1 Introduction

1.1 We take privacy and the protection of personal information seriously. This privacy notice sets out details about how we gather, use and share personal information and about individual privacy rights. How we use personal information depends upon the context in which it is made available to us.

1.2 Our Data Protection Officer (DPO) provides help and guidance to make sure we apply good practice standards to protecting personal information. Our DPO can be reached by email at dpo@donaldson-timber.co.uk if you have any questions about how we use personal information.

2 About us

2.1 This privacy policy is issued by and on behalf of It's Plane & Simple Ltd, which is part of the James Donaldson Group (Group). This policy applies to the Plane & Simple online marketplace, including all of its webpages, applications and service or tools (Services).

2.2 The Group is made up of different legal entities, details of which can be found here. It's Plane & Simple Ltd are the 'data controller' which means we are responsible for the processing of your personal data. Please note our DPO represents the Group as a whole, and any enquiries about how personal data is used by any Group entity should be directed to the DPO.

3 What kinds of personal information we use

3.1 We use a variety of personal information depending on the circumstances under which personal information is made available to us.

3.2 We collect personal information from you and any devices used (including mobile devices) in the following circumstances:

(a) where you provide information as part of your registration and account set up for the Service as a buyer on the Plane & Simple Marketplace, we will collect your name(s), email address, phone number, username and password, billing address, delivery address(es), order details and payment information (including debit or credit information) and account preferences;

(b) where you provide personal information as part of your registration and account set up on behalf of a seller we will collect your name, business email address, business phone number, account preferences and any other information required to process buyers' orders;

(c) where you provide personal information as part of your registration and account set up if you are seller who is a sole trader, we will collect your name, business details, business email address, business phone number, business account details, business payment details, business address, account preferences and any other information that may be required to process buyers' orders; in respect of transactions we facilitate via the Services, we collect details of any purchases or orders made by you or sold by you (as the case may be), your feedback and survey responses;

(d) we hold the names, job titles, employer details and professional contact details for various business contacts, including client contacts and supplier contacts;

(e) when you visit the Plane & Simple marketplace, we collect some technical information about how you use our Services, including using cookies. More information about our use of cookies is available in our Cookies Policy;

(f) we also may collect other technical data when you use our Services, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Plane & Simple marketplace; and

(g) we may use names, postal addresses and email addresses for marketing purposes.

4 How we use your personal information

We may use your personal information for the following purposes:

(a) where we have a contract with you, to perform that contract and facilitate the sale and purchase of goods through our Services and to assist with the processing of payments in relation to such sales;

(b) to allow us to ask for your feedback, assess customer satisfaction and to improve our overall operations;

(c) to provide access to and use of our Services, to manage your account, and to keep our Services safe and secure;

(d) to contact you regarding your account, to troubleshoot your problems, to assist with complaints or to resolve disputes in relation to orders placed through the use of our Services, or as otherwise necessary to provide customer service;

(e) to communicate with you by sending you information about products and services that we think may be of interest to you. We will not send you marketing communications if you have not given us your consent to do this, or if you have given us your consent and then changed your mind and unsubscribed;

(f) to validate your information to check that the data we hold about our users is accurate, consistent and up to date;

(g) to improve our Services by detecting, preventing, mitigating and investigating fraudulent or illegal activities; and

(h) to comply with any legal or regulatory obligations to which we are subject.

5 Our legal basis for using your personal information

5.1 We will only use your personal information where it is permitted by law and where:

(a) we need to use your personal information to perform a contract with you in respect of your use of the Services;

(b) we need to use your personal information to comply with our legal or regulatory obligations;

(c) you have given us consent to use your personal information (if consent is needed we will ask for this from you separately); and

(d) it is in our legitimate business interests to be able to comply with our obligations and exercise our rights under our contract with the corporate entity you represent, and there is no disadvantage to you or risk to your personal information.

5.2 If you do not provide us with the personal information we request from you, or if you do not allow us to process your personal information that we may obtain from other sources (such as credit reference agencies), we may not be able to offer you our Services, or continue to administer any Services that you have with us.

6 Who we share your personal information with

6.1 We may share your personal information with:

(a) other members of our Group, for example your personal information may be held on Group-wide IT systems;

(b) our Service providers who process and store data on our behalf (such as our IT service providers);

(c) our professional advisers;

(d) our insurers;

(e) law enforcement, taxation and legal authorities;

(f) if you are a buyer, we will  share your data with a seller in order for us to provide the Services, resolve any disputes or deliver feedback; and

(g) if you are an individual acting on behalf of a seller or if you are seller who is a sole trader, we will share your data with buyers in order for us to provide the Services, resolve any disputes or deliver feedback.

6.2 We may also share your personal information with third parties in the event that:

(a) our business or substantially all of its assets are acquired by a third party;

(b) if we are under a duty to disclose or share your personal information;

(c) in order to comply with any legal or regulatory obligation;

(d) in order to enforce or apply any contract with you (or the business you represent); or

(e) to protect our rights, property, or the safety of our employees, customers or others.

7 How long we keep your personal information

7.1 We keep your personal information for as long as we need to for the purposes we have set out above, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

7.2 We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

7.3 To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

7.4 If you would like to see a copy of our retention policy, please contact our DPO.

8 Information security measures

We will treat all of your personal information in strict confidence and we will take all reasonable steps to keep your personal information secure once it has been transferred to our systems. We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your personal information. If you would like more information about the security measures, we use to protect your data, please contact our DPO.

9 Transferring data outside of the UK

9.1 Many of our external third parties, including email service providers and web hosting providers are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

(a) We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.

(b) Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

10 Your privacy rights

10.1 Data protection laws give you a number of rights as set out below. If you would like to exercise any of your rights, please contact our DPO in writing.

(a) Access: you may request access to a copy of your personal information.

(b) Withdraw Consent: where our processing of your personal information is based on your consent, you can withdraw your consent at any time.

(c) Rectification: you may ask us to rectify any inaccurate information we hold about you.

(d) Erasure: you may ask us to delete the personal information we hold about you, where there is no reason for us to continue to hold your information.

(e) Portability: you may ask us to provide you with the personal information that we hold about you in a structured, commonly used, machine readable format, or you can ask us to send your information in this format to another controller.

(f) Object: you may object to our processing of your personal information.

(g) Restriction: you can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.

10.2 If you are not happy with the way in which we process your personal information, or the way in which we handle any request by you to exercise your privacy rights, you may make a complaint to the ICO by visiting their website at https://ico.org.uk/concerns/ or on 0303 123 1113.

11 Changes to this notice

We may modify this notice from time to time, so please review it regularly. This version was last updated on 3 February 2021.