PRIVACY AND COOKIES POLICY

Who Are We?

We are Saddleback Limited, a distributor of cycling-related products to both businesses and consumers.

Saddleback is a company registered in England and Wales under number 04134944. Our registered office and main trading address is 12 Apollo Park, Armstrong Way, Yate, Bristol BS37 5AH. Our VAT number is GB840 3506 55. We operate the website www.saddleback.co.uk.

Our GDPR Owner and data protection representatives can be contacted directly here:

• gdpr@saddleback.co.uk
• 01454 285285

What is personal data?

Under the EU’s General Data Protection Regulation (GDPR) personal data is defined as:

“any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

How we use your information

This privacy notice tells you how we, Saddleback Ltd, will collect and use your personal data for the following purposes:

• Account registration
• My Account
• Checkout procedure
• Email newsletter sign-up
• Ambassadorship form
• Warranty form
• Crash replacement form
• Reviews
• Back in stock requests
• Emails – enquiries, complaints or other feedback
• Cookies

Personal Data We Collect

We collect your personal data through the primary touchpoints outlined below.

Please note that unless you are 16 years of age or older, we are unable to process orders – or handle your data – without explicit parental consent.

Account registration

Personal data collected:

During registration for a Saddleback account – part of the transactional process – we collect the following personal data.

• First Name
• Last Name
• Email Address

Please note, we do not have access to the password you enter here.

Where this data is stored:

Your data is stored through Shopify’s data storage, databases and the general Shopify application. Your data is secured using SSL Encryption on a secure server behind a firewall.

Your data will also be accessible through our secure, GDPR-compliant email platform, Klaviyo – but won't be used for marketing purposes unless you opt-in to our Saddleback Riders' Club newsletter either by signing up to our mailing list or by ticking the box to join the Saddleback Riders' Club during registration.

What we use this data for:

This data is used to process the registration of your online account, maintain your online account, identify you as a customer when you place orders with us and process and complete orders you place via the site.

It is also the address that draft orders will be sent to, should a member of the customer services team create one for you.

We also use this data to process and deal with any complaints or enquiries made by you.

This information is also used to send you abandoned checkout emails, which we believe to be of legitimate interest to you based on the contents of your cart when you began checkout.

We also use this information for post-purchase customer services including enquiries regarding the service you have recieved from us and product review requests.

How long this data is kept:

We will keep your name and email address on file along with your order history until you opt-out so that we can offer post-purchase services including warranty and crash replacement on items you have purchased. If you choose to remove this personal data, we may be unable to meet your post-purchase support requirements.

If you have any queries regarding the length of time specific data will be retained, please email gdpr@saddleback.co.uk.

How to opt out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

 

My Account Area

Personal data collected:

In the ‘My Account’ area, you have the option of adding addresses to your account. You can also view your order history here.

• Addresses

Where this data is stored:

Your data is stored through Shopify’s data storage, databases and the general Shopify application. Your data is secured using SSL Encryption on a secure server behind a firewall.

What we use this data for:

This data is used to make checkout quicker by pre-populating address fields when you place orders with us, maintain your online account and process and complete orders you place via the site.

How long this data is kept:

We will keep your name and email address on file along with your order history until you opt-out so that we can offer post-purchase services including warranty and crash replacement on items you have purchased. If you choose to remove this personal data, we may be unable to meet your post-purchase support requirements.

How to opt out:

You can simply remove addresses as you wish from the ‘My Account’ area.

Checkout

Personal data collected:

During the checkout process, we collect the following personal information which is stored securely in our Shopify system.

• First name
• Last name
• Billing address
• Shipping address
• Phone number

Where this data is stored:

Your data is stored through Shopify’s data storage, databases and the general Shopify application. Your data is secured using SSL Encryption on a secure server behind a firewall.

Your name and address data is also passed to a secure third-party, GDPR-compliant shipping integration system called Zenstores which allows us to send your items to you.

What we use this data for:

This data is used to complete orders you place via the site including processing your order, sending your items to you, keeping you updated via email and or telephone on the status of your order and dealing with any customer service issues during and after the purchase cycle.

How long this data is kept:

Saddleback Ltd is required to retain some information in accordance with the law, such as information needed for income tax and audit purposes.

In the case of accounting, we are obliged to retain invoices for six years.

How to opt out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Checkout – Payments

Saddleback Ltd does not hold any bank or card details. During checkout, you provide payment either using a debit or credit card using Shopify’s PCI-DDS-compliant secure online payment gateway, powered by Stripe, or via PayPal.

Personal data collected:

• Payment information

Where this data is stored:

If you choose a direct payment gateway to complete your purchase, then Shopify stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS).

All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover.

PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers. For more insight, you may also want to read Shopify’s Terms of Service (https://www.shopify.com/legal/terms) or Privacy Statement (https://www.shopify.com/legal/privacy).

How long this data is kept:

Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted.

How to opt-out:

As your purchase transaction data is deleted following the completion of your purchase, opt-out is unnecessary. If you have any queries, please email gdpr@saddleback.co.uk.

V12 Finance

When an application for finance is made, you will temporarily leave our site to make your credit application with V12 Finance, at which point V12 Finance becomes the data processor for any personal information relating to your finance application.

What personal information transfers from Saddleback to V12 Finance?

• Title

• Name

• Last name

• Home address

Additional information collected by V12 Finance:

• Nationality

• DOB

• Time at address

• 3 years of address history

• Employment information

• Sort code

• Bank account number

V12 Finance Privacy Declaration:

"We will never sell or pass on the customer’s details for marketing purposes, however we would like to make them aware of our products and services or those from carefully selected third parties such as lenders and brokers which we think they may be interested in. Finally the customer will need to choose if they would like their statements to be sent to them electronically rather than by post, which can be done by selecting that they wish to go paperless."

 

Saddleback Riders' Club email newsletter sign-up

Registration for the free Saddleback Riders' Club newsletter is available either through forms found on the website (www.saddleback.co.uk/pages/riders-club) or by ticking the Join the Saddleback Riders' Club checkbox during registration.

Personal data collected:

• Email address
• First name
• Last name

Where this data is stored:

This data is stored securely in an encrypted third-party service provided by our email system, Klaviyo.

What we use this data for:

We will use this data to add you to our Saddleback Riders' Club newsletter list. Our newsletter contains a variety of content including exclusive offers and is sent to you approximately once a week. Signing up for the Riders' Club also makes your profile eligiable for loyalty reward emails when you shop with us.

How long we keep this data:

Your details will be maintained on our email list until you opt-out.

How to opt-out:

You can update your preferences or unsubscribe using the links at the bottom of every email.

Ambassadors form

Our ambassadorship form – www.saddleback.co.uk/pages/become-an-ambassador – collects several pieces of personal data in order to ascertain your suitability to become an ambassador for Saddleback and our brands.

Personal data collected:

• First name
• Last name
• Age
• Gender
• Location
• Email address
• Phone number
• Social media profiles

Where this data is stored:

This data is stored securely in an encrypted third-party service provided by our forms system, Cognito Forms.

What we use this data for:

We use this data to ascertain your suitability to become an ambassador for Saddleback and our brands. We also use it to contact you in the event that we would like to progress your ambassadorship application.

How long we keep this data:

Personal data from unsuccessful applicants will be deleted on a 60-day cycle.

How to opt-out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Warranty processing

Our warranty processes require some personal data in order to process a warranty request.

Personal data collected:

• First name
• Last name
• Email address
• Phone number

Where this data is stored:

This information is stored on a Microsoft secure-by-design, GDPR-compliant email server equipped with two-step authentication for additional security.

It may also be transferred to our secure ERP system in order to complete warranty processes.

What we use this data for:

We use this data to begin the procedure for processing warranty cases. Using this essential information, our warranty and customer service teams can contact you in a timely manner to update you on the status of your request and facilitate the return and replacement of items purchased from us.

How long we keep this data:

We will keep your information on file for the life of the product warranty or until you opt-out so that we can offer post-purchase services including warranty and crash replacement on items you have purchased. If you choose to remove this personal data, we may be unable to meet your post-purchase support requirements.

How to opt-out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Crash replacement

In order to process crash replacement requests, it is necessary to collect some personal information.

Personal data collected:

• First name
• Last name
• Email address
• Phone number

Where this data is stored:

This information is stored on a Microsoft secure-by-design, GDPR-compliant email server equipped with two-step authentication for additional security.

It may also be transferred to our secure ERP system in order to complete warranty processes.

What we use this data for:

We use this data to process crash-replacement orders. Once we have ascertained your eligibility for a crash-replacement product, we then use this data to marry up with your Saddleback account so we can email you a draft order invoice for your items at special crash replacement pricing.

How long we keep this data:

We will keep your name and email address on file along with your order history until you opt-out so that we can offer post-purchase services including warranty and crash replacement on items you have purchased. If you choose to remove this personal data, we may be unable to meet your post-purchase support requirements.

How to opt-out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Reviews

We use a third-party reviews system, Yotpo, which allows you to leave a review for products you’ve purchased from us. You will find the reviews form under the ‘Reviews’ tab on each product page.

Personal data collected:

• Name
• Email address

Where this data is stored:

This data is stored securely in an encrypted third-party service provided by our reviews system, Yotpo.

What we use this data for:

This data is used to verify your purchase of the product you’re reviewing and to publish the review on our website. The name under which the review appears can be anonymised at your discretion. The review itself may also be used for marketing purposes. Your email address is not visible alongside your review.

How long we keep this data:

This data will be kept as long as the review is visible on the website.

How to opt-out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Back in stock emails

When items are out of stock, you have the option of signing up to be notified when the product is available to purchase.

Personal data collected:

• Email address

Where this data is stored:

This data is stored securely in an encrypted, GDPR-compliant third-party service provided by our email system, Klaviyo.

What we use this data for:

We will use this data to send you a one-off email alerting you to stock of your selected product becoming available to purchase.

How long we keep this data:

Your details will be maintained on our email list until you opt-out.

How to opt-out:

You can update your preferences or unsubscribe using the links at the bottom of each stock alert email. Please note that opting out of one email alert with opt out of other pending alerts.

Live Chat

We use a third-party live chat system from Live Chat, which allows you to ask questions and make the most of our product knowledge prior to purchase. You will find the Live Chat functionality hovering at the bottom right-hand side of the browser window.

Personal data collected:

• Name
• Email address

 

Other data collected while using live chat:

• Approximate location
• IP address
• Pages you've visited on the website
• Technology information including device and browser version

 

Where this data is stored:

This data is stored securely in an encrypted third-party service provided by our Live Chat system.

What we use this data for:

This data is used to provide you with the best possible live-chat experience, help with any troubleshooting issues while browsing the site and to follow up with you via email following live chat should you ask us to contact you with additional information. By using Live Chat, your email address will not be added to any marketing email lists or shared with anyone else.

How long we keep this data:

This data will be kept on our secure system in order to help you with ongoing pre- and post-purchase enquiries.

How to opt-out:

If you wish us to remove your data from our systems, please contact gdpr@saddleback.co.uk and we will be happy to help.

Privacy Consent

By consenting to this privacy notice you are giving us permission to process your personal data specifically for the purposes identified.

Consent is required for Saddleback Ltd to process both types of personal data, but it must be explicitly given. Where we are asking you for sensitive personal data we will always tell you why and how the information will be used.

You may withdraw consent at any time by contacting gdpr@saddleback.co.uk. We will facilitate your request in line with our opt-out procedures.

Data Controllers and Data Processors

When using and buying from our site, Saddleback Ltd is the data controller – we collect the data from our customers.

We also use third party data processors, who process personal data on our behalf. For example, through using a Shopify system, Shopify is a data processor.

We only use data processors to fulfil our services to our customers and never share third data with third parties for marketing purposes without your explicit consent. Wherever we use data processors, each processor is required to be GDPR compliant to safeguard your personal data.

Disclosure

We may pass on your data to third parties in order to complete our services with you. We never pass your data to third parties for marketing or other purposes.

We may pass on information containing your data to other parties as follows:

• To our sub-contractors and data processors to administer your online account and orders and other parts of the services

• To the police, regulatory bodies or legal advisers in connection with any alleged criminal offence or where required by law

Where your information is shared, it remains protected under GDPR.

Retention periods

Saddleback Ltd is required to retain some information in accordance with the law, such as information needed for income tax and audit purposes.

How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices.

We will process your personal data for as long as is necessary to process your orders and provide you with customer service support in relation to your orders.

Location of data

Your data may be held or accessed by Saddleback Ltd in the UK in the course of providing the site and services to you. We also use third party providers in order to fulfil the purposes of our services to you who may be located in countries in Europe, Canada or in the US.

In terms of any such transfers, we ensure that your data is transferred with relevant and appropriate contractual and other safeguards in place to ensure that it is kept secure and remains protected by GDPR. You consent to this transfer of your data on these terms.

Other links

Please be aware that the site may link to other web sites that may be accessed by you through our site. We are not responsible for the data policies, content or security of these linked web sites. We do not have any control over the use to which third parties may put your data where you choose to purchase products or services or otherwise to contact them via this site.

Your rights as a data subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: in the event that Saddleback Ltd refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined below.

All of the above requests will be forwarded on should there be a third party involved (as disclosed as per the ‘Disclosure’ section above) in the processing of your personal data.

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Saddleback Ltd, or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and Saddleback Ltd’s data protection representatives Data Protection Officer / GDPR Owner.

Contact details of the Data Protection Officer / GDPR Owner:

John Wager
Saddleback Ltd
Unit 12 Apollo Park
Armstrong Way
Yate
BS37 5AH

gdpr@saddleback.co.uk

01454 285285

Privacy FAQs

Why does Saddleback Ltd need to collect and store personal data?

In order for us to provide you with our ecommerce service s we need to collect personal data for correspondence and to complete transactions. In any event, we are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.

We do not use your personal details to contact you for marketing purposes unless you opt-in to our email newsletter, a process requiring your explicit consent.

Will Saddleback Ltd share my personal data with anyone else?

We may pass your personal data on to third-party service providers contracted to Saddleback Ltd in the course of dealing with you. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only to deliver our ecommerce services to you.

When they no longer need your data to fulfil this service, they will dispose of the details in line with Saddleback Ltd’s procedures. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your consent, unless we are legally required to do otherwise.

How will Saddleback Ltd use the personal data it collects about me?

Saddleback Ltd will process (collect, store and use) the information you provide in a manner compatible with the EU’s General Data Protection Regulation (GDPR). We will endeavour to keep your information accurate and up to date, and not keep it for longer than is necessary. Saddleback Ltd is required to retain information in accordance with the law, such as information needed for income tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices. Personal data may be held in addition to these periods depending on individual business needs.

Under what circumstances will Saddleback Ltd contact me?

Our aim is not to be intrusive, and we undertake not to ask irrelevant or unnecessary questions. Moreover, the information you provide will be subject to rigorous measures and procedures to minimise the risk of unauthorised access or disclosure.

Can I find out the personal data that the organisation holds about me?

At your request, Saddleback Ltd can confirm what information we hold about you and how it is processed. If Saddleback Ltd does hold personal data about you, you can request the following information:

• Identity and the contact details of the person or organisation that has determined how and why to process your data. In some cases, this will be a representative in the EU.
• Contact details of the data protection officer, where applicable.
• The purpose of the processing as well as the legal basis for processing.
• If the processing is based on the legitimate interests of Saddleback Ltd or a third party, information about those interests.
• The categories of personal data collected, stored and processed.
• Recipient(s) or categories of recipients that the data is/will be disclosed to.
• If we intend to transfer the personal data to a third country or international organisation, information about how we ensure this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure there are specific measures in place to secure your information.
• How long the data will be stored.
• Details of your rights to correct, erase, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the supervisory authority.
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

What forms of ID will I need to provide in order to access this?

Saddleback Ltd accepts the following forms of ID when information on your personal data is requested:

Passport, driving licence, utility bill / bank statement no older than three months.