Privacy Policy

Outsiders Store is a subsidiary of Ellis Brigham Holdings Ltd (06837170) registered at 45 Brunel Avenue, Salford, Manchester M5 4BE.

Outsiders Store Limited is responsible for all legislative and regulatory demands placed upon the company including the safeguarding and security of our customers, past, present and future. The responsibility of this falls to our Data Controller.

We accept that in transacting with Outsiders Store, for purchase or return of goods and services, or information requests it’s possible that you do so without having first read this Privacy Policy, and that you place this level of trust upon us due to the traditional values we hold for decency, fairness and transparency.

In upholding these levels, we have compiled this Privacy Policy which sets out our obligations and commitment to you. We also want you to know that you can request to see the data we hold on you, challenge its accuracy or revoke permission by withdrawing your consent at any time.

Throughout your relationship with us, your personal data remains yours, we are simply fortunate to possess it to help us conduct a supportive and meaningful business relationship which we hope you will continue to value.

On 25th May 2018 the Data Protection Bill frequently referred to as GDPR (General Data Protection Regulation) came into force and replaced the Data Protection Act (1998). The rest of Europe also introduced GDPR in each of the respective countries.

There are many similarities between the DPA and GDPR however, there are a few significant differences which bring positive changes to the way personal data is stored and processed. This applies to data held in digital and printed forms where it is used.

One of the changes under the new regulations requires all businesses to confirm the basis they use for storing and using your personal data across each separate process within their business. Outsiders Store applies three rulings using a mixture of either, ‘Consent’, ‘Legitimate Interest’ or ‘Contract’. These three terms may be new to you and so to help avoid any confusion we’ll explain the nuances of each here.

Consent – Outsiders Store will refuse to send you any personal communications unless you have expressed your prior consent either by subscribing to our emails or electing to receive our printed mailings by subscribing through our website. Please note you can unsubscribe at any time by confirming this action at the foot of any email you receive, or by revoking your permission for us to send you printed mailings through the dedicated catalogue unsubscribe feature on our website.

Legitimate Interest – We store data on you that relates to the purchases you make as well as any other interactions you may have with us so that we can tailor our service to suit your potential needs. In these circumstance your data will then be used as is permitted under GDPR, as long as your personal interests don’t override our grounds for having a legitimate interest in doing so.

Contract - You will be required to supply us with elements of your personal data for orders that require delivery to your home or business address and this data forms part of the contract we have to supply you with the goods you have ordered and that are needed for use in order to verify at the time of delivery. This data is supplied as part of the contract that you freely enter into with us at the time of order. To understand more about the terms of the contract please refer to our Terms and Conditions.

At the time you provide your personal data to us we will make it clear to you what you’re providing it As we continue to serve you, we amalgamate these sources so that we know precisely what we are entitled to use your data for.

Under the new regulations the emphasis is that you, our customer and data subject are in control of who you provide your personal data to by granting us permission to use it so that we may provide you with the services you choose in support of a commercial relationship with us. Put simply, you are in effect loaning us the access rights to your personal data until you see fit to change this arrangement.

Personal data, often referred to as personal information, includes things like your name, address, email address, age, date of birth, telephone number(s) and social media accounts, but it can also include things like your account number(s), or a unique IP address – anything in fact that can link to you as an individual. This all falls under the protection of GDPR.

This is different to personal data and includes things related to your purchase history namely the method you used to make a purchase from us, such as one of our online websites, or in-store; it might also include when you made this purchase and which of our stores you purchased your goods from. As GDPR’s focus is to protect your personal data, this information is not included under the regulations. However, should you ask to see the data we hold in addition to the personal data we retain, we may still show you examples of this, but this is an extension to our obligations and our way of extending the level of trust and transparency.

This is the third example of data that passes through our business and it includes credit and debit card information. However, the security of this is controlled through other regulations (namely the Payment Card Industry - Data Security Standards) which exists to further reduce your (and our) personal risk. This data bypasses our systems and instead enters a payment gateway to be processed directly between your bank or charge card company, and our financial partner.

Data profiling is a trusted technique that attributes other assumed or known factors to the personal data that you consent to provide us. The process will add things such as: the typical size of your family, the size and approximate value of your home, the occupation you might have, your age range, your propensity to read certain newspapers or respond to email campaigns.

By understanding more about you we believe this will help us to improve the service we offer but we don’t believe we should do this without your consent. So, over the course of your consent we will occasionally seek your approval for this periodically. Under GDPR you will always be able to see what data we hold on you by serving a Subject Access Request upon us.

Under the Data Protection Bill once your data is passed to us, by definition we become the Data Controller’. This definition is the highest definition placed upon us by the ICO and means that we are charged with utmost level of care when it comes to safeguarding your privacy.

To preserve our relationship with you and not cause unnecessary frustration or anxiety to others, Outsiders will from time-to-time work to maintain the quality and relevancy of the data we hold, processing it against nationally verified suppression files such as change of address data, gone-away and bereavement registers. Whilst we are not obliged to do this, we believe that in order to fulfil our obligations as ‘Data Controller’, this remains good business practice and provides a duty of care to our customers and their families.

Personal, location and transactional data is collected through our businesses systems and is the responsibility of the company’s Data Controller. You can ask to see or amend what you believe are errors within this data or remove your permission for us to retain it, by reading the steps that we describe next e.g. ‘Subject Access Request’ & ‘Right to be Forgotten’. For anything else you should contact our customer services by emailing customer.services@outsidersstore.com

You can ask to receive a copy of your personal data whenever you choose under a process called a ‘Subject Access Request’. Under a ‘SAR’ we will provide you with a free copy of all the personal data we hold on you in a machine-readable format (Microsoft Excel) within 30 days of us being able to successfully validate who you say you are. This is particularly relevant in order to avoid any security breaches or false claims for access to your personal data.

If we believe your request is complex or numerous we can extend the process for a further two months, but we will explain to you why this has been necessary within the initial 30 days of us validating who you are. If we deem your requests to be manifestly unfounded, excessive or particularly repetitive we are permitted to charge a reasonable administration fee to comply with requests for further copies of the same information. Should these excessive requests continue we are legally entitled to refuse your request, which should you disagree, you are within your rights to contact the Information Commissioner’s Office and state your claim. All SAR requests are logged within our systems to manage the individual frequency of each request.

You can see how to submit a Subject Access Request to our Privacy Team by visiting the SAR/RTBF (Right to be Forgotten) page.

Should you ever decide to refuse us permission to use your personal data, you can invoke your Right to be Forgotten’. In activating this process, we will to remove all your personal details from our systems. Once removed this information will not be available to you, or us again, and should you recommence your relationship with us at a future date and provide us with a fresh set of permissions, none of your previous personal data would be available for re-assignment at that stage.

You can invoke your Right to be Forgotten to our Privacy Team by visiting the SAR/RTBF (Right to be Forgotten) page.

N.B. Please note that should you decide to invoke your RTBF, we are still required under other company law to store any transactional data that would have once been connected to you as an individual.

You will see located around our retail stores CCTV recording equipment. This equipment is there to safeguard you and our property whilst on our premises. It is not used to assign a personal identity to your photographic image and is therefore not governed by GDPR. This information may be legally used by the Police or other law enforcement agencies if called upon as part of any investigation.

In order to process an online order we reserve the right to send a number of transactional emails. These include but are not limited to an order confirmation, order status updates and dispatch confirmation emails. Once dispatched, our delivery partner will also send a combination of email and SMS messages to advise on the progress and status of the delivery.

Once you have given us your consent to communicate with you, any registration of your personal details on the Direct Marketing Association’s – Mailing Preference Service (MPS) or Telephone Preference Service (TPS) cease to become valid until you rescind your consent directly with us through any of the methods described above. Our policy of direct consent remains the only position we will use to communicate with customers.

The PECR is derived from European law (European Directive 2002/58/EC) and is also known as the ‘E-Privacy Directive’. This regulation supplements the regulations under GDPR with its primary focus addressing personal privacy across passive or active forms of distributed electronic communication e.g. Email, SMS (Text Messaging), website tracking cookies, apps, digital telephony etc.

We accept that in this increasingly complex and joined up world consumers may not understand the methods used to gather personal data, but as a Data Controller it is our role to make this as transparent as possible and provide you with the ability to revoke your permission at any time wherever we can.

Details regarding your online transaction will be monitored by Google in accordance with their own Certified Shops Privacy Policy. Outsiders Store have no control over this, but they (Google) may contact you to discuss your shopping experience with us.

A cookie is a piece of computer code - a text file - that is made up of a series of letters and numbers and placed on your device each time you visit one of our websites. Although they may sound sinister to some, they're actually very useful as they allow us to greatly improve your, and the other users of your devices', visits to our sites, simply by understanding more about your preferences and interests.

Some cookies are essential because without them the website would not appear correctly in your browser. The cookie itself does not contain or collect personally identifiable information but instead will remember previous purchases, page visits and account details and will help us to recommend products that suit the users of your devices. These recommendations and preferences are all made automatically and are not associated with any personal information we have previously collected about your interests. When you first visit the website you will be asked to accept our cookie policy, and you may also remove any cookies by adjusting the software settings of your browser to either delete the cookies which already exist and/or block new ones from being stored or accessed, (see below for more information).

All of the cookies we use are solely for the benefit of you, your device users and us. The full list of cookies that we use can be found here: https://www.outsidersstore.com/pages/cookie-declaration

Cookie Removal: The best way to do this is in your own browser settings, where you can disable cookies entirely or for specific websites you visit.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over any other website or your personal data privacy.

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Outsiders Store's Data Controller will be responsible for the storing and processing of your data once you’ve given us your permission to use it and regardless of which of our data collection sources it comes to us from. At no stage will your personal data find its way into our systems unless you have willingly and freely provided it to us directly.

In possessing your personal data, we accept that this does not give us the right to abuse its use, and that consequently we will take due consideration of the balance between what we deem to be infringing your privacy and our ability to provide you with timely information. Should you feel we’ve got this wrong you can always remove specific permissions such as unsubscribing yourself from any future email activity using the unsubscribe link sent within our emails.

Our Data Controller commits to maintain your personal privacy throughout amendments to our system infrastructure and any of the commercial relationships we have with our third-party suppliers. These ongoing changes require that we review our Privacy Policy no less than once per annum and update the Policy edition, regardless of changes to the material content.

The only time we will share your data with anyone other than you, or members of our staff will be if we are required to do so as part of an investigation by law enforcement authorities.

Any changes we make to this Privacy Policy will be for the benefit of our customers and employees, but no changes will be made that breach our duty of care or any regulation. All changes will be notified in writing directly to you and also on our website.

Should you ever feel that we have not met the regulations, we are registered with the Information Commissioner’s Office.