Data Protection Policy

This policy sets out how we handle the personal data of our employees, customers and other individuals (“data subjects”). It also sets out our expectations of you in order for us to comply with data protection legislation. It applies to all personal data we process regardless of the media on which that data is stored (i.e., paper or electronic).

Protecting the confidentiality and integrity of personal data is a critical responsibility that we take seriously at all times. We are exposed to significant fines for any failure to comply with data protection legislation.

We are a “controller”. This means that we are responsible for deciding how we hold and use the personal information about you, our customers and others.

We have appointed a Privacy Officer to oversee compliance with this policy. Any questions or concerns about this policy or how we process personal data should be referred to our Privacy Officer at privacy@smythstoys.com.

Personal data is any information relating to a person that we can use to identify them. Examples include names, addresses, email addresses, photographs, CCTV footage, CVs etc.

We adhere to the principles relating to the processing of personal data as set out in data protection legislation which require personal data to be:

• (a) processed lawfully, fairly and in a transparent manner;
• (b) collected only for specified, explicit and legitimate purposes;
• (c) adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• (d) accurate and where necessary kept up to date;
• (e) not kept in a form which permits identification of data subjects for longer than is necessary;
• (f) processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;
• (g) not transferred to another country without appropriate safeguards in place; and
• (h) made available to data subjects and allow data subjects to exercise certain rights in relation to their personal data.

We may process the following personal information about you:

• Identity data: Name, title, date of birth, nationality, gender, PPSN/national insurance number, driving licence, passport, image (CCTV, photographs).
• Contact data: address, telephone number, email address, next of kin and emergency contact information.
• Financial data: bank account details, payroll records, tax status information, salary, remuneration history, pension and benefits.
• Employment data: right to work documents, references, CV, cover letter, job title, training records and professional membership, performance information, disciplinary and grievance information, working hours.

We may also process the following special categories of personal information:

• Information on your religious beliefs if you are employed by Smyths Toys NI Limited.
• Information about your health, including any medical condition, health and sickness records, medical certificates, medical reports.
• Biometric data for fingerprint time recording system.
• Information about criminal convictions and offences.

We need all the categories of information listed above primarily to allow us to perform our contract with you and to enable us to comply with our legal obligations. In some cases, we may use your personal information to pursue our legitimate interests, provided your fundamental rights do not override those interests. The situations in which we will process your personal information are listed in the table below. Some of the bases for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide information requested, we may not be able to perform the contract we have entered into with you or we may be prevented from complying with our legal obligations.

We will only process your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that reason is compatible with the original purpose.

We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. We may collect information about criminal convictions as part of the recruitment process and/or we may be notified of such information directly by you or a third party. We may use this information about criminal convictions and offences in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role, in particular where in the course of your employment with us, you would have direct interaction with children, access to cash and/or valuable inventory.

You will not be subjected to any automated decision making.

We may share your data with third parties, including third party service providers and other entities within our Group where required by law, necessary to perform our contract with you, and/or where we have another legitimate interest in doing so. If we do share your personal data with third parties, they must have appropriate technical and organisational measures in place in order to safeguard your personal data. If any of our third parties are located outside of the UK or EEA, we will ensure that adequate safeguards are put in place in order to safely transfer your data.

You agree that we have the right to share your personal data with the following recipients or categories of recipients:

• (a) any department or authorised person within our Group;
• (b) any government, financial or regulatory body, agency or department, embassy, consulate or similar authority or institution to the extent necessary in connection with the performance of your contract or duties for us, including payroll processing and applying for, maintaining and confirming work permits, visas and/or making travel arrangements, during the course of your work for Smyths Toys; and
• (c) our authorised suppliers, third party service providers, sub-contractors, business partners and advisers. For example, we will share personal data regarding your participation in any pension scheme operated by or for us with the trustees, managers or administrators of the pension scheme. Names, photographs and images may also be published, disclosed or shared via printed or online publications or via other online or social media platforms or applications in the ordinary course of our business.

We will disclose your personal data we hold to third party recipients:

• (a) if we are under a duty to disclose or share personal data in order to comply with any law, legal obligation or court order, or in order to enforce rights under data protection legislation or other agreements; and
• (b) to protect our rights, property or safety, our customers or others. This includes exchanging information with other companies and organisations for the maintenance and security of our services.

We have put in place appropriate technical and organisational measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to only those who have a business need to know. Your personal data will only be processed based on our instructions, and anyone so processing will be subject to a duty of confidentiality.

We will retain your personal information in accordance with our Data Retention Policy. Please see the data protection posters in the staff area which set out the retention periods for various types of personal data. Once the retention period has elapsed, you must destroy or erase the relevant personal data. For more information on our retention periods, please contact privacy@smythstoys.com.

All employees must complete data protection and IT security training to enable them to comply with data protection legislation.

Data subjects have rights when it comes to how we handle their personal data. These include rights to:

• (a) request access to any personal data we hold about them. This enables a data subject to receive a copy of the personal information we hold about the data subject and check that we are lawfully processing it;
• (b) ask to have inaccurate personal data corrected;
• (c) request the erasure of personal data. This enables a data subject to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Data subjects also have the right to ask us to stop processing personal information where we rely on our legitimate interests and there is something about the processing which makes the data subject want to object to processing on this ground.
• (d) request the restriction of processing personal information. This enables a data subject to ask us to suspend the processing of personal information about a data subject, for example if the data subject wants us to establish its accuracy or the reason for processing.
• (e) request the transfer of personal data to another party.

It is important that the personal information we hold about you is accurate and correct. Please keep us informed if your personal information changes during your employment with us.

All requests for access to personal data must be forwarded immediately to privacy@smythstoys.com who will respond to the person seeking access whether an employee, customer or other individual.

A data subject will not have to pay a fee to access their personal information or exercise any of its other rights. However, we may charge a reasonable fee if the request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request.

We may need to request specific information from a data subject to help us confirm their identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In circumstances where consent has been provided to process a data subject’s personal information, they have the right to withdraw consent at any time. To withdraw consent, a data subject must email privacy@smythstoys.com. The withdrawal of consent will not impact or affect the lawfulness of processing prior to its withdrawal.

If you know or suspect that a personal data breach has occurred, contact privacy@smythstoys.com immediately and follow the Data Breach Response Plan. Do not attempt to investigate the matter yourself. You must preserve all evidence relating to the suspected or personal data breach. An example of a personal data breach is allowing a customer to record CCTV footage on their phone or other recording device.

We are subject to certain rules and privacy laws when marketing to our customers. For example, we require our customers’ consent in order to send them marketing emails. Customers have the right to object to direct marketing at any time. A customer’s objection to direct marketing must be promptly honoured. If a customer opts out at any time, their details should be removed from our marketing list(s) as soon as possible.

We keep this policy under regular review. This version was last updated in March 2023.

Drugs and Alcohol Policy

This policy sets out the Company’s aims in reducing and managing alcohol and drug problems in the workplace by having clear rules in place regarding use and possession of alcohol and drugs, testing, and supporting those who have reported an alcohol or drug dependence. Health and safety is of the utmost importance to Smyths Toys. Protecting our staff, contractors and visitors is at the forefront of what we do.

Due to the level of vehicles and machinery that is in use by majority of personnel on site, the distribution centres that we operate from are deemed as high risk units.

The consumption of alcohol and drugs has implications for health and safety at work since these substances impair coordination, judgement and decision making. This could lead to an increased risk of accidents and injuries.

This policy is designed to comply with relevant legislation such as the Health and Safety at Work etc Act 1974 and the Misuse of Drugs Act 1971.

You must not consume alcohol or unlawful drugs whilst at work, during breaks, or in a period prior to work in which they would still be under the influence when attending work.

You must not be in possession of alcohol or illegal drugs in the workplace.

If you are taking prescription drugs, you should advise your manager(s) immediately of any side effects which may affect work performance or the health and safety of yourself or others.

One-off cases where the rules of this policy are breached, such as someone consuming alcohol or drugs whilst at work or reporting for work under the influence of alcohol or drugs or suffering from the effects of alcohol will be classed as gross misconduct and will be dealt with under the normal disciplinary procedures.

Anyone found in possession of illegal drugs, dealing drugs or using illegal drugs whilst at work will be reported to the police.

For the purpose of the policy, alcohol dependence is defined as:

Consumption of alcohol by an employee, either intermittent or continuous, whereby the employee’s ability to perform their duties is impaired or their attendance at work is interfered with, or they endanger the safety of themselves and/or others.

Drug dependence is defined as:

The use of illegal drugs or solvents, the deliberate use of prescribed or over the counter drugs (when not for a medical condition), either intermittent or continuous, whereby the employee’s ability to perform their duties is impaired or their attendance at work is interfered with, or they endanger the safety of themselves and/or others.

If you suspect or know you have a drug or alcohol dependency, you must inform management immediately and are encouraged to seek support at an early stage. If we are aware that you have a drug or alcohol dependency, support will be given where possible. This may result in a temporary change to your job role or working patterns. Where the problem has become apparent through deterioration in work performance, you will have to demonstrate satisfactory completion of a programme of support and an improvement in work performance or disciplinary action will be taken.

Employees have access to our confidential, external Employee Assistance Programme (EAP), 24/7. Our EAP offers support for substance abuse / addiction. Or with consent, we can make a management referral on your behalf.

The Company acknowledges that relapse is common with alcohol and drug problems. Relapses will be reviewed on a case-by-case basis, considering the needs of the department affected and the business needs of the organisation. Please be aware that the disciplinary route might be followed after subsequent relapses.

Following treatment, the Company will endeavour to ensure that you return to your existing job. If you are unable to fulfil those duties the Company will consider alternative duties. Promotional prospects will be unaffected following treatment.

The Company aims to ensure that the confidentiality of anyone experiencing alcohol or drug problems is maintained by appropriate people, for example, HR, Occupational Health and the appropriate Manager(s). Information regarding individual cases will not be divulged to third parties unless the safety of the person concerned, or others would be compromised by not doing so.

Targeted alcohol and/or drug testing may be required in the circumstance of reasonable suspicion or as a result of an accident or near miss.

Anyone that causes or contributes to near misses, incidents or serious accidents will be subject to drug and alcohol testing.

You may be subject to drug and alcohol testing in the event that there is suspicion of workplace use, possession or impairment.

Example of reasons for reasonable suspicion may be:

• Odours (smell of alcohol, drugs, body odour or urine)
• Movements (unsteady, fidgety, dizzy, lethargic)
• Eyes (dilated, constricted or watery eyes, red eyes or involuntary eye movements)
• Face (flushed, sweating, confused or blank look)
• Speech (slurred, slow, distracted mid-thought, inability to verbalise thoughts)
• Emotions (argumentative, low, agitated, irritable, drowsy, emotional)
• Actions (yawning, twitching).
• Inactions (sleeping, unconscious, no reaction to questions).
• Discovery of paraphernalia or drug / alcohol related items (bottles, cans)
• Etc.

Alcohol tests:

• Alcohol tests will be completed using an electronic breathalyser. If the result is 0, that will be the end of the test. If the result is above 0, you will be asked to wait 20 minutes and then give another breath sample. If the result of the second test is above the UK Drink Drive limit (35 micrograms), you will likely be suspended from work and invited for an investigation meeting under the disciplinary procedure.

Drug tests:

• Drug tests will be completed using a skin and saliva sample test that will be rubbed on your tongue and skin (hairline / forehead). The final result will be displayed after 5 minutes. If the drug test is negative, that will be the end of the test. If the result is ‘non-negative’, this is an indication that drugs have been detected. Following a ‘non negative’ result, the employee must provide a urine confirmation sample to clarify if they do or do not have drugs in their system. The laboratory will be contacted immediately after indication of a ‘non negative’ result and they will send someone to the site within 2 hours to collect a urine sample for laboratory testing. You will then likely be suspended from work and invited for an investigation meeting under the disciplinary procedure.

Please note:

• The testing will take place on site in a private room
• All testing will be carried out on site with a witness. Those carrying out the testing must adhere to the manufacturers guidelines provided with the test kit
• No testing is random
• Refusal to take part in an alcohol or drug tests will be treated as a positive result and could result in disciplinary action
• In the event of a result confirming an individual is under the influence of alcohol or drugs, the police will be contacted if they leave the site driving or operating a vehicle or bike

Mobile Device Policy

The purpose of this policy is to outline what the Company considers to be acceptable and unacceptable use of mobile phones, electronic watches, Personal Digital Assistants or any other Electronic Personnel Equipment or Device at work.

Mobile phones and other electronic devices can be both disruptive, in terms of productivity and concentration levels and dangerous, from a health and safety point of view. Mobile phone use in the workplace can also risk breaches of confidentiality.

We, as an employer, have a duty to ensure that the working environment is safe, and that safe policies and practices are adopted.

This policy will apply differently to individual members of staff and what is acceptable will depend on the type of work being undertaken and the working environment. We expect all employees to adopt a common-sense approach in this regard.

When the term mobile phone is used this refers to mobile phone, personal digital assistants or any other electronic equipment or device.

This policy also covers phone calls, text messages, social media, email, video messages, picture messages and accessing the internet.

The use of Personal Mobile devices is prohibited during working hours in the Warehouse.

Any personal calls or use of such devices must be handled in personal time only (during breaks or upon completion of your shift). If you have an emergency and need to use any of the aforementioned devices or equipment during your working hours, you must request approval from your supervisor or manager before doing so and ensure that you are in a safe place when in use.

The use of such devices whilst operating machinery or while in control of a warehouse vehicle within the workplace (including in the yard / apron yard and other outside areas) is strictly prohibited for your safety and for the safety of others.

Using a mobile phone or any other personal electronic device at work may inadvertently risk breaching your duty of confidentiality. For example, by sending a photo which reveals the location of a specific job or contract. Employees and workers are strictly prohibited from taking pictures or filming at any time during the working day.

Managers and supervisors who have permission to use their mobile phones for business needs are able to do so however, must not use them whilst near or in use of machinery or warehouse vehicles. Permitted use of mobile phones and other devices can only take place in the designated areas within the warehouse.

Any employee found to be in breach of this policy will be subject to disciplinary action under the disciplinary policy. The Company will treat breaches of this policy as Gross Misconduct.

Social Media Policy

Smyths Toys social media accounts are operated and monitored by the relevant Head Office departments. All employees are prohibited from writing work related comments on the Smyths Toys social media pages. If you have a query or an employment issue you wish to raise you should contact your line manager.

You’re not allowed to set up Smyths Toys accounts on Social Media sites or make postings on behalf of Smyths Toys without authorisation from the relevant Head Office department.

Smyths Toys operates a ‘takedown’ procedure for their Facebook page. If an employee has any complaints or objections to material or content including user messages posted on the Facebook page, please contact: internalcs@smythstoys.com. Where the Company considers material or content on Facebook to be inappropriate, it will remove the content immediately.

If you are contacted for comments about the organisation for publication anywhere, including in any social media outlet, direct the query to the Head of Marketing and do not respond without written approval.

Be mindful that as an employee you are an ambassador for the Company even when you’re not at work; because of this we recommend that you don’t tag / add Smyths Toys as your employer on any social media platform aside from LinkedIn. You should never have a Smyths Toys logo or staff uniform visible in your profile picture. Under no circumstances should you post any company related information on your social media account or anywhere else on the internet, this includes contact information or personal details relating to your store / office or colleagues, financial and business performance, or any confidential business information.

In general, be responsible and respectful towards others and the Company when posting on social media. We treat comments that you make online in the same way as if you had made them in person. This includes messages made in a private setting as these can be printed or copied and made public. E.g., If you made a comment on social media about a colleague and they are offended by this then we could class this as bullying.

You must not express opinions on our behalf via social media, nor imply that you are speaking on our behalf. If you disclose your affiliation with us in your profile or in any other social media postings, you must state that your views do not represent those of your employer.

Breaches of our social media policy may be dealt with under our disciplinary procedure.

Safe Use of Knifes Policy

The purpose of this policy is to give practical advice and reduce the risk of injury to anyone permitted and required to use a knife at work.

1. The manager will issue you with the correct knife for your task.
2. Only use a knife that is supplied by the company.
3. Check the condition of your knife and only use knives if there are no signs of damage. Should the knife have any damage you must not use it and request a replacement from your manager.
4. Ensure you are considering the working environment. The floor surface should be even and provide sufficient slip resistance. The cutting surface must be secure.
5. Always point away when using knives. You must not cut towards yourself or your fingers.
6. Do not attempt to catch a falling knife. Step back and let it fall.
7. Do not leave knives laying around. Once finished, you must return them to the designated area.

Unauthorised Use of Vehicles / Machinery

By law, all fork truck drivers must be specially trained.

Under no circumstance, is any member of staff allowed to use the below vehicles/machinery unless specifically trained and/or qualified and authorised by management:

• Fork Truck
• Motorised Pallet Truck (MPT)
• Reach Truck
• Cardboard Bailer
• VNA Forklift (Very Narrow Aisle)
• Strapping Machines
• Box Machines

All Fork truck, MPT and Reach Truck drivers must have:

• Completed a recognized fork truck training course.
• Hold a current Fork truck driving qualification.

Use of vehicles and machinery untrained will result in dismissal.

Cardboard Baler Machines Usage

• All Boxes must be flattened before being thrown into the baler.
• Never load any other materials except cardboard- Anything else must be disposed of into the bins/bags provided.
• Do not overload the baler- If cardboard is building up please wait until clears before loading again.
• Never climb on the baler regardless of the circumstances or issues.
• Do not attempt to empty or operate the Baler unless adequate training is provided.
• Any concerns must be reported to management on-call.

Box Machines Usage

• Ensure daily safety checks are being done correctly and signed prior operating the machine.
• Do not interfere with machines while in an automated cycle.
• Do not remove any guards or protections.
• Do not misuse the compressed air gun. The sole purpose of this is to ease machinery cleaning.
• Do not alter any machinery settings unless adequate training is provided.
• Ensure correct PPE is being used while operating.
• Any concerns must be reported to management on call.

Strapping machines Usage

• Ensure daily safety checks are being done correctly and signed prior operating the machine.
• Do not misuse the compressed air gun. The sole purpose of this is to ease machinery cleaning.
• Do not alter any machinery settings unless adequate training is provided.
• Any concerns must be reported to management on-call.

Pre-Start Annual Health Assessment

Health and Safety Induction Sign Off

Even though Smyths Toys operates in a low-risk environment, it is essential that new employees are given an overview of the risk to their health and safety. This is to include an explanation of the potential risks along with the control measures in place.