DD: your privacy

   Using your personal information

We will only use your personal information when the law allows us to.

Most commonly, we will use your personal information in the following circumstances:

• where we need to perform the contract we are about to
  enter into or have entered into with you
• where it is necessary for our legitimate interests(or those of a third party) and your interests and fundamental rights do not override those interests, and
• where we need to comply with a legal or regulatory obligation.

We will provide details of what basis we are relying upon in the relevant Privacy Notice for that activity.

   Social Media

We love social media and chatting with you there, whether it be on Facebook, Twitter, LinkedIn and Instagram:

www.facebook.com/ddgroupuk
www.twitter.com/dd_group_uk
www.linkedin.com/company/ddgroupuk/
www.instagram.com/dd_group_uk

Don’t forget, however, that everybody can see everything you do there (our sites are public) so if you want us to keep your information private, please don’t put anything on these sites which you or your loved ones would like to keep private, whether now or in the future.

If you use certain social media features from within our website or connect with us on our social media webpages, the privacy policies of those companies will apply. Please read them carefully before you share your information with us and others as these companies may have different standards of protection of information than we do.

   Failing to give us your personal information

Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our products and services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

   Changing why we use your personal information

We won’t do this.

We will only use your personal information for thepurposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose or where we are required to by law.

   Sharing your personal information

We don’t generally share your Personal Information with third parties unless:

• we are required to do so by law or another regulatory body, or where we deem it necessary for legal or safety purposes. it is with other entities in the DD group.
• it is with suppliers who provide processing services to us under contract that complies with the law.
• professional advisers including lawyers, bankers, auditors and insurers based who provide consultancy, banking, legal, insurance and accounting services.
• we have another legitimate reason for doing so.

If we do this, we require these third parties to respect the security of your personal information and to treat it in accordance with the law.

We will, where necessary, share your personal information with other third parties, for example in the context of the possible sale or restructuring of the
business.

   The security of your debit or credit card

When you pay us using your debit or credit card you rightly expect the highest levels of security for your card details. This is why we comply with PCI DSS.
(For more details on this, go to: What is PCI DSS?)

This is a worldwide payment card industry data security standard that helps us process your card payments securely and protect you against the misuse of your card information.

   Transferring your personal information outside of the EEA

It may be necessary to transfer your personal information outside of the EEA in order for us to make use of service providers based in global jurisdictions. If we undertake such transfer, we will always do so in compliance with the law in a manner that protects the security of your personal information.

   Securing and protecting your personal information

Your personal information deserves the greatest protection and security. This is why we have put in place appropriate security measures to prevent it from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality to us.

We have put in place appropriate procedures to deal with any suspected security breach which involves personal information and we will let you and any applicable regulator know of a breach where we are legally required to do so.

   Keeping your personal information for as long as necessary

We will only keep your personal information for as long as necessary to fulfil the purposes we collected it unless we need to keep it for other purposes including for satisfying any legal, accounting, or reporting requirements.

To work out the appropriate retention period for personal
information, we consider:

• the amount, nature, and sensitivity of the personal
  information
• the potential risk of harm from unauthorised use or
  disclosure of your personal information;
• the purposes for which we process your personal
  information and whether we can achieve those
  purposes through other means, and the applicable
  legal requirements.

Each Privacy Notice will set out what the retention period is for the personal information that it deals with.

In some circumstances we may anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

   Keeping your personal information up to date

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information changes by e-mailing gdpr@ddgroup.com or updating any account you hold with us when your personal
information changes.

   Exercising your legal rights

Under certain circumstances, by law you have the right
to:

• access to your personal information (commonly known as a ‘subject access request’). This means you can receive a copy of the personal information we hold about you and check that we are processing it properly
• the correction of the personal information that we hold about you. This means you can correct any incomplete or inaccurate information we hold about you
• the erasure of your personal information. This means you can ask us to delete or remove personal information where there is no good reason for us continuing to process it
• the restriction of processing of your personal information. This means you can ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it; and
• the transfer of your personal information to another
  party.

If you want to do any of these things please contact the relevant person on the Privacy Notice that your issue relates to or contact our DPO at gdpr@ddgroup.com.

In almost all circumstances you do not have to pay a fee to access your personal information (or to exercise any of the other rights).

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

   Dealing with cookies

Not all cookies are bad! Most websites you visit, such as the DD site, use cookies to improve how the website works by letting that website ‘remember’ you, either for the duration of your visit (using a ‘session cookie’) or for repeat visits (using a ‘persistent cookie’).