Privacy policy

DESIGN DUNDEE LIMITED

ONLINE SHOP CUSTOMER PRIVACY NOTICE

Who we are

Design Dundee Ltd. (company number SC370598), is a company registered in Scotland and our registered office is at Whitehall House, 33 Yeaman Shore, Dundee, United Kingdom DD1 4BJ. Our main trading address is Design Dundee Ltd, V&A Dundee, Enterprise House, 3 Greenmarket, Dundee, United Kingdom DD1 4QB (“DDL”, “we” or “us”).

Contact details

DDL is the controller responsible for your personal data. If you have any questions, comments or requests regarding this privacy notice or our data protection practices, please contact us by email at .

Purpose of this privacy notice

We are committed to protecting and respecting your privacy. This privacy notice aims to give you information on how DDL collects and processes your personal data through your use of this website to purchase a product or contact us. This notice is supplementary to our wider .

If you are under 16 years of age, you should always ask your parent or guardian before buying products from as well as responding to anything on and asking us to send anything to you or another young person on our website.

Personal data we may collect from you

Contact Details: name and title, your address, billing address, email address and telephone numbers.
Usage Data: information about how you use our products, services and website.
Technical Data: your internet protocol (IP) address, browser type and version, time zone setting and location, browser type, operating system, and other technology on the devices you use to access our website.
Financial Data: includes bank account and payment card details.
Transaction Data:includes details about payments to and from you and other details of products and services you have purchased from us.
Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

The table in Annex A to this notice sets out the type of data we may process about you.

How your personal data is collected?

We collect personal data directly from you when you:

Become a customer of DDL;
Sign up to our e-news letter; and
Contact us by phone, our website, email, social media.

Website Data

When you visit our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy at Cookie Policy for further details.

Third-party links

This website may contain links to and from the websites of participant organisations, our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.

How your personal data is used

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract we are about to enter into or have entered into with you;
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
Where we need to comply with a legal obligation.

Annex A to this notice sets out the ways we may use your personal data and the legal bases we rely on to do so.

How long to we keep your personal data

We retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Marketing

With your consent, we may send you information about special offers, products and services which we think may interest you. We may ask permission to share your information with third parties affiliated with us so they can send information about their special offers, products and services. You can ask us or third parties to stop sending you marketing messages at any time following the opt-out links on any marketing message sent to you or by contacting datacontroller@vandadundee.org

Sharing your personal data

We may share your personal data securely with external third parties, including:

External third parties that provide us with services, providers, our professional advisers and regulatory bodies;
Dundee Museums Foundation (a Scottish Charitable Incorporated Organisation registered Scottish Charity No. SC043889, registered office address 34 Reform Street, Dundee, DD1 1RJ) strictly for the purposes of record keeping, in the instance where you have made any donations and for marketing and fundraising for V&A Dundee; and
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

Where third parties process data on our behalf, they won’t use your personal information for their own purposes and we only permit them to use it in accordance with our instructions and the law.

International Transfers

If any of our external third parties are based outside the EEA we may need to send them your personal data. Where we transfer your personal data out of the EEA, we make sure we have appropriate safeguards in place to protect it.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of your rights set out above, please do not hesitate to contact us at datacontroller@vandadundee.org

right to request access to your personal data - you can request a copy of the personal data we hold on you;
right to request correction of your personal data - if any personal data we hold on you is incorrect, you can request to have it corrected;
right to request erasure of your personal data - you can ask us to delete your personal data in certain circumstances;
right to object to processing or restrict processing of your personal data - you may object to our processing of your personal data in certain circumstances;
right to request the transfer of your personal data - to provide you, or a third party you have chosen, with your personal data; and
right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time
right to complain – if you have any data protection complaints, you have the right to complain to the Information Commissioner's Office (ICO) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Email: casework@ico.org.uk Telephone: 0303 123 1113

Changes to the privacy notice

Any changes we may make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. We keep our privacy notice under regular review. Please check back frequently to see any updates or changes to our privacy notice. If you have any questions about his notice please contact datacontroller@vandadundee.org.

Annex A – Processing Activities

This table format described the ways we may use your personal data when you buy products from our website, and the legal bases we rely on to do so.

Purpose	Type of personal data	Legal basis for processing
When you agree to become a customer of DDL	· Contact Details	· Performance of a contract
To manage our relationship with you by responding to your enquiries and notifying you of changes to our terms or privacy notice	· Contact Details, Usage	· Performance of a contract · Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To process and deliver your order including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us (c) Process any returns and issue refunds	· Contact, Financial, Transaction, Marketing and Communications Data	· Performance of a contract · Necessary for our legitimate interests (to recover debts)
To contact you for the purposes of research, feedback and surveys	· Contact Data	· Performance of a contract · Necessary for our legitimate interests (to keep our records updated and to study how customers use our services/products)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	· Contact Details, Technical, and Usage Data	· Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security and to prevent fraud) · Consent (to set cookies) · Necessary to comply with a legal obligation
To administer our products/services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes	· Contact Details, Technical Data	· Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	· Contact Details, Usage, Technical, Marketing and Communications Data	· Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	· Technical and Usage Data	· Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about products or services that may be of interest to you	· Contact Details, Technical, Marketing Communications Data	· Necessary for our legitimate interests (to develop our products/services and grow our business)