By "personal data" we mean any information that could be used to identify you or link an action to you in some way.

The main personal data we tend to collect is:

• Personal details, such as your name, gender and date of birth
• Contact details like your address, email address and phone number
• Payment information, including payment method and billing address

We want you to have the best possible experience shopping with us, so we also collect the following data in order to improve your experience:

• Preferred shopping channel, such as instore, online or over the telephone
• Your purchase history when you make purchases from us online or over the telephone
• Your preferred store
• Information submitted to us as part of our online or telephone gift wrap service, including any optional gift message you asked us to include
• Technical information about the way you access our website, including your IP address, geographical location, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform and device information (such as mobile, desktop or tablet)
• Information about your computer and about your visits to and use of our website, including information about the adverts you click on to lead you to our website, how you interacted with the website (search terms entered, page response times, download errors, length of visit to certain pages, page interaction information such as scrolling, click, and mouse-overs) and where you went next (including full URLs and methods used to browse away from the site).
• Information about your social media accounts, including your username, when you interact with us via social media
• Information about any competition entries you have made

Other data we may collect includes:

• CCTV images. Our stores are fitted with CCTV to help protect our staff and customers. As a result, your image may be captured during your visit
• Your interactions with our Customer Services team. This will include written comments about your queries and our responses to you

We do not knowingly capture any sensitive Personal Data relating to:

• Race or ethnic origin
• Political opinions
• Religious or other similar beliefs
• Medical or health conditions (both physical and mental)
• Sexual orientation

If we do ever collect such personal data from you we will make sure that we only do this with your explicit consent, or as otherwise permitted under relevant data protection laws.

(Please note that you must be 16 years old or over to subscribe to receive marketing communications from Cath Kidston. Anyone aged under 16 years old must have consent from a parent or guardian. We do not knowingly collect personal data from anyone under the age of 16.)

• There are several touch points where we collect your data.
• In most cases we will collect personal data directly from you. For example, we collect personal data from you in the following circumstances:

Marketing

• When you fill in any form or survey
• When you enter one of our competitions or prize draws
• When you make use of one of our promotions
• When you interact with one of our ads or digital marketing channels

Online

• When you create an account online (or instore)
• When you make a purchase online
• When you engage with us on social media (including Facebook, Instagram, Twitter or Pinterest)
• When you contact our Customer Services team

Instore

• When you visit our stores, the CCTV systems that are in place to help protect our staff and customers may capture your image
• When you sign up to receive our marketing communications via email, post or SMS
• When you enter one of our competitions or prize draws

Telephone

• When you contact our Customer Services team
• When you make a purchase over the telephone, we will collect your name and email address or telephone number to send you a link by which you can pay for your purchase. You will need to provide payment information via that link to pay for the purchase. We will also collect your address to post your purchase to you.

We also collect personal data from other sources, such as:

• Through friends or family. If someone wishes to purchase a gift for you or order something on your behalf online they will need to provide us with your name and delivery details so that we can ensure you receive the order.
• Other publicly available sources. We access and store information which is available from public sources, including some personal data (for example, we may have access to information on your social media profile when you interact with us on any social media platform we use).
• Through your browser or device or through our servers. Certain information is collected by most browsers or automatically through your device. As mentioned above, we collect your IP address or other device identifier (this enables us to recognise your computer or device when you use the website) via our server log files.
• Through cookies and our digital advertising partners. Our website uses cookies to recognise you when you visit and use the website. This helps us to provide you with a good experience when you browse our website and also allows us to make any adjustments or improvements. For more information on the cookies we use, the purposes for which we use them and ways to limit the use of cookies and similar technologies in relation to your browsers or devices, please see the 'Tell me more about cookies' section below.

We use your personal data for a variety of purposes related to the day to day running of CK Acquisitions Limited, and to ensure we provide our customers with the highest standards of service. From a legal perspective, we need to apply a justification for our use of your personal data, so we have set out an explanation of this below. We will only use your personal data as set out in this policy.

We use your personal data:

• 1. For internal business purposes such as generating statistics about our customers, undertaking consumer research and developing marketing plans and managing our audits. This helps us to make sure that we are serving our customers in the best way and ensures we continue to be interesting and relevant to them. Where we do this we will use the information in aggregate form (so that we cannot identify individuals). We may collect, store or accumulate certain non-personally identifiable information concerning our customers' and visitors' use of www.cathkidston.com, such as information regarding which of our pages are most popular and general website administration.
• We rely on our legitimate interests as a business to process personal data in this way whilst always ensuring that your rights are protected.
• 2. To help us ensure our website runs effectively we need to ensure that the content on our website is presented in the best and clearest manner for you and your device. We also use personal data to administer our website for internal operations (including troubleshooting, data analysis, testing, research, statistical and survey purposes).
• We rely on our legitimate interests as a business to process personal data in this way (for example, we have a clear interest in ensuring that our website works properly and that our web services are efficient), whilst always ensuring that your rights are protected.
• 3. Where we have a contractual obligation to you. We need to process certain personal data (such as your address or your payment details) if you purchase a product from us online or over the telephone so that we can fulfil that order. We may also need to process personal data where you wish to return goods and/or receive a refund. This also may mean passing your name and address on to our trusted logistics or courier third parties (for more information about this please see the 'Do you share my personal data?' section below).
• We will process your personal data in this way because it is necessary in order to perform our agreement with you to deliver the products you have ordered.
• 4. To administer and run promotions, competitions, and prize draws. We like to run competitions and prize draws to engage with our customers and those who may be interested in our brand. We will need to process some personal data in order to run these (for example, in order to pick and contact a winner and deliver their prize).
• We process your data in this way either because we have your consent to do so or because it is in our legitimate interests to process the data in this way to run the promotion, competition or prize draw. Whenever we rely on our legitimate interests, we will always make sure that your rights are protected.
• 5. For other marketing purposes. We use personal data to help us send direct marketing to our customers and other interested parties. For more information about the ways we use personal data for marketing and our justification for doing so please refer to the 'Using your data for marketing purposes' section below.
• 6. As part of our consumer or market research we may conduct online customer surveys by email (we rely on our legitimate interests as a business to process personal data in this way whilst always ensuring that your rights are protected, and in limited circumstances). We may also undertake detailed consumer research with particular customers, though we will only ever engage in this level of consumer research with the individual's consent. Such consent may of course be revoked at any time.
• 7. Where we have a legal obligation to do so. In some circumstances we may need to pass on personal data or give access to personal data to law enforcement or another statutory authority. For example, we may need to use personal data to comply with tax laws or in scenarios that involve criminal activity, such as fraud or theft. For instance, this may be CCTV imagery.

We will never sell your personal data or give it to anyone else for them to use for their own purposes without making that clear to you. However, we do sometimes share your personal data in various ways. We have set these out in more detail below:

Sharing with organisations that provide services to us:

• If you place an order from us online or over the telephone we need to process that order, which will mean passing your name and address on to our fulfilment provider or our trusted logistics or courier third parties.
• Where you place an order from us over the telephone, we will also need to share your name, email address or telephone number and order details with our payment platform provider to enable us to send you a link on which you can pay for your purchase.
• We also work with data analysis firms, consumer insight agencies and market research agencies to help us understand our customers and ensure that we continue to meet their needs and serve them most efficiently. The majority of this data is statistical/analytical and it is not possible to identify you from this information.
• We have a customer relationship management system which is provided to us by a third party. This system helps us to communicate efficiently and effectively with suppliers and consumers.
• We also work with authorisation agencies, customer support specialists, website developers, web hosting companies and marketing fulfilment companies (e.g. companies that coordinate mailings [including by post and email]).

If you would like any further information about the kinds of service providers we work with please get in touch with us at welovetolisten@cathkidston.co.uk

Sharing with other "controllers" of personal data:

• For consumer insight purposes and making sure we serve the right ads:

  In limited circumstances we work with other parties (who will also be controllers of personal data, i.e. using the data for their own purposes) to gather information; where both parties have a separate justification for collecting the personal data. For example, we have partnered with Rakuten Marketing to help us ensure we are serving the right ads, at the right time, to the right individuals across the internet. Personal data is collected via a cookie on our website (for more information about the ways in which Rakuten processes personal data you can view Rakuten's privacy policy here).

  For more information about the ways we use cookies and how to control them please refer to the 'Tell me more about cookies' section below.

  Sharing with our favourite partners for marketing purposes:

  Where you have given us your consent to do so, we may share your contact details with our favourite partners so that they can send you freebies and other things we think you might find interesting. You can change your mind and revoke your consent for us to share this personal data with our partners at any time by contacting us using the details set out below.

• Business transfers:

  As we continue to develop our business, we might sell certain of our assets, or be sold. In such transactions, user information, including personal data, may be one of the business assets transferred. Similarly, if our ownership structure changes, we may need to disclose your personal data to the new owners or operators of our website as part of that process.

• Sharing personal data to protect our rights or comply with our legal obligations:

  We may disclose any information, including personal data, we deem necessary to comply with any applicable law, regulation, legal process or governmental request. This might mean sharing your data with courts, lawyers, police, local authorities or other third parties where permitted or required by law.

• International transfers of personal data:

  Your Personal Information will be stored at facilities located across the world and not necessarily within the European Economic Area ("EEA").

  There will be instances where we need to transfer your personal data to countries outside the UK or the EEA. For example, we work with some global service providers who are based outside of the UK or EEA.

  Although countries outside the UK and EEA may not provide the same level of protection of personal data as the UK and countries within the EEA, we will always ensure that appropriate safeguards are implemented to protect your personal data, including agreeing appropriate contract terms with third parties or relying on recognised certifications such as the EU-US privacy shield.

• Your trust is very important to us, so we have strict policies in place to make sure your data is protected and secure.
• We implement various technical and organisational security measures to protect the security of your personal data, both online and offline, and we comply with all required legal and industry security best practices to ensure the integrity, confidentiality and availability of customer data.
• If you have any questions about the ways which we protect personal data you can contact us using the contact details provided below.

• We only retain your personal data for as long as is necessary and for the purposes described in this policy. This means that retention periods will vary according to the type of the personal data and the reason that we have it in the first place.

For example:

• If you have provided us with your consent to receive marketing communications we will keep this personal data until such consent is revoked or we no longer undertake marketing activities
• If you have registered with us online, we will keep certain information, such as your address, so that you can continue to make online purchases as seamlessly as possible, until you remove these details from your registration
• if you have registered with us online, we will also keep information about the products you have bought from us in the past to help us know what you are likely to be interested in in future

Depending on our relationship with you and how we have collected your personal data, we will use your personal data to market to you about new products, special offers, discounts, new partnerships, events and competitions by telephone, email or post. We do this in the following circumstances:

• Where we have your consent to do so. You can proactively subscribe to receive marketing communications from us over the telephone, instore or online. . You can change your mind and revoke your consent at any time. For more information about how to do this please refer to the 'How do I unsubscribe from marketing communications?' section below.
• Where we rely on our legitimate interests. If you are a customer of Cath Kidston (i.e. if we have gathered your contact details in the context of a transaction or registration), we want to be able to email you about any exciting new products or offers we think you will be interested in, based on items you have previously bought from us. We may also contact you by telephone or post about products or offers we think you will be interested in. We will not market to you by telephone if you are registered with the Telephone Preference Service unless you have consented for us to do so. We will also always ensure you have the opportunity to opt-out of receiving further marketing communications. For more information about how to do this please refer to the section 'How do I unsubscribe from marketing communications?' below.

If you would like to stop receiving our marketing communications you can let us know in the following ways:

• via any emails you receive from us, by clicking 'UNSUBSCRIBE' at the bottom of the email;
• by visiting any of our stores and asking a member of the team to amend your preferences;
• by contacting us using the details in the 'How do I get in touch?' section below; or
• through your account settings, by visiting the 'My Account' page once you have logged in.

We will action these requests within 30 days.

Stopping marketing communications will not prevent you from receiving non-marketing communications (for example, if you have purchased a product from us online or by telephone, we will still send you updates so that you know when your purchase is being delivered).

We use cookies to help us collect and manage personal data on our website and across the internet. We want to be as transparent as possible about our use of cookies, so we have set out more information here about the types of cookies we use and the ways in which we use them.

• What are cookies and how do we use them?

Cookies (and other similar technologies that you may hear about, such as tags, pixels, beacons etc.) are small files of data that are stored on your internet browser, computer, handheld device or mobile as you browse various web pages. Cookies provide certain information about your online activity.

There are different types of cookies which help us achieve different things. We have grouped our cookies in two ways: (i) all cookies are either session cookies or persistent cookies, and (ii) all cookies serve one of four purposes.

• Session and persistent cookies.

When we use these terms we refer to how long the cookie sits on your device. Session cookies only exist for a small amount of time (a session cookie will only exist on your device when you use the website) whereas persistent cookies will remain on your device for longer. We use persistent cookies to enable the website to determine whether you have visited and signed in previously.

• Cookie purposes:

We use the following types of cookies, which are used for the following broad purposes:

• Strictly Necessary. These are cookies that are required for the operation of our website. They are essential in order to ensure the website works property.
• Performance cookies. These cookies allow us to recognise and count the number of visitors to our website, and see how these users move around our website. They help us to improve the way our website works, for example, by ensuring that users can find what they are looking for easily.
• Functionality Cookies. These are used to recognise you when you return to our website and improve your shopping experience. They enable us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to a website, the pages you have visited and the links you have followed, and use this information to make sure any advertising you see (both on our website and elsewhere on the internet) is more relevant to your interests. The information is sometimes shared with third parties for this purpose.

Which cookies are used on www.cathkidston.com?

• In order to be as transparent as possible about the cookies we use we have listed the cookies that are currently active on www.cathkidston.com below, and we have provided information about what these cookies do.

Adroll Smart Pixel

We use AdRoll’s smart pixel. AdRoll may serve you with targeted Ad's by occasionally placing a cookie on your browser. No information about the visitor will be stored by the Adroll smart pixel. The data that is collected includes:

- Website Activity - what pages you visited while on the website. This helps us understand what pages you were interested in during your visit.

- Device and Browser - This includes browser or device you used to access the website, e.g. device type and IP address.

- Ad Data - This is data about the on line adverts AdRoll served (or attempted to serve) you. It includes information such as what page an advert appeared on, the number of times the advert was served to you and if you engaged with the advert.

Please note, none of your personal data will be shared with Adroll.

You can find information on how you can opt out here. Opting out could result to seeing adverts which have no relevance to your interest.

Please note that if you decide to 'share' content from our website with friends through social networks – such as Facebook and Twitter - you may be sent cookies from these websites. We don't control the setting of these cookies, so please check the third-party websites for more information about their cookies and how to manage them.

• How can I control cookies?

You may choose whether or not to accept cookies and can control them through your web browser. In most cases, your computer will automatically enable cookies, but you can amend these settings either within the browser options for the provider itself, or through a third party cookie management website.

We want to make sure managing cookies is as easy as possible for our customers, so we are currently working with a number of technology providers to find particular ways to make cookie control on our website easier.

Please follow the links below for browser options for the following providers:

• Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
• Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en

For more information about cookies and how you can control them we recommend you visit: http://www.youronlinechoices.com/uk/

Please note that if you reject all cookies entirely it could result in our website no longer working properly. For example if you want to buy products on our website you will need to have cookies enabled within your internet browser.

The law gives you a number of rights over your personal data and our use of it. These rights are:

• to withdraw your consent to any processing of personal data where we rely on that consent;
• to ask to see what personal data we hold about you and to find out about the way that we process that data (and in some circumstances, you can ask us to provide a copy to a third party);
• to ask us to correct or update any personal data which is inaccurate;
• to ask for personal data to be deleted in some (but not all) circumstances where there is no good reason for us to continue to process it;
• to object to our processing of personal data in some (but not all) circumstances, including objecting to direct marketing;
• to ask us to temporarily stop using your data if you don't believe that we have a right to use it, or to stop us from using your personal data where there is no good reason for us to continue to use it; and
• not to be subject to decisions made solely on the basis of 'automated processing' (i.e. the right not to be subject to decisions made solely by algorithms or computers without input from a human) in certain circumstances.

You can access any personal data that you have submitted via the website by visiting the 'My Account' page. Alternatively you can contact our Customer Services team, who will be able to help, using the contact details set out in the 'How do I get in touch' section below.

• Ensuring your personal data is accurate:

We will take reasonable steps to create an accurate record of any personal information about you. However, we do not take responsibility for confirming the ongoing accuracy of your personal data. For example, we need to you inform us if you move house and wish to have deliveries sent to your new address.

If your details change (perhaps you’ve moved home), you can simply update your preferences by clicking on "UPDATE YOUR PREFERENCES" at the bottom of every email or via the 'My Account' section on our website.

We hope that you have found all the information you need on this page, but if you have any further queries or need to get in touch with us regarding anything set out above you can contact us in the following ways.

• you can email us at customerdata@cathkidston.co.uk us anytime.

We aim to get back to you within 24 hours.

We hope that you feel you can contact us first in any instances where you are unhappy about how your personal data is being treated, and we will try our very best to help. However, should you need to, you also have the right to complain about our use of your personal data. You can contact the Information Commissioner's Office via their website: https://ico.org.uk/concerns/ or by calling 0303 123 1113.

NAI - https://optout.networkadvertising.org/?c=1

DAA - https://optout.aboutads.info/?c=2&lang=EN