The Wow Company UK Limited (referred to as the “Company”, “we”, ‘us” or “our” in this privacy policy) is committed to protecting and respecting your Personal Data.
This policy sets out the basis on which any Personal Data we collect from you, or that you provide to us, will be processed by us. It will also inform you of your privacy rights and how the law protects you.
Please read the following carefully to understand our views and practices regarding your Personal Data and how we will treat it. By visiting www.thewowcompany.com (the “Website”) you are accepting and consenting to the practices described in this policy as well as consenting to our use of cookies in accordance with the terms of this policy.
The Wow Company UK Limited is a private limited company registered in England and Wales with company registration number 05007424 and is the Controller and responsible for your Personal Data.
Our contact information is as follows:
Data Protection Officer at privacy@thewowcompany.com.
The Wow Company UK Ltd
3rd Floor
86-90 Paul Street
London
England
EC2A 4NE
Telephone: 01264 721670
UK GDPR
Under the UK GDPR’s General Data Protection Regulation (GDPR), Personal Data is defined as:
“Any information relating to an identified or identifiable living natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Our commitment to you is:
We promise we will:
- Process data lawfully, fairly and in a transparent manner
- Collect data for specified, explicit and legitimate purposes (mostly to provide services to you)
- Ensure your data is processed and stored securely and is kept up-to-date
You will always:
- Have access to the data stored on you
- Be able to correct any inaccuracies in the data
- Be able to erase your data and restrict its processing where it doesn’t conflict with legal obligations, obligations to regulatory bodies, e.g. HMRC or our legitimate interests
- Know we will erase any data no longer required, even if you haven’t asked
- Know that as technology changes we will constantly review and update our processes to ensure we’re always protecting your data
1) The basis upon which we will process you Personal Data
1a. Processing your Personal Data: Necessary for the Performance of a Contract
The processing of your Personal Data by The Wow Company UK Ltd or a third party will be undertaken to fulfil the services agreed to complete our contractual obligations to you and any obligations to any regulatory bodies.
1b. Processing your Personal Data: Legitimate Interests
The processing of your Personal Data by The Wow Company UK Ltd or a third party may be undertaken if we have a legitimate interest to do so. In our case this includes:
- For the purposes of providing our clients with information about our services and to monitor usage in order to improve those services from time to time.
- Ensuring that any data is stored and transferred securely and in a way that protects against the unlawful use, destruction or loss of your Personal Data.
- In connection with the provision and maintenance of our IT system.
- Sharing your personal information as part of a business sale, reorganisation or similar transaction.
We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
1c. Processing your Personal Data: By Consent
Where we process your Personal Data by relying on your consent to do so, we shall ensure that such consent is freely given by you, specific with regards to what processing we wish to undertake so that you are fully informed and unambiguous and given by a clear affirmative action.
We may collect and process the following data about you:
- The information about you that you give us. This could be by filling in any forms on the Website or by corresponding with us by phone, e-mail, or any other way.
- Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender. Also details about your employer or the organisation you represent and your position/ role at that employer/ organisation. We may also collect copies of your identity documents in connection with our legal and regulatory obligations, for example in relation to Anti-Money Laundering and Sanctions.
- Contact Data includes billing address, delivery address, email address and telephone numbers to be used in relation to orders you place with us and also online accounts and subscriptions you open and put in place with us.
- Financial Data includes bank details and payment card details, and information about your assets and financial position.
- Transaction Data includes details about payments to and from you and other details or products and services you have purchased from us.
- Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
- Regarding each of your visits to our Website, depending on the cookies settings you select, we may automatically collect the following
- Usage Data via cookies: Technical Data which may include: the Internet protocol (IP) address used to connect your computer to the Internet; browser type and version; time zone setting; browser plug-in types and versions and the operating system and platform.
- information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our Website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any name, email address or phone number used to contact us. The legal basis for this processing is our legitimate interests, namely monitoring and improving our Website and enabling you to communicate with us and for us to send you reports and other material by request.
- Aggregated data: You can alter the website information we collect by changing your cookies settings when you visit our website, or via your web browser. We may also collect, use and share aggregated data such as statistical or demographic data which is not Personal Data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.
- Job Applicants: Personal information gathered during the applicant process, and any DBS checks we choose to undertake. Also details of your employment history and preferred accreditations.
- Special Categories of Personal Data: these are details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not normally collect any special categories of data outside of the information disclosed to us in identity documents you provide to us, nor do we collect any information about criminal convictions and offences, except in anti-money laundering and sanctions search results we receive. Such IP documents and search results are processed on the basis of our legitimate interests and also in compliance with legal obligations, in conjunction with special category data conditions (f) (legal claims or judicial acts) and (g) (reasons for substantial public interests (with a basis in law)). However, if we do need to process such data we will ask for your explicit consent to do so.
- Usage Data via cookies: Technical Data which may include: the Internet protocol (IP) address used to connect your computer to the Internet; browser type and version; time zone setting; browser plug-in types and versions and the operating system and platform.
For further details on the purposes for which we will use it, please see paragraph 7 below (purposes for which we will use your Personal Data).
3) Disclosure of your Personal Data
We may have to share your Personal Data with the parties set out below for the purposes set out in the table below.
- Internal Third Parties: other companies or departments in our Group acting as Processors or joint Controllers and provide IT and system administration services and undertake leadership reporting;
- External Third Parties: service providers acting as Processors who provide IT and system administration services to assist us in the improvement and optimisation of the Website. Also, anti-money laundering and sanctions search providers.
- Other Third Parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may process your Personal Data in the same way as set out in this Privacy Notice. Other third Parties may also include credit reference agencies for assessing your credit score where this is a condition of us entering into a contract with you and any financial reference agencies for assessing suitability where this is a condition of us entering into a contract with you. Also, third parties which collate and process reviews in respect of our services.
- Professional advisers and Professional Service Providers: acting as Processors or joint Controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting and payroll services.
- HM Revenue & Customs, regulators and other authorities acting as Processors or joint Controllers who require reporting of processing activities in certain circumstances.
- E-Commerce Platform Service Providers, to provide e-commerce platform solutions.
- Payment Service Providers, who are used to process customer payments for one-time and subscription purchases.
- Law Enforcement Bodies, such as the ICO or National Crime Agency and the Police.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. To find out more about how the processing for a new purpose is compatible with the original, please contact our data protection team. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Where we need to collect Personal Data by law, or under the terms of a contract we have with you (as to fulfil our obligations under such contract and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel an order for a product you have with us but we will notify you if this is the case at the time.
Your data will be processed in accordance with the UK GDPR and Data Protection Act 2018. We will generally save your Personal Data in the UK. Some of our external third parties are based outside the European Economic Area (EEA) so their processing of your Personal Data will involve a transfer of data outside the UK and the EEA. Whenever we transfer your Personal Data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the UK Information Commissioner.
- We may use specific contracts approved by the UK Information Commissioner which give Personal Data the same protection it has in the UK.
- When processing Personal Data in countries outside of the UK, we ensure that the appropriate standard contractual clauses are implemented (by way of International Data Transfer Agreement (IDTA) or UK Addendum.
Much of our data processing is conducted by Xero that has the highest security standards. Xero encrypts all data that goes between you, us and Xero using industry-standard TLS (Transport Layer Security), protecting your personal and financial data. Your data is also encrypted at rest when it is stored on Xero’s servers, and encrypted when transferred between data centres for backup and replication. All other cloud services we use internally also use industry-standard TLS (Transport Layer Security) and have up-to-date security measures and protocols.
We have set out below, in a table format, a description of all the ways we plan to use your Personal Data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need additional details about the specific legal ground we are relying on to process your Personal Data where more than one ground has been set out in the table below.
|
Purpose/Activity |
Category of Personal Data |
Lawful basis for processing including basis of legitimate interest |
|
To register you as a new customer, to perform our onboarding checks (for example identification verification and anti-money laundering checks) and to enter into a contract with you. |
(a) Identity (b) Contact |
(a) Performance of a contract with you (b) Compliance with legal obligations (c) To prevent fraud |
|
To process and deliver the services that we agree to provide to you including: (a) Manage payments and charges (b) Collect and recover money owed to us (c) Complying with legal and regulatory reporting obligations (e.g., regarding money laundering and sanctions), (e) To assist the insurance providers, law enforcement bodies and regulators. |
(a) Identity (b) Contact (c) Transaction |
(a) Performance of a contract with you (b) Necessary for our legitimate interests c) to recover debts due to us. (d) compliance with legal obligations |
|
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy or if we were to use your data for a purpose not set out in this policy. (b) Asking you to leave a review or take a survey |
(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Transaction |
(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests d) to keep our records updated, e) to study how customers and clients use our products/services; (f) compliance with legal obligations |
|
To administer and protect our business and our IT Sytems, intranet and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
(a) Identity (b) Contact (c) Profile (d) Technical (e) Usage |
(a) Necessary for our legitimate interests i) for running our business relationship, ii) provision of administration and IT services, network security, iii) to prevent fraud, iv) in the context of a business reorganisation or group restructuring exercise. (b) Necessary to comply with a legal obligation |
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you |
(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical |
Necessary for our legitimate interests i) to study how customers use our products/services, ii) to develop them, iii) to grow our business and iv) to inform our marketing strategy. |
|
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences |
(a) Technical (b) Usage |
Necessary for our legitimate interests i) to define types of customers for our products and services; ii) to keep our website updated and relevant; iii) to develop our business; and, iv) to inform our marketing strategy. |
|
To make suggestions and recommendations to you about goods or services that may be of interest to you, including providing general technical updates |
(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile |
Necessary for our legitimate interests i) to develop our products/services; and, ii) to grow our business. |
|
To use third party marketing platforms to obtain information regarding you as a customer in respect of your purchases and to measure and understand the effectiveness of the advertising we serve to you |
(a) Identity (b) Contact (c) Profile (d) Marketing and Communications |
Necessary for our legitimate interests i) to study how customers use our products/services, ii) to develop them, iii) to grow our business and iv) to inform our marketing strategy. |
|
To perform services for you throughout your relationship with us and customer service |
(a) Identity (b) Contact (c) Transaction (d) Profile |
(a) Performance of a contract with you (b) Necessary for our legitimate interests i) for running our business relationship, ii) provision of administration and IT services, network security, iii) to prevent fraud. |
|
Job applicants: |
a) Identity |
i) Legitimate interests. |
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
You also have the right to request deletion of all of your Personal Data we hold on record about you or modify your Personal Data if it is inaccurate or incomplete for further details, please see paragraph 10 below. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, insurance, tax, accounting, and other requirements we are required to comply with.
Your Personal Data shall not be kept for longer than is necessary, although it is not possible for us to always specify in advance how long this may be for. We may have to continue to store and process your data and also contact you directly relating to the completion of our services if it is necessary for our compliance with certain legal, regulatory or insurance obligations. By law we have to keep basic information about customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes. For further information, please contact us.
If you are a job applicant:
- Where your application is successful, we will provide further information as to how we will use your personal information during the course of your employment.
- Where your application is unsuccessful, we will retain your applicant data for 6 months.
You have a number of rights under data protection laws in relation to your Personal Data. You have a right to:
- Request access to your Personal Data (commonly known as a "subject access request"). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it. You can request access to your Personal Data we hold by emailing privacy@thewowcompany.com. We will typically respond to your request within 30 days and any data will be provided in a machine-readable format. Please see paragraph 12(c) below for further details.
- Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Ask us not to process your Personal Data for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes. We will never disclose your information to any third party for such purposes. Occasionally, we may share your data with businesses that are part of the Wow group of companies (the “Group”) – businesses that are wholly or part-owned by Wow Holdings Limited of 3rd Floor, 86-90 Paul Street, London, England, London with company registration number 09646592. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at privacy@thewowcompany.com.
- Request erasure of your Personal Data in certain circumstances. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
- Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in one of the following scenarios:
- If you want us to establish the data's accuracy;
- Where our use of the data is unlawful but you do not want us to erase it;
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
- You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Our Website may, from time to time, contain links to and from the Website of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any Personal Data to these websites.
11) Third Party Links
Our Website may, from time to time, contain links to and from the Website of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any Personal Data to these websites.
12) Cookies
For more information about the cookies we use and how to change your cookies preferences, please see our Cookie Policy.
13) Accessing your personal data.
If you would like to access the Personal Data we hold about you, please contact us as described in paragraph 10 above.
(a) No fee usually required
You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
(b)What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
(c)Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
You have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK regulator for data protection issues (www.ico.org.uk) We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
The ICO address is as follows:
Information Commissioners Office
Water Lane
Wilmslow
Cheshire
SK9 5AF
Phone: 0303 123 1113
Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our privacy policy.
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes.
Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
Comply with a legal obligation means processing your Personal Data where it is necessary for compliance with a legal obligation that we are subject to.
Personal Data has the meaning given to it at the beginning of this Privacy Notice.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
Processor means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.
The Wow Company UK Ltd
Version 2, implemented MARCH 2024
