Privacy Policy

This Privacy Policy outlines the procedures through which we, Right Turn Websites, gather, store, and utilize information about you in connection with your usage or interaction with our website, www.rightturnwebsites.co.uk, and any other methods by which we obtain or gather information about you. This Privacy Policy came into effect on the date “Last Updated” above.

This section provides a brief summary of how we collect, store, and utilize information about you. It is meant to offer a general overview and should be read alongside the detailed sections of this Privacy Policy for comprehensive understanding

• How we collect or obtain information about you
• Information we collect
• How we use your information
• Disclosure of your information to third parties
• Do we sell your information to third parties (other than in the course of a business sale or purchase or similar event)
• How long we retain your information
• How we secure your information
• Use of cookies and similar technologies
• Transfers of your information outside the European Economic Area
• Use of automated decision making and profiling
• Your rights in relation to your information
• Sensitive personal information

The data controller in respect of our website and business is Right Turn Websites. You can contact the data controller by writing to Right Turn Websites, 69 Meadowbrook, Wigan, Greater Manchester, WN5 8ED or sending an email via our contact form.

If you have any questions about this Privacy Policy, please contact the data controller.

We gather and utilize information from visitors to our website in accordance with this section and the section titled “Disclosure and Additional Uses of Your Information.”

Web Server Log Information

We use our own servers to host our website. Our website server automatically logs the IP address used to access our site, along with other details about the visit such as accessed pages, request date and time, referral source (e.g., referring website or URL), and browser version and operating system. Our server is located in the United Kingdom.

Use of Website Server Log Information for IT Security Purposes

We collect and store server logs to uphold network and IT security, ensuring the integrity of our server and website. This includes analyzing log files to detect and prevent unauthorized access to our network, distribution of malicious code, denial-of-service attacks, and other cyber threats through identification of unusual or suspicious activities.

Legal Basis for Processing: Compliance with a legal obligation as per Article 6(1)(c) of the General Data Protection Regulation (GDPR). Our legal obligation includes implementing appropriate technical and organizational measures to secure information processing. Recording website access via server log files constitutes such a measure.

Legal Basis for Processing: Our legitimate interests as per Article 6(1)(f) of the GDPR. Our legitimate interest lies in utilizing your information to maintain network and information security.

Use of Website Server Log Information to Analyze Website Usage and Enhance User Experience

We analyze the information obtained from our website server logs to understand how users interact with our site and its features. This analysis includes assessing visit frequency, unique visitors, visit times and dates, visitor locations, and types of operating systems and browsers used.

We leverage insights gained from this analysis to enhance our website. For instance, we may adjust website content, information, and structure based on user engagement levels and duration spent on specific pages.

Legal Basis for Processing: Our legitimate interests under Article 6(1)(f) of the GDPR. Improving our website to better serve our users and understanding their preferences constitute our legitimate interests.

Cookies and Similar Technologies

Cookies are data files sent from a website to a browser to record user information for various purposes.

We utilize cookies and similar technologies on our website, including essential, functional, analytical, and targeting cookies, as well as web beacons. For detailed information on how we use cookies, please refer to our cookies policy.

You have the option to decline some or all cookies used on or via our website by adjusting your browser settings. However, doing so may impair your ability to fully utilize our website or its features. For further details about cookies and instructions on how to modify your browser settings, please visit www.allaboutcookies.org or consult our cookies policy.

We collect and utilize information from individuals who contact us in accordance with this section and the section titled “Disclosure and Additional Uses of Your Information.”

Email

When you send an email to the contact form provided on our website, we gather your email address and any other information you include in the email (such as your name, telephone number, and details in any signature block).

Legal Basis for Processing: Our legitimate interests under Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Legitimate Interests: Responding to inquiries and messages received and maintaining records of correspondence.

Legal Basis for Processing: Necessary for the performance of a contract or to take steps at your request to enter into a contract under Article 6(1)(b) of the GDPR.

Reason for Necessity for Contract Performance: When your message pertains to us providing goods or services, or taking steps before providing goods and services (such as providing information about said goods and services), we process your information accordingly.

Transfer and Storage of Your Information

We utilize a third-party email provider, Google, to store emails sent to us. Their privacy policy is available at: Google Privacy Policy.

Emails sent to us are stored on servers located outside the European Economic Area, specifically in the United States of America. For further details, please refer to the “Transfers of Your Information Outside the European Economic Area” section of this privacy policy.

Contact Form

When you contact us using our contact form, we collect company name, contact name, phone number, email address, and details related to your inquiry.

Failure to provide mandatory information required by our contact form will prevent submission, and we will not receive your inquiry.

Legal Basis for Processing: Our legitimate interests under Article 6(1)(f) of the GDPR.

Legitimate Interests: Responding to inquiries and messages received and maintaining records of correspondence.

Legal Basis for Processing: Necessary for the performance of a contract or to take steps at your request to enter into a contract under Article 6(1)(b) of the GDPR.

Reason for Necessity for Contract Performance: When your message pertains to us providing goods or services, or taking steps before providing goods and services (such as providing information about said goods and services), we process your information accordingly.

Transfer and Storage of Your Information

Messages sent to us via our contact form are stored both within and outside the European Economic Area on servers belonging to our email provider and our CRM provider, Freshsales, located in the United States of America. Their privacy policies are available at: Freshsales Privacy Policy and Google Privacy Policy.

Phone

When you contact us by phone, we collect your phone number and any information provided during your conversation with us.

We do not record phone calls.

Legal Basis for Processing: Our legitimate interests under Article 6(1)(f) of the GDPR.

Legitimate Interests: Responding to inquiries and messages received and maintaining records of correspondence.

Legal Basis for Processing: Necessary for the performance of a contract or to take steps at your request to enter into a contract under Article 6(1)(b) of the GDPR.

Reason for Necessity for Contract Performance: When your message pertains to us providing goods or services, or taking steps before providing goods and services (such as providing information about said goods and services), we process your information accordingly.

Post

If you contact us by post, we will collect any information provided in any postal communications sent to us.

Legal Basis for Processing: Our legitimate interests under Article 6(1)(f) of the GDPR.

Legitimate Interests: Responding to inquiries and messages received and maintaining records of correspondence.

Legal Basis for Processing: Necessary for the performance of a contract or to take steps at your request to enter into a contract under Article 6(1)(b) of the GDPR.

Reason for Necessity for Contract Performance: When your message pertains to us providing goods or services, or taking steps before providing goods and services (such as providing information about said goods and services), we process your information accordingly.

We collect and utilize information from individuals who interact with specific features of our website in accordance with this section and the section titled “Disclosure and Additional Uses of Your Information.”

E-Newsletter

When you subscribe to our e-newsletter on our website or opt to receive news and product updates from us by entering your email address and clicking subscribe or ticking a box at checkout indicating your preference.

Legal Basis for Processing: Your consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR). Consent is obtained when you sign up to receive our e-newsletter using the methods described above.

Transfer and Storage of Your Information

We utilize third-party services, MailChimp and Campaign Monitor, to send our e-newsletter and manage our mailing list. Their privacy policies are available at: Campaign Monitor Privacy Policy and MailChimp Privacy Policy.

Information you provide to subscribe to our e-newsletter will be stored on MailChimp and Campaign Monitor servers, located both within and outside the European Economic Area, specifically in the United States of America. For further details on safeguards used during data transfers outside the European Economic Area, refer to the “Transfers of Your Information Outside the European Economic Area” section of this privacy policy.

Use of Web Beacons in Emails

We utilize technologies such as web beacons (small graphic files) in the emails we send to gauge engagement levels by measuring delivery rates, open rates, click-through rates, and time and date information. Web beacons are employed only if you have consented to their use.

For more information on how our third-party mailing list providers utilize web beacons, please consult their privacy policies available at: Campaign Monitor Privacy Policy and MailChimp Privacy Policy.

Registering on Our Website

When you register and create an account on our website, we collect the following information: [list of information collected during registration], including your IP address and email address.

Failure to provide mandatory information required by the registration form will prevent registration and account creation on our website.

Legal Basis for Processing: Necessary for the performance of a contract or to take steps at your request prior to entering into a contract under Article 6(1)(b) of the GDPR.

Reason for Necessity for Contract Performance: Registering an account on our website is essential to access the goods and services you purchase from us.

Transfer and Storage of Your Information

Information submitted via the registration form on our website will be stored within the European Economic Area on servers located in the United Kingdom. For further details on safeguards applied during data transfers outside the European Economic Area, refer to the “Transfers of Your Information Outside the European Economic Area” section of this privacy policy.

We collect and use information from individuals who place orders on our website in accordance with this section and the section titled “Disclosure and Additional Uses of Your Information.”

Information Collected When You Place an Order

Mandatory Information: When you place an order for goods or services on our website, we collect your name, email address, payment address, company name (if applicable), and VAT number (if applicable).

Failure to provide this information will prevent you from purchasing goods or services from our website or entering into a contract with us.

Legal Basis for Processing: Necessary to perform a contract (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

Reasons Why Necessary to Perform a Contract: The mandatory information collected via our checkout form is required to establish the contracting party and to communicate with you to fulfill our contractual obligations, including sending receipts and order confirmations.

Processing Your Payment

After placing an order on our website, you are required to make payment for the goods or services ordered. To process your payment, we utilize third-party payment processors, including PayPal, and GoCardless. Your payment may be processed by any of these providers depending on your chosen payment method.

PayPal, or GoCardless collect, use, and process your information, including payment details, in accordance with their respective privacy policies. You can access their privacy policies via the following links: PayPal Privacy Policy, GoCardless Privacy Policy.

Transfer and Storage of Your Information

• PayPal is located in the United States of America. Information related to payment processing is stored outside the European Economic Area on PayPal’s servers in the United States of America.
• GoCardless is located in the United Kingdom. Information related to payment processing is stored within the European Economic Area on GoCardless’s servers in the United Kingdom.

For further details about the safeguards applied when transferring your information outside the European Economic Area, please refer to the “Transfers of Your Information Outside the European Economic Area” section of this privacy policy.

Legal Basis for Processing: Necessary to perform a contract (Article 6(1)(b) of the GDPR).

Reasons Why Necessary to Perform a Contract: To fulfill your contractual obligation to pay for the goods or services ordered from us.

Marketing Communications

During checkout, you have the option to receive marketing communications from us.

Our Similar Goods and Services: You can opt out of receiving marketing communications related to goods and services similar to those you purchase from us by not ticking the marketing communication box during checkout or by unsubscribing from our email marketing. If you do not opt out, we will send you marketing communications regarding similar goods and services.

Legal Basis for Processing: Our legitimate interests (Article 6(1)(f) of the GDPR).

Legitimate Interests: Direct marketing and promoting our products and services.

This section outlines how we obtain or collect information about you from third parties.

Information Received from Third Parties

We typically do not receive information about you from third parties. However, third parties from which we may receive information include design agencies, digital agencies, or affiliates/resellers. It is also possible that third parties with whom we have had no prior contact may provide us with information about you.

Information we obtain from third parties generally includes your name, contact details, and any additional information they provide to us.

Legal Basis for Processing: Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

Reasons Why Necessary to Perform a Contract: If a third party shares information about you (such as your name and email address) with us to facilitate our provision of services to you, we will process your information to fulfill our contractual obligations or to take steps at your request to enter into a contract.

Legal Basis for Processing: Consent (Article 6(1)(a) of the GDPR).

Consent: If you have requested that a third party share information about you with us for purposes unrelated to our service provision, we will process your information based on your consent, which you provide by requesting the third party to share your information with us.

Legal Basis for Processing: Our Legitimate Interests (Article 6(1)(f) of the GDPR).

Legitimate Interests: In situations where a third party shares information about you with us and you have not consented to such sharing, we have a legitimate interest in processing that information under certain circumstances. For instance, we may process your information to fulfill our obligations under a subcontract with the third party, where the third party holds the main contract with you. Our legitimate interest lies in fulfilling our obligations under the subcontract.

Similarly, if third parties provide us with information indicating that you have infringed or potentially infringed any of our legal rights, we have a legitimate interest in processing that information to investigate and address any potential infringement.

Handling Information Received in Error

If we receive information about you from a third party in error or without a legal basis for processing, we will promptly delete your information.

Information Obtained from Third Parties by Us

In certain circumstances, such as to verify or obtain missing information necessary to provide you with our services, we may obtain information about you from publicly accessible sources, both within and outside the EU. These sources may include Companies House, online customer databases, business directories, media publications, social media platforms, and websites (including your own if available).

Additionally, we may obtain information about you from private sources, both within and outside the EU.

Legal Basis for Processing: Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the GDPR).

Reasons Why Necessary to Perform a Contract: If you have entered into or requested that we enter into a contract with you, we may obtain information from public sources to understand your business and deliver services to you or to an adequate standard.

For example, if you request email correspondence and we lack or need to verify your email address, we may obtain or confirm it from your website or a directory.

Legal Basis for Processing: Our Legitimate Interests (Article 6(1)(f) of the GDPR).

Legitimate Interests: In certain cases, we have a legitimate interest in obtaining information from public and private sources. For instance, if we suspect or find that you have infringed any of our legal rights, we have a legitimate interest in gathering and processing information from these sources to investigate and address suspected or potential infringements.

This section outlines when we disclose information about you to third parties and additional purposes for which we use your information.

Disclosure of Your Information to Third Parties

We disclose your information to third parties under specific circumstances as detailed below.

Providing Information to Third Parties such as Google Inc. and FullStory.com

We utilize Google Analytics on our website, which collects information including IP addresses and data from cookies. Google uses this information for various purposes, such as improving its Google Analytics service. Information is shared with Google in an aggregated and anonymized form. For more details on what information Google collects and how it is used, please visit the following link: Google Privacy Policy.

Legal Basis for Processing: Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation (GDPR)).

Legitimate Interest(s): Meeting our contractual obligations to Google under our Google Analytics Terms of Service (Google Analytics Terms).

You can opt out of Google Analytics by installing the browser plugin available here: Google Analytics Opt-out.

Transfer and Storage of Your Information

Information collected by Google Analytics is stored on Google’s servers in the United States of America, outside the European Economic Area (EEA). For information on safeguards used when transferring your information outside the EEA, please refer to the “Transfers of Your Information outside the European Economic Area” section in this privacy policy.

Sharing Your Information with Third Parties Related to Our Business Operations

We share your information with third parties associated with the operation of our business, where necessary. These may include our advisors and insurers. Details on each of these third parties are provided below.

Legal Basis for Processing: Our legitimate interests (Article 6(1)(f) of the GDPR).

Legitimate Interest: Efficiently running and managing our business.

Advisors

Occasionally, we seek advice from advisors such as financial advisors, lawyers, and public relations professionals. Your information is shared with these third parties only when necessary to enable them to provide relevant advice.

Insurers

We share your information with our insurers as necessary, such as in relation to claims or under our general disclosure obligations pursuant to our insurance contract.

Disclosure and Use of Your Information for Legal Reasons

We may disclose your information in the following situations:

• Indicating Criminal Acts or Threats to Public Security: If we suspect criminal conduct or threats to public security (e.g., fraud or cybercrime), we may need to contact appropriate authorities such as the police.
• Enforcement of Legal Rights: We may use your information to enforce our legal rights, including sharing information with debt collection agencies if you fail to pay amounts owed.
• Legal Disputes: We may use your information in legal disputes or proceedings, including mediation, arbitration, or court resolution processes.
• Compliance with Legal Obligations: We will use and process your information to comply with legal obligations, such as disclosing information pursuant to a court order or subpoena or to authorities like the National Crime Agency in relation to suspected money laundering.

Legal Basis for Processing: Our legitimate interests (Article 6(1)(f) of the GDPR) and compliance with a legal obligation (Article 6(1)(c) of the GDPR).

Legitimate Interests: Preventing crime, enforcing legal rights, resolving disputes, and ongoing compliance with legal requirements.

This section outlines how long we retain your information. We have established specific retention periods wherever possible. Where specific periods are not feasible, we have provided criteria used to determine retention periods.

Retention Periods

1. Server Log Information: We retain information on our server logs for up to 1 year.
2. Order Information: When you place an order for goods or services, we retain this information for six years after the end of the financial year in which you placed your order. This is in accordance with our legal obligation to maintain records for tax purposes.
3. Correspondence and Enquiries: When you make an enquiry or contact us by email, contact form, or phone, we retain your information for as long as necessary to respond to and resolve your enquiry. After resolving your enquiry, we retain the information for an additional 6 months, after which it will be deleted.
4. E-Newsletter: We retain the information you used to sign up for our e-newsletter for as long as you remain subscribed (i.e., you do not unsubscribe) or until we decide to discontinue our e-newsletter service, whichever comes first.

Criteria for Determining Retention Periods

In other circumstances, we retain your information no longer than necessary, considering the following:

• The purposes and usage of your information both now and in the future (e.g., whether it is necessary to store the information to fulfill our contractual obligations or to contact you in the future).
• Any legal obligations requiring us to process your information (e.g., record-keeping obligations under applicable law or regulation).
• Any legal basis for continuing to process your information (e.g., your consent).
• The value of your information, both currently and in the future.
• Industry standards and practices regarding data retention periods.
• The level of risk, cost, and liability associated with retaining your information.
• The difficulty in ensuring the information remains accurate and up-to-date.
• Any other relevant circumstances (e.g., the nature and status of our relationship with you).

Your information may be transferred and stored outside the European Economic Area (EEA) under the circumstances outlined below. We will also transfer your information outside the EEA or to an international organization to comply with legal obligations to which we are subject (e.g., compliance with a court order). Where required, we ensure appropriate safeguards and protections are in place.

Contact Form

Information you submit via our contact form is transferred outside the EEA and stored on servers provided by our third-party providers: Google G-Suite.

• Country of Storage: United States of America. This country does not have an adequacy decision by the European Commission.
• Safeguard(s) Used: Our third-party providers have self-certified their compliance with the EU-U.S. Privacy Shield.

Email

Information you submit via email is transferred outside the EEA and stored on servers provided by our third-party email provider: Google G-Suite.

• Country of Storage: United States of America. This country does not have an adequacy decision by the European Commission.
• Safeguard(s) Used: Our third-party email provider has self-certified its compliance with the EU-U.S. Privacy Shield.

E-Newsletter

Information you submit when signing up for our e-newsletter is transferred outside the EEA and stored on servers provided by our third-party mailing list provider: MailChimp.

• Country of Storage: United States of America. This country does not have an adequacy decision by the European Commission.
• Safeguard(s) Used: Our third-party mailing list provider has self-certified its compliance with the EU-U.S. Privacy Shield.

Google Analytics

Information collected by Google Analytics (including your IP address and actions on our website) is transferred outside the EEA and stored on Google’s servers.

• Country of Storage: United States of America. This country does not have an adequacy decision by the European Commission.
• Safeguard(s) Used: Google has self-certified its compliance with the EU-U.S. Privacy Shield. The EU-U.S. Privacy Shield is an approved certification mechanism under Article 42 of the GDPR, permitted under Article 46(2)(f) of the GDPR. You can access Google’s Privacy Shield certification here.

Subject to certain limitations on certain rights, you have the following rights in relation to your information, which you can exercise by writing to Right Turn Websites, 69 Meadowbrook, Wigan, Greater Manchester, WN5 8ED or sending an email via our contact form:

1. Access: You have the right to request access to your information and to obtain information about how we use and process your information.
2. Correction or Deletion: You have the right to request the correction of inaccurate information about you or, in certain circumstances, to request the deletion of your information.
3. Restriction of Processing: You have the right to request that we restrict our use of your information in certain circumstances.
4. Data Portability: You have the right to receive your information which you have provided to us in a structured, commonly used, and machine-readable format (e.g., a CSV file). You also have the right to request that we transfer this information to another data controller, where technically feasible.
5. Objection to Processing: You have the right to object to the processing of your information for certain purposes. For further information, please see the section below entitled “Your right to object to the processing of your information for certain purposes.”
6. Withdrawal of Consent: If we rely on your consent to use or process your information, you have the right to withdraw that consent at any time. However, please note that this will not affect the lawfulness of our use and processing of your information based on your consent before the withdrawal.
7. Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

In accordance with Article 77 of the General Data Protection Regulation (GDPR), you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or of an alleged infringement of the GDPR.

For the UK, the supervisory authority is the Information Commissioner’s Office (ICO). You can find their contact details here.

Further Information

The above rights are provided in summary form only, and certain limitations apply to many of these rights. For further details about your rights in relation to your information, including any limitations which apply, please visit the following pages on the ICO’s website:

• Guide to the General Data Protection Regulation (GDPR) – Individual Rights
• Is my information being handled correctly?

You can also refer to the GDPR itself, contained in Articles 12 to 22 and 34, available here for further information about your rights.

Verifying Your Identity

Where you request access to your information, we are required by law to use all reasonable measures to verify your identity before doing so. This is to protect your information and reduce the risk of identity fraud or unauthorized access.

How We Verify Your Identity

If we have sufficient information about you on file, we will use that information to verify your identity.

If we cannot identify you from such information, or if we have insufficient details, we may request original or certified copies of specific documentation to verify your identity before providing access to your information.

We will specify the exact information required to verify your identity based on your circumstances when you make such a request.

You have the following rights in relation to your information, which you may exercise by writing to Right Turn Websites, 69 Meadowbrook, Wigan, Greater Manchester, WN5 8ED or sending an email via our contact form::

1. Objecting to Processing for Public Interest or Legitimate Interests: You have the right to object to us using or processing your information where we do so in order to carry out a task in the public interest or for our legitimate interests, including profiling based on these purposes.
2. Objecting to Processing for Direct Marketing Purposes: You have the right to object to us using or processing your information for direct marketing purposes, including any profiling related to such direct marketing.

How to Object to Direct Marketing

You may exercise your right to object to us using or processing your information for direct marketing purposes by:

• Clicking the unsubscribe link contained at the bottom of any marketing email we send to you and following the instructions provided.
• Sending an email via our contact form, requesting that we stop sending you marketing communications, or including the words “OPT OUT” in your email.

For more information on how to object to our use of information collected from cookies and similar technologies, please refer to the section titled “How to accept or reject cookies” in our cookies policy, available here.

‘Sensitive personal information’ is information about an individual that reveals their racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying an individual, information concerning health or information concerning a natural person’s sex life or sexual orientation.

We do not knowingly or intentionally collect sensitive personal information from individuals, and you must not submit sensitive personal information to us.

If, however, you inadvertently or intentionally transmit sensitive personal information to us, you will be considered to have explicitly consented to us processing that sensitive personal information under Article 9(2)(a) of the General Data Protection Regulation. We will use and process your sensitive personal information for the purposes of deleting it.

We update and amend our Privacy Policy from time to time.

Minor Changes to Our Privacy Policy

Where we make minor changes to our Privacy Policy, we will update our Privacy Policy with a new effective date stated at the beginning of it. Our processing of your information will be governed by the practices set out in that new version of the Privacy Policy from its effective date onwards.

Major Changes to Our Privacy Policy or the Purposes for Which We Process Your Information

Where we make major changes to our Privacy Policy or intend to use your information for a new purpose or a different purpose than the purposes for which we originally collected it, we will notify you by email (where possible) or by posting a notice on our website.

We will provide you with the information about the change in question and the purpose and any other relevant information before we use your information for that new purpose.

Wherever required, we will obtain your prior consent before using your information for a purpose that is different from the purposes for which we originally collected it.