We understand that your privacy and the security of your personal information is extremely important. This notice sets out what we do with your personal information, what we do to keep it secure, from where and how we collect it, as well as your rights in relation to the personal information we hold about you.
This policy applies if you interact with us through our stores, over the phone, online, through our mobile applications or otherwise by using any of our websites or interacting with us on social media (our “Services”).
CMC Chesterfield LTD is currently made up of multiple branches around the UK. We also own and operate buymybike.co.uk.
Your personal information is, where appropriate, shared within CMC Chesterfield LTD.
We do use a number of third parties to process your personal information on our behalf and some of them are based outside of the European Economic Area.
You have a number of rights over your personal information. How you can exercise these rights is set out in this notice.
We do send direct marketing, if we’re allowed to. And we do this to encourage you to buy our products and services by sending you offers and ideas that we feel will be of benefit to you. If you want us to stop then here's how.
We also display online advertising relating to our products and services our website: cmcbikes.com, on other websites and online media channels.
Who are we?
How and what personal information we collect
Our legal basis for processing your personal information
How do we use your personal information?
Cookies and similar technologies
Others who may receive or have access to your personal information
Where we store your personal information outside the EEA
Keeping you informed about our products and services
Automated decision making and profiling
How long will we keep your personal information for?
When we say ‘we’ or ‘us’ in this policy, we’re referring to the separate and distinct legal entity CMC Chesterfield LTD from time to time. CMC Chesterfield LTD controls your personal information.
Information that you provide to us such as your name, address, date of birth, telephone number, email address, and any feedback you give to us, including by phone, email, post, or when you communicate with us via social media;
Information about the services that we provide to you (including for example, the things we have provided to you, when and where, what you paid, the way you use our products and services, and so on);
Information required to make decisions about your application for products and services offered by CMC Chesterfield LTD (for example, insurance and loans) such as your employment details, information taken from identification documents such as your passport or driving licence, and details about additional insured parties.
Information about whether or not you want to receive marketing communications from us;
Information about any device you have used to access our Services (such as your device’s make and model, browser or IP address) and also how you use our Services. For example, we try to identify which of pages of our website you use and when and how you use them.
Your contact details and details of the emails and other electronic communications you receive from us, including whether that communication has been opened and if you have clicked on any links within that communication. We want to make sure that our communications are useful for you, so if you don’t open them or don’t click on any links in them, we know we need to improve our Services; and
Information from other sources such as specialist companies that provide customer information (like credit reference agencies such as Experian, fraud prevention agencies, claims databases, marketing and research companies), social media providers and the DVLA, as well as information that is publicly available.
Whenever we process your personal information we have to have something called a “legal basis” for what we do. The different legal bases we rely on are:
Consent: You have told us you are happy for us to process your personal information for a specific purpose;
Legitimate interests: The processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.
Performance of a contract: We must process your personal information in order to be able to provide you with one of our products or services;
Insurance: Where we process your information as part of offering you an insurance product;
Finance: to undertake credit checks for finance;
Prevention of fraud: Where we are required to process your data in order to protect us and our customers from fraud or money laundering;
Vital interests: The processing of your personal information is necessary to protect you or someone else’s life;
Public information: Where we process personal information which you have already made public;
Legal claims: The processing of your personal information is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; and
Legal obligation: We are required to process your personal information by law;
Comply with opt out: We will use minimal personal information to ensure we do not send you any further marketing messages;
There are a number of ways in which we may use your personal information, depending on how you interact with us. If you do not provide your information to us, then we will be unable to interact with you in that way – for example, if you do not provide your name, address and account details when purchasing one of our products online, we will not be able to sell you that product as we would be unable to process your payment or deliver the product to you. We may use your information in the following ways:
To provide our products and services - we need to use your personal information to make our products and services available to you. If you then decide to order any of our products or services then we’re delighted, thank you. After that, we need to provide them to you and process your payment. And we need to use your details to do all this.
To personalise your shopping experience - we try to understand our customers so we can provide you with a great shopping experience, relevant marketing, personalised offers, shopping ideas and online advertising. Understanding how you interact with CMC Chesterfield LTD, where you shop, the products and services you buy and how you use and browse our websites helps us to do this.
For safety and security - we use your personal information to help provide safe and secure environments for our colleagues to work in, our customers to shop in and for our businesses to be conducted. To enable this we use CCTV, monitor online behaviour and carry out checks to help us ensure that our customers are genuine to prevent fraud and to help customers use our services appropriately.
Analytics and profiling - we use your personal information for statistical analysis and to help us understand more about our customers. That includes understanding the products and services you buy, the manner in which you consume them, how you shop across CMC Chesterfield LTD locations and by creating profiles about you. This helps us to serve you better and to find ways to improve our services, stores and websites. These profiles help us to send you offers that are more relevant to you.
Contacting you - we use your personal information to contact you: either to conduct market research or to contact you about products and services from us. We may also contact you in relation to any questions you have raised with us or to discuss the status of your account with us.
Vital information - We may use your personal information to contact you if there are any urgent safety or product recall notices to communicate to you or where we otherwise reasonably believe that the processing of your personal information will prevent or reduce any potential harm to you. It is in your vital interests for us to use your personal information in this way.
Legal obligations - We will use your personal information to comply with out legal obligations including: to assist HRMC, the police, the Driver and Vehicle Licensing Agency (DVLA) or any other public authority or criminal investigation body; to identify you when you contact us; and to verify the accuracy of the data we hold about you.
We may disclose your information to our third party service providers, agents, subcontractors and other organisations for the purpose of providing services to us or directly to you on our behalf. Such third parties may include cloud services providers (such as hosting and email providers) or advertising agencies, administrative services or other third parties who provide services to us.
When we use third party service providers, we only disclose to them any personal information that is necessary for the to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.
Authorised dealers in our network
We may share your information with other companies within our Authorised Dealer Network. They may use your personal information in the ways set out in How we use your personal information section or in connection with products and services that complement out own range of products and services, for example finance or insurance products.
Third parties who provide products and services
We work closely with various third parties to bring you a wide range of products and services which are complementary to ours. When you enquire about or purchase one or more of these products or services through us (e.g. via our website), the relevant third party may use your details to provide you with information and carry out their obligations arising from any contracts you have entered into with them.
All information you provide to us may be transferred to countries outside the European Economic Area (EEA). By way of example, this may happen where any of our group companies are incorporated in a country outside of the EEA or if any servers or those of our third party service providers are from time to time location in a country outside of the EEA. These countries may not have similar data protection laws to the UK.
If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights countries to be protected as outlines in this policy. These steps include imposing contractual obligations on the recipient of your personal information or ensuring that the recipients are subscribed to international frameworks that aim to ensure adequate protection. Please contact us using the details at the end of this policy for more information about the protections that we put in place and to obtain a copy of the relevant documents.
If you use our services whilst you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.
We would like to tell you about the great offers, ideas, products and services of CMC Chesterfield LTD from time to time that we think you might be interested in. Where we have your consent or it is in our legitimate interests to do so, we may do this through the post, by email, text message or by any other electronic means.
We won't send you marketing messages if you tell us not to and we only send you marketing messages if you specifically opt in, but if you receive a service from us we will still need to send you occasional service-related messages. If you wish to amend your marketing preferences, you can do so by sending a message to our customer care team at https://www.cmcbikes.com/customerCare.
Please note that it can take up a little while for all marketing to stop once you either withdraw your consent or tell us you’d like to opt out of marketing. This is because some marketing may already be in transit.
You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.
If you are seeking to exercise any of these rights, please contact us using the details in the “Contact Us” section below. Please note that we will need to verify your identity before we can fulfil any of your rights under data protection law. This helps us to protect the personal information belonging to our customer against fraudulent requests.
We use automated decision making, including profiling, in certain circumstances, such as when it is in our legitimate interests to do so, or where we have a right to do so because it is necessary for us to enter into, and perform, a contract with you. We use profiling to enable us to give you the best service from CMC Chesterfield LTD, including specific marketing which we believe you will be interested in.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for you or affects you in any other significant way.
If you are seeking to exercise this right, please contact us using the details in the “Contact Us” section below.
We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:
We limit physical access to our buildings and user access to our systems to only those that we believe are entitled to be there;
We use technology controls for our information systems, such as firewalls, user verification, strong data encryption, and separation of roles, systems & data;
We utilize industry “good practice” standards to support the maintenance of a robust information security management system; and
We enforce a “need to know” policy, for access to any data or systems.
If you would like to exercise one of your rights as set out in the “Your rights” or “Automated decision making and profiling” sections above, or you have a question or a complaint about this policy, or the way your personal information is processed, please contact us by one of the following means:
By email: firstname.lastname@example.org By post: Data Protection Officer, CMC Chesterfield LTD, Derwent Buildings, Chesterfield, S45 9DP.
You also have the right to lodge a complaint with the UK regulator, the Information Commissioner. Go to ico.org.uk/concerns to find out more.