General Data Protection Regulation
Who we are
We are 21CPhotos LTD operating online as www.sleepmonsters.com. Our contact and other details are set out at the end of this policy. We are the data controller in relation to the personal data processed in accordance with this policy (except where this policy explains otherwise).
The purposes for which we collect personal data
We collect and process personal data as follows:
If you browse our website;
If we wish to send you advertising, marketing or promotional material;
We may collect your individual contact details in order to send you direct marketing material in order to advertise, market or promote our goods and services (this will be subject to your prior consent where appropriate). We may combine this with other information we obtain about the things you are interested in and that are relevant to the services provided by us in order to help us ensure that marketing material that we send you is relevant to what you are interested in.
If you provide goods or services (or you work for someone who supplies goods or services) to us;
We may collect your individual contact information to enable us or other suppliers of ours to communicate with you in relation to the provision of goods or services by you or the person that you work for (for example, in relation to the management and administration of the provision of the relevant goods or services) and other personal information relating to you in the course of provision of the goods or services concerned.
We normally process personal data only in the UK, EU, or the US (as our servers are based there);
Where personal data is transferred in relation to providing our services we will take all steps reasonably necessary to ensure that it is subject to appropriate safeguards, such as relying on a recognised legal adequacy mechanism which may include by entering into EC approved standard contractual clauses relevant to transfers of personal information – see:
Security of your personal data;
All personal data processed by us is stored securely (the level of security being appropriate to the nature of the data concerned and the other relevant circumstances). Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website and any transmission is at your own risk. Once we have received your information, we will use appropriate procedures and security features to try to prevent unauthorised access.
Who we share your personal data with
WE DO NOT SHARE YOUR PERSONAL DATA WITH ANYONE
The legal basis for our processing of personal data
The legal basis on which we process your personal data is as follows;
Where it is necessary to obtain your prior consent to processing in order for us to be allowed to do it, we will obtain and rely on your consent in relation to the processing concerned (in relation to any processing we are carrying out with your consent, see below for how to withdraw your consent).
Otherwise, we will process your personal data where the processing is necessary:
for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract;
for compliance with a legal obligation to which we are a subject; or
for the purposes of the legitimate interests pursued by us or another person, provided that this will only be in circumstances in which those legitimate interests are not overridden by your interests or fundamental rights and freedoms which require protection of personal data.
How long we keep your personal data;
We process personal data only for so long as is necessary for the purpose(s) for which it was originally collected, after which it will be deleted or archived except to the extent that it is necessary for us to continue to process it for the purpose of compliance with legal obligations to which we are subject or for another legitimate and lawful purpose.
You have the following rights in relation to personal data relating to you that we process;
You may request access to the personal data concerned.
You may request that incorrect personal data that we are processing be rectified.
In certain circumstances (normally where it is no longer necessary for us to continue to process it), you may be entitled to request that we erase the personal data concerned.
Where we are processing your personal data for marketing purposes or otherwise based on our legitimate interests, you may in certain circumstances have a right to object to that processing.
Where we are processing personal data relating to you on the basis of your prior consent to that processing (such as in relation to marketing by email), you may withdraw your consent, after which we shall stop the processing concerned.
To exercise any of your rights (including withdrawing relevant consents or obtaining access to your personal data), you should contact us as set out below.
If you have a complaint about any processing of your personal data being conducted by us, you can contact us or lodge a formal complaint with the Information Commissioner.
Contacting the regulator;
The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data.
Our contact details are;
40 Ferry Street