Smyths Toys Warehouses – Data Protection Policy

Smyths Toys Warehouses – Data Protection Policy

  • Purpose of the policy

  • This policy sets out how we handle the personal data of our employees, customers and other individuals (“data subjects”). It also sets out our expectations of you in order for us to comply with data protection legislation. It applies to all personal data we process regardless of the media on which that data is stored (i.e., paper or electronic).

    Protecting the confidentiality and integrity of personal data is a critical responsibility that we take seriously at all times. We are exposed to significant fines for any failure to comply with data protection legislation.

    We are a “controller”. This means that we are responsible for deciding how we hold and use the personal information about you, our customers and others.

    We have appointed a Privacy Officer to oversee compliance with this policy. Any questions or concerns about this policy or how we process personal data should be referred to our Privacy Officer at privacy@smythstoys.com.

  • What is personal data?

  • Personal data is any information relating to a person that we can use to identify them. Examples include names, addresses, email addresses, photographs, CCTV footage, CVs etc.

  • Data Protection Principles

  • We adhere to the principles relating to the processing of personal data as set out in data protection legislation which require personal data to be:

    • (a) processed lawfully, fairly and in a transparent manner;
    • (b) collected only for specified, explicit and legitimate purposes;
    • (c) adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
    • (d) accurate and where necessary kept up to date;
    • (e) not kept in a form which permits identification of data subjects for longer than is necessary;
    • (f) processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;
    • (g) not transferred to another country without appropriate safeguards in place; and
    • (h) made available to data subjects and allow data subjects to exercise certain rights in relation to their personal data.

  • The type of information we hold about you

  • We may process the following personal information about you:

    • Identity data: Name, title, date of birth, nationality, gender, PPSN/national insurance number, driving licence, passport, image (CCTV, photographs).
    • Contact data: address, telephone number, email address, next of kin and emergency contact information.
    • Financial data: bank account details, payroll records, tax status information, salary, remuneration history, pension and benefits.
    • Employment data: right to work documents, references, CV, cover letter, job title, training records and professional membership, performance information, disciplinary and grievance information, working hours.

  • We may also process the following special categories of personal information:

    • Information on your religious beliefs if you are employed by Smyths Toys NI Limited.
    • Information about your health, including any medical condition, health and sickness records, medical certificates, medical reports.
    • Biometric data for fingerprint time recording system.
    • Information about criminal convictions and offences.

  • How we will use information about you

  • We need all the categories of information listed above primarily to allow us to perform our contract with you and to enable us to comply with our legal obligations. In some cases, we may use your personal information to pursue our legitimate interests, provided your fundamental rights do not override those interests. The situations in which we will process your personal information are listed in the table below. Some of the bases for processing will overlap and there may be several grounds which justify our use of your personal information.

  • Purpose/Activity Type of data Legal basis for processing
    To set you up on our systems when you start working with us e.g., Smyths360, Payroll, Smyths Academy
    • Identity Data
    • Financial Data
    • Performance of a contract
    • Compliance with a legal obligation
    To record whether you consent to biometric fingerprint scanning for the purposes of recording your working hours
    • Biometric Data
    • Consent
    To provide you with information about training that requires completion and to provide the training
    • Identity Data
    • Contact Data
    • Employment Data
    • Performance of a contract
    • Legitimate interests in growing and developing our business
    To assist us in any investigations we need to carry out i.e., grievances, disciplinary, legal claims or disputes
    • Identity Data
    • Contact Data
    • Employment Data
    • Financial Data
    • Legitimate interest in running and protecting our business
    • Compliance with a legal obligation
    To submit the required information on religious beliefs for employees working in Northern Ireland
    • Identity Data
    • Religious Beliefs
    • Compliance with a legal obligation
    To submit the required information on gender pay
    • Identity Data
    • Financial Data
    • Compliance with a legal obligation
    To pay you for the hours worked and/or annual leave taken and any other benefits and/or entitlements
    • Identity Data
    • Contact Data
    • Financial Data
    • Employment Data
    • Performance of a contract
    • Compliance with a legal obligation
    To carry out right to work checks
    • Identity Data
    • Compliance with a legal obligation
    To contact your emergency contact in the event of an emergency
    • Identity Data
    • Contact Data
    • Legitimate interests in running our business
    To carry out our respective obligations under your contract of employment e.g., probation, performance reviews etc.
    • Identity Data
    • Contact Data
    • Financial Data
    • Employment Data
    • Performance of a contract
    • Legitimate interests in running our business
    To apply for a work permit/visa and/or making travel arrangements on your behalf
    • Identity Data
    • Contact Data
    • Financial Data
    • Employment Data
    • Legitimate interests in growing and running our business

  • If you fail to provide information requested, we may not be able to perform the contract we have entered into with you or we may be prevented from complying with our legal obligations.

    We will only process your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that reason is compatible with the original purpose.

    We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. We may collect information about criminal convictions as part of the recruitment process and/or we may be notified of such information directly by you or a third party. We may use this information about criminal convictions and offences in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role, in particular where in the course of your employment with us, you would have direct interaction with children, access to cash and/or valuable inventory.

    You will not be subjected to any automated decision making.

  • Data Sharing

    We may share your data with third parties, including third party service providers and other entities within our Group where required by law, necessary to perform our contract with you, and/or where we have another legitimate interest in doing so. If we do share your personal data with third parties, they must have appropriate technical and organisational measures in place in order to safeguard your personal data. If any of our third parties are located outside of the UK or EEA, we will ensure that adequate safeguards are put in place in order to safely transfer your data.

    You agree that we have the right to share your personal data with the following recipients or categories of recipients:

    • (a) any department or authorised person within our Group;
    • (b) any government, financial or regulatory body, agency or department, embassy, consulate or similar authority or institution to the extent necessary in connection with the performance of your contract or duties for us, including payroll processing and applying for, maintaining and confirming work permits, visas and/or making travel arrangements, during the course of your work for Smyths Toys; and
    • (c) our authorised suppliers, third party service providers, sub-contractors, business partners and advisers. For example, we will share personal data regarding your participation in any pension scheme operated by or for us with the trustees, managers or administrators of the pension scheme. Names, photographs and images may also be published, disclosed or shared via printed or online publications or via other online or social media platforms or applications in the ordinary course of our business.

    We will disclose your personal data we hold to third party recipients:

    • (a) if we are under a duty to disclose or share personal data in order to comply with any law, legal obligation or court order, or in order to enforce rights under data protection legislation or other agreements; and
    • (b) to protect our rights, property or safety, our customers or others. This includes exchanging information with other companies and organisations for the maintenance and security of our services.
  • Data Security

    We have put in place appropriate technical and organisational measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to only those who have a business need to know. Your personal data will only be processed based on our instructions, and anyone so processing will be subject to a duty of confidentiality.

  • Data Retention

    We will retain your personal information in accordance with our Data Retention Policy. Please see the data protection posters in the staff area which set out the retention periods for various types of personal data. Once the retention period has elapsed, you must destroy or erase the relevant personal data. For more information on our retention periods, please contact privacy@smythstoys.com.

  • Training

    All employees must complete data protection and IT security training to enable them to comply with data protection legislation.

  • Rights of Data Subjects

  • Data subjects have rights when it comes to how we handle their personal data. These include rights to:

    • (a) request access to any personal data we hold about them. This enables a data subject to receive a copy of the personal information we hold about the data subject and check that we are lawfully processing it;
    • (b) ask to have inaccurate personal data corrected;
    • (c) request the erasure of personal data. This enables a data subject to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Data subjects also have the right to ask us to stop processing personal information where we rely on our legitimate interests and there is something about the processing which makes the data subject want to object to processing on this ground.
    • (d) request the restriction of processing personal information. This enables a data subject to ask us to suspend the processing of personal information about a data subject, for example if the data subject wants us to establish its accuracy or the reason for processing.
    • (e) request the transfer of personal data to another party.

  • It is important that the personal information we hold about you is accurate and correct. Please keep us informed if your personal information changes during your employment with us.

    All requests for access to personal data must be forwarded immediately to privacy@smythstoys.com who will respond to the person seeking access whether an employee, customer or other individual.

    A data subject will not have to pay a fee to access their personal information or exercise any of its other rights. However, we may charge a reasonable fee if the request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request.

    We may need to request specific information from a data subject to help us confirm their identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

    In circumstances where consent has been provided to process a data subject’s personal information, they have the right to withdraw consent at any time. To withdraw consent, a data subject must email privacy@smythstoys.com. The withdrawal of consent will not impact or affect the lawfulness of processing prior to its withdrawal.

  • Personal Data Breach

  • If you know or suspect that a personal data breach has occurred, contact privacy@smythstoys.com immediately and follow the Data Breach Response Plan. Do not attempt to investigate the matter yourself. You must preserve all evidence relating to the suspected or personal data breach. An example of a personal data breach is allowing a customer to record CCTV footage on their phone or other recording device.

  • Direct Marketing

  • We are subject to certain rules and privacy laws when marketing to our customers. For example, we require our customers’ consent in order to send them marketing emails. Customers have the right to object to direct marketing at any time. A customer’s objection to direct marketing must be promptly honoured. If a customer opts out at any time, their details should be removed from our marketing list(s) as soon as possible.

  • Changes to this policy

  • We keep this policy under regular review. This version was last updated in March 2023.

  • Clear Signature
  • DD slash MM slash YYYY