Toolstation CCTV Privacy Notice

The company posting this privacy notice is a member of the Travis Perkins Group (the “Travis Perkins Group” means Travis Perkins plc and its subsidiaries).

Images captured on devices operated by the Travis Perkins Group are classed as Personal Information.

Travis Perkins Group is committed to protecting your privacy and comply with data protection laws applicable to the United Kingdom, including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

We capture your image and in some cases your audio when you come into the field of vision and capture of any of the following devices in operation:

CCTV (Video Surveillance) in:

• Stores
• Car parks
• Offices

We use the recorded images and audio for the following purposes:

• the prevention and detection of crime
• for the safety of our colleagues, customers and visitors
• to provide evidence for investigations, insurance, health & safety breaches
• for training purposes (steps are taken to protect the privacy of any person captured)

Where CCTV is in operation clear signage will be displayed informing you of its use. 

The Travis Perkins Group has a legitimate interest in operating video and audio recording devices, in order to keep colleagues, customers and visitors safe and protect our property, assets and reputation.

Sometimes CCTV is processed for compliance of a legal obligation.

We will only share your personal information when we consider the request to be appropriate, for example with the following parties:

• Service providers: to manage and operate the CCTV system as our data processor
• Competent authorities e.g. the Police to assist investigations
• Insurance providers: to assist with insurance claims, legal claims and investigations.
• Any relevant regulators: where we are required to do so by law 
• Individuals when exercising their data protection & privacy rights

We do not disclose personal information to anyone else except as set out above unless we have your consent, or we are legally obliged to do so.  We do not sell your data.

We may anonymise any of the personal information we hold on our CCTV system (so that it does not directly identify you, for example by obscuring your face) and it therefore ceases to be your personal information. We may use this anonymised information for any other purposes.

Your personal information will be processed safely and securely within the UK and European Economic Area (EEA).

Information is retained in line with its purpose of processing. Whilst being processed on the recording devices it will be retained for 31 days as standard however, any recorded images that have been downloaded for investigation, incident evidence, insurance claims or legal proceedings may be required for longer and will be retained in line with our retention schedule. Once there is no reason to retain any recorded data, i.e. the purpose for its request has been fulfilled, it is deleted unless retention is required for continuing legal proceedings.

You can exercise certain rights in regards to your personal information:

• The right to receive a copy of the information we hold about you
• The right to have inaccurate information corrected or incomplete information completed
• The right to have your information erased
• The right to have the processing of your information restricted
• The right to withdraw your consent or object to processing reliant upon legitimate interests
• The right to have your information transferred to another organisation
• The right to request human intervention in regards to automated decision making

In regard to CCTV processing some of these rights are not absolute rights.  The applicability of these rights is dependent upon our purpose and the lawful basis of processing relied upon. 

Should your request be one that we cannot process you will be informed of this, along with the reasons as to why your request cannot be carried out.

You can exercise your rights either verbally or in writing. However, should you make a request verbally we recommend that you follow this up in writing to provide a clear correspondence trail. 
Requests in relation to accessing your personal information can be made by emailing dataprotection@toolstation.com

If you are making a request on behalf of someone else please email dataprotection@toolstation.com

We have an obligation to respond within one month of receiving your request. Should we deem the request to be complex, the response time can be extended by up to two months and you will be informed of the extended response date, alongside an explanation, within the original one-month time frame.

If required, identification will be requested within the one-month time frame and only limited to what is necessary for confirmation, such as a copy of your driving licence, passport or utility bill.  Once ID has been confirmed we will then process your request.

Should we refuse to comply with a request we will inform you of this within the one-month time frame and provide an explanation outlining our justification, our internal complaints procedure and your right to complain to a supervisory authority and to enforce your rights through a judicial remedy.

Contact information for submitting a request can be found at the bottom of this privacy notice.

If you have a query about this privacy notice please contact the Travis Perkins Group’s Data Protection Officer by writing to them at:

Travis Perkins Group Data Protection Officer
Travis Perkins plc
c/o General Counsel Office
Rye Hill House
Rye Hill Close
Lodge Farm Industrial Estate
Northampton
NN5 7UA

Or emailing them at: dataprotection@travisperkins.co.uk (marking emails for the attention of the Data Protection Officer)

If you are not satisfied with our use of your personal information or our response to any request made by you in relation to your personal information, you have a right to make a complaint to the Information Commissioner:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545745 (national rate) Email: casework@ico.org.uk 

The ICO currently recommends you contact them within 3 months of your last contact with us and advises you to contact them once the company's complaints process has been exhausted.