Privacy Policy

01 Purpose

Eat Crisps Ltd, known as Eat Crisps or the Company, respects your privacy and is committed to protecting your personal data. This notice explains how we process your personal data on our website and app where you are a reviewer, client, supplier of services, or a visitor to our website. It also explains your privacy rights under Data Protection Laws such as the UK Data Protection Act 2018, the UK GDPR and the EU GDPR.

02 Controller for Personal Data

A "controller" is a person or organisation who alone or jointly determines the purposes for which, and the way, any personal data is or is likely to be processed. Unless we notify you otherwise, Eat Crisps is the controller of your personal data.

03 Scope

This privacy notice applies to the processing of personal data by us where you are a:

• Reviewer — where you provide your feedback and rating on crisps.
• Client — where we provide our services to you, e.g. reports and analysis in anonymised and aggregate form.
• Supplier — for the provision of products and services to us by suppliers or service providers.
• Visitor — where you are a visitor on our website.

04 Types of personal data

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed — this is known as anonymised data, which falls outside the scope of Data Protection Laws.

Eat Crisps may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

• Identity Data — first name, last name, username or similar identifier and title.
• Contact Data — billing address, delivery address, email address and telephone numbers.
• Financial Data — bank account and payment card details from clients and suppliers, or where you take out a subscription with us.
• Transaction Data — details about payments to and from you and other details for services you have purchased from us.
• Technical Data — IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform.
• Profile Data — your username and password, searches made by you, your ratings and comments, preferences, feedback and survey responses.
• Usage Data — information about how you use our website and services.
• Marketing and Communications Data — your preferences in receiving marketing from us and third parties, and your communication preferences.

Depending on your relationship with us, we may process the categories above along with any categories specific to you — see the processing tables below for how this applies to your relationship with us.

05 Anonymised & aggregate data

Eat Crisps may anonymise personal data so that it can no longer be associated with you, for research or statistical purposes, in which case we may use this information indefinitely without further notice to you. Anonymised data falls outside the scope of Data Protection Laws because it cannot be directly associated with an individual. This also means we may take individual reviewers' feedback and ratings about crisps and generate reports using anonymised and aggregate data to help third parties, such as our clients, understand the crisps industry better.

06 Lawful bases: how we use your personal data

Eat Crisps will only use your personal data when the law allows us to. We will use your personal data in the following circumstances:

• Performance of a contract — where we need to perform a contract we are about to enter into, or have entered into, with you, for example when you sign up to our services.
• Legal obligation — where we need to comply with a legal obligation, for example for accounting or legal purposes.
• Legitimate interests — where it is necessary for our legitimate interests, or those of a third party, and your interests and fundamental rights do not override those interests.
• Consent — we do not generally rely on consent as a legal basis for processing your personal data. Where we do, you have the right to withdraw consent at any time by contacting privacy@eatcrisps.com.
• Vital interests — where necessary to protect your vital interests in case of emergencies.
• Public obligation — where we need to comply with a public obligation, for example in matters of public health.

07 How we collect your personal data

Directly from you — you give us your personal data through direct interactions with us, such as (i) filling in forms on our website, (ii) leaving ratings and comments, or (iii) corresponding with us by email, post or telephone.

Third-party sources — we receive Identity Data and Contact Data about you from third parties when other parties send us your personal data to enable the provision of services from us, or when you provide your personal data to a third party for the purpose of sharing it with us.

08 Processing tables

The tables below show our processing activities, the categories of personal data involved, and our lawful basis for processing it, broken down by your relationship with us.

Eat Crisps also gathers information and statistics collectively about visitors to our website. Analysis of this information shows the most frequently used sections of the site and helps us continually improve the service. See our Cookie Policy for more on how we set cookies.

09 Providing personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide that information when requested, we may not be able to perform the contract — for example, to provide you with our services. In this case we may have to cancel our service, but we will notify you at the time if this happens.

10 Marketing communications

Eat Crisps may send you marketing communications. You have the right to object to processing your personal data for direct marketing purposes, and can unsubscribe using the methods contained in the communications we send, or by contacting us (see Contact us below).

Where you opt out of marketing communications, this will not apply to personal data provided as a result of registering for or using our service, or your other interactions with this website.

11 How we share your personal data

We do not and will not sell any of your personal data to any third party, including your name, contact information or payment information. We may have to share your personal data with:

• Internally — our employees and contractors working on providing your services, on a need-to-know basis.
• Suppliers — service providers who support our business, including IT, communications and outsourced business support.
• Professional advisers — lawyers, bankers, auditors and insurers providing consultancy, banking, legal, insurance and accounting services.
• Payment service intermediaries — providers who help facilitate payment to us.
• Law enforcement bodies, regulators and other authorities — to comply with legal requirements or adhere to good practice.
• Advertising networks and analytics service providers — to support and display ads on our website and other social media tools.
• Third parties — in the context of the acquisition or transfer of any part of our business, or business reorganisation. Any new owners would use your data in the same way as set out in this notice.

12 International transfers for UK/EU

We may transfer and process your personal data outside of the UK/EU to countries where data protection laws are less stringent. When we do, we only transfer to entities that offer the same level of protection as the UK Data Protection Act 2018, UK GDPR and EU GDPR, either by:

1. Transferring only to countries deemed to provide an adequate level of protection; or
2. Using specific contracts approved for use in the UK or EU that give personal information the same protection it has in the UK/EU, such as Article 46 UK and EU GDPR safeguard mechanisms.

For other countries, we use local law guidance to ensure personal data is transferred securely where required. To find out more about the transfer mechanism used, contact us at privacy@eatcrisps.com.

13 Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to employees, agents, contractors and other third parties who have a business need to know, and they will only process it on our instructions, subject to a duty of confidentiality.

The transmission of information via the internet is not completely secure. Although we take reasonable measures to protect your personal data, Eat Crisps cannot guarantee the security of information transmitted, and any transmission is at your own risk.

14 Data retention

Eat Crisps will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for legal, regulatory, tax, accounting or reporting requirements. We may retain data for longer in the event of a complaint or if we reasonably believe there is a prospect of litigation.

To determine the appropriate retention period we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for processing, and applicable legal or regulatory requirements.

15 Data subject rights

Under certain circumstances you have rights under Data Protection Laws. Not all rights are absolute, and depending on where you are located, not all rights apply. You can:

• Request access to your personal data — a "data subject access request" — to receive a copy of what we hold about you.
• Request correction of any incomplete or inaccurate information we hold about you.
• Request erasure of your personal data where there is no good reason for us continuing to process it (we may not always be able to comply for specific legal reasons, and will notify you if so).
• Object to processing where we rely on legitimate interests, though we may be entitled to continue processing based on overriding legitimate grounds or legal claims.
• Request restriction of processing in specific scenarios — for example while we verify accuracy, or while a legal claim is established.
• Request transfer of your personal data ("data portability") to you or a third party in a structured, machine-readable format.
• Withdraw consent at any time, where we rely on consent as our lawful basis. This won't affect processing carried out before withdrawal, though we may not be able to provide certain services afterwards.
• Automated decision-making — we do not carry out automated decision-making about you.

16 Keeping personal information accurate and current

It's important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes, or contact us if you wish to update it.

17 Carrying out your data subject rights

You will not have to pay a fee to access your personal data or exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may need to request specific information to confirm your identity, as a security measure to ensure data isn't disclosed to anyone without the right to receive it.

We try to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex, in which case we'll notify you and keep you updated.

18 Concerns and complaints

We would appreciate the chance to deal with your concerns in the first instance — see Contact us below. If you have unresolved issues, you have the right to complain at any time to a data protection supervisory authority, such as the UK's Information Commissioner's Office (ICO). You may also lodge a complaint with a supervisory authority if you live or work outside the UK, or have a complaint concerning our processing activities.

19 Changes to our privacy notice

This privacy notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update it, and will obtain your consent to any material changes where required by applicable Data Protection Laws.

20 Contact us

If you would like more information about how we manage personal information we hold about you, please contact us at:

Email: privacy@eatcrisps.com