Privacy

• 1. B&M Group Customer Privacy Notice.
  • 1.1. B&M Group (B&M UK, Heron Foods, and B&M France) are committed to protecting the privacy and security of your personal information.
  • 1.2. This privacy notice describes how we collect and use personal information about customers in accordance with data protection law including the General Data Protection Regulation 2016 (GDPR) and Data Protection Act 2018 (DPA).
  • 1.3. EV Retail Limited is a “data controller” for the B&M Group. This means that it is responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
  • 1.4. It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
  • 1.5. We may update this notice from time to time so it’s important that you should periodically check the webpage to ensure that you are aware of any changes.
• 2. The kind of information we hold about you.
  • 2.1. Personal information means any information about an individual from which that person can be identified directly or indirectly. It can be placed into special categories of more sensitive data which require a higher level of protection.

What personal information do we hold about you?

Table 1:

• 3. Examples of “special categories” of more sensitive personal information include:
  
  

  Table 2:

  • 1. Incident reports if you have an accident in one of our stores.
  • 2. Information to defend any claim brought against us, this may include medical data.
  • 3. Records of criminal activity in our stores and online fraud.
• 4. How is your Personal Information collected?
  
  • 4.1. We collect personal information that you give to us when you use bmstores.co.uk, www.bandmretail.com or heronfoods.com (“the website”), the B&M App (“the App”), when you visit one of our stores or contact our customer services team.
• 5. How we use your information?
  
  • 5.1. We will only use your personal information when the law allows us to. We will generally use your personal information in the following circumstances:
    
    

    Table 3:

    • 1. When we need to perform the contract, we have entered into with you, for example when you purchase something from us.
    • 2. Where you have consented to processing, for example to receive marketing.
    • 3. Where we need to comply with a legal obligation, for example for accounting records.
    • 4. Where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests. This could include the use of CCTV and keeping customer services records.
    • 5. To protect your interests, for example if you had an accident in one of our stores.
  • 5.2. The situations in which we will process your personal information are listed below.
    
    

    Table 4:

    • 1. Where it is in our legitimate interest to do so or you have given your consent to send promotions about new products and latest offers by email, the App, SMS, phone, or post.
    • 2. To contact you for market research purposes via email, the App, text, phone, or post where it is in our legitimate interest to do so.
    • 3. Manage and respond to customer service enquiries.
    • 4. Where necessary, resolve customer services queries by passing information to relevant third parties and between B&M departments.
    • 5. To manage your online account and process your order.
    • 6. Post prizes that have been won when entering competitions.
    • 7. To send you a birthday greeting.
    • 8. Take payment for items you have ordered and refund you when things go wrong.
    • 9. To deliver items you have ordered from us including sending you order and delivery update messages by SMS and email.
    • 10. To respond to your complaints or concerns.
    • 11. To support considerations of Health & Safety.
    • 12. Loss prevention including monitoring the use of our website for suspicious and fraudulent activity.
    • 13. Review website and App traffic and usage to improve and develop our website, App and our products and services.
    • 14. Notify you about changes to our website, App, products, or services and your account from time to time.
    • 15. Carry out anonymous analysis of data on user visits, browsing patterns, trends, and preferences, for our market research purposes and to track and measure the impact, results or pattern of website traffic and preferences from other promotional and marketing activities of B&M.
    • 16. Comply with any applicable law, legal process or enforcement by any regulatory body which is binding on B&M.
  • 5.3. If you fail to provide some or all personal information when requested, we may not be able to perform the contract we have entered into with you (such as delivering a product you have ordered from us or issuing a refund).
• 6. Transactional monitoring and cookies.
  • 6.1. We use cookies and similar technologies to enhance your browsing experience and collect information about your usage of our services.
  • 6.2. You can manage your cookie preferences through your browser settings, or by using the cookie tool on our websites.
  • 6.3. See Appendix 1.
• 7. Links to our websites.
  • 7.1. Our websites and App may contain links to other websites or Apps of third parties.
  • 7.2. We do not have any control over websites or Apps of third parties. Their own privacy policies will apply in relation to your personal information. You should always check the privacy notice of third party websites and Apps before using them.
• 8. Social Media.
  • 8.1. When you use our websites or App or those of trusted providers, you may be able to share information through social media networks such as Facebook and twitter, for example through “Likes” or reviews. When doing this your data may be visible to providers of social network services and their users, as well as B&M Group. We recommend that you consider the privacy settings on your social media accounts so that you are aware of how your information is processed and used.
• 9. Change of Purpose.
  • 9.1. If we need to use your personal information for a different reason or an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
• 10. Disclosure of your data to third parties and data processors.
  • 10.1. We do not sell, rent, loan, trade or otherwise disclose your personal information, except as described in this policy.
  • 10.2. EV Retail may disclose your information with trusted third-party business partners so that we can provide you with the service you requested.
  • 10.3. We may disclose your information to data processors who provide direct marketing, advertising, and market research services to us to help improve our services to customers and users of our website and App.
  • 10.4. Third parties are not permitted by EV Retail to contact you for marketing purposes unless you have given your consent.
  • 10.5. It may be necessary to disclose your personal information with a third party when we are required or permitted to do so by law and if the business is part of the business is sold or integrated.
• 11. Facial Recognition ( Facewatch)
  • 11.1. Facewatch facial recognition is used within our premises for the lawful purpose of prevention and detection of unlawful acts including theft and violence against our colleagues and customers.
  • 11.2. We supply incident details and CCTV images of people responsible for unlawful acts within our premises to Facewatch; and receive alerts from Facewatch if a person entering our premises is known by Facewatch to be responsible for committing an unlawful act in our premises or elsewhere.
  • 11.3. Our lawful basis for the processing of personal data in this way is that the processing is necessary for a task carried out in the public interest, namely the prevention and detection of crime.
  • 11.4. Our lawful basis for the processing of criminal offences committed within our premises in this way is that the processing is necessary for a task carried out in the substantial public interest, namely the prevention and detection of crime.
  • 11.5. Facewatch is the data controller responsible for the processing of personal data by way of facial recognition.
  • 11.6. We display clear signage in all stores where Facewatch is used, this signage details how to obtain the Facewatch privacy notice and how Facewatch can be contacted.
  • 11.7. The Facewatch privacy notice can be found at facewatch.co.uk/privacy and explains rights under UK GDPR. To contact Facewatch DPO please contact [email protected]
• 12. Data Security
  • 12.1. We have security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.
• 13. How long will you use my information for?
  • 13.1. We will only retain your personal information for as long as necessary.
  • 13.2. We may anonymise your personal information so that it can no longer be associated with you. We generally retain your data for no more than 6 years following our last contact with you.
• 14. Your rights, in relation to personal data.
  
  

  Table 5:

  1. Right to be informed	2. You have the right to be informed about the collection and use of your personal data. This is communicated via this “Privacy Notice”.
  3. Right to access	4. You have the right to access and receive a copy of your personal data, and other supplementary information. This is known as a “data subject access request”.
  5. Right to rectification	6. You have the right to have inaccurate personal data rectified or completed if it is incomplete.
  7. Right to erasure	8. You have the right to have personal data erased unless it can be demonstrated that there is an overriding need to retain the data.
  9. Right to restrict processing	10. You have the right to restrict or suppression of your personal data. This is not an absolute right and only applies in certain circumstances.
  11. Right to data portability	12. This allows you to obtain and reuse your personal data for your own purposes across different services. Moving from one IT environment to another in a safe and secure way, without affecting its usability. The right only applies to information an individual has provided to a controller.
  13. Right to object	14. You have the right to object to the processing of your personal data in certain circumstances.
  15. Rights related to automated decision-making including profiling	16. You should receive information about the processing of personal data. Be able to obtain human intervention, express your point of view, obtain an explanation on the decision and be able to challenge it.

  • 14.1. You will not have to pay a fee to access your personal information unless your request is clearly unfounded or excessive. We may also refuse to comply with the request in such circumstances.
  • 14.2. We may need to request specific information from you to help us confirm your identity.
• 15. Right to withdraw consent
  • 15.1. To withdraw your consent (for example if you no longer wish to receive marketing) please contact the relevant customer service team.
  • 15.2. How to contact us:
    
    

    Table 6:

    Customer Services	Customer Services	Customer Services
    B&M Retail Limited	B&M France	Heron Foods Limited
    The Qube		Jackson Way
    Dakota Drive	SAS B&M	Melton
    Estuary Commerce Park	8 r Bois Joli, 63800	East Yorkshire
    Speke	Cournon d’Auvergne	HU14 3HJ
    Liverpool	France
    L24 8RJ.
    [email protected]	[email protected]	[email protected]

• 16. You can make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.