Privacy Notice

Who we are

Palace Cycles is a family-run business selling bikes, parts and related products both from our shop in Carlisle and online. We also offer a servicing and repairs service and occasionally run workshops in bike maintenance.

This privacy notice is to let you know how we promise to look after your personal data. It explains how we do this and tells you about your privacy rights and how the law protects you.

Palace Cycles is based at 120-124 Botchergate, Carlisle CA1 1SH.

Phone number: 01228 523142, email: sales@palacecycles

You can find out more about us at https://palacecycles.co.uk

If you have any questions or want more details about how we use your personal data, please let us know.

Where Palace Cycles determines the work we want to do, we are the data controller (as defined by the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA)

When we are contracted to do work for another organisation we are the data processor for that organisation, for example the operation of cycle to work schemes.

Information about you

When you use our products, services and facilities we may collect your personal information:

• When you make a purchase or otherwise use our services
• Through emails, letters, phone calls or face to face with our staff

We are given information about you from third parties we work with including:

• Cycle to work schemes
• Giant Bikes – where customers order through their website and pick their bikes up from us

Why we collect information about you

If anyone can be identified by any information that we collect, this information is called ‘personal data’. Data protection law says that Palace Cycles must have a reason or ‘purpose’ for collecting and using personal data.

Our purposes are to:

• Deliver our services
• Manage our relationship with you
• Develop new ways to meet our customers’ needs
• Improve our services
• Keep internal records
• Provide you with further information about our products and services by email

How we ensure that the processing we do is lawful

Palace Cycles cannot use your personal data for any reason unless we have a lawful basis to do so. We use one or more lawful bases for each of our purposes.

Deliver our services:

• We have or soon will have a contract with you
• We have a legal obligation

Manage our relationship with you:

• We have a legitimate interest in using your information. This information allows us to process queries effectively. We may use feedback given to us.

Develop new ways to meet our customers’ needs:

• We have a legitimate interest in using your information. We may use feeedback given to us.

Improve our service delivery:

• We have a legitimate interest in using your information

Keep internal records:

• We have a legal obligation

Provide you with further information about our products and services by email:

• We have a legitimate interest in using your information. We believe that this information is of benefit both to us and to people with whom we have an existing relationship.

We will always explain what our legitimate interests are and will do so in detail when we collect the information if it isn’t covered above.

Special Category Personal Data

Special category data is personal data which the UK GDPR says is more sensitive, and so needs more protection. It is likely to be (but is not limited to) information about any disability a customer may have.

You may choose to give us special category personal data about yourself if you are asking us to recommend a bike for you, or would like us to alter a bike to suit you.

The lawful basis that we use for processing this kind of information is your explicit consent.

How Long Do We Keep Your Information?

Details of financial transactions are kept for six years following the financial year in which the transaction took place.

If we have any other legal obligation to keep your personal data for a specific length of time, for example if your bike is warrantied by the manufacturer, we will tell you when you purchase it.

Maintenance and repair records for any bike purchased from us will be kept for as long as we are aware that you still own the bike.

If we have a contract with another organisation we keep the personal data specific to that contract for as long as it tells us to. Again, we will tell you when it is collected.

Who Do We Share Your Personal Information With?

When we share your personal data with third parties who perform services for us, we require them to take appropriate steps to protect your personal information, and only to use the personal information for the purpose of performing those specific services.

We currently use

Name of company	The service they perform for us
123-reg / Ecomail	IT hosting and maintenance
Lightspeed Retail	Online shop
Benson Accountants, Wigton	Accountants
HSBC	Banking
BT	Phone provider
Apple	Email provider
Giant Bicycles, Trek, Bianchi, Frog Bikes, Upgrade UK, Madison Distribution *	Provision of warranties
Facebook, Instagram*	Social media platform
Lightspeed Payments, Global Payments, PayPal*	Payment platform

*These businesses are data controllers in their own right and don’t use your information in the same way that we do, so we recommend that you read their privacy notices.

We will never sell or distribute your personal information to any other third parties or make it public unless we have a legal obligation to do so.

Transferring personal data outside the EU

Where we transfer your personal data outside the UK we have procedures in place to make sure that these restricted transfers are made lawfully. To do this we use a standard contractual clause that is approved by the Information Commissioner’s Office.

Links to other websites

Our website may contain links to other websites of interest. We do not have any control over these websites and cannot be responsible for the protection and privacy of any information which you provide whilst visiting these sites because they are not governed by our privacy notice and policies. You should exercise caution and look at the privacy statement applicable to the website in question.

Your Rights

You have rights in relation to the personal information we hold about you. These are:

• The right to be informed about the collection and use of your personal data. We do this by providing you with this privacy notice and other, more targeted privacy notices when we collect the information.
• The right of access. This is commonly referred to as ‘subject access’. You have the right to make a request to see all the personal data that Palace Cycles holds about you. You can make this request verbally or in writing and we must respond within one calendar month.
• The right to rectification. If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address and we will promptly record your request and amend our records if required.
• The right to erasure. This is also known as ‘the right to be forgotten’. You can make this request verbally or in writing. This right only applies in certain circumstances.
• The right to restrict processing. This right only applies in certain circumstances. If we agree to restrict your personal data we will store it but not use it.
• The right to data portability. This allows you to obtain and re-use your personal data for your own purposes across different services. If you would like us to transfer your personal data electronically, we will do this. It only applies to information you have given us and where Palace Cycles is the data controller.
• The right to object. You have the right to object to the processing of your personal data in certain circumstances. You can make an objection verbally or in writing. You have the absolute right to stop your personal data being used for direct marketing and where we use legitimate interests as the lawful basis for processing you have the right to stop us using your personal information for this purpose.
• Rights in relation to automated decision making and profiling. Palace Cycles does not use any of your personal data to make automated decisions or to create a profile of you.

When we are contracted to do work for another organisation

When Palace Cycles acts under instruction from another organisation we are the data processor and the other organisation the data controller. There will be a contract in place which will tell us what to do with your information. If any of your personal data is being used for a purpose that is not controlled by Palace Cycles, you will be given a different privacy notice which will tell you all about it.

Your rights are unlikely to be affected if your information is used in this way.

How to complain

If you are unhappy about the way we handle your personal data please let us know verbally or in writing by contacting us using the details given above.

We will explain how we have processed your personal information and if we have made a mistake will put this right.

If you are still dissatisfied, you may report your concern to the Information Commissioner’s Office (ICO) by contacting:

Wycliffe House, Water Lane, Wilmslow SK9 5AF

Tel. 0303 123 1113

or go online to www.ico.org.uk/concerns