Privacy and security

We treat your data with the utmost respect and care. We always aim to be as transparent to our customers as possible and we treat your data the way we would expect our own personal data to be treated. You can find out about what information we store, how we process your data, your rights and other privacy related information in the following privacy policy. If you have any questions relating to your personal information, please contact the Data Controller: email enterprise@victimsupport.org.uk or write to: Victim Support, 1 Bridge Street, Derby, Derbyshire, DE1 3HZ.

To view Victim Support's privacy policy, please see the following link:
https://www.victimsupport.org.uk/privacy-policy

Who are we?
Victim Support Gifts is a trading name of Otter House Ltd (Company Number: 2655839) who operate this website on behalf of Victim Support. Otter House Ltd is the Data Processor for this website and are registered with the Data Protection register under Registration Number Z6136350. Victim Support is the Data Controller for this website and are registered with the Data Protection register under Registration Number Z764183X.

What data do we hold?
We only hold the data that is necessary to fulfil our contract with you on behalf of the charity and make sure our service is the best it can be. We use the legitimate interest basis under the GDPR (General Data Protection Regulations) to process your personal information in order to process any orders. We will need to hold your name, address, email address and telephone number on our systems. We store this data so that we can not only complete our contract with you to fulfil your order but also for fraud protection reasons and to be able to provide refunds etc. Your order information is passed to another Data Processor; Clientbase Fulfilment Ltd (To view Client base Fulfilment Ltd's privacy policy please see the following link: http://www.clientbasefulfilment.co.uk/privacy-policy.html). Clientbase Fulfilment Ltd fulfil your order and then remove the order information after suppling the order details to Victim Support.

When you visit our website, we track each browsing session and the various products you have visited. We do this for several reasons including gaining feedback on our products and services, as well as being able to provide a better service to you by recommending products and services we think you will like. We use this data to tailor our emails to you and make use of it through our other marketing channels if you have subscribed to our email list or any of those other channels.

You can read more about our cookie policy here:
https://www.victimsupportgifts.co.uk/acatalog/Cookie-Policy.html

We do not store or hold any credit or debit card information. All payments go through our payment providers (Sage Pay and PayPal) securely using encryption.
We store your device type and IP address in our system logs for fraud protection reasons and to help identify any intrusions or denial of service attacks on our website. We do not use your IP address for any other reason and all logs are stored securely on our servers. These logs are deleted periodically.

Our website servers are hosted in Germany.

Who do we share your data with?
For us to function as a business and provide you with the best possible customer service and experience, we work with a few other third parties. We also share some of your data with our customer support team and other staff members as required so they can support you in case of a problem with a purchase or product or to help fulfil our contract with you (for instance a warehouse picker/packer). We only share your data with third party companies to fulfil our services to you. We will never sell your data to any other company or third party.

Our website uses Google Analytics to track user interaction. We use this data to determine how many people are using our site, what they are viewing, when they are viewing it and how they are navigating through the site. We use this data as feedback to be able to improve our service and offerings to you and it helps us with making decisions on how our promotions are doing, server requirements in the future (capacity planning) etc. Google records data like your approximate location, internet browser, device and operating system however, none of this device is identifiable to us. Google Analytics does record your IP address though this is not identifiable to us. Google makes use of cookies. You can control cookies using your browser settings (Please see here for more information: http://www.allaboutcookies.org/manage-cookies/).

We provide several ways for customers to pay for their goods so if you have a PayPal account you can use that account to make a payment. We also use Sage Pay for standard credit/debit card payments. This privacy policy does not cover these external processors so please read their respective privacy policies if you are concerned about the way your data is processed. Whilst we believe that all payment information is processed by servers hosted in the European Economic Area (EEA), we cannot guarantee it as these payment processors may end up using servers hosted in the USA or elsewhere. If you are not happy with the possibility of payment information being sent outside of the EEA, we recommend that you do not use our site to purchase products, services or donations.

We use a variety of other third-party companies who provide professional services to us and help us run our business. These companies help us with things like merchandising our site and internal search results of our website, marketing agencies, email service providers, advertising partners and other software partners (for example postcode lookup). We may use companies whose services are either based in the EEA (European Economic Area) or are located outside of the EEA but are under an equivalent and approved privacy scheme by the EU (for example the EU-US privacy shield see here for more information: https://www.privacyshield.gov/welcome).

Our current Data Processors are:

Google analytics: Our website like many others uses GA to track information about number of users, pages visited, length of browse time. We use this information to improve our sites and services.

Clientbase Fulfilment Ltd: Clientbase Fulfilment Ltd fulfil your order and then remove the order information after suppling the order details to Victim Support. Clientbase Fulfilment Ltd is a Data Processor for this website and are registered with the Data Protection register under registration number Z6136350.

Sage Pay: Our website like many others use payment providers to process the payments online for your orders securely using encryption. We use this information to confirm whether payment has been made and to action refunds. For more information on Sage Pay and their privacy policy, please see here for more information: https://www.sagepay.co.uk/policies/privacy-policy

PayPal: Our website like many others use payment providers to process the payments online for your orders securely using encryption. We use this information to confirm whether payment has been made and to action refunds. For more information on Sage Pay and their privacy policy, please see here for more information: https://www.paypal.com/uk/webapps/mpp/ua/privacy-prev

Your Rights
Under the General Data Protection Regulations (GDPR) you have several new rights in relation to the data we store and hold about you:

- The right to see what information we have via a subject access request: please contact the Data Controller: email enterprise@victimsupport.org.uk or write to: Victim Support, 1 Bridge Street, Derby, Derbyshire, DE1 3HZ.

To view Victim Support's privacy policy, please see the following link:
https://www.victimsupport.org.uk/privacy-policy

- The right to be forgotten and have your data removed from our systems.
- The right to have your data rectified if it is incorrect.
- The right to be informed about the way we process and handle your data. You can read about how we process your data and handle it in this privacy policy.
- The right to data portability so you can reuse your personal data for your own purposes across different services
- The right to opt out of automated decision making including profiling.
- The right to lodge a complaint with a supervisory authority

You can read more about your rights and GDPR here at the information commissioner's office https://ico.org.uk

Marketing:
If you do not wish to receive our marketing anymore, you can stop receiving marketing messages from us through

- Previous marketing emails we have sent you by clicking the unsubscribe link
- By contacting our customer services team

Data Retention
We keep order information for our own records and legal reasons for a limited amount of time. However, we will not keep this information longer than is necessary. If you do ask for your data to be erased, we may not be able to remove all of it due to ensuring we uphold our responsibilities to legal or regulatory requirements, fraud and abuse or to enforce our terms and conditions.

Changes to how we protect your privacy
Data protection and security is an ever-changing landscape. Our website will continually evolve with new service providers and mechanisms to provide our customers with a better service. Your data and privacy are of the utmost importance to us. We will always ensure your data is protected when implementing new services and will update this privacy policy as and when new things become live.

How to contact us
We always want to hear from our customers (especially if you feel we've let you down or could do better).

If you:

- Have any questions or feedback about this notice
- Would like us to stop using your information
- Want to exercise any of your rights as set out above, or have a complaint

Please don't hesitate to contact our customer care team, who will be happy to answer any questions you may have.

You can contact the Victim Support privacy team by email enterprise@victimsupport.org.uk or write to: Victim Support, 1 Bridge Street, Derby, Derbyshire, DE1 3HZ.

To view Victim Support's privacy policy, please see the following link:
https://www.victimsupport.org.uk/privacy-policy