4. How is your personal data collected?
We use different methods to collect data from and about you including through:
Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or through chat or social media.
This includes personal data you provide when you:- Sign up to receive the Brown Sparrow Newsletter
- Make inquiries or request information be sent to you
- Order our products or services;
- Ask for marketing to be sent to you;
- Engage with us on social media;
- Enter a competition, promotion or survey;
- Contact customer services; or
- Leave comments or reviews on our products or services (please be kind!).
5. Payment information.
Brown Sparrow uses a third party payment processors PayPal to process payments made for products and services via the Website. All Online payments will be conducted in accordance with Payment Card Industry (PCI) data security standards (which are high!) and your billing information (which is only used by these payment processors for the purpose of performing fraud protection) is encrypted before being communicated to them. Subject to the below exceptions, your credit card details are communicated directly from your browser to these payment processors - Brown Sparrow never (ever!) sees your full Permanent Account Number (PAN). This means that the payment form is either off-site or displayed in a frame on the payment page.
For PayPal we only store the tokens required to identify the transaction with PayPal, issue refunds and identify transactions made using PayPal.
6. Data security.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. Data retention.
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers for tax purposes.
We also make a promise to you that you can come back at any time in the future and re-print products you have ordered from us in the past. So, unless you actively delete this information, we keep it, so we can keep our promise to you.
In some circumstances you can ask us to delete your data; see Your legal rights below for further information.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.