At the Halfords Group we want to make sure you know what data we collect from you, why we
collect it, what we do with it and how you can ask us questions about it or exercise your rights
When we say “Halfords” we mean the Halfords Group of companies and this Privacy Notice applies
to all the companies in our group.
If you are reading this notice on a company website, then it is part of our group.
If you want to know more about the companies that make up the Halfords Group plc then contact us
here.
We understand that your privacy and the security of your personal information is extremely
important.
This privacy notice tells you what we do with your personal information, how we keep it secure,
and where and how we collect it, as well as your rights in relation to the personal information
we hold about you.
We’d like you to read all of our privacy notice, but we understand that sometimes you know
exactly what you want and just want to go straight to it, so we’ve listed below the most common things
customers ask us - the “FAQ’s”
Frequently Asked Questions
“What’s your address?”
Our postal address is: Halfords Group plc, Icknield Street Drive, Washford West, Redditch B98 0DE.
I want to contact the Data
Protection Officer (the “DPO”)
You can find the contact details for the DPO at the bottom of this notice but please have a look
at
these FAQ’s first as they may be able to assist you with your problem.
“I would like a copy of my
personal data”
No problem, this is called a “Subject Access Request” or SAR. But first we need some information
from
you to ensure we only disclose your personal data to you, or your representative. To make sure
we
have all the information from you that we need to fulfil your request, we have created a form
here.
The form is simple to complete, is free and allows you to access your personal data securely.
The Legal - By law we have one month to provide you with
a
copy of your personal data which starts from the moment you have provided proof of your
identity. We
may extend the time limit by a further two months if the request is complex or if we receive a
number of requests from you.
“I would like you to delete
my
personal data”
You have a right to erasure also known as the” right to be forgotten” but this doesn’t always
apply.
We will always review each request for erasure on a case-by-case basis.
However, if you have bought something from us, we will be unable to erase your personal data
because we need to keep records of transactions for business purposes. This data will
automatically delete 7 years from the date of your last transaction with us.
If you still want to ask us to delete your personal data, please follow the link here.
The Legal - we have one month to respond to your request
which starts from the moment you have provided proof of your identity.
“I think you may have the
wrong
data about me, and I would like you to correct it”
This is your right to rectification. Tell us what you think we have that’s wrong, such as the
wrong
vehicle registration number, a previously owned vehicle registration number, or a booking error.
We will check it and if the data we hold is wrong, we will change it.
We have a duty to ensure all personal data we hold is accurate. You can ask us to rectify your
data
here.
The Legal - we have one month to respond to your request
which starts from the moment you have provided proof of your identity.
“I would like to opt out of
receiving marketing information”
Marketing emails and text messages have an opt out or unsubscribe button at the bottom of the
email/text. This is the quickest and easiest way for you to unsubscribe. If you have already
deleted
the email or text, then you can send us a request to unsubscribe you
here.
If the email/text does not contain an opt out or unsubscribe button it’s because it’s a service
message not a marketing message. A service message may be an MOT reminder or an invitation to
provide feedback, or a product review request. If you no longer wish to receive any
communications
from Halfords, then please go
here.
“I would like a copy of any
CCTV images you may have captured of me during my recent visit to your premises”
Yes, we can do that as CCTV images are personal data, however, please be aware that we only
retain
CCTV images for 30 days from when they were recorded, after which they are deleted by the system
and
we are unable to recover them.
To request a copy of your CCTV images go
here.
The Legal - we have one month to provide you with a copy
of
your personal data which starts from the moment you have provided proof of your identity. We may
extend the time limit by a further two months if the request is complex or if we receive a
number of
requests from you.
How and why we collect your
personal data
As an essential part of our business, we collect and manage customer data. In doing so, we
observe
all relevant data protection legislation, and are committed to protecting and respecting
customers’
privacy and rights. Specifically, Halfords acts as “Data Controller” in respect of the
information
gathered and processed by this website, when customers visit one of our stores or autocentres or
use
one of our mobile services.
In order that you are reliably informed about how we collect, process, store and share your
information, we have developed this Privacy notice. This notice also advises how you can
have
control over how we use your data.
What personal data do we
collect
and why?
We collect information
about you so that we can:
Provide you with our services in our stores, autocentres, mobile services and online sales.
We use cookies on our websites to collect your data, you can find out more about how we use
cookies to collect your data
Collecting information from
you:
The information that we collect from our customers is known as “personal data” and may include
your name, home address, e-mail address, telephone number and vehicle registration number.
We collect this information
in various ways.
This could be when you fill in a form on a website, or when you correspond with us by telephone,
e-mail, webchat, or letter, when you buy something from one of our stores or websites or visit
one
of our Autocentres.
We don’t store your payment card details as we use a third-party payment processor, so we never
see
your payment card information.
Who we share your personal data with
We will share your personal data with other companies within the Halfords Group, to help us
provide you with products and services we think you will be interested in.
We also use third party service providers who help us provide our products and services to you.
These third parties include:
- Advertising companies
- Social media providers
- Market research partners
- Companies that work with us on email campaigns
- Financial services such as Klarna purchase payments
- IT services
- Logistics and delivery services
- Security and fraud prevention service providers
- Contact centres for customer support
- Companies who assist us in administering competitions and promotions
Cookies
Third parties such as Google Analytics, may drop cookies on your computer or mobile devices.
These
cookies may use information about your visits to our websites to provide relevant advertisements
about
goods and services that you may be interested in. They may also employ technology used to
measure
the
effectiveness of our advertising using cookies to collect information about your visits to our
sites
in
order to provide relevant advertisements about goods and services you may be interested in. The
information collected through this process doesn’t let us, or them, collect your name, contact
details
or other personally identifying details unless you choose to provide them. We have cookie
controls
in
place on all of our websites that allow you to choose how much, if any, personal data you
provide.
For
more information about cookies go to our Cookie Notice
CCTV & Body Worn Video Devices
We use CCTV across the Halfords Group for the protection of our colleagues, customers, and
business. This includes investigating accidents, incidents, criminal activities, and breaches of
our policies. Some car parks are run by third parties, so please check the local notice.
Some of our colleagues also wear body worn video (cameras) devices. These are only activated in
high-risk situations. These devices record both audio and video.
We can share CCTV with public or regulatory authorities or in response to requests from
individuals seeking to protect their rights, the rights of others or helping to prevent crime
and nuisance. We will only share CCTV if we consider a request to be appropriate.
International Transfers
Some of our trusted suppliers and service providers are based outside the EEA for the purposes
described in this privacy notice (please see the “Who we share your personal data with.” section
above for further details). If we do this, your personal information will continue to be
protected by appropriate safeguards as set out in the UK/EU GDPR. These will be transfer
mechanisms approved by regulators.
Your rights
You have a number of rights under data protection legislation which, in certain circumstances,
you may be able to exercise in relation to the personal information we process about you.
- the right to be
informed;
about how we collect and use your personal data.
- the right to
access;
a copy of the personal information we hold about you.
-
Right to rectification; of inaccurate personal information we
hold about you.
-
Right to be
forgotten;
- Right to
object;
to our use of your personal information.
- Right to
restrict;
processing.
- the right
of data portability;
and
Where we rely on consent as the legal basis on which we process your personal information, you
may also withdraw that consent at any time.
If you are seeking to exercise any of these rights, please submit a request
here.
Please note when submitting a request, you will be asked to provide valid photo identification
so that we can verify your identity before we can fulfil any of your rights under data
protection law. This helps us to protect the personal information belonging to our customer
against fraudulent requests.
How long will we retain
your data?
We will keep your personal information for the purposes set out in this privacy notice and in
accordance with the law and relevant regulations. We will never retain your personal
information for longer than is necessary. In most cases, our retention period will come to
an end 7 years after the end of your relationship with us.
Retention Schedule
Halfords Group PLC maintains a data retention schedule in which we list in detail how long we
keep categories of data. If you would like more information about our retention schedule,
contact the data protection officer at Halfords. dataprotectionofficer@halfords.co.uk.
Data privacy and
security
At Halfords, we maintain a comprehensive data management work programme, which
includes processes for ensuring that data protection is a key consideration of all
new and existing IT systems that hold customers’ personal data. Where any concerns,
risks or issues are identified, we conduct relevant impact assessments in order to
determine any actions that are necessary to ensure optimum privacy.
We also maintain an active information security work programme which seeks to protect
the availability, confidentiality, and integrity of all physical and information
assets. Specifically, this helps us to:
- protect against potential breaches of confidentiality
- ensure all IT facilities are protected against damage, loss, or misuse
- increase awareness and understanding of the requirements of information security
and the responsibility of our colleagues to protect the confidentiality and
integrity of the information that they handle and
ensure the optimum security of this website
We recognise that the security of data and transactions on this website is of
primary importance. We therefore ensure that all connections to secure parts of
the website (such as when you login) are encrypted and authenticated using
strong protocols, key exchanges and ciphers.