Privacy Policy
Hello! Thanks for visiting us. We'd like to explain the terms on which we engage with you through our website and/or app.
Our lawyers tell us that we must give you loads of detail, so we've set out the top lines here and you can click on any of them for the detail.
- Yet another thing that you can't do until you're 18...
- Who we are and contact details
- What information we use
- How we collect your personal information
- What we do with your information and how it is lawful
- Who we share your information with, and why
- International transfers
- How long we keep your information
- Your rights in relation to your information
Yet another thing that you can't do until you're 18...
The databonds website, app, and service are for people who are 18 or over. If you are lucky enough to be younger than that, you will have to wait a bit longer before you can sign up.
Who we are and contact details
databonds is a trading name of Open Retail Limited (company number 13638064). We are responsible for looking after your personal data, keeping it safe and using it lawfully.
If you want to get in touch about any privacy issues, please contact us here: privacy@databonds.co.uk
If you want to get in touch about any privacy issues, please contact us here: privacy@databonds.co.uk
What information we use
The information about you that we use falls into various groups.
- Identity Data - first name, last name, username or similar identifier, title, date of birth and gender.
- Contact Data - email address and telephone numbers.
- Your household – the number of people in your household; occupation; household income bracket; whether the account-holder is the main shopper;
- Shopping Data – loyalty card number; online shopping ID; registered email address; details of the products and services that you have bought.
- Your journey with us: how you use our website, app, products, and services.
- Your computer and internet settings: your IP address, login data, browser type and version, browser plug-ins, operating system and platform, and time zone.
- Your marketing preferences: whether you have chosen to receive our marketing communications and if so, whether you prefer emails or calls (we don't use paper...).
How we collect your personal information
We collect information directly from you when you register for the app, website, or any of our services and when you answer surveys, send us feedback or any other messages.
We also collect information in the background about how you use our app and website. When you ask us to retrieve your shopping data from retailers, they send us your data. We upload this into our data warehouse and you can always see what information is there via the website or the app.
We also get your information from analytics and advertising services. View our Cookie Policy to see who they are and what sort of data they collect.
We also collect information in the background about how you use our app and website. When you ask us to retrieve your shopping data from retailers, they send us your data. We upload this into our data warehouse and you can always see what information is there via the website or the app.
We also get your information from analytics and advertising services. View our Cookie Policy to see who they are and what sort of data they collect.
What we do with your information and how it is lawful
Mostly, we use your personal information to retrieve your shopping data for you, pop it into our data warehouse, make insights available in the future and allow you to request your shopping data via the website and/or app. We use it to provide you with insights into your shopping habits, allocate you databonds, and enter you into our prize draw. These are all things that we have agreed to do as part of our contract with you.
We also do some things with your shopping data that are in our legitimate interests, and which don't unfairly affect your privacy.
Your shopping data in our data warehouse is linked to your ID number but not to your contact details (this is called ‘pseudonymising'. That means that only someone who knows your ID number can identify you from it and we never share your ID number. Once we have done that, we delete the copy that we received from the retailer).
We generate money to fund the prize draws by aggregating your shopping info that is in our data warehouse with that of all our other members and generating anonymised insights that we sell to brands and our other clients. You cannot be identified from this information.
Sometimes we combine the information in our data warehouse with anonymous demographic or statistical material from various sources. You can't be identified from this combined information, and it is no longer personal data.
We don't generally ask you to consent to our use of your info except for sending you marketing stuff.
You can see full details of what we do with your info and how we make it lawful in the table below.
We also do some things with your shopping data that are in our legitimate interests, and which don't unfairly affect your privacy.
Your shopping data in our data warehouse is linked to your ID number but not to your contact details (this is called ‘pseudonymising'. That means that only someone who knows your ID number can identify you from it and we never share your ID number. Once we have done that, we delete the copy that we received from the retailer).
We generate money to fund the prize draws by aggregating your shopping info that is in our data warehouse with that of all our other members and generating anonymised insights that we sell to brands and our other clients. You cannot be identified from this information.
Sometimes we combine the information in our data warehouse with anonymous demographic or statistical material from various sources. You can't be identified from this combined information, and it is no longer personal data.
We don't generally ask you to consent to our use of your info except for sending you marketing stuff.
You can see full details of what we do with your info and how we make it lawful in the table below.
International transfers
We do not transfer your information outside the UK.
How long we keep your information
We only keep your info for as long as we need it - either for the purpose for which we collected it or where we need it to comply with any legal, regulatory, tax, accounting or reporting requirements.
Details of how long we keep distinct aspects of your information are available in our retention policy detailed below.
Details of how long we keep distinct aspects of your information are available in our retention policy detailed below.
Your rights in relation to your information
As you'll have gathered from what we do, we're keen on helping you to control the use of your personal info. The law gives you various rights, too, in particular, to:
- request access, correction, or erasure
- object to processing
- request restriction of processing
- request transfer
- withdraw consent.
This privacy policy was updated in September 2024; it is next due to be reviewed in September 2025.
Additional information
What we do with your information and how it is lawful
Our legitimate interests include the following activities so long as we do them in a way that doesn't unfairly affect your privacy:
- Supplying services to you
- Protecting website and app users, employees, and other individuals, and maintaining their safety, health, and welfare
- Promoting, marketing, and advertising our products and services
- Personalising communications or content within emails, on the website and in the app
- Understanding users' behaviour, activities, preferences, and needs
- Improving existing and developing new products and services
- Complying with legal and regulatory obligations
- Preventing, investigating, and detecting crime, fraud, bullying, harassment, discriminatory or other anti-social behaviour, and taking action against perpetrators, including working with law enforcement agencies
- Protecting databonds, its users, and partners, by taking appropriate legal action against third parties who have committed criminal acts, or breach their legal obligations to databonds
- Fulfilling our duties to our users, partners, colleagues, shareholders, and other stakeholders.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
|---|---|---|
| To register you as a new member and provide you access to the website and/or app and its features | Identity Contact Shopping | Performance of a contract with you |
| To provide you with the Services as set out in ourTerms & Conditions | Identity Contact Household Your computer and internet settings Your journey with us Shopping Your marketing preferences | Performance of a contract with you, Necessary for our legitimate interests (to deliver and develop our products/services and grow our business) |
| To manage our relationship with you which will include telling you about: new services or changes to our existing services, any changes to our terms or privacy policy, opportunities to leave a review or take a survey | Identity Contact Shopping Your marketing preferences | Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services) |
| To enable you to take part in a prize draw | Identity Contact Shopping Your journey with us Your marketing preferences | Performance of a contract with you Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business) |
| To provide you with insights into your shopping habits | Identity Contact Shopping Household | Performance of a contract with you |
| To administer and protect our business, the website, and the app (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data) | Identity Contact Your computer and internet settings | Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) Necessary to comply with a legal obligation. |
| To use data analytics to improve our website and the app, products/services, marketing, customer relationships and experiences | Your computer and internet settings Your journey with us | Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website and the app updated and relevant, to develop our business and to inform our marketing strategy) |
| To make suggestions and recommendations to you about goods or services that may be of interest to you | Identity Contact Shopping Household Your computer and internet settings Your journey with us Your marketing preferences | Necessary for our legitimate interests (to develop our products/services and grow our business) |
| To allow a new owner to continue our business | Identity Contact Household Your computer and internet settings Your journey with us Shopping Your marketing preferences | Necessary for our legitimate interests (to sell or merge our business or to acquire a new business) |
Your legal rights
You have the right to:
- Access – ask us for and receive a copy of the personal data we hold about you.
- Correction - ask us to correct any incomplete or inaccurate data we hold about you, though we may need to verify the accuracy of the new data you provide to us.
- Erasure - you can ask us to delete or remove personal data where there is no good reason for us continuing to use it.
- Object to our use - where we are relying on a legitimate interest and there is something about your particular situation which makes you feel it unfairly affects your privacy.
- Request restriction of our use – you can ask us to suspend the use of your personal data in the following scenarios:
- If you want us to establish the data's accuracy.
- Where our use of the data is unlawful, but you do not want us to erase it.
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
- You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Request transfer - you can ask us to provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent - you can do this at any time where we are relying on consent to use your personal data. This will not affect the lawfulness of anything we did before you withdraw your consent. If you do so, we may not be able to provide certain products or services to you. We will tell you if this is the case at the time.
If you want to do any of these things, please contact us here.
How long we keep your information
Open Retail has retention or erasure schedules for specific categories of data. They are set out in this table.
This schedule is due for review on 15th November 2024.
If you have any queries, please contact privacy@databonds.co.uk
| TYPE OF DATA | RETENTION PERIOD | REASON | COMMENTS |
|---|---|---|---|
| Personal data provided by members via the website or app | 2 years from last contact | Business need | Required to operate the business |
| Personal data contributed by members from shopping information supplied by retailers | 3 years from uploading | Business need | Stored as pseudonymised data and not shared with any third party |
| Aggregated data contributed by all members from shopping information supplied by retailers | Indefinite | Business need | No individual can be identified from this data. Historical insights remain commercially valuable |
| Opt-out/suppression lists | Indefinite | Business and compliance need | Only sufficient information to enable the opt-out is retained. |
| Evidence of consent to marketing (including electronic marketing) | While consent valid. 6 years from date consent withdrawn or ceases to be valid | Business need. Limitation period | Consent can be withdrawn at any time and may not necessarily remain valid indefinitely although how long it remains valid will depend on the context. |
| Customer complaints handling | 6 years from settlement or closure | Business need and limitation period | |
| Website analytics reports from cookies and other similar technology as set out in our Cookie policy | 2 years | Business need | This refers to the output from information obtained via cookies. No firm period recommended by the ICO, although the French regulator recommends 25 months from collection and, for Google Analytics, the DMA* recommends 2 years. Cookies themselves may be set for different periods depending on the function of the cookie. See our Cookie policy for more details |