We understand that your privacy and the security of your personal information is extremely important. This notice sets out what we do with your personal information, what we do to keep it secure, from where and how we collect it, as well as your rights in relation to the personal information we hold about you.

This policy applies if you interact with us through our Shop, over the phone, online, or otherwise by using any of our websites or interacting with us on social media.

Intu-Diy – Things you really need to know

• You have a number of rights over your personal information. How you can exercise these rights is set out in this notice.
• We do send direct marketing, if we’re allowed to. And we do this to encourage you to buy our products and services by sending you offers and ideas that we feel will be of benefit to you. If you want us to stop then you will need to unsubscribe from our mailing list.
• We also display online advertising relating to our products and services online media channels.

Who are we?

• Intu-Diy, 2 Morton Street, Byker, Newcastle, England, NE6 2JH

What sorts of personal information do we hold?

• Information that you provide to us such as your name, address, date of birth, telephone number, email address, and any feedback you give to us, including by phone, email, post, or when you communicate with us via social media. 
• Information about the services that we provide to you (including for example, the things we have provided to you, when and where, what you paid, the way you use our products and services, and so on).
• Your account login details for our services, including your user name and chosen password.
• Information about whether or not you want to receive marketing communications from us.
• Information about any device you have used to access our Services (such as your device’s make and model, browser or IP address) and also how you use our Services.
• Your contact details and details of the emails and other electronic communications you receive from us, including whether that communication has been opened and if you have clicked on any links within that communication.

Our legal basis for processing your personal information

Whenever we process your personal information we must have something called a “legal basis” for what we do. The different legal bases we rely on are:

• Consent: You have told us you are happy for us to process your personal information for a specific purpose.
• Legitimate interests: The processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.
• Performance of a contract: We must process your personal information in order to be able to provide you with one of our products or services.
• Prevention of fraud: Where we are required to process your data in order to protect us and our customers from fraud or money laundering.
• Legal claims: The processing of your personal information is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Legal obligation: We are required to process your personal information by law.

How do we use your personal information?

There are a number of ways in which we use your personal information, depending on how you interact with us. If you do not provide your information to us, then we will be unable to interact with you in that way.

We may use your information in the following ways:

To provide our products and services – we need to use your personal information to make our products and services available to you.

To personalise your shopping experience – Understanding how you interact with the into-diy, the products and services you buy and how you use and browse our websites.

For safety and security – we monitor online behaviour and carry out checks to help us ensure that our customers are genuine to prevent fraud and to help customers use our services appropriately.

Analytics and profiling – we use your personal information for statistical analysis and to help us understand more about our customers. That includes understanding the products and services you buy. This helps us to serve you better and to find ways to improve our services, stores, websites. These profiles help us to send you offers that are more relevant to you.

Contacting you – we use your personal information to contact you: either to conduct market research or to contact you about products and services from us and other companies. We may also contact you in relation to any questions you have raised with us or to discuss the status of your account with us.

Cookies and similar technologies We use cookies to help give you the best experience on our websites and to allow us and third parties to tailor ads you see on ours and other websites.

“A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.”

This helps us analyze data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Who might we share your personal information with?

Klarna

“In order to offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data transferred is processed in line with Klarna’s own privacy notice.”

Our service providers – we work with partners and suppliers so that they can help us provide the products and services you require from us. These third parties process your personal information on our behalf and are required to meet our high standards of security before doing so. We only share information that allows them to provide their services to us or to facilitate them providing their services to you. These third parties include:

• Advertising companies, who help us place into-diy adverts online.
• Scheme providers – such as Visa and MasterCard in order to manage your account and so your payments are processed.
• Our agents, advisers or others involved in running accounts and services for you and your business.
• Social media providers – such as Facebook, Instagram and Twitter – where we interact with you on social media.
• Third party vendors who help us to manage and maintain the Group IT infrastructure.
• Logistics and delivery providers who enable us to deliver products you order on our websites.
• Where relevant, our professional advisors, such as lawyers and consultants.
• Companies that deploy our email campaigns for us because they need to know your email address to carry out these services.
• Companies that provide insights and analytics services for us so we can stock the right products, send the right marketing campaigns and understand our business and customers better.
• Security and fraud prevention companies to ensure the safety and security of our customers, colleagues and business.
• Companies who assess faults and repair products on our behalf.
• Companies administer competitions for us so they run smoothly.
• Companies that enable us to collect your reviews and comments, both online and offline.

Other organisations and individuals – we may share your personal information in certain scenarios. For example:

• If we’re discussing selling or transferring part or all of into-diy, we may share information about you to prospective purchasers and their advisers – but only so they can evaluate the relevant business; or
• If we are reorganised or sold to another organisation, we may transfer information we hold about you to them so they can continue to provide the Services to you.
• If we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority such as the police or the Department for Work and Pensions;
• If we need to do so in order to exercise or protect our legal rights, users, systems and services; or In response to requests from individuals (or their representatives) seeking to protect their rights or the rights of others. We will only share your personal information in response to requests which do not override your privacy interests. For example, we will not share your personal information with individuals who are merely curious about you, but we will share your personal information to e.g. insurers, solicitors, employers etc. which have a legitimate interest in your personal information.

Keeping you informed about our products and services

We would like to tell you about the great offers, ideas, products and services of the into-diy from time to time that we think you might be interested in. Where we have your consent or it is in our legitimate interests to do so, we may do this through the post, by email, text message or by any other electronic means. We won’t send you marketing messages if you tell us not to, but if you receive a service from us we will still need to send you occasional service-related messages. If you wish to amend your marketing preferences, you can do so by logging into your account and Unsubscribing from Email Marketing

Please note that it can take up a little while for all marketing to stop once you either withdraw your consent or tell us you’d like to opt out of marketing. This is because some marketing may already be in transit.

Your rights

You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.

These include:

• the right to access a copy of the personal information we hold about you;
• the right to correction of inaccurate personal information we hold about you;
• the right to restrict our use of your personal information;
• the right to be forgotten;
• the right of data portability; and
• the right to object to our use of your personal information. Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time.

If you are seeking to exercise any of these rights, please contact us using the details in the “Contact Us” section below. Please note that we will need to verify your identity before we can fulfil any of your rights under data protection law. This helps us to protect the personal information belonging to our customer against fraudulent requests.

How long will we keep your personal information for?

We will keep your personal information for the purposes set out in this privacy policy and in accordance with the law and relevant regulations. We will never retain your personal information for longer than is necessary. In most cases, our retention period will come to an end 7 years after the end of your relationship with us.

Security

We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:

• We limit physical access to our buildings and user access to our systems to only those that we believe are entitled to be there;
• We use technology controls for our information systems, such as firewalls, user verification, strong data encryption, and separation of roles, systems & data;
• Systems are proactively monitored through a “detect and respond” information security function;
• We utilize industry “good practice” standards to support the maintenance of a robust information security management system; and
• We enforce a “need to know” policy, for access to any data or systems.

Contact us

If you would like to exercise one of your rights as set out in the “Your rights” or “Automated decision making and profiling” sections above, or you have a question or a complaint about this policy, or the way your personal information is processed, please contact us by one of the following means: Intu-Diy, 2 Morton Street, Byker, Newcastle, England, NE6 2JH You also have the right to lodge a complaint with the UK regulator, the Information Commissioner. Go to ico.org.uk/concerns to find out more.