Privacy Policy

Last updated: December 2020

OUR PRIVACY PROMISE

Your privacy is important to Matilde Jewellery ("we", "us" and "our").  We are committed to protecting your personal data and being transparent about the personal data we hold and use and, wherever possible, giving you control over how we use your personal data.

This policy is intended to be communicated to you in a concise, transparent, intelligible, and easily accessible manner, but we appreciate that you may have queries or want to seek clarification as to its terms. If so, please contact us (using the details set out at paragraph 2 below) and we will endeavour to respond to you as soon as possible.

We may make changes to this policy from time to time, including as may be necessary or prudent to reflect any changes in the ways in which we process personal data or any changes in data protection laws.  Any changes and updates to this policy will be posted on the Matilde Jewellery Website. Please check this policy regularly so that you are aware of any changes. 

1. INTRODUCTION

      Please read this policy carefully. Among other things, it explains:

  • What personal data we collect about you;
  • Why we collect and use your personal data and the legal bases we rely on for processing;
  • Who we disclose your personal data to;
  • Where we store your personal data;
  • How long we keep your personal data; and
  • Your rights regarding the personal data you provide to us.
2. WHO WE ARE AND OUR CONTACT DETAILS

For the purposes of data protection laws, the data controller is Matilde Limited (trading as Matilde Jewellery), a company registered in England and Wales (company no. 12589338) with its registered office at Elsley Court, 20-22 Great Titchfield Street, London W1W 8BE.

If you have any queries regarding this policy or the way in which we process your personal data, please contact us at:

Email: info@matildejewellery.com

Address: Elsley Court, 20-22 Great Titchfield Street, London W1W 8BE

3. CHANGES TO YOUR PERSONAL INFORMATION

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes or if you become aware that any personal data that we hold about you is not accurate.

4. WHEN DO WE COLLECT YOUR PERSONAL DATA

We may collect information direct from you and use, disclose and store it when you:

  • access, use or create an account on the Matilde Jewellery website;
  • correspond/interact with us via email, phone, social media or other channels;
  • make any enquiry;
  • purchase a product from us;
  • request customer support;
  • sign up to receive an email newsletter from us;
  • participate in competitions, surveys and questionnaires or provide us with a review or feedback;
  • post content on our social media pages or any of our other channels.

We may also automatically collected certain Technical Data (as defined below) relating to your device and your activities on the our website. We may also collect such data from third parties such as analytics providers (including Google) [and third party platforms and organisations within advertising networks (including Facebook)].

5. WHAT PERSONAL DATA WE COLLECT

The type of personal data we process may include (as applicable) the following:

Categories of Data

Description of Data

 

Identity Data

 

Name, address, title, gender, nationality, country of residence, details in an email signature, username, bio and any profile data that is publicly available eg. in your Facebook profile.

 

Contact Data

 

Email address, address, telephone number, mobile number, social media handles, other information in an email signature.

 

Correspondence Data

Information which you provide in, or we learn about you from, any correspondence or communications with us, including details of any enquiries or requests for customer care support and any other information you provide to us.

 

Usage Data

Device IP address, the pages of the website that you visit, usage information for the website, your use of social sharing features such as Likes, comments and links that you share (eg. via Facebook Comment or Share).

 

Technical Data

 

Type of device, unique device identifier (e.g. an IMEI number, IDFA, IP, or Mac address), network information, the type of operating system, platform and browser you use, location, time zone settings and other device related information and online identifiers.

 

Marketing and Communications Data

Your marketing preferences and communication preferences and any information that you may provide to us in any reviews or feedback.

 

Financial and transaction data - If you purchase any products from the website, your payment details (such as bank account and payment card details) will be collected by an external payment service provider. We will not collect or access any such details and you should contact the relevant third party for information relating to use of your financial and transaction data.

Children – our products are aimed at those who are 18 years old or over.

Analytics Data – we may receive aggregated statistics and insights from advertising, analytics and attribution providers regarding your use of the website. This information does not contain any personally identifiable information.

Information about why we process the above personal data and the lawful basis we rely upon is set out in the table at paragraph 6 below.

6. WHY WE COLLECT AND USE YOUR PERSONAL DATA

6.1. We use your personal data for a number of purposes but only where we are allowed to by the law.

6.2. We may process your personal data in any circumstances where such processing is necessary:

6.2.1. in order to perform any contract we have entered into with you (e.g. to provide you with products you have ordered) or in anticipation of any contract we may enter into with you;

6.2.2. to comply with any applicable law or regulation (e.g to provide information regarding fraudulent or criminal activity to the police) ; and/or

6.2.3. for the purposes of the legitimate interests pursued by us or a third party. These legitimate interests include the purposes identified in the table below at paragraph 6.5 but also include other commercial interests and our internal administrative purposes. Where we rely on legitimate interests as the lawful basis for processing your personal data, we will put in place appropriate safeguards to protect your data and to ensure that your interests or fundamental rights and freedoms are not overridden by those legitimate interests.

6.3. We may also process your personal data where we have your consent (e.g. where you tick a box to receive email newsletters). Where we rely on consent as the lawful basis for processing your personal data, you have the right to withdraw your consent at any time and if you wish to do so, you should contact us using the contact details set out in paragraph 2 above. Where we obtain your consent to send you a newsletter, you can unsubscribe by following the unsubscribe link within the communication. The withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds.

6.4. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data.

6.5. Information about the purposes for which we use your personal data, the types of personal data we process to achieve these purposes, and the lawful basis by which we process it, is set out in the table below:

Purpose/Activity

Type of Personal Data Processed

Lawful Basis for Processing

Registration

 

  • To create an account with us

 

  • Identity Data
  • Contact Data
  • Correspondence Data
  • Marketing and Communications Data
  • Consent
  • Performance of a contract
  • Compliance with a legal obligation
  • Our legitimate interests to operate our business and fulfil our legal and contractual obligations

 

 

Sale of our products

 

  • To process and fulfil any order you place for  products
  • To process any returns and refunds
  • Identity Data
  • Contact Data
  • Correspondence Data

 

 

  • Performance of a contract
  • Compliance with a legal obligation
  • Our legitimate interests to operate our business and fulfil our legal and contractual obligations

Business Operation and Maintenance

 

  • To operate and protect our website (including troubleshooting, incident management and data breach management, data analysis, product and system testing, system maintenance, support, reporting and hosting of data)

 

  • Identity Data
  • Contact Data
  • Correspondence Data
  • Usage Data
  • Technical Data

 

  • Performance of a contract
  • Compliance with a legal obligation
  • Our legitimate interests to operate and improve our business, fulfil our legal and contractual obligations and for the purposes of IT security

 

Customer Relationship Management

 

  • To manage our relationship with our customers which includes notifying you of any changes to our terms or this policy or to our products, to respond to enquiries, complaints, messages, and requests for customer support
  • Identity Data
  • Contact Data
  • Correspondence Data
  • Marketing and Communications Data
  • Consent
  • Performance of a contract
  • Compliance with a legal obligation
  • Our legitimate interests to respond to enquiries, messages and requests, operate, develop and improve our business and to fulfil our legal and contractual obligations

 

Business Development

 

  • To improve our website, products, customer relationships and experiences
  • Identity Data
  • Contact Data
  • Correspondence Data
  • Usage Data
  • Technical Data
  • Marketing and Communications Data

 

  • Our legitimate interests to define types of customers for our products and services, develop and improve our business and to inform our marketing strategy

Business Management

 

  • To manage our business including to keep financial and accounting records, carry out audits, testing, comply with our reporting requirements and other corporate governance requirements including any requirement to share data with law enforcement
  • To exercise our rights set out in contracts including recovering debts owed to us
  • To monitor fraudulent transactions or criminal activity

 

  • Identity Data
  • Contact Data
  • Correspondence Data
  • Usage Data
  • Technical Data
  • Performance of a contract
  • Compliance with a legal obligation
  • Our legitimate interests to exercise our rights (including to recover debts), to operate our business (including internal administration and IT services, network security, to prevent fraud and in the context of a business reorganisation, sale or group restructuring exercise) and to fulfil our legal and contractual obligations

 

Marketing and Advertising

  • To market our products
  • To make suggestions and recommendations to you about other products that may be of interest to you
  • Asking you to leave a review or take part in a poll/survey
  • To enable you to take part in a prize draw or competition including the publication of certain details if you are the winner
  • To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
  • To use data analytics to improve our business, our website, our products, marketing, customer relationships and experiences
  • Identity Data
  • Contact Data
  • Marketing and Communications Data
  • Usage Data
  • Technical Data
  • Consent
  • Our legitimate interests to develop our business and to inform our marketing strategy

 

6.6. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

6.7. If we need to use your personal data for an unrelated purpose, we will notify you (which may be by way of update to this policy) and we will explain the legal basis which allows us to do so.

6.8. Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

7. WHAT IF YOU REFUSE TO PROVIDE US WITH ANY PERSONAL DATA?

7.1. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested (or fail to consent to the processing of that data, if necessary), we may not be able to provide to you the product you have ordered from us.

8. SHARING INFORMATION WITH THIRD PARTIES

8.1. We will not share any of your personal data with third parties except as set out in this paragraph 8 or otherwise notified to you or agreed between you and us from time to time.

8.2. We may share personal data with our group companies (including our subsidiaries, ultimate holding company and its subsidiaries). We may also share personal data with third party service providers who we engage to provide services which facilitate our business. We may also need to share personal data with other third parties in order to comply with our legal and regulatory obligations. Below is a list of specific third parties and other categories of third parties with whom we may share your personal data:

8.2.1. Website developer;

8.2.2. Website hosting company;

8.2.3. Mailchimp who delivers our newsletter to those who have subscribed;

8.2.4. Google Analytics and Google Ads, operated by Google LLC, our provider of online marketing tools and other analytics, advertising and attribution partners;

8.2.5. Third party platforms including Facebook, Inc.;

8.2.6. Payment service providers;

8.2.7. Shopify (our platform provider);

8.2.8. Deliver couriers;

8.2.9. Any third party buyer of our business or assets;

8.2.10. Law enforcement or a regulator;

8.2.11. Legal counsel and other professional advisers including accountants and auditors.

8.3. We ensure that any third party engaged by us who processes your personal data in connection with the purposes listed above has policies and procedures in place to ensure compliance with data protection laws.

8.4. For any third parties that are based, or process data, outside of the EEA and the United Kingdom, we engage such third parties in accordance with paragraph 9 below.

8.5. We will remain the controller responsible for the processing of your personal data notwithstanding that third parties may operate as a joint controller with us. For some processing activities we may act as a processor for a third party and, in such circumstances, the third party will be responsible for providing you with the processing information required under data protection laws.

8.6. We may share your personal data with third parties where we are required to do so by law or regulation (such as in connection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that your actions violate applicable laws or any contract with us).

8.7. In the event that our business or any part of it is sold or integrated with another business, your details may be disclosed to our advisers and those of any prospective purchaser and will be passed to the new owners of the business.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

9.1. Our servers are located in the UK but from time to time it may be necessary for us to transfer your information internationally. In particular, your information may be transferred to and/or stored on the servers of third parties identified in paragraph 8 which are based outside of the UK and the EEA.

9.2. However, we will not transfer your personal data outside of the UK and the EEA unless:

9.2.1. such transfer is to a country or jurisdiction which the EU Commission or the UK has approved as having an adequate level of protection; or

9.2.2. appropriate safeguards are in place in accordance with data protection laws. These safeguards include the use of standard contractual clauses or binding corporate rules; or

9.2.3. the transfer is otherwise allowed under data protection laws (including where we have consent or the transfer is necessary for the performance of a contract with the data subject).

9.3. We will ensure that where your personal data is transferred outside of the UK and the EEA, it is afforded the same protection as would be afforded to it within the EEA and UK.

9.4. If you are based outside of the UK and place an order and/or open an account with us or subscribe to our email newsletter, we will transfer your personal data to the UK.

10. YOUR RIGHTS AS A DATA SUBJECT

10.1. Subject to any conditions and requirements set out in data protection laws, you may have some, or all, of the following rights in relation to the personal data we hold about you:

10.1.1. the right to request a copy of your personal data held by us;

10.1.2. the right to correct any inaccurate or incomplete personal data held by us;

10.1.3. the right to request that we erase personal data we hold about you;

10.1.4. the right to request that we restrict the processing of your data;

10.1.5. the right to have your personal data transferred to another organisation;

10.1.6. the right to object to certain types of processing of your personal data by us; and

10.1.7. the right to complain (please see paragraph 13 of this policy).

10.2. PLEASE NOTE that these rights are not absolute in all situations and may be subject to conditions and provisions set out in data protection laws.  We cannot, therefore, guarantee that we'll be able to honour any request from you in connection with the rights set out above. (For example, even if you request that we delete your personal data, we may be required by law to retain some personal data for accounting and record keeping purposes or in order that we comply with our legal and regulatory obligations).

10.3. For further information, or to exercise any particular right, please contact us at info@matildejewellery.com .

11. STORAGE AND RETENTION OF YOUR PERSONAL DATA

11.1. As a minimum, we need to store your personal data for as long as is necessary to enable us to fulfil the purpose for which it is processed, including to fulfil our legal and regulatory obligations (e.g. relating to record keeping) and to exercise or defend any legal claims.

11.2. We will notify you without undue delay in accordance with the requirements of data protection laws, if we have reason to believe that there has been a personal data breach by us which could adversely affect your rights and freedoms and we are required by law to notify you.

12. LINKS TO THIRD PARTIES

12.1. Our website may link or redirect to other websites, social media accounts or other content which is not under our control. Such links or redirections are not endorsements of such websites or representation of our affiliation with them in any way and such third party websites are outside the scope of this policy.

12.2. If you access such third party websites or platforms, please ensure that you are satisfied with their respective privacy policies before you provide them with any personal data. We cannot be held responsible for the activities, privacy policies or levels of privacy compliance of any website or platform operated by any third party.

13. QUESTIONS AND COMPLAINTS

13.1. We take our data protection obligations seriously. If you have any questions or complaints about this policy or the way that we handle your personal data, we would appreciate the chance to deal with your concerns in the first instance before you approach the relevant data protection authority. Please contact us using the details provided in paragraph 2 above.

13.2. You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner's Office (ICO) (www.ico.org.uk).