Privacy Policy
Last updated: 17th September 2021
Introduction
As part of running our business and providing products and services via our website, it is sometimes necessary for us to collect and process information about you.
We are acutely aware of the need for security and privacy of your data, and we take our commitment to that privacy very seriously.
In this privacy policy, we aim to set out what personal information we have (or may have) access to, why we need it, what we do with it, who we share it with and your rights in relation to that data.
Please be assured that we only collect and use information that is required to help us fulfil product orders and otherwise further our legitimate business interests – we are not in any way involved in the practice of selling personal data to 3rd parties.
Who we are & how to contact us
Firstly, we should introduce ourselves:
We are Spice Unlocked Ltd, a company registered and operating in the United Kingdom under company number 12660256.
Our registered address is 20-22 Wenlock Road, London, England, N1 7GU.
If you wish to contact us on any privacy related issue, please email us at privacy@spiceunlocked.com.
Why we collect data
Firstly, when we refer to ‘personal data’, we mean any information that can (or could, in theory) be sufficient to identify you as an individual. That is the type of data that we are most keen to protect.
Obvious examples of personal data are things like your name, your email address, phone number, postal address etc.
Other less obvious examples are technical information that is sent by your computer (or other device) when using our systems, like your IP address or broad physical location.
We will only collect or process this type of information for a reason, and those reasons are broadly:
- Where it is essential, such as the need to collect your home address for the purpose of delivering an order to you;
- Where we need to in order to make our website work in a usable and convenient way – such as the need to remember what products you have placed in your online basket;
- Where it allows us to undertake security and anti-fraud/anti-spam checks to protect our systems;
- For marketing and promotional purposes – such as the ability to detect whether you have visited our website before, and to allow us to tailor/personalise marketing or advertising on that basis.
Our general principle is this:
- where it is essential for us to collect and process data (either to fulfil an order or other request that you have made), then we will do so – and we will detail information relating to that data here in this privacy policy.
- When data is required for some other, non-essential purposes (such as for our own marketing purposes) then we will only do so if we have your consent.
We believe that this approach is fully in line with the requirements and principles of the Data Protection Act and the UK GDPR.
What data we collect
When you visit the Spice Unlocked website
When you visit the Spice Unlocked website, regardless of whether you place an order, our system will automatically collect some limited information about you – or, more accurately, about your computer/other technology.
Your computer/device will send information to us such as your Internet Protocol (‘IP’) address, your broad physical location, the type of device you’re using (such as the browser type and version) and some other technical data.
We can’t identify you as an individual from this information. Storing this basic technical information allows us to perform certain security processes (such as detecting and preventing attempts to maliciously access our website).
Analytics
We would also like to collect some other information about your visit to our website, including what pages you visited, how long you browsed the site for, which buttons you clicked on, and so forth. This type of analytics information allows us to understand and improve our services over time.
However, this analytics information is not essential to the operation of the website, and so we will ask for your consent before we collect this information about you. For that, we will use a pop-up consent box when you first visit the site, alongside the ability for you to change/withdraw that consent at a later stage. You can find more details about this aspect in the section on Cookies below.
Marketing
In addition to our website, we operate a number of social media channels, including Facebook, Instagram and Twitter.
It is useful for us to be able to identify which of the visitors to our website are also social media users – as this can allow us to tailor/personalise some of our social media campaigns.
By connecting our website to those social media platforms, it is possible for us to do that.
Similar to analytics, since this activity is not essential to the operation of the site, we will ask for your consent before we process this type of information about you. We will use a popup consent box when you first visit the site, where you can select whether you agree to this marketing activity.
You can find more details about this aspect in the section on Cookies below.
When you place an order via the Spice Unlocked website
Perhaps obviously, when you place an order via our website, we have to collect certain data about you in order to fulfil the order. That data includes:
- Your name and address for billing purposes
- Your name address for shipping purposes (if different)
- Your email address
- Your phone number.
This information is collected purely for the purposes of fulfilling your order and providing ongoing customer support, we will not use it for any other purposes – so you can rest assured that we will not, for example, send unsolicited mail to your address as a result of purchasing a product from us.
See also:
When you create an account on the website
For convenience, our website offers the ability to create a Spice Unlocked account, so that you only need to enter your information (name, addresses etc) on your first order. Essentially, it makes subsequent orders quicker and easier.
You can create an account without placing an order, and if you do, we will collect the same information as detailed in the section above on placing an order.
See also: Cookies
When you leave a product review
Our website allows customers to leave their own personal product reviews. In order for us to keep this process secure (and prevent spam/offensive comments), we require certain information to be submitted with the review and we operate a review moderation process.
In order to leave a review, you must provide (in addition to the detail of your review itself) your name and your email address.
This data is stored for the purposes of moderating your review – and whilst your name may be displayed on the website alongside your review, your email address will never be publicly displayed.
Notes relating to online payments and debit/credit card security
When you place an order via the Spice Unlocked site, you will be given the choice of two methods of payment – PayPal or Stripe (Debit/Credit card payments).
Please be assured that we do not have any access whatsoever to the payment information that you enter (whether that be via your PayPal payment mechanisms, or the debit/credit card information that you enter). In both cases, the payment details are exposed only to the payment processor themselves (i.e. PayPal or Stripe), and at no point do we process, store or otherwise have access to your payment details.
Even in the event that you choose to store your payment details for future orders, those details are stored on the relevant 3rd party’s system, and never on our site or servers.
Cookies and other similar technologies
Most people are now familiar with website cookies. They are small text files that can be placed on your computer/device when you visit a website, and which can be used for a variety of purposes.
In general terms, they do not store personal data about you, but they can allow a system to recognise that you have visited before and, as a result of that, perform some different action.
Because they can be used for the purpose of ‘tracking’ a user’s activity in this way, cookies are considered to fall within the scope of the Data Protection Act, UK GDPR and other privacy regulations.
For this reason, we will ask for your consent before we use any cookies that are not essential to the operation of the website. We will do that via a popup cookie consent notification that appears when you first visit our website.
That cookie notification explains that:
- The site does use some cookies that are essential to the operation of the site. They include ones that enable our instore shopping cart to work (and remember what you want to purchase), alongside some for security purposes and some that (ironically) remember your cookie preference choices. When you visit the site, we will use these cookies and will not seek your consent beforehand;
- The site would also like to use cookies that are not essential to the operation of the site, but which will help us streamline or improve our business, help us to tailor/personalise our advertising or generally make the site easier and more convenient for you to use. These non-essential cookies are split into different categories (currently ‘Analytics’ and ‘Marketing’) and you have the ability to choose whether you want to allow those cookies to be used. The default position is always ‘no’. If you click on the ‘Accept All’ button on the cookie notification, that is your means of expressing consent to all of our recommended cookies.
When visiting the website, you can check/update your cookie preferences at any time by using the ‘Cookie Consent’ link at the bottom of every page.
Depending on the web browser you use, it is also possible to block the placement of cookies on all websites by changing the settings on the browser itself. Please note, however, that doing this may affect the functionality of our site, and not all functions will be available to you.
Who we share data with
We operate on a strict ‘need to know’ basis for all data that we work with, and that is particularly true for any personal data. The only people/organisations that are granted access to personal data are:
- Employees of Blackbox Web Design who provide design and/or support services;
- Our web hosting technology suppliers (currently 20i.com, DigitalOcean and Linode) who provide the physical server infrastructures that our website(s) operate on. We ensure that all servers in use reside physically in the UK, and that no customer data is transferred to data centres outside the UK.
- Our cloud storage and technology supplier (currently Amazon Web Services) whose services we use for secure backup storage and email relay services. We utilise AWS data centres within the UK for such purposes.
- Defiant Inc, the providers of the Wordfence™ security software that protects our website. Only limited, technical data (such as device IP address, browser type/version, language etc) are transmitted.
Your rights in relation to your data
The DPA and UK GDPR stipulate that you have the following rights:
- Your right of access – You have the right to ask us for copies of your personal data.
- Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
If you wish to exercise any of these rights, please contact us using the contact details set out above.
