…the effective mixed freight solution

Rainbow Freight Group

Thanks for visiting our website www.rainbownightfreight.com (the Site). This Privacy Notice set outs the basis on which we process any personal data which is provided to us here at W. A. Rainbow & Sons, whether that data is provided to us by you directly or from a third party.

Please read this Notice carefully and ensure that you understand our rights and responsibilities under it. 

W. A. Rainbow & Sons Ltd is made up of different legal entities. This privacy notice is issued on behalf of the entire Group so when we mention W. A. Rainbow & Sons Ltd, we, us or our we are referring to the relevant company in the Group responsible for processing your data.

The Site is operated by W. A. Rainbow & Sons Ltd, a company registered in the United Kingdom under number 01783207, with its registered offices at Quibells Lane, Newark, Notts, England NG24 2AL.

Summary

Full details are set out in the relevant sections of this Notice below, but in summary:

We generally receive personal data relating to you:

from you directly, where you contact us through the Site or otherwise, or where we do business with you or your organisation; or

from third parties with whom each of you and we have a separate relationship. For example, if you have received a package delivered by us then we will have been provided with your contact details by the third party who sent you that package;

We use your data to provide our services, in the course of our business activities with your organisation, to correspond with you, meet our legal obligations and improve our Site and services. We may also use your data in the performance of contracts with third parties (for example, if we have been appointed by a third party to deliver parcels or mail on their behalf to individuals including you);

We only provide your personal data to third parties for our limited business purposes or as permitted by law. We don’t share your data with third party advertisers;

We store data for specified periods for our limited business purposes;

You have certain rights, prescribed by law, in relation to the processing of your data, such as rights to request access, rectification or deletion of your personal data;

The Site does not use cookies;

This Privacy Notice does not apply to our employees, contractor or workers, or candidates for employment or engagement (for whom we have separate, internal privacy notices); and

You can contact us to enquire about any of the contents of this Privacy Notice.

1. Introduction

1.1 In this Notice we explain how we will handle your personal data.

2. How we use your personal data

2.1 In this section we have set out:

(a) the general categories of personal data that we may process;

(b) in the case of personal data that we did not obtain directly from you, the source and specific categories of that data;

(c) the purposes for which we may process personal data; and

(d) the legal basis of the processing. When we refer to a “legal basis” we mean a basis for processing, described in Article 6 of the General Data Protection Regulation (GDPR), under which we conduct the relevant processing.

Personal data we obtain from you

Usage data

2.2 We may process data about your use of the Site ("usage data"). This may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use. This data is obtained through our analytics tracking system. Often usage data will be aggregated in such a way that it contains no information pertaining to an individual at all: as such is it not actually personal data but we address it in this Notice for completeness’ sake. We process usage data for the purpose of improving our Site. The legal basis for this processing is our legitimate interests, namely the improvement of our Site.

Correspondence data

2.3 We may process personal data contained in or relating to any communication that you send to us, whether through the Site, by email, through social media, by using live-chat functions, or as feedback on our services which you provide based on our customer satisfaction surveys, including through third parties like TrustPilot who we engage to solicit feedback on our behalf. All of this together is correspondence data. This may include the communication content and metadata associated with the communication, as well as any contact details you provide to us such as your name, email address, phone number, job title, address or social media username. The correspondence data may be processed for the purposes of communicating with you and record-keeping. The legal basis for this processing is our legitimate interests, namely the proper administration of the Site, our business and our communications.

Enquiry data

2.4 We may process personal data contained in any enquiry you submit to us indicating your interest in our services or business (enquiry data), such as the contents of your enquiry and any contact details you provide to us such as your name, email address, phone number, job title or address. This may be processed for the purposes of marketing relevant services to you. The legal basis for this processing is our legitimate interests, namely ensuring that enquiries are followed up appropriately and marketing our services.

Delivery data

2.5 We may process personal data which we have obtained from you in connection with deliveries of mail, parcels or consignments which are either addressed to you or for which you have provided a signature. That data could include your name and signature. We may also process personal data which is generated by our drivers when delivering mail or parcels to you for the purposes of confirming delivery. That could include geo-location data (showing that our driver was in your locality) or photographs of the delivery location. All of this information together is delivery data. This may be processed by us for the purposes of recording and evidencing delivery of mail and parcels carried by us. The legal basis for this processing depends on whether the delivery data relates to the addressee for the mail, parcel or consignment or whether it relates to another individual who is not the addressee but who signed for the delivery. In relation to the addressee, the legal basis for our processing is the performance of a contract benefiting the addressee. In relation to other individuals, the basis for our processing is our legitimate interests, namely ensuring that we are able to demonstrate that we have performed our delivery obligations.

Telephone recordings

2.6 We may record calls made to us. These recordings may be processed by us for the purposes of record-keeping and administering the activity to which the call relates (for example, complaint handling or enquiry handling) and for training purposes. The legal basis for this processing is our legitimate interest, namely ensuring that we are able to properly track, manage and respond to telephone communications.

Personal data we obtain from others

Service data

2.7 We may process personal data relating to personnel at organisations to whom we provide services, or from whom we purchase services service data). For example, we may process information relating to key account contacts at our suppliers and customers, with whom we deal regularly in the course of our business. Service data may be processed by us in connection with the supply, receipt and administration of the relevant services. The legal basis for this processing is our legitimate interests, namely ensuring that we are able to supply, receive and administer relevant services in the course of our business.

Addressee data

2.8 We may process personal data relating to individuals to whom mail, parcels or consignments carried by us are to be delivered (addressee data), such as the name, address and contact details of those individuals. Addressee data is provided to us by our business customers: for example, if we provide carriage services to a retailer of furniture, then that retailer will necessarily have to provide us with personal data relating to the addressee in order for us to deliver the furniture ordered. Addressee data may be processed by us in connection with the carriage and delivery of the relevant mail, parcels or consignments, and in connection with associated administration and correspondence, both with the relevant business customer and with the addressee. The legal basis for this processing is the performance of a contract benefiting the addressee: for example, if you have ordered a package from a retailer then you have a contract with that retailer, and our delivery services help that retailer perform its obligations to you. We may also use addressee data to contact addressees shortly after delivery to solicit feedback on the provision of our services. The legal basis for that processing is our legitimate interests, namely ensuring the quality of our services.

CCTV data

2.9 We have installed CCTV systems in some of our premises, and on some of our vehicles. We may process stills or footage which contains images of individuals (CCTV data). CCTV data may be processed by us for the purposes of monitoring building and vehicle security and crime prevention and detection. The legal basis for this processing is our legitimate interests, namely ensuring the safety and security of our staff, premises and property.

Other processing by us

2.10 We may process any of the personal data identified in this Notice where necessary in connection with legal claims. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.

2.11 We may also process any of the personal data where necessary for compliance with a legal obligation to which we are subject, or in order to protect your or another individual’s vital interests.

2.12 We may process any of the personal data in connection with backups of any element of our IT systems or databases containing that personal data. The legal basis for this processing is our legitimate interests, namely ensuring the resilience of our IT systems and the integrity and recoverability of our data.

Third party personal data

2.13 Please do not supply any other person's personal data to us, unless we prompt you to do so.

3. Providing your personal data to others

3.1 We may disclose your personal data to other entities within our group of companies.

3.2 We may disclose your personal data to our insurers and/or professional advisers as necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.

3.3 We may disclose personal data to our suppliers or subcontractors, or to third parties with whom you have a contractual relationship (such as retailers from whom you have ordered packages for delivery) in connection with the uses described above. For example, we may disclose:

(a) addressee data to our sub-contractor drivers;

(b) delivery data to the sender of the relevant mail, package or consignment;

(c) any personal data in our possession or control to organisations which host the servers on which our data is stored; and

(d) enquiry and correspondence data to our email service providers, on whose servers our correspondence may be stored temporarily or backed up longer-term.

3.4 We may also disclose personal data which relates to our business to any third party which purchases (or proposes to purchase) our business, or the part of our business to which that personal data relates.

3.5 We may also disclose personal data where necessary for compliance with a legal obligation to which we are subject, or in order to protect your or another individual’s vital interests, or in order to enforce our rights.

4. International transfers of your personal data

4.1 In this section, we provide information about the circumstances in which your personal data may be transferred to countries outside the European Economic Area (EEA).

4.2 The hosting facilities for our Site and all of our major systems are located within the EEA, generally in the United Kingdom.

4.3 Some of the third parties to whom we may transfer your personal data, discussed above, may be located outside the EEA or may transfer your personal data to their own service providers located outside the EEA. If so, then we will ensure that transfers will only be made to countries in respect of which the European Commission has made an "adequacy decision” or otherwise will only be made with appropriate safeguards, such as the use of standard data protection clauses adopted or approved by the European Commission. You may contact us if you would like further information about these safeguards.

5. Retaining and deleting personal data

5.1 This section sets out information about our data retention policies, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

5.2 Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

5.3 We will retain and delete your personal data as follows:

(a) usage data will be retained for thirty (30) days from collection, and then deleted. As an exception, aggregated usage data from which no individual can be identified may be retained by us indefinitely;

(b) enquiry and correspondence data will be retained for the duration of the enquiry or chain of correspondence, and then for twelve (12) to eighteen (18) months afterwards depending on the content. For example, enquiry correspondence is normally retained for one year but complaints or responses to our satisfaction surveys will be retained for eighteen (18) months;

(c) delivery data and addressee data will be retained until delivery of the relevant items is complete (or until the sender has confirmed that the item is no longer to be delivered) and will then be deleted after three (3) months;

(d) telephone recordings will be retained for six (6) months;

(d) service data will be retained for as long as we provide or receive the relevant services, and will then be deleted after two to six years depending on the content. For example, documents recording goods received by us will be retained for two years, while invoices (whether issued to or by us) will be retained for six years;

(e) CCTV data will be deleted after 24 weeks.

5.4 We may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person, or in connection with any legal claim.

6. Data security

6.1 We have put in place appropriate security measures to prevent your personal data from being lost, used, accessed, altered or disclosed by accident or without authorisation. In addition, we limit access to your personal data to those officers, employees and contractors who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

6.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. Your rights

7.1 In this section we have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included in our summaries. You can read guidance from the Information Commissioner’ Office at www.ico.org.uk for a fuller explanation of your rights.

7.2 Your principal rights under data protection law are:

(a) the right to access: you have the right to confirmation as to whether or not we process your personal data and, where we do, to access to the personal data, together with additional information including details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee;

(b) the right to rectification: you have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed;

(c) the right to erasure: in some circumstances you have the right to the erasure of your personal data. These might include if the personal data are no longer needed for the purposes for which they were processed or if the processing is for direct marketing purposes. However, there are some exclusions of the right to erasure, such as where processing is necessary for compliance with a legal obligation or in connection with legal claims;

(d) the right to restrict processing: in some circumstances you have the right to restrict the processing of your personal data. Where processing has been restricted, we may continue to store your personal data and will observe the restrictions on processing except in the case of processing permitted by applicable law (for example, in connection with legal claims or for reasons of public interest);

(e) the right to object to processing: you have the right to object to our processing of your personal data on the basis of the legitimate interests pursued by us or by a third party. If you make such an objection, we will stop processing the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is for legal claims. You also have the right to object to our processing of your personal data for direct marketing purposes and if you do so we will stop processing your personal data for that purpose;

(f) the right to data portability: if the legal basis for our processing of your personal data is consent, or the performance of a contract with you, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others; and

(g) the right to complain to a supervisory authority: if you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

7.3 You may exercise any of your rights in relation to your personal data by written notice to us, either in writing to the address mentioned above or by email to info@rainbownightfreight.com

8. Our details

8.1 You can contact us:

(a) by post, using the postal address given above;

(b) by telephone, on the contact number published on the Site from time to time; or

(c) by email, using the email address published on the Site from time to time. If you have specific questions relating to our use or processing of personal data, then you can contact our Data Protection Controller at info@rainbownightfreight.com

9. Third Parties and Security

9.1 The Site may contain links to third party websites and may refer to third party service providers and other entities. If you follow a link to any third party website or deal with any third party entity referred to on the Site, then you should note that these third parties may have their own privacy and cookie policies, and that we are not responsible for their use of any personal data which you may provide to them. You should ensure that you have read and understood any relevant policies.

9.2 Although we do our best to ensure the security of personal data provided to us (and to use only reputable service providers), any transmission of data via the Internet is by its nature insecure and we cannot guarantee the security of any personal data you provide to us.

10. Amendments

We may update this Notice from time to time by publishing a new version on the Site. You should check occasionally to ensure you are happy with any changes to this Privacy Notice, although we may notify you of material changes to this Notice using the contact details you have given us.

Last updated: 11th May 2018

Privacy Notice