Privacy Notice

Personal information, often referred to as personal data, means any information relating to an individual that has been identified or could be identified. It does not include data where the identity has been removed (anonymous data).  

 When we collect it from you  

We may collect your personal information when you are filling in forms on our Sites or visiting our Trade Apps, purchasing a product from us online, via our Trade Apps, or in store, by corresponding with us by post, phone, email, SMS or by the filling in of data capture forms in store or by a member of our staff on your instruction. This includes personal information you provide when you:  

•  visit our stores, Sites, Trade Apps or social media pages;
  
  
•  buy, place an order for or receive a quotation for our products or services;
  
  
•  receive a refund on our products;
  
  
•  create an account on our Sites or Trade Apps;
  
  
•  subscribe to our services or publications;
  
  
•  request to receive marketing;
  
  
•  participate in a competition, promotion or survey;
  
  
•  give us some feedback;
  
  
•  use an online or Trade Application based service (e.g. our visualiser feature);
  
  
•  request an e-receipt;
  
  
•  request information following a sample purchase or quote;
  
  
•  sign up to receive press releases or investor alerts;
  
  
•  contact our customer services team;
  
  
•  make an enquiry direct to our store (e.g. via phone);
  
  
•  leave an online customer review of our products or service
  
  
•  arrange an in-store consultation;
  
  
•  sign up for a credit account or apply for interest free credit; or
  
  
•  request a quotation.
  
  

For trade customers and trade/ business users only, we will also collect your data in the following ways when you:

•  give us business cards to be displayed in store;
  
  
•  where applicable, register for a trade account for discount purposes;
  
  
•  join our trade loyalty scheme; or
   
•  attend an in store event or training day (such as a trade roadshow).
  
  

  How we receive information about you  

 We receive information from you in a variety of ways, as follows: Personal information that you give to us We collect the following information if you choose to give it to us:  

•  Account information including your username and password, purchases or orders made by you, basket or shopping cart details, your interests, preferences, feedback and survey responses;
  
  
•  Biographical information including your date of birth, job title and employer details;
  
  
•  Business information including, for trade account holders we will also keep a record of your business name, business email address, telephone numbers, business or elected postal address, website address, focus of work, nature of business, logo, skills and training, and VAT Registration number, business type, industry sector, number of employees and credit limit;
  
  
•  Communication information including service messages, enquiry details, your opinion of our products and services and your comments on them and any personal information you include in any correspondence with us, including any complaints or legal claims;
  
  
•  Contact information including your name, title and contact details (email address, telephone number, postal address, delivery address, change of address information, social media handle);
  
  
•  Credit information including credit scores and reports and supporting information;
  
  
•  Financial information including your payment and gift card information and amount spent in-store or on line and, in relation to certain refunds, your bank account details;
  
  
•  Identity information including information in any passport, driving licence or other formal identity documents;
   
•  Monitoring information including any CCTV footage or telephone recordings containing your voice or visual image; and
  
  
•  Preferences information including details regarding your marketing preferences, when and how you consented to receive marketing communications from us (including the time and date you provided your consent).
  
  

If you do not provide this information to us we may not be able to fulfil your orders for our products and services, contact or communicate with you or resolve your queries or requests effectively. Personal information that we collect about you when you visit our Sites, or our Trade Apps we automatically collect:  

• Device information including the internet protocol (IP) address of your device and details regarding the type of device and access or browser software you use to access our Sites or Trade Apps, time zone setting and location, browser plug-in types and versions, page information, operating system and platform and other technology on the devices you use to access our Sites or Trade Apps and information we collect or use from cookies used on our Sites or cookie equivalents used with our Trade Apps, (for more information please see our Cookie Policy).
  
  
• Usage information including details of your use of our Sites and Trade Apps, namely traffic data, weblogs and statistical data, including where and when you clicked on certain parts of our Sites or visited areas of our Trade Apps and details of the webpage (where applicable) from which you visited our Sites;
  
  

If you do not provide this information, you may be unable to access some or all of a relevant Site or its features, or access and use a relevant Trade App.  

Personal information we may receive from other sources We obtain certain personal information about you from other sources (including those outside of our business) which may include other Topps Companies, our suppliers and our customers. The sources that may send to us personal information about you are as follows and each company name listed includes a link to their privacy policy:

Aggregated data We also collect or create and then use and share aggregated data such as statistical or demographic data for a variety of purposes. Aggregated data may be derived from your personal information but is not considered personal information in law as it does not reveal your identity and cannot readily be linked to you. For example, we may aggregate your usage data relating to our Sites and/or Trade Apps to calculate the percentage of users accessing a specific online feature.

We use your personal information for a variety of reasons.  We rely on different legal grounds (known as ‘lawful bases’) to process your personal information, depending on the purposes of our use and the risks to your privacy.  

3.1. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal information, and which of the lawful bases we rely on to do so. Where we rely on the existence of a legitimate interests to process your personal information, we have also identified the specific legitimate interests on which we rely. We may rely on more than one lawful basis depending on the specific purpose for which we are using your personal information. Please Contact us if you need further details about the specific lawful basis we are relying on to process your personal information.  

3.2. MARKETING We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. If we specifically request your permission to send (or you specifically ask us to send) you newsletters, marketing material or to notify you of special events, offers, promotions, competitions or new products and services by email, SMS, post or phone (as you indicate), we rely on your consent to do so.  Our requests for your marketing permissions may cover one or more Topps Companies.  Otherwise we process your personal information for direct marketing purposes on the basis that it is necessary for us to pursue our legitimate interests as a business (see the section at the end of this policy for further details).    

If you do not wish to receive communications from us, please inform us by using the unsubscribe link at the foot of the email by using the STOP code within the SMS,  by using any preference portal features (where available on a particular Site) or by contacting us in store.  
 

We only disclose your personal information outside our business in limited circumstances and we do not sell your information to third parties. We work with other Topps Companies, services providers and certain other parties who may receive your personal information from us, as follows:  

Other Topps Companies  

There are also circumstances where we share your information with Topps Companies or companies in our corporate group in order to understand you as a customer, fulfil orders, transactions, handle complaints or provide you with a service or information that you have requested or for audit or business administration purposes. Any Topps Companies that receive your personal information from us will handle it in the ways described in this policy.  

Our Suppliers  

We may disclose your information to our trusted third party service providers, agents and subcontractors (Suppliers) for the purposes of providing services to us or directly to you on our behalf, including the operation and maintenance of our Sites, Trade Apps, and social media pages. All Suppliers are subject to thorough security checks, and will only hold the minimum amount of personal information needed in order to fulfil the orders you place or provide a service on our behalf. We will put in place a contract with each of our Suppliers that requires them to protect your personal information, unless we are legally required to share that information. Any Suppliers that work for us will be obliged to follow our instructions.  

Our Suppliers can be categorised as follows:

We use a number of different social media platforms to communicate with you and to promote products and services. We process your personal information using these platforms in a variety of ways, as follows: Pages/accounts. We use your personal information when you post content or otherwise interact with us on our official pages and accounts on      

Facebook, Instagram, Pinterest, LinkedIn, YouTube, TikTok and other social media platforms. 

We also use the Page Insights service for Facebook, Instagram and LinkedIn to view statistical information and reports regarding your interactions with the pages and accounts we administer on those platforms and their content. Where those interactions are recorded and form part of the information we access through these Page Insights services, we and the relevant platform are joint data controllers of the processing necessary to provide that service to us.  Please see the beginning of this privacy policy for more information about our joint data controller arrangements. Cookies. We use cookies and similar technologies in our Sites and Trade Apps to collect and send information to Meta, LinkedIn and Pinterest about actions you take on our Sites and Trade Apps.

In particular:

•  Meta (who operates the Facebook and Instagram platforms) and Pinterest use this information to provide services to us and also for further processing for their own business purposes. We and each of these platforms are joint data controllers of the processing involved in collecting and sending your personal information to these platforms using cookies and similar technologies as each of us has a business interest in the platforms receiving this information.  You can find out more about these technologies by visiting our Cookie Policy.
  
  
•  The services we receive from Meta that use the information above are delivered to us through Meta Business Tools, which include Meta Pixel, Social Plugins, Website Custom Audiences and Conversions API (CAPI). The services we receive from Pinterest that use the information above are delivered to us through Pinterest’s Ad Services including Pinterest Tag and Pinterest API. These tools allow us to target advertising to you within Meta’s and Pinterest’s respective social media platforms by creating audiences based on your actions on our Sites and allow these platforms to improve and optimise the targeting and delivery of our advertising campaigns for us.
  
  
•  We use LinkedIn Insight Tag, a small piece of code that we embed in our Sites that allows us to perform in-depth campaign reporting and unlock insights about users that may visit our Sites via our LinkedIn campaigns (e.g. by allowing us to discover business demographics by layering LinkedIn data on data about our Sites’ visitors). LinkedIn Insight Tag enables the collection of metadata such as IP addresses, timestamps, and events such as page views.  You can find out more about these technologies by visiting our Cookie Policy.
  
  
•  You can opt-out of online behavioural advertising by using the AdChoices tool at aboutads.info or by adjusting your mobile ad identifier settings, or your personalisation settings within your account on the relevant social media platform.
  
  

  Our relationship with Meta, LinkedIn and Pinterest. As we are joint controllers with these platforms for certain processing, we and each platform have:

•  entered into agreements in which we have agreed each of our data protection responsibilities for the processing of your personal information described above;
  
  
•  agreed that we are responsible for providing to you the information in this policy about our relationship with each platform; and
  
  
•  agreed that each platform is responsible for responding to you when you exercise your rights under data protection law in relation to that platform’s processing of your personal information as a joint controller.
  
  

Meta and LinkedIn also process, as our processor, contact information that we submit for the purposes of matching, online targeting, measurement, reporting and analytics purposes. These services include the processing those platforms carry out when they display our advertisements to you in your news feed at our request after matching contact details for you that we have uploaded to a platform operated by those platforms. These advertisements may include forms through which we collect contact information you give to us. Further information. The Meta company that is a joint controller of your personal information is Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.  The LinkedIn company that is a joint controller of your personal information is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.  The Pinterest company that is a joint controller of your information is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.  For further information regarding Meta and its use of your personal information, please see:  

•  Meta’s Controller Addendum for Page Insights and UK Controller Addendum for Business Tools, LinkedIn’s Page Insights Joint Controller  Addendum and Pinterest’s Advertising Services Agreement, including Data Sharing Addendum and Joint Controller Addendum which include information regarding how our and those platforms’ responsibilities to you are allocated as controllers of your personal information;
  
  
•  Meta’s Privacy Center including its Privacy Policy, LinkedIn’s Privacy Policy and Pinterest’s Privacy Policy which include details of the legal grounds (known as ‘lawful bases’) on which each platform relies to process your personal information, together with details regarding your data protection rights; and
  
  
•  Meta’s help pages regarding its Page Insights and Business Tools and its terms and conditions relating to those tools.
  
  
•  LinkedIn’s help pages regarding its Page Insights and its terms and conditions relating to its advertising services, including LinkedIn Insight Tag.

Our relationship with Tiktok. To find out more about our relationship with TikTok, please see the terms of the data sharing arrangement we have with TikTok and the TikTok Privacy Policy.

Except in a limited number of cases, we do not transfer your personal information outside of Europe. Where we do, we take measures to protect your personal information.   Some of the information you provide to us may be transferred to countries outside the UK and European Economic Area (EEA), usually because some of our Suppliers are based outside of these areas. These countries may not have similar data protection laws to the UK these countries are listed in the table under Disclosure of your personal information by us. For example, we transfer your personal information to the USA when using our email marketing services provider, certain data analytics providers and some social media platforms.   Where we transfer your information outside of Europe in this way, we take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected in the ways required by data protection law as outlined in this policy. These steps include imposing contractual obligations on the recipient of your personal information using standard clauses issued by the UK Information Commissioner’s Office (or other relevant body) and relying on decisions issued by the relevant UK Secretary of State (or other relevant person) declaring that a recipient or country is adequately protective of personal information to a degree that allows us to safely transfer your personal information to that recipient or country.  This includes any international frameworks that allow recipients to certify that they can receive your personal information safely and process it in a manner that is protected to an equivalent standard as that under UK laws. Please contact us using the details at the end of this policy for more information about the protections that we put in place and to obtain a copy or access to the relevant documents.   If you use our services whilst you are outside the UK, your information may be transferred outside the UK in order to receive those services.

We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet and to our Sites, or over communication networks with our Trade Apps may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information.

We employ security measures to protect the personal information you provide to us, to prevent access by unauthorised persons and unlawful processing, accidental loss, destruction and damage. When we have provided (or you have chosen) a password or pin allowing you access to certain parts of our Sites or accessing our Trade App via mobile devices, you are responsible for safeguarding it and keeping it confidential and must not allow it to be used by third parties.

Our Sites, Trade App, and social media pages may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites‚ so we encourage you to read their privacy policies. We are not responsible for the privacy policies and practices of other websites (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience.

We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk.  

In addition, if you linked to our Sites from a third party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and recommend that you check the policy of that third party website.

We will not hold your personal information in an identifiable format for any longer than is necessary for the purposes for which we collected it.  

Except where the circumstances below apply, we retain your personal information for 6 years from the end of the year in which your account closes. This is so we can comply with our legal and contractual obligations, establish, bring and defend legal claims and use your information for analytics and business planning purposes. The only exceptions to the period mentioned above are where:

•  we collect CCTV footage (which we retain for 30 days), device and usage information (which we retain for 2 years) or user information on our social media pages (which we retain indefinitely);
  
  
•  you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law;
  
  
•  you exercise your right to require us to retain your personal information for a period longer than our stated retention period;
  
  
•  we bring or defend a legal claim or other proceedings during the period we retain your personal information, in which case we will retain your personal information until those proceedings have concluded and no further appeals are possible;
  
  
•  we archive your personal information, in which case we will delete it in accordance with our routine deletion cycle based on good industry practice; or
  
  

•  in limited cases, existing or future law or a court or regulator requires us to keep your personal information for a longer or shorter period, or we are reasonably requested to do so by law enforcement authorities.

You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to verify your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 1 month after we have received this information or, where no such information is required, after we have received full details of your request.

Please see the sections below to find out more about these rights

•  to be informed about the processing of your personal information (this is what this policy aims to do)
  
  
•  to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
  
  
•  to object to processing of your personal information
  
  
•  to withdraw your consent to processing your personal information
  
  
•  to restrict processing of your personal information
  
  
•  to have your personal information erased
  
  
•  to request access to your personal information and information about how we process it
  
  
•  to electronically move, copy or transfer your personal information in a standard, machine-readable form (known as portability)
  
  
•  rights relating to automated decision making, including profiling (see below)
  
  

If you wish to exercise any of the rights set out above, please contact us at [email protected].  

You have the right not to be subject to purely automated decisions (including profiling) where this has a significant effect on you. We do not envisage that any decisions will be taken about you in this way, however we will update this statement if this changes. You also have the right to complaint to the UK data protection regulator (see section 1.2 above for further information).