Issue Date: May 2018

1. INTRODUCTION

This Privacy and cookies Policy (hereinafter, the "Privacy Policy") provides detailed information on how Eden Springs (UK) Ltd (hereinafter, "EDEN") uses and protects your personal data when browsing our website www.edensprings.co.uk (hereinafter, the "Website"), as well as your rights in this respect.

This Privacy Policy applies to the processing of personal data provided by you or that we obtain from you when you access and use the Website, be it for browsing the Website, purchasing our products or services, requesting information from us, contacting us, submitting an application or making use of the functionalities or services available on the Website.

EDEN respects your right to privacy and complies with the current legislation on personal data protection, including Organic Law 15/1999, of 13 December, on the Protection of Personal Data, its developing regulations and any other regulations that may amend, supplement or replace them in the future, as well as with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), applicable from 25 May 2018, as well as any other rules that may develop or supplement it in the future.

We recommend that you carefully review our Privacy Policy to ensure that you understand how your personal data is used when browsing the Website.

 

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The data controller is the legal person that determines the purposes and means of the processing of personal data. In other words, the controller decides how and for what purpose personal data are processed.

For the purposes of this Privacy Policy, the data controller is EDEN: Eden Springs, UK, with registered address at Eden Springs (UK) Ltd Unit D, The Fleming Centre, Fleming Way, Crawley, West Sussex, RH10 9NN, Registered in the UK. VAT No GB 232 1604 11. Registered No. 04063744.

 

3. WHO CAN YOU CONTACT AT EDEN REGARDING THE PROTECTION OF YOUR PERSONAL DATA?

If you have any questions or wish to receive more information regarding the processing or protection of your personal data, you may contact us via any of the following:

Data controller: Eden Springs (UK) Ltd
Postal address: Eden Springs (UK) Ltd Unit D, The Fleming Centre, Fleming Way, Crawley, West Sussex, RH10 9NN
Telephone: +44 (0) 1698 725000
Email: gdpr.inquiries@uk.edensprings.com

The Website through the Customer Zone at +44 (0) 1698 725000 or at gdpr.inquiries@uk.edensprings.com

You may also contact our Privacy/Data Protection Officer at: gdpr.inquiries@uk.edensprings.com

 

4. WHAT IS PERSONAL DATA?

Personal data is any information relating to an identified or identifiable natural person.

 

5. WHAT PERSONAL DATA ARE PROCESSED BY EDEN?

For the purposes laid out in this Privacy Policy, EDEN collects and processes the following personal data:

  1. Identifying data: name, surname, identification document (tax identification number or code, foreigner identification number, passport number or residence permit).
  2. Contact information: postal address, email address, landline telephone number, mobile telephone number.
  3. Transaction data: information on purchases, orders, contracts, billing and collection, payment methods, bank details and any other data relating to your transactions with us.
  4. Electronic data: IP address, device type and ID, browser type and language, domain through which the Website is accessed, browsing information, Website activity.

EDEN does not intentionally collect information on minors, except with the express consent of their parents or legal guardians. You guarantee to be over 16 years old.  If you know or suspect that EDEN has personal data of minors, please contact us through any of the channels indicated in section 3 of this Privacy Policy and this information will be removed.

 

6. COLLECTION AND OBTENTION OF PERSONAL DATA.

EDEN collects and processes personal data that you voluntarily provide us when interacting with our Website, in particular when:

  • requesting us for information or quotes of our products and services;
  • subscribing to our newsletter;
  • registering to our Customer Zone or renewing access to the Customer Zone;
  • checking service availability for your home or location;
  • acquiring EDEN products or services;
  • requesting technical assistance or assistance relating to EDEN's services;
  • sending us your CV with the aim of taking part in recruitment processes.

You are only obliged to provide personal data that is necessary for EDEN to provide you services or make available the functionalities of the Website to you that you have requested.

For example, if you wish to receive EDEN's newsletter, it will necessary for you to provide us with your email address. If you request information from us or would like us to contact you, you must provide us with the contact information needed for these purposes. If you wish to acquire any product or service that EDEN makes available on its Website, it will be necessary that you provide, among other information, a postal address to which we can send your order. If you do not provide us with this personal data, it would not be possible for us to provide you with our services.

The fields of the forms available on the Website that are required to be filled in shall be marked with an asterisk (*). If not all the required information is provided or if we receive an unusual or incorrect response, we will not be able to process your request or provide you with the corresponding service or functionality.

In any event, you guarantee and are liable for the truthfulness, accuracy, validity and authenticity of the personal data provided and undertake to keep them duly updated.

It is not necessary to provide us with your personal data to browse the Website. However, when visiting our Website, EDEN collects, automatically and through cookies -. depending on your browser specific settings, the following information:  IP address, device type and ID, browser type and language, domain through which the Website is accessed, browsing information, Website activity. For more information, you may check section 12 of this Privacy Policy "USE OF COOKIES".

 

7. WHAT DO WE USE YOUR PERSONAL DATA FOR? PURPOSES AND LEGAL BASIS FOR DATA PROCESSING

In general, the personal data you provide to us and that we obtain from you are used to process your requests and transactions, to provide you with high-quality service and to inform you about opportunities we believe may interest you.

Below are the specific purposes for which we process your personal data:

  1. To provide you with information you request, including quotes of products and services. In this case, your consent is the legal basis for processing your data.
  2. To send you our newsletter with information, promotions, campaigns and news on products and services of Eden Group and products and services of third parties marketed and distributed by EDEN. In this case, your consent is the legal basis for processing your data.
  3. To check service availability at your home or location. In this case, the need to take steps, at your request, prior to entering into a contract is the legal basis for processing your data.
  4. To register you as a customer, process your transactions, manage the contractual relationship with you, grant you access to the private customer area, send you relevant information on products and services, notifications of delivery, maintenance, invoicing, collections and payments, process transactions and payment methods as well as any other service communication or communications related to your contact and transactions, management of loyalty programmes, discounts and promotions, perform satisfaction surveys or surveys related to -products and services marketed and distributed by EDEN. In this case, the legal basis for processing your data is, if you are a residential customer, the performance of the product sales contract or the service provision contract with EDEN; and, if you are a corporate customer, our legitimate interest in contracting and providing our services to the company at which you are employed or provide services to.
  5. To create an account to provide you with access to the Customer Zone, to renew access to the Customer Zone and to provide you with access to the information and services available in the therein: information on your customer account, billing and payments, order placements, information on products and services marketed and distributed by EDEN, management of loyalty programmes, discounts and promotions. In this case, the legal basis for processing your data is, if you are a residential customer, the execution of the agreement of the sale of products or provision of services with EDEN; and, if you are a corporate customer, our legitimate interest in contracting and providing our services to the company at which you are employed or provide services to.
  6. To respond to requests for technical support or support relating to EDEN's services. In this case, your consent is the legal basis for processing your data.
  7. To store your data and contact you regarding recruitment and staff selection processes at Eden Springs, as well as to manage your participation in said processes. In this case, your consent is the legal basis for processing your data.
  8. If you give your consent, to send you marketing communications on our products and services and on products and services of third parties marketed and distributed by EDEN, our publications, opinion surveys, promotional and advertising information, coupons, offers (including customised offers) and recommendations of our products and services as well as of products and services of third parties marketed and distributed by EDEN, according to your interests and based on a profile developed by us, by phone, post, email, SMS and MMS. In this case, your consent is the legal basis for processing your data.
  9. To guarantee the security of our Website and of the information. In this case, the legal basis for processing your data is the legitimate interest in providing a secure environment and preventing harm to EDEN's systems and to the users' information, as well as unauthorised access to and misuse of EDEN's systems and users' information.
  10. For internal management purposes: planning, resource allocation, policy development, quality improvement, strategic analysis, marketing and commercial development, monitoring, audit, evaluation and reporting. In this case, the legal basis for processing your data is our legitimate interest in understanding and analysing the development of our business, improving our products and services, and exploring ways to develop and enhance our business.
  11. With regard to the purposes of the use of cookies, you may check section 12 of this Privacy Policy "USE OF COOKIES". In this case, your consent is the legal basis for processing your data.

When the basis for data processing is consent, you may withdraw it at any time by sending a communication to the Data Protection Officer including a copy of your National ID number or of a document proving your identity, indicating your address for communication purposes, and providing the necessary details to process your request. You may always contact us through any of the channels indicated in section 3 of this Privacy Policy

Bear in mind that receiving marketing information is not essential to maintain the relationship we have with you. If you prefer not to receive marketing communications, you may inform us at any time through the means indicated, or opt-out at the link provided for these purposes in the marketing communications that you receive by email, or if the communications are provided by other means, through the procedure indicated for these purposes.

To what extent is decision-making automated?

EDEN does not use completely automated decision-making processes to engage in, develop or terminate a contractual relationship with you. If we were to use these processes in a specific case, we would inform you, communicate you your rights in this respect, and comply with our legal obligations in accordance with applicable regulations.

Will you use profiling?

With the aim of being able to offer you products and/or services in accordance with your interests and to improve your user experience, we may develop a "commercial profile" based on the information provided. However, automated decisions will not be taken based on said profile.

 

8. WHO WILL WE SHARE YOUR PERSONAL DATA WITH?

We only use, transfer or share personal data with third parties in accordance with the terms laid out in this Privacy Policy. EDEN does not sell or rent your personal data to third parties and only communicates them to persons or entities if we obtain your prior consent or pursuant to or in accordance with applicable legislation when said consent is not necessary for a specific transfer.

We will share or give third parties access to your personal data when necessary to achieve one of the objectives described below and in accordance with current legislation:

a. Our suppliers. EDEN shall communicate or allow access to your personal data to companies that provide services to us under a contract, when it is necessary to achieve one of the purposes described in section 7 of this Privacy Policy WHAT DO WE USE YOUR PERSONAL DATA FOR?  PURPOSES AND LEGAL BASES FOR DATA PROCESSING: IT and web platform services, management of orders and shipping, payment processing, email distribution, call centres, web positioning services, marketing, market analysis and organisation of promotional campaigns. If any of these service providers needs to access your personal data, they will use it only to provide us with a service and according to our instructions. We also require them to keep the data confidential and secure and to return or destroy the data when they no longer need it.

b. Legal obligations: EDEN may communicate your personal data when the transfer is necessary to comply with a legal obligation, including the transfer to competent authorities, judges and courts. This includes complying with requests made by authorities in accordance with Law 10/2010, of 28 April, on the prevention of money laundering and the financing of terrorism.

c. Eden Group companies: EDEN shall allow access to your personal data to companies belonging to Eden Group within the European Union that provide services to us and act as data processor, for the purposes described in section 7.j) of this Privacy Policy WHAT DO WE USE YOUR PERSONAL DATA FOR?  PURPOSES AND LEGAL BASES FOR DATA PROCESSING.

d. International data transfers. Your personal data may be sent to a company belonging to Eden Group and located in Israel, which provides us with information technology services, IT support and maintenance services and acts as data processor. We inform you that Israel is a country that provides an adequate level of personal data protection, by virtue of the adequacy decision of the European Commission of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data.

 

9. WHAT MEASURES DO WE APPLY TO KEEP YOUR PERSONAL DATA SAFE?

EDEN takes the appropriate technical and organisational measures in accordance with current regulations to protect your personal data against any misuse, destruction, loss, accidental or illicit modification, disclosure or unauthorised access, including the measures necessary to deal with any suspected data breaches.

The Website has a log-in system, with a user name and password, through which only authorised users can access the private Customer Zone area. EDEN shall not use this information at any time for any use other than maintenance of the mentioned Customer Zone, to manage the business relationship with you, as well as to offer any services available in the Customer Zone.

You agree to keep and use the user name with due diligence. The use of the password is personal and non-transferable and the transfer of the password to third parties is not allowed, not even temporarily. In that regard, you must take the necessary measures to safeguard your password, preventing its use by third parties. Accordingly, you are solely responsible for the use of your password, to the entire indemnity of EDEN.

If you are aware of or suspect that your password is being used by third parties or that personal data may be being misused or accessed without authorisation, please notify us as soon as possible through any of the channels indicated in section 3 of this Privacy Policy WHO IS YOUR CONTACT AT EDEN FOR THE PROTECTION OF YOUR PERSONAL DATA?.

 

10. HOW LONG DO WE RETAIN YOUR DATA FOR?

EDEN shall retain your personal data for the time necessary to fulfil the purposes for which they were collected, or while you do not exercise your right to erasure or to withdraw your consent.

The data will be subsequently deleted, unless a longer retention period is required or permitted by law (for instance, for the establishment, exercise or defence of legal claims) in which case they will be retained duly blocked as long as required before deleting them.

To determine an appropriate retention period of your data, we apply the following criteria:

  1. The data necessary to provide you with the information you request, including quotes of products and services, shall be retained for the time necessary to attend to and process said requests, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  2. The data necessary to send you the newsletter shall be retained so long as you do not withdraw your consent or inform us of your wish to not continue receiving it, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  3. The data to register in our Customer Zone shall be retained during the term of the contract with EDEN, so long as you do not unsubscribe to the private area, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  4. The data necessary to check the availability of service at your home or location shall be retained so long as it is strictly necessary for these purposes, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  5. The data related to the acquisition of EDEN products and services in the context of a contractual relationship shall be retained during the term of the contract with EDEN or for the time necessary to exercise the rights and comply with the obligations of the contract with EDEN, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  6. The data necessary to attend to your requests for technical support or those related to EDEN products and services shall be retained for the time necessary to attend to and process said requests, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  7. When you consent to receive marketing communications, your data shall be retained so long as you do not withdraw your consent or inform us of your wish to not continue receiving these communications, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  8. The data sent with a view to participate in recruitment/staff selection processes shall be retained on a general basis for 3 years, in accordance with the applicable legal provisions and the statute of limitations periods laid down in the legislation.
  9. When cookies are placed on your device, the data shall be retained in accordance with the applicable legal requirements and the recommendations made by the competent authorities.

 

11. WHAT ARE YOUR RIGHTS WITH RESPECT TO THE PROCESSING OF YOUR PERSONAL DATA?

In accordance with the applicable legislation, you have specific rights with regard to the collection and processing of your personal data.

These rights are the following:

  1. Right to information: You have the right to be informed about the use and processing of your personal data in a concise, transparent, intelligible and easily accessible manner, and with clear and simple language.
  2. Right of access: You have the right to request from us, at any time, that we confirm if we are processing your personal data, that we provide you with access to said data and to the information about the processing of them, and to obtain a copy of said data. The copy of your personal data that we provide you shall be free, although the request for additional copies could be subject to a reasonable fee based on administrative costs. On our part, we may request that you give proof of your identity or require more information from you that is necessary to handle your request.
  3. Right to rectification: You have the right to request the rectification of inaccurate, outdated or incomplete personal data that concerns you. You may also request that any personal data that may be incomplete is completed, including by means of providing a supplementary statement.
  4. Right to erasure: You have the right to request the erasure of your personal data when, inter alia, the data are no longer necessary for the purposes for which they were collected or processed. However, this right is not absolute so that EDEN may continue keeping them duly blocked in the in those cases laid down in the applicable regulations.
  5. Right to restriction of processing: You have the right to request that we restrict the processing of your personal data which means that we may continue storing them, but may not continue processing them if any of the following conditions is met:
    • that you contest the accuracy of the data, during a period of time that allows -us to verify the accuracy of said data;
    • the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;
    • EDEN no longer needs the data for the purposes of processing, but you need them for the establishment, exercise or defence of legal claims;
    • You have objected to the processing, pending the verification whether EDEN's legitimate grounds override yours.
  6. Right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format. This right is applied when the processing of your personal data is based on consent or on the execution of a contract, and said processing is carried out by automated means.
  7. Right to object: This right allows you to object to the processing of your personal data, including profiling. We shall no longer process your data unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims.
  8. Right to withdraw consent: In those cases in which we have obtained your consent to process your personal data in connection with certain activities (for example, with the aim to send you marketing information), you may withdraw it at any time. -
  9. The right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Information Complaints Commission, whose details are available at https://ico.org.uk/

You may exercise your rights by sending a communication to gdpr.enquiries@uk.edensprings.com, including a copy of your National ID card or of a document proving your identity, indicating your address for communication purposes, and providing the necessary details to process your request.

If you wish to withdraw the consent given to receive marketing communications, you may inform us at any time through the means indicated, or opt-out at the link provided for these purposes in the marketing communications that you receive by email, or if the communications are provided by other means, through the procedure indicated for these purposes.

If our requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either charge a reasonable fee, considering the relevant administrative costs, or we may not act on the request.

For further information on your rights you may contact us through any of the channels indicated in section 3 of this Privacy Policy WHO IS YOUR CONTACT AT EDEN FOR THE PROTECTION OF YOUR PERSONAL DATA?

 

12. AMENDMENTS

EDEN may amend this Privacy Policy to adapt it to the changes that the Website may undergo or in relation to the processing of your personal data. In that case, EDEN will contact you through the usual communication channels and sufficiently in advance to notify you of the appropriate amendments and will send you the updated privacy policy.

The updated and prior versions of the Privacy Policy may be available at any time on the Website.