Privacy & Cookies Policy

Criterium Cycle Company Limited (“Criterium Cycles”) is committed to respecting and protecting your privacy and complying with Data Protection Legislation including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

This Privacy & Cookies Policy describes the personal data about you that we process and the legal basis for processing. It also describes your rights as a data subject.

We may need to update this Privacy & Cookies Policy from time to time so it’s always a good idea to review it from time to time.

“Criterium Cycles” (and “we”, “us”, or “our”) refers to Criterium Cycle Company Limited (registered in Scotland with company number SC439426) and with its registered office at Unit 3, Dobbies Garden World, Melville Nurseries, Lasswade, Midlothian, EH18 1AZ.

Criterium Cycles is the controller of all personal data processed about you during the provision of our services to you.

We obtain your personal data whenever you:

• speak to us in person;
• fill in forms on our website https://www.criteriumcycles.co.uk;
• correspond with us by telephone, by email, by letter or by any other means.

We process the following personal data about you:

• Title
• First name
• Last name
• Date of Birth
• Home address
• Home telephone number
• Email address
• Marital status
• Height
• Weight
• Gender
• Financial details, such as details about your bank account;
• Any information about your purchase, and subsequent use, of our products and services.

If you visit our website https://www.criteriumcycles.co.uk we collect information about your computer:

• IP address (where available);
• Geographic location (if you allow this when prompted by your browser)
• Operating system;
• Browser type;
• to enable our systems to recognise your device and to provide features to you, we use cookies.

For more information about cookies and how we use them, please read our Cookie Policy below.

If you receive emails from us and interact with them we collect:

• Time you received the email;
• Time you opened the email;
• Device you used to open the email;
• Geographical location when you opened the email;
• Which parts of the email you interacted with.

If you use social media accounts which are registered using the same email address you have provided to us elsewhere, our systems enable us to link your social media accounts to our systems and so we will process:

• Links to any social media accounts that you use.

Purpose of processing

We process your personal data solely to provide you with the services you have requested.

Legal basis for processing

We process your personal data solely to provide you with the services you have requested.

The legal basis for processing your personal data is that it is necessary for the performance of our contract with you.

We also process your personal information for a number of legitimate interests, including managing all aspects of our relationship with you, for marketing including sending you further information about our products and services that may be relevant to you, to help us improve our services and products, and to exercise our rights or handle warranty or insurance claims.

Taking into account your interests, rights and freedoms, legitimate interests which allow us to process your personal data include:

• to manage our relationship with you, our business and third parties who provide services for us;
• to keep our records up to date and to provide you with marketing as allowed by law;
• for statistical research and analysis so that we can monitor and improve products, services, websites and apps, or develop new ones;
• to monitor how well we are meeting our service & performance expectations through customer feedback surveys;
• to enforce or apply our website terms of use, our policy terms and conditions or other contracts, or to protect our (or our customers’ or other people’s) rights, property or safety;
• to exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with.

We will share your personal data with:

• Any organisation paying for the services we provide to you, including inter alia insurers, finance providers and cycle to work scheme providers;
• Other organisations you belong to, or are professionally associated with, to confirm your entitlement to claim discounts on our services;
• people or organisations we have to, or are allowed to, share your personal information with by law;
• the police and other law-enforcement agencies to help them perform their duties, or with others if we have to do this by law or under a court order;
• other third parties we work with to provide our services, such as agents working on our behalf, insurers, actuaries, auditors, solicitors, translators and interpreters, tax advisers, debt-collection agencies, credit-reference agencies, fraud- detection agencies, regulators and data-protection supervisory authorities.

Criterium Cycles contracts with a small number of external organisations who are categorised as Data Controllers in their own right. Data protection legislation obliges us to define precisely what such organisations are expected to do in a legally binding contract. An important part of these contracts is that it obliges our service providers to be as equally committed to the care and privacy of your personal data as we are.

We only work with organisations that comply with data protection legislation and these organisations are audited to ensure compliance. The following categories of controllers are used by Criterium Cycles although we reserve the right, at our absolute discretion, to amend this list from time to time:

Finance providers – We are authorised by the FCA to act as a secondary credit broker and may therefore introduce customers to third party finance providers from time to time.

Cycle to work – We work with a number of providers of Cycle to Work schemes under the Government scheme of the same name.

We contract with a small number of external organisations who are categorised as Data Processors and who provide us with specialist services. Data protection legislation obliges us to define precisely what such organisations are expected to do in a legally binding contract. These contracts oblige our service providers to be as committed to the care and privacy of your personal data as we are.

We only work with organisations that confirm to us that they comply with data protection legislation. The following categories of processors are currently used by Criterium Cycles although we reserve the right, at our absolute discretion, to amend this list from time to time:

Suppliers of cycle equipment and services – we work with a wide range of cycle equipment and service providers who also provide long term warranty, technical and service support for the products you purchase from Criterium Cycles.

HR Specialists – From time to time we use recruitment specialists to help us hire our team members.

IT Service Providers – We employ third party service providers to help manage our IT infrastructure and services. These companies sometimes have administrator access to our systems to enable their continuous and effective operation. We have contracts in place with them and can revoke their access if required.

Marketing Agencies – We utilise a number of third party specialist providers (often by means of license) to help manage our marketing activity. These include email marketing providers, customer feedback services, social media specialists and CRM system providers.

EPOS & Finance System providers – We utilise third party providers of point of sale, inventory, accounting and bookkeeping software systems and services to help manage our financial records and accounts including our EPOS systems.

We do not perform any profiling based on personal data that has a legal or significant effect.

We do not perform any automated decision-making involving personal data.

We will neither transfer nor process personal data outside the United Kingdom, nor will we permit personal data to be transferred or processed outside the United Kingdom, unless it is under one or more of the following conditions:

• the territory into which the data are being transferred is one approved by the UK’s Information Commissioner;
• the territory into which the data are being transferred is within the European Economic Area;
• the territory into which the data are being transferred has an adequacy decision issued by the European Commission;
• the transfer is made under the unaltered terms of the standard contractual clauses issued by the European Commission for such purposes;
• the transfer is made under the provision of binding corporate rules which have been approved and certified by the European Commission;
• the transfer is made in accordance with one of the exceptions set out in Data Protection Legislation.

We can only use your personal data to send you marketing material if we have your consent or a legitimate interest as described above.

If you consent (opt-in) to receiving marketing materials from us, you can remove that consent (opt-out) at any time by either, clicking on the ‘unsubscribe’ link that appears in all marketing emails we send. If you don’t want to receive texts from us you can tell us by contacting us at any time. Otherwise, you can always contact us to update your contact preferences.

If you wish to exercise any of your rights concerning your personal data, you should contact us at the following address:

Address Criterium Cycle Company Limited, Unit 3, Dobbies Garden World, Melville Nurseries, Lasswade, Midlothian, EH18 1AZ

Tel 0131 663 6220

Email [email protected]

If you are not satisfied with the response you receive within a reasonable timeframe you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is:

Information Commissioner’s Office – Wycliffe House, Water Lane Wilmslow Cheshire SK9 5AF

• (t) 0303 123 1113
• (e) [email protected]