1. Right to be informed
You have the right to be informed about how we collect and use your personal data. This is known as a key transparency requirement under the UK?GDPR. This Privacy notice provides that information. We regularly review, and where necessary, update your privacy information, if we do, we will highlight those amendments with the date and time they were made. If you require more information about how we process your personal data, go here.
2. Right to access
You have the right to ask us for a copy of your personal data that we hold about you. This is known as a “Subject Access Request” or SAR. We will send you a copy of the information within one month of your request once we have confirmed your identity. We can extend the time limit by a further two months if your request is complex or if we receive a number of requests from the you.
A third party can also make a SAR on your behalf but we need to know we have your permission to give them the information so we may need further information from you such as a written authorisation.
We can accept SAR requests either verbally, via email or post or via social media, however, the quickest and most secure way for you to obtain your personal data is via our SAR portal here. The SAR portal has been set up make the SAR process as quick and easy as possible and we can keep you updated as to the progress of your request. You can communicate with us about your SAR via the portal as well as securely view your personal data.
We can refuse to provide your information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive. However, we will always do our best to provide you with your personal data and help you to change your request, for example if we believe the request to be excessive, by asking you to clarify your request to help us locate the information you are asking us for.
3. Right to rectification
If you think any of the information, we hold about you is incorrect, you can either:
- visit the “My Account” section of the website where you can make changes to some of the information that we hold about you; or
- go here and submit a request asking us to check your information and if it’s incorrect, change it for you.
4. Right to be forgotten
You can ask us to erase your personal information. We can only do this in certain circumstances (see Frequently Asked Questions above). We will consider every request for erasure on an individual basis. You can ask us to delete your data here.
5. Right to object
You can object to us using your data in certain circumstances. If your request relates to direct marketing, we will stop using your data for marketing purposes immediately on request. This is also known as “opting out” of marketing (see Frequently Asked Questions). If you believe we should stop using your data for any other purpose, you can ask us to stop using your data here
6. Right to restrict processing
You can ask us to restrict the use of your data if you think it is inaccurate, but this will take time to validate, if you believe our data processing is unlawful but you do not want your data erased, if you want us to retain your data to establish, exercise or defend a legal claim, or if you wish to object to the processing of your data. Then you can ask us here but please be aware, you will need to explain to us why you need us to restrict using your data.
7. Right to data portability
If you would like us to move, copy or transfer the data that we hold about you to another organisation, please contact our Data Protection Officer at firstname.lastname@example.org.
Please be advised that this only applies to certain data which has been submitted by you electronically for specific purposes only. Our Data Protection Officer can provide further advice.
Where we hold a customer’s details, we will also seek to ensure that, as far as possible, we maintain a single composite record of their interactions with us, which may require us to match their different activities. Where customers have indicated that they do not want us to us their data for receiving communications (other than those deemed legitimate), we will use this information purely for anonymised internal analytics and reporting, for example, looking at sales trends which does not identify individual customers.
If you do not want us to undertake profiling or matching, you may either:
- object to the processing of your data (see number 5 of this Privacy Notice above) or
- request that Halfords erases all personal data about you (see number 4 of this Privacy Notice above)