complaint to the Information Commissioner’s Office (ICO), who may be contacted in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; by telephone on 0303 123 1113; by fax on 01625 524510 or online at www.ico.org.uk. if you are located in any member state of the EU you can complain to your local supervisory authority as list of such authorities can be found here https://edpb.europa.eu/about-edpb/about-edpb/members_en

14. This policy

This privacy policy was published on [29.03.2023] and last updated on [29.03.2023].

We keep our privacy policy under regular review. The terms and provisions of this privacy policy may be changed, updated and amended from time to time. If we do so during the time when we are providing you with products and services we will inform you of those changes.

If you would like this policy to be supplied to you in another format (for example audio, large print, braille) please contact us at the address in clause 12 above.