Privacy Policy

Virgin Atlantic Shops Away is operated by Valuedynamx Limited on behalf of Virgin Atlantic Airways Ltd. (Flying Club). Effective Date of this Policy: 05 October, 2021

1. INTRODUCTION

Virgin Atlantic Flying Club pride ourselves on the importance of our customer relationships. This also extends to the way in which we handle personal information about our customers. We are committed to being transparent about the ways in which we intend to use your information, to provide you with choices about how we use it and fundamentally to ensure the security of your information.

You can access the full Virgin Atlantic Privacy Policy here and you can find the Privacy Policy of Virgin Red Limited (“VR”) here. VR own and manage Virgin Points

This Privacy Policy relates to the processing of personal data in relation to the Virgin Atlantic Shops Away shopping site (“Shops Away”) and the transactions associated with using it. VR is the ‘Data controller’ and Collinson Valuedynamx Ltd operate and provide the Shops Away service as a ‘Data Processor’ for VR except when processing your information for marketing purposes, in this capacity only, Collinson Valuedynamx is the Data Controller.

Unless otherwise stated, all references to “we” or “our” shall imply Virgin Red Limited as data controller and Collinson Valuedynamx Ltd acting as VR’s data processor.

2. SCOPE

The scope of this Privacy Policy covers customers in respect of the following:

• Collecting Personal Data
• Using Personal Data
• Disclosing Personal Data
• Lawful Basis for Processing Personal Data
• Data Security
• Retaining Personal Data
• Securing Personal Data
• International Data Transfers
• Your Rights (including Subject Access Request)
• Updates / Amendments
• Third Party Websites
• Collinson Valuedynamx Ltd Website – Use of Cookies
• Opt-in / Opt-out
• Changes to our Policy
• Data Protection Registrations
• Our Details
• Complaints

3. COLLECTING PERSONAL DATA

This Policy details how we collect and use your data when you visit the Shops Away website and any other form of correspondence.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

We collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature to feature more popular retailers or features. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Other personal data that we collect are:

• Your contact information (such as your name and email address);
• The services and products in which you are interested or have purchased;
• Information required for Payment purposes such as payment information so that we can award you Virgin Points for “In Store” payments. This includes Card Details (last 4 digits only) and Card expiry date
• information related to enquiries you make with us.

We may be required by law to collect certain personal information. We may also be required to collect your personal information under the terms of the contract we have with you, Failure to provide this information, may prevent us from being able to perform the contract we have to cancel a product or service you have with us, in all instance, we will notify you if this is the case at the time.

We also collect information about your computer and about your visits to the Shops Away website, including your IP address, browser type and version. Some other personal details that are device based, such as device ID, device type, and location data. Processing of this data implies collecting, storing, using, disclosing or disposing of individuals’ personal data. Please see section 14 for information on how we use cookies.

We may collect, use and store your personal data:

• To Improve the services we offer you and to a wider audience based upon the services and/or locations you have chosen to utilise;
• Based on Information that you provide to us when using any of our services we provide, or that is generated during using those services.
• Based on Information that you post on our social media platforms.
• Based on Information contained in, or relating to, any communication when you call us or that you send to us through our website, email or in writing.
• Information to help us comply with court orders and to exercise and defend our legal rights.
• Any other personal information that may be sent to us and which we use for legitimate business purposes.

Before you disclose to us the personal data of another person, you must obtain that person's consent to both the disclosure and the processing of that personal data in accordance with this Privacy Policy. Where the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, we are mandated to collect this personal information in order to provide you with our services. Non provision of this information means that we cannot provide you with the services requested.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4. USING PERSONAL DATA

We use your personal data to offer you our services (in this instance, awarding Virgin Points via your chosen retailer with your online or in store purchases). If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so, and the ways in which we use your data is listed below.

We collect your personal information when:

You fill in forms for example, we will keep a record of the information you provide us when you write to us or contact our customer service centres.

We use the personal information we collect to:

• Provide you with access to the Shops Away website;
• Provide the services you request;
• Provide you with information you have requested, including without limitation, service emails concerning your purchase (e.g. cancelled purchases, points crediting status, missing transactions etc.);
• Respond to any enquiries from you regarding our products and services (e.g. points tracking requests);
• Where you have agreed, provide you with information about certain other goods and services which we believe may be of interest to you (e.g. newsletters);
• We may collect information on your activity on our website through monitoring your navigation and use of tools and functions available on our website. This non-personal information may be used in aggregated format to enable us to analyse the use of the website and to enhance the services offered (e.g. navigation experience, selection of retailers in our website);
• Meet our legal and regulatory obligations;
• Detect and prevent fraud.

Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. DISCLOSING PERSONAL DATA

We will not share your personal data with anyone else unless you agree to this, or such sharing is necessary to fulfil our contract with you, or we are legally allowed or required to do so. Additionally, your personal data will only be shared with selected organisations which comply with our security procedures and policies.

Your personal information may be disclosed in the ways set out in this Privacy Policy or subject to any agreements in place between us with the following third parties: -

• Another member of our group of companies where they help provide our services to you, as part of a need to know or as part of improving our existing or new solutions and services.
• companies or other organisations that we have engaged to provide services on our behalf, such as, system providers, web-hosting companies, mailing vendors, analytics providers, event hosting services, and information technology providers;
• Our service providers and subcontractors, where they help us provide our services to you. Also, companies or other organisations where You have asked us to or agreed that we may share your personal information with them;
• Our partners where this is necessary to provide You with a service;
• Fraud prevention or debt collection organisations when required to protect our legitimate interests;

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

In addition your information may be disclosed to:-

• any law enforcement agency, court, government and/public authority or other third party, we may share personal information obtained through the website in order to comply with a legal or regulatory obligation, or otherwise to protect our rights, the rights of any third party or individuals' personal safety, or to detect, prevent, or otherwise address fraud, security or safety issues;
• To a regulating body (e.g. the Information Commissioners Office) or other authority where we need to comply with a regulatory or legal obligation. Also, any external auditor or applicable body or court where we are required to do so by law or regulation or as part of any investigation.
• To any prospective buyer and/or third party in the event we sell any part of our business and/or assets, we will ensure via contracts and other legal instruments that the buyer uses your personal data in accordance with the tenets outlined in this Privacy Policy. That is, we will use reasonable efforts to try to ensure that the entity to which your personal information is transferred uses it in a manner that is consistent with this notice.

We do not sell, rent or trade any of your personal data.

We will not, without your consent, disclose or supply your personal data to any third party for the purpose of their or any other third party's direct marketing.

6. LAWFUL BASIS FOR PROCESSING PERSONAL DATA

There are different lawful grounds that we rely on to use your personal information and we will collect and use your personal information in the following situations:

Where our use of your personal information is necessary to perform a contract that you are a party to, or to take steps that you request before entering into a contract, for example for administrative purposes, .

Where our use of your personal information is within our legitimate interests or the legitimate interests of the organisation with which we have shared your personal information, we will have made sure that your personal information, and your rights in relation to that information, are protected. For example, we may rely on this legal ground if we use your personal information to:

• understand and improve our services and/or business or marketing strategies;
• for marketing research purposes to manage and improve our relationship with you and;
• to help find out what information or services are most likely to interest You and to send or show You information, offers, and online advertisements for these services;
• to personalise your experience of our services; to ensure that our services are delivered and used in accordance with the law and the terms and conditions that apply to them;
• where necessary to protect or defend our or another's rights or property, or to detect, prevent, or otherwise address fraud, security, safety or privacy issues;

Where We have a legal obligation to process your data. We might need to pass information about you to law enforcement agencies if they think or we think you have done something you shouldn’t have. Where we believe it is in your Vital Interests . In limited circumstances where we believe it is necessary to protect someone's safety or vital interests;

Where we believe it is in the Public Interest. In certain circumstances, we may need to use your personal information for purposes which are in the public interest; and

Where we have your consent. Consent is the basis used to send marketing to you for email newsletters.

Where consent is relied on, you have the right to withdraw that consent at any time. Please see the 'Opt-in/Opt-out' section of this notice for more details.

7. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. PERSONAL DATA DISPOSAL AND RETENTION

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

9. SECURING PERSONAL DATA

We will ensure that all necessary and adequate safeguards are in place to prevent unauthorised access, loss, misuse or alteration of your personal data.

We store all personal information on secure servers with relevant access, encryption and firewall controls.

Any personal data sent to us, either in writing or email, may be insecure in transit and we cannot guarantee its delivery.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of your personal data, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We will not ask you for your password.

10. INTERNATIONAL DATA TRANSFERS

Your personal information will be treated in accordance with UK law concerning data protection and may be transferred within the European Economic Area ("EEA"), as well as to countries outside the EEA (including to the USA). The countries to which we transfer your personal information are the United Kingdom (primary servers) and United States, Hong Kong and Australia (replicas).

Apart from the UK, these countries may not be regarded by the European Commission as ensuring an adequate level of protection for personal information. As a result, when we transfer your personal information outside the EEA, we will put in place appropriate international transfer legitimising safeguards in accordance with our legal obligations to ensure that your personal information is adequately protected. If this is the case, we will ensure that appropriate safeguards are in place to protect your personal information and to ensure it is kept securely at all times. Such safeguards used are the EU Commission approved Standard contractual Clauses (Model Contract Clauses- MCC’s) or other legitimising instruments (as stated in chapter v of the GDPR) for international data transfer for data to be processed appropriately. If you would like to know more about how we protect your personal information when it is transferred outside the EEA, please contact us using the details below.

11. YOUR RIGHTS

As we outline in the "Your rights" section below, you will have the right to object to our using your information for our legitimate interests. However, please keep in mind that your objection to this sort of processing may affect our ability to carry out the tasks that we have set out above.

You have the right to stop using the service and terminate your Flying Club membership at any time. When you do so, you will no longer be able to use, earn or spend Virgin Points with Flying Club. Please note that, in these circumstances, we may still keep your information in accordance with the " PERSONAL DATA DISPOSAL AND RETENTION" section.

You also have the following rights when it comes to our handling of your personal information:

• Right of access - You have the right to request a copy of your personal information and to request supporting information explaining how your personal information is used. Please note that sometimes we may ask you to provide proof of identity before we show you your personal information. This is so we can protect unauthorised access.
• Right of rectification - You have the right to request that we rectify inaccurate personal information about you.
• Right of erasure - You have the right to request that we erase all personal information about you (please note that we may be able to reject or restrict the request in some circumstances, depending on the information we hold and our lawful reason to keep it).
• Right to restrict processing - In some situations, you have the right to request that we do not use the personal information you have provided (for example if you believe it to be inaccurate).
• Right to object - You have the right to object to certain processing by us of your personal information where the processing is based on our "legitimate interests" (unless we have overriding compelling grounds to continue processing) and the right to object to direct marketing by us.
• Right to information portability - You may have the right to request that we provide you with certain information that you have provided to us in an electronic format or to provide that information to a third party.

Please get in touch with us at the address or email below if you would like to exercise any of these rights (including having access to your personal information):

Virgin Red
Virgin Red Limited
66 Porchester Road
London W2 6ET
UK

[email protected].

Alternatively, you can contact our information protection officer at [email protected]

You have the right to complain to the UK's information protection regulator, the Information Commissioner's Office (ICO), about our handling of your information. You can use the relevant section of the ICO website to do this: https://ico.org.uk/make-a-complaint/.

12. UPDATES / AMENDMENTS

In order to remain compliant with any legal and regulatory obligations, or as part of our evolving business practices, we may update this Privacy Policy from time to time by publishing a new version. In certain instances, we may notify you.

13. THIRD PARTY WEBSITES

We are not responsible for the practices employed by Third Party Websites linked to or from our Website nor the information or content contained therein. Please remember that when you use a link to go from our Website to a Third-Party Website, our Privacy Policy will no longer apply. Your browsing and interaction on any other Website, including Third Party Websites, which have a link on our Website, are subject to that Website's own Privacy Policy.

14. USE OF COOKIES

Shops Away uses cookies on the website in order to improve your user experience by enabling our website to 'remember' you, either for the duration of your visit (using a 'session cookie') or for repeat visits (using a 'persistent cookie').

Please click here to read our Cookie Policy which explains what we do and how you can alter your cookie settings.

15. MARKETING

Shops Away Marketing

If you have consented to receiving our Shops Away newsletter about the offers available with Shops Away merchants, this will be sent to you by Collinson Valuedynamx. You have the right, at any time, to withdraw your consent and Collinson Valuedynamx will not process your personal data to send you the newsletter.

These marketing messages will be separate from the general Flying Club marketing messages that you may have already agreed to receive. Therefore, if you opt out of receiving marketing emails about Shops Away it will not opt you out of your general Flying Club marketing messages or communication from VAA or Virgin Red where you have opted into receiving communication from them separately.

You can opt-out of receiving email communications simply by clicking the unsubscribe link, which is contained within every marketing emails or outreach that you are sent.

You may instruct us at any time not to process your personal data for marketing and communications purposes by means of ‘opting-out’.

Please note it can take up to 14 days for a request to be fulfilled because of pre-planned or ongoing marketing activity.

16. CHANGES TO OUR POLICY

We keep our Privacy Policy under regular review, and we will make any new versions available on our website. This Privacy Policy was last updated in September 2021.

17. OUR DETAILS

Shops Away
Virgin Red Limited
66 Porchester Road
London W2 6ET
UK

[email protected]

COMPLAINTS

If you feel your rights have not been respected, or do not feel a situation was resolved satisfactorily, you have the right to raise a complaint with the UK Information Commissioner’s Office.

You can contact them as follows: -