Last Updated: March 2019
This website is not intended for children and we do not knowingly collect data relating to children.
1.2. We are a veterinary healthcare online platform based at 28 Hornbeam House, Maitland Park Villas, London, NW3 2EJ and can be contacted on +44 7422 942065 or firstname.lastname@example.org.
1.3. Our Data Protection Officer, Thom Jenkins, can be contacted at 28 Hornbeam House, Maitland Park Villas, London, NW3 2EJ, +44 7422 942065 or email@example.com.
1.4. We will always comply (and be able to demonstrate our compliance) with relevant data protection legislation, including the Data Protection Act 2018 (“DPA”) and General Data Protection Regulation (“GDPR”) as applicable, when processing your personal data. Further details on the DPA and GDPR can be found at the Information Commissioner’s Office website (www.ico.gov.uk). For the purposes of data protection legislation, we will be the “controller” or “data controller” of all personal data held in respect of this Policy
2. Data Processing
2.1. In this Policy we use certain terms from the relevant data protection legislation;
(a) “data subject” i.e. anyone who can be identified from personal data;
(b) “controller/data controller” i.e. a business which holds personal data and decides how it should be processed;
(c) “processor/data processor” i.e. a business which holds personal data on behalf of a controller and processes it in accordance with the controller’s instructions;
(d) “personal data” i.e. recorded information we hold about you from which you can be identified. It may include contact details, user IDs and passwords, online identifiers, photographs, other personal information, device information, expressions of opinion about you or indications as to our intentions about you;
(e) “special categories of personal data” i.e. personal data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life or sexual orientation;
(f) “processing” i.e. doing anything with personal data including collecting, using, storing, accessing, disclosing and destroying it.
2.2. We will process your personal data in accordance with the following principles:
(a) all personal data must be processed lawfully, fairly and in a transparent manner;
(b) all personal data must be collected for one or more specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes;
(c) all personal data shall be restricted to what is adequate, relevant and limited for those purposes;
(d) all personal data shall be kept accurate and up to date (and reasonable steps must be taken to erase or rectify inaccurate personal data);
(e) all personal data must be kept for no longer than is necessary for those purposes;
(f) all personal data must be protected by appropriate technical and organisational security measures to prevent unauthorised or unlawful processing and accidental loss, destruction or damage.
2.3. We may collect, use and store your personal data, as described in this Policy, where necessary in order to:
(a) perform any contract to which you are party or in order to take steps at your request prior to entering into a contract e.g. providing you with information about our business;
(b) exercise our legitimate business interests e.g. providing services to your business, issuing invoices, sending you updates and promotional information;
(c) carry out other functions with your specific consent;
(d) comply with our legal obligations e.g. combating money-laundering, fraud, crime.
CHANGE OF PURPOSE
2.4. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
2.5. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
2.6. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
2.7. We will use your personal data in order to provide you with the best possible customer service, and to keep you updated about our other services and products. You may amend your subscription settings at any time by contacting us at firstname.lastname@example.org or by clicking on the “unsubscribe” link on any email you receive from us.
2.8. We will only process your personal data to the extent that it is necessary for the purposes specified in this Policy and we will keep the personal data we store about you accurate and up to date. Where it is inaccurate or out of date, it will be destroyed - please let us know if your personal details change or if you become aware of any inaccuracies in the personal data we hold about you.
2.9. We will not keep your personal data for longer than is necessary for the purposes specified in this Policy. Where it is no longer required, it will be pseudonymised, anonymised, destroyed or erased as appropriate.
2.10. We will never sell your personal data or make it available to any third parties without your prior consent (which you are free to withhold) except where:
(a) we use a processor, in which case we will ensure that the processor complies with this Policy and all relevant data protection legislation;
(b) we are required to do so by law;
(c) we seek investment or sell any part of our business or assets (in which case we may disclose your personal data confidentially to the prospective investor/buyer as appropriate in accordance with our legitimate interests).
2.11. We have implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction. We will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.
2.12. We reserve the right to amend this Policy from time to time without prior notice. You are advised to check the Site regularly for any amendments (but NB amendments will not be made retrospectively).
2.13. We will only transfer personal data outside the UK or EEA subject to appropriate safeguards. These safeguards will usually consist of standard data protection clauses which we will adopt and implement with the relevant data processor or third party service provider; we will inform you in advance if other safeguards are to apply.
2.14. We sometimes collect information on behalf of our customers, following their instructions and with no direct relationship with the individuals whose personal data we process. In such cases, it is our customer who is “controller” and decides the reasons for which the personal data will be processed, and we will be acting as “processor”.
IF YOU FAIL TO PROVIDE PERSONAL DATA
2.15. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
3. What information do we collect and why?
3.1. We will only collect personal data to the extent that it is required for the specific purpose made clear to you at the time. We will only process personal data in accordance with relevant data protection legislation.
3.2. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
(a) apply for our products or services;
(b) create an account on our Site or Apps;
(c) subscribe to our service or publications;
(d) request marketing to be sent to you;
(e) enter a competition, promotion or survey; or
(f) give us feedback or contact us.
3.3. If you contact us, we will keep a record of that contact including your contact details and any relevant account information.
Automated technologies or interaction
3.4. In addition to your access details, we will log details of your interactions with us including transactions you carry out through the Site and the Apps.
3.6. Our server logs requests for Site and App content. By analysing this information, we can identify which parts of the Site and Apps are popular and which are not, helping us to improve the Site and Apps. The Site and Apps use these log files to compile non-personal statistical information about matters such as length of stay on the Site or Apps, type of pages visited and other general information. This information is entirely anonymous: we want to know how people in general are using the Site or Apps, not what you in particular are doing on the Site or Apps.
Third parties or publicly available sources.
3.7. We will receive personal data about you from various third parties and public sources as set out below:
(b) Google; and
(c) Royal College of Veterinary Surgeons (RCVS) register (applicable to vets only).
3.8. We will hold your personal data on our systems for as long as:
(a) your account remains valid; and/or
(b) any contracts you make with us or with the vets on Gula are live; and/or
(c) is necessary to comply with our legitimate business interests; and/or
(d) is necessary to comply with our legal obligations; and/or
(e) you have indicated you are happy for us to do so
3.9. We may use your personal data:
(a) to carry out our obligations arising from any contracts entered into between you and us;
(b) to provide you with information, products or services that you request from us or which we feel may interest you, including changes and updates;
(c) to ensure that the Site is presented in the most effective manner for you and for your computer or smartphone;
(d) in accordance with our legitimate business interests and legal obligations.
3.10. See table “Purposes for which we will use your personal data” below to find out more about the types of lawful basis that we will rely on to process your personal data.
3.11. Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
THE DATA WE COLLECT ABOUT YOU
3.12. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
3.13. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
(a) Identity Data includes first name and last name.
(b) Contact Data includes email address and telephone numbers.
(c) Financial Data includes bank account and payment card details.
(d) Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
(e) Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Site and/or Apps.
(f) Profile Data includes your username and password, purchases or orders made by you, your preferences, feedback and survey responses.
(g) Usage Data includes information about how you use our Site, Apps, products and services.
(h) Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
3.15. We do not collect any Special Categories of Personal Data about you. Nor do we collect any information about criminal convictions and offences.
3.16. We may use the personal data listed above in an anonymised manner in order to improve our services.
3.17. We use third-party data processors to provide parts of our service. These providers are GDPR-compliant. We list them below:
(a) For pet owners Stripe collects and processes your payment information on our behalf;
(b) For pet owners and vets Twilio collects and processes the actual video calls on our behalf;
(c) For pet owners and vets Auth0 collects and processes login details (Identity Data and Contact Data) on our behalf.
PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA
3.18. We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
3.19. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
3.20. We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You can update your preferences at any time by emailing email@example.com detailing your request.
PROMOTIONAL OFFERS FROM US
3.21. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
3.22. You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.
DISCLOSURES OF YOUR PERSONAL DATA
3.23. We may share your personal data with the parties set out below for the purposes set out in the table “Purposes for which we will use your personal data” above and under 3.17 above.
(a) Vets and veterinary clinics using the App;
(d) Auth0; and
3.24. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
4. Links to other websites
5. Your rights
5.1. You have the following rights in respect of your personal data held by us. Please send all requests in respect of these rights to our Data Protection Officer (firstname.lastname@example.org):
(a) to access your personal data;
(b) to be provided with information about how your personal data is processed (this information is set out in this Policy);
(c) to have your personal data corrected where necessary (please contact our Data Protection Officer (email@example.com) promptly should you become aware of any incorrect or out-of-date information);
(d) to have your personal data erased in certain circumstances (please refer to the appropriate data protection legislation or consult the ICO for details);
(e) to object to or restrict how your personal data is processed;
(f) to have your personal data transferred to yourself or to another business.
5.2. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you OR by contacting us at any time.
5.3. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of [a product/service purchase, warranty registration, product/service experience or other transactions].
NO FEE USUALLY REQUIRED
5.4. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
WHAT WE MAY NEED FROM YOU
5.5. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
TIME LIMIT TO RESPOND
5.6. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
5.7. If you consider that we have not complied with this Policy or the relevant data protection legislation in respect of your personal data or someone else’s, you should raise the matter with our Data Protection Officer (firstname.lastname@example.org). Any such breach will be taken seriously and will be dealt with in accordance with the relevant data protection legislation.
5.8. You have the right to take any complaints about how we process your personal data to the Information Commissioner:
Information Commissioner’s Office
Cheshire SK9 5AF
0303 123 1113.
5.9. For more details, please consult the relevant data protection legislation or address any questions, comments and requests regarding our data processing practices to our Data Protection Officer (email@example.com).