Last updated: 13th November 2023

1       Introduction

Welcome to Heat Merchants. This policy explains how we handle and use your personal information and your rights in relation to that information. Under GDPR of May 2018, the Heat Merchants is controller of that information.

The Washglade Limited T/A Heat Merchants (hereafter referred to as the “Company”) with registered offices at Muirfield Drive, Naas Road, Dublin 12, Ireland, is committed to protecting and respecting your privacy.

This Privacy Policy explains why and how we will use the personal information that we have obtained from you or others, with whom we share it and the rights you have in connection with the information we use. Please read the following carefully.

This policy describes the way we handle and use the personal information that we obtain from all the different interactions you may have with us as a business, including when you visit our stores, social media pages or website currently located at https://www.heatmerchants.ie or when you contact us.

The Company is the controller in relation to the processing activities described below. This means that Company decides why and how your personal information is processed. Please see the section at the end of this policy for our contact and legal information.

This policy was last updated on the date that appears at the top of this page.

2       Personal Information We Collect About You

We receive personal information about you that you give to us, that we collect from your visits to our stores, website, and social media pages and that we obtain from other sources, including third parties. We only collect personal information which we need and that is relevant for the purposes for which we intend to use it.

Information that we collect about you in store, online, by phone, social media and email:

• Your name, title and contact details (email address, telephone number, postal address);
• Any information you include in correspondence you send to us or in forms you submit to us at our stores or when using our website or social media pages;
• Details of your orders and purchases;
• Your marketing preferences;
• The opinions and other information you provide when responding to customer surveys and product reviews;
• Any personal information included in your entries to competitions that we run;
• Your identification information when exercising the rights that you have in relation to our processing of your personal information (see further Your rights in relation to your personal information);
• Details of any transactions between you and us;
• Voice recordings of calls you make to our customer service centre and information you give us when you contact us with a query or issue;
• Your payment card details and, in relation to certain refunds, your bank account details;
• Footage of you on CCTV;

When you visit our website we automatically collect:

• The frequency of your voucher, shopping code usage;
• Details of your use of our website namely traffic data, weblogs and statistical data, including where and when you clicked on certain parts of our website and details of the webpage from which you visited it;
• The date and time you used our website;
• The pages you visited on our website and how long you visited us for;
• The website address from which you accessed our website;
• If we have asked for it, details regarding when and how you consented to receive marketing communications from us (including the time and date you provided your consent);
• Cookie, pixels and beacon identification information (for more information please see our Cookie Policy).

3. Use of Your Personal Information

We use your personal information for a variety of reasons. We rely on different legal grounds to process your personal information, depending on the purposes of our use and the risks to your privacy. You will only receive emails from us if:

1. we have obtained your contact details in the course of a sale or negotiation for a sale of our products or services and you have not objected to receiving such direct email from us. Of course, we will only use your contact details to send you marketing emails that are based on similar products or services that you purchased from us and you will always have the opportunity to opt out at any time or
2. if you have consented to receiving marketing from us (you can opt-out of receiving them at any time). We do not share your personal information with companies that would send their marketing to you.

We use your personal information in the following ways:

3.1       Where You Have Provided Consent

We may use and process your personal information for the following purposes where you have consented for us to do so:

• To contact you via email, online or by post (as you have indicated) with marketing information about our products, events, product launches, exciting offers and services.
• To conduct online surveys and follow-up interviews. Personal data obtained via a survey will only be used for research purposes, and not for directing marketing.

You may withdraw your consent for us to use your information in any of these ways at any time. Please see the ‘YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION’ section below for further details.

3.2       Where Necessary To Comply With Our Legal Obligations

We will use your personal information to comply with our legal obligations:

• To keep a record relating the exercise of any of your rights relating to our processing of your personal information.
• To take any actions in relation to health and safety incidents required by law.
• To handle and resolve any complaints we receive relating to the services and products we provide.

3.3       Where Necessary for us to Pursue a Legitimate Interest

We may use and process your personal information where it is necessary for us to pursue our legitimate interests as a business for the following purposes:

• Processing necessary for us to promote our business, brands and products and measure the reach and effectiveness of our campaigns;
• To contact you with targeted advertising delivered online through social media and other online platforms operated by other companies, unless you object. You may receive advertising based on information about you that we have provided to the platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it has received from us;
• To identify and record when you have received, opened or engaged with our website or social media or other electronic communications (please see our Cookie Policy for more information);
• To analyse, evaluate and improve our products and services so that your visit and use of our website, social media pages and stores are more useful and enjoyable (we will generally use data amalgamated from many people so that it does not identify you personally);
• To administer our website, and our social media pages and for internal operations, including troubleshooting, testing, statistical purposes;
• To verify the accuracy of data that we hold about you and create a better understanding of you as an account holder or visitor;
• For network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
• To inform you of updates to our terms and conditions and policies;
• To enforce or protect our contractual or other legal rights or to bring or defend legal proceedings;
• Protecting the Company buildings and assets, both during and after normal business hours, the Premises’ perimeter, entrances and exits, lobbies and corridors, special storage areas;
• Managing any health and safety risks and/or accidents in accordance with the Company’s health and safety obligations and relevant insurance policies;
• Supporting the An Garda Síochána in a bid to deter and detect crime and anti-social behaviour, including assisting in identifying, apprehending and prosecuting offenders.
• Monitoring of access control systems and verification of security alarms and keyholders

3.4       Where Necessary For us to Complete Orders and Run Competitions

We will use your personal information where this is necessary for us to perform our contract with you or to carry out any pre-contract steps you’ve asked us to so that you can enter into that contract, for the following purposes:

• To process your payment card or bank details when taking payment for your orders or when providing a refund
• To process, fulfil and complete your orders, purchases and other transactions entered into with us and deliver your order and
• To run our competitions and promotions that you enter from time to time and to distribute prizes.

3.5       Where Processing is in Your Vital Interests

We will use your personal information where this is in your vital interest to notify you of any product recall issues.

3.6       Marketing Communications

If we have requested your consent and you give your consent, we may use your personal information to contact you by email, online or by post to notify you of special offers, promotions, competitions or new products and services. We try to adapt any marketing material that we send to you for example by notifying you of special offers or promotions that will be of relevance to you, apply to your interests and in your location (we do this by monitoring your browsing and online shopping habits and providing information on products you have viewed and related products).

If you do not wish to receive communications from us, please inform us by using the unsubscribe link inside the email, by sending an email to info@heatmerchants.ie or by changing your preferences on your online account.

If you opt-out of receiving marketing communications from us, we keep your email address on our suppression list indefinitely to ensure that we comply with your wishes.

4       Disclosure of Your Personal Information by us

We only disclose your personal information outside our business in limited circumstances. If we do, we will put in place a contract that requires recipients to protect your personal information, unless we are legally required to share that information. Any contractors or recipients that work for us will be obliged to follow our instructions. We do not sell your personal information to third parties.

We may disclose your information to our third-party service providers, agents and subcontractors (Suppliers) for the purposes of providing services to us or directly to you on our behalf, including the operation and maintenance of our website, and social media pages.

When we use Suppliers, we only disclose to them any personal information that is necessary for them to provide their services and only where we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

The following companies provide professional services to help us operate our website. For further information about how these services process your data please visit the privacy policies listed.

• Magento is used to power our online store. Magento Privacy Policy [https://magento.com/trust/privacy]
• Google Analytics is a web analytics service offered by Google. Google uses the data collected to track and monitor the use of our websites. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. Google Privacy Terms
• YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites. Google Privacy Terms
• New Relic provides information on how well the website is working. New Relic Privacy Policy
• Chatify (formerly Pubble) is used to support webchat, allowing realtime communication with our customers. Pubble/Chatify Privacy Policy

4.1       Use of Cookies

The Company uses cookies to enhance our users' experience and to develop our products and services.

For further information, see our Cookie Policy.

5       Transfers of Your Personal Information Outside of Europe

We do not transfer your personal information outside of Europe. If we do so in the future, we’ll let you know and take measures to protect your personal information.

All information you provide to us is stored on our secure servers which are located within the European Economic Area (EEA).

If at any time we transfer your personal information to, or store it in, countries located outside of the EEA (for example, if our hosting services provider changes) we will amend this policy and notify you of the changes. We will also ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries outside of the EEA do not have adequate data protection laws equivalent to those in the EEA. If we transfer your personal information to the United States of America, we will only send the personal information to USA entities subject to Standard Contractual  Clauses or where we have an alternative safeguard in place in accordance with applicable law. Where they apply to our data transfer activities, we may rely on adequacy decisions by the European Commission about certain countries for data transfers to countries outside the EEA.

6       Security and Links to Other Websites

We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet and to our website and our social media pages may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information.

We employ security measures to protect the personal information you provide to us, to prevent access by unauthorised persons and unlawful processing, accidental loss, destruction and damage.

We use Internet standard encryption technology ("SSL" or "Secure Socket Layer" technology) to encode personal data that you send to us when placing an order through the website. To check that you are in a secure area of the website before sending personal information to us, please look at the bottom right of your website browser and check that it displays an image of a closed padlock or an unbroken key.

The transmission of information via the internet is not completely secure. Although we will do everything possible to protect your personal information, we cannot guarantee the security of any personal information during its transmission to us online. You accept the inherent security implications of using the internet and will not hold us responsible for any breach of security unless we are at fault.

If you are using a computer or terminal in a public location, we recommend that you always log out and close the website browser when you complete an online session for your security. In addition, we recommend that you take the following security measures to enhance your online safety:

• When creating a password, we recommend use at least 8 characters with a combination of letters and numbers.
• We recommend you frequently change your password.
• Keep your passwords private. Remember, anyone who knows your password may access your account.
• Avoid using the same password for multiple online accounts.
• We will never ask you to confirm any account or credit card details via email. If you receive an email claiming to be from Company.
• If you receive such an email claiming to be from the Company asking you to do so, please ignore it and do not respond and report it to us.

Our website and social media pages may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites, so we encourage you to read their privacy policies. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk.

7       The Periods For Which We Retain Your Personal Information

We are obliged to retain certain information to ensure accuracy, to help maintain quality of service and for legal, regulatory, fraud prevention and legitimate business purposes.

If Personal Data is disclosed to us by you in connection with a general enquiry through the Company’s website, for example where you enter your details into a website form or you send us an email, that Personal Data will be retained in line with our Retention Policy.

Other information will be retained for no longer than is necessary for the purpose for which it was obtained by us or as required or permitted for legal, regulatory, fraud prevention and legitimate business purposes. In general, we (or our service providers on our behalf) will hold this information for a period of seven years, unless we are obliged to hold it for a longer period under law or applicable regulations.

We will not hold your personal information in an identifiable format for any longer than is necessary for the purposes for which we collected it. For certain purposes we retain your personal information indefinitely (e.g. to supress marketing messages).

8       CCTV (Closed Circuit Television Systems)

Closed Circuit Television Systems (CCTV) are installed on Company premises for security and health and safety purposes. The legal basis for processing data using CCTV is Legitimate Interest and has been justified by Company management.

• Third Parties: Recorded data obtained by the Company through the CCTV system may only be released by the Company when authorised by the Data Protection Lead. Our CCTV network is managed by Network Security Ltd.
• Data Retention: CCTV recordings are kept for a maximum of 30 days, except where the image identifies an issue and is retained specifically in the context of an investigation/prosecution of that issue.
• Security: The Company is obliged to implement technical and organisational measures to ensure that personal data are kept secure from any unauthorised or unlawful processing and accidental loss, destruction, or damage. For Company CCTV systems, this can include restricting access to footage and the use of encryption and password protection for devices storing CCTV footage. The storage medium is maintained in a secure environment, to which only authorised personnel have access to and view the footage.

9       Your Rights in Relation to Your Personal Information

You have certain rights in respect of your personal data and we have processes to enable you to exercise these rights.

9.1       Right of Access

This is known as a Data Subject Access Request or a DSAR in short. If you want to know if we are processing personal data relating to you and to have access to any such personal data you can Contact the Data Protection Lead using the contact details listed at the bottom of this page. In order to furnish you with a copy of your personal data that we hold we will need to verify your identify.

You have the right to access any personal information that we process about you and to request information about:

• What personal data we hold about you
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from you, information about the source

9.2       Right to Rectification

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

Depending on the type of personal data you believe is inaccurate, we may ask you for further proof to ensure that the personal data is being corrected properly. If we are satisfied that the personal data is inaccurate, we will make the necessary changes.

9.3       Right to Erasure

You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use.

You have a right to ask for your personal data to be erased in certain circumstances. However, this right does not apply where we have to comply with a legal obligation or where we need personal data for the establishment, exercise or defence of legal claims. In addition, if you opt out of marketing communications or have previously opted out of marketing communications, we have to keep a record, or such opt out to ensure that we don’t contact you in the future.

9.4       Right to Restriction

You have a right to request that processing of personal data is restricted in certain circumstances. However, we shall still continue to process the personal data for storage purposes, for the establishment, exercise or defence of legal claims or with your consent.

9.5       Right to Object

Where we are relying on legitimate interests as a legal basis to process your data, you have a right to object to such processing on grounds relating to your particular situation.

9.6       Right to Portability

In certain circumstances, you can request that we provide to you your personal data in a commonly used format. If you wish to make such a request, you can contact the Data Protection Lead using details provided below.

9.7       Right to Complain to the Supervisory Authority

You have the right to lodge a complaint with the Irish Data Protection Commission. More details can be found on their website at https://www.dataprotection.ie.

• Online: https://www.dataprotection.ie/en/contact/how-contact-us
• Email: dpo@dataprotection.ie
• 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
• Phone: 076 110 4800 / 057 868 4800

For more information or to exercise your data protection rights, please contact the data protection team using the contact details listed below.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.

10      Unsubscribing

From time to time, we may contact you with details on special promotional offers or products that we think you would be interested in, via Email, Telephone, SMS, Post or from specially selected Third Parties. If you do not want to receive these communications, you can opt out in the following ways:

You make this preference known to us in writing by using the contact form at Contact Us. Please clearly state your marketing preferences here.

Please note:

Requests not received in the specific format indicated, are in danger of being misdirected. We reserve the right for our customer advisors to contact you regarding your account where necessary.

11       Changes to this Privacy Statement

Please check this page regularly for changes to this policy.

You can contact us with your queries in relation to this policy or for any other reason by post, email or by phone.

12       Contact Us

If you have any questions or concerns about how we process your data, you can contact us at 090 642 4000 or dataprotection@heatmerchants.ie or write to: Data Protection Lead, Heat Merchants Group, Moydrum Road, Athlone, Co. Westmeath.