1. This Policy (“Policy”)

1.1 Your privacy is important to Citizen Watch United Kingdom Limited (company number: 04104163) whose registered address is at Citizen House, 7 Ashville Way, Wokingham, Berkshire, England, RG41 2PL (“Citizen Watch”, “CW”, “we”, “us”, “our”).

1.2 We are committed to protecting your personal data and treating any information that we obtain about you with care and in a manner that is compliant with all applicable data protection laws. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals and our wider operations in the European Economic Area (EEA).

1.3 For individuals and customers in the EU, that includes the EU General Data Protection Regulation 2016/679 ("GDPR"). It will also include any applicable national law, such as (in the UK) the Data Protection Act 2018 and the UK GDPR as transposed into national law.

1.4 Please read this Policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

1.5 This policy supplements (and its terms apply in addition to) any other terms of use or other terms and conditions agreed between you us from time to time, including the purchase terms and conditions.

1.6 Our website uses cookies. Please refer to our Cookie Policy for more information about the cookies we use and the purposes for which we use them.

1.7 Amendments and updates to this Policy may be made from time to time. Any revisions will be posted on this page, so you will always be aware of what information we collect and how we use that information. Please review this page regularly so that you are aware of any changes.

2. How and when we collect personal data

2.1 We collect personal data from you when you:

• register for an account on our website;
• purchase products via our website;
• contact us by telephone or email;
• submit any queries or complaints;
• complete customer surveys or participate in any event, prize draws or competitions run by us;
• leave us a review or send us feedback;
• complete any forms for transactional, employment or other purposes; and
• buy gift cards/vouchers.

2.2 All of the personal data referred to in paragraph 2.1 above will be provided by you directly.

3. Personal data we collect about you

The personal data we collect, and process may include (if and as applicable):

Categories of Data	Description of Data
Identity and Contact Data	Identity and contact information such as your title, name and surname, username, email address, postal address, billing address, date of birth, gender, contact telephone number and other information provided by you when you register for a Citizen Watch account, purchase a product or subscribe to our mailing list.
Product Data	Data and information in relation to any order or purchase made by you, order details, payment information and any preferences and other transaction information provided or obtained in connection with any such order or purchase.
Correspondence Data	Data and information which you provide in any correspondence with us including details of any enquiries, requests for customer support, claims and complaints you may send us.
Marketing and Communications Data	Marketing and communications data, which includes your preferences in receiving marketing from us and our third-party partners and your communication preferences.
Transaction Data	Information ascertained by your registration for an account, use of our website and purchase of our product via the website, including your interests and purchase history.
Technical Data	Data and information obtained through the use of cookies when you use our website such as time zone and IP address and location data.

4. Purposes for which we process your personal data

4.1 We use your personal data for a number of purposes but only where we are allowed to by law.

4.2 We may process your personal data in any circumstances where such processing is necessary:

4.2.1 in order to perform any agreement between us (including your purchase of any product);

4.2.2 to comply with any applicable law or regulation; and/or

4.2.3 for the purposes of the legitimate interests pursued by us or third parties. These legitimate interests include the purposes identified in the table below but also include other commercial interests and our internal administrative purposes.

4.3 We may also process your personal data where we have your consent. Where we only on consent as a lawful basis for processing our personal data, you have the right to withdraw your consent at any time and if you wish to do so, you should contact our Data Protection Officer using the contact details set out in this privacy policy.

4.4 Where we obtain your consent to send you marketing communications, you can unsubscribe by following the unsubscribe link within the communication or clicking ‘unsubscribe’ in your account area. Where marketing consent is gained through the acceptance of cookies, this can be managed by clicking here. The withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds.

4.5 We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

4.6 We may process your personal data ourselves or in conjunction with our third-party service providers in accordance with paragraph 6.

4.7 Information about the purposes for which we use your personal data, the types of personal data we process to achieve these purposes, and the lawful basis by which we process it, is listed below:

Purpose / Activity	Types of Personal Data Processed	Lawful basis for Processing
Registration and Account Management • To register you as a new customer • To create and manage your customer account with us	• Identity and Contact Data • Technical Data • Marketing and Communications Data	• Performance of a contract
Provision of our Products and Services • To process and deliver orders and purchases • Manage payments including issuing refunds where required • To provide you with our service guarantee	• Identity and Contact Data • Technical Data • Transaction Data	• Performance of a contract
Relationship Management • To manage our relationship with you including notifying you about changes to our terms and conditions and/or privacy notice • Responding to enquiries, messages and requests for customer support and to deal with any complaints	• Transactional Data • Correspondence Data	• Performance of a contract
Marketing • To market our products	• Identity Data and Contact Data • Marketing and Communications Data	• Performance of a contract
Business Management • To administer and protect our business and website (including troubleshooting, data analysis, testing system maintenance, support, reporting and hosting of data) • To improve our website, products/services, marketing, customer relationships and experiences.	• Identity Data and Contact Data • Transactional Data • Correspondence Data • Product Data • Marketing and Communications Data • Technical Data	• Performance of a contract
Customer Experience Management • To enable you to partake in a prize draw or competition, to leave a review or to complete a survey. • To deliver relevant and personalised content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you. • To make suggestions and recommendations to you about goods or services that may be of interest to you.	• Identity Data and Contact Data • Marketing and Communications Data • Correspondence Data • Technical Data	• Performance of a contract

4.8 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes.

4.9 If we need to use your personal data for an unrelated purpose, we will notify you (which may be by way of update to this notice) and we will explain the legal basis which allows us to do so.

4.10 Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5 What if you refuse to provide us with any personal data

5.1 Where we need to collect personal data by law, or under the terms of an agreement we have with you, and you fail to provide that data when requested (or fail to consent to the processing of that data, if necessary), we may not be able to perform the contract or arrangement we have or are trying to enter into with you (for example, to provide you with products). In this case, we may have to cancel a product or service you have with us, but we will endeavour to notify you if this is the case at the time.

6 Sharing information with third parties

6.1 We will not share any of your personal data with third parties except as set out in this paragraph 6 or otherwise notified to you or agreed between you and us from time to time.

6.2 We may share personal data with our group companies and partnered companies (together, "Affiliates") to provide our products and for the other purposes outlined in this notice.

6.3 From time to time, we will also need to share personal data with the following types of third-party service providers who we engage to provide services which facilitate our business and who may need to process your personal data to the extent necessary to provide those services:

6.3.1 Foundation Commerce Limited, our provider of hosting and storage services;

6.3.2 HotJar, operated by Hotjar Ltd, our provider of website analytics dashboards and insights;

6.3.3 Google Analytics and Google Ads, operated by Google LLC, our provider of online marketing tools;

6.3.4 Klarna, operated by Klarna Bank AB, our provider of payment services;

6.3.5 Mollie, our provider of payment services;

6.3.6 SendCloud, operated by SendCloud B.V., our provider of shipping and product returns automation services;

6.3.7 DPD, operated by Geopost Holdings Limited, our provider of shipping and courier services;

6.3.8 DX, our provider of shipping and courier services;

6.3.9 Klaviyo, operated by Klaviyo, Inc., our provider of marketing tools; and

6.3.10 any similar or placement third parties from time to time.

6.4 We seek to ensure that any third party engaged by us who processes your personal data in connection with the purposes listed above has policies and procedures in place to ensure compliance with data protection laws.

6.5 For any third parties that are based, or process data, outside of the EEA, we engage such third parties in accordance with paragraph 7.

6.6 Unless otherwise disclosed to you from time to time, we will remain the controller responsible for the processing of your personal data notwithstanding that third parties may be engaged as data processors.

6.7 We may also share your personal information with third parties where we are required to do so by law or regulation (such as in connection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that your actions violate applicable laws, any terms of use governing our website or any other arrangement between us, or any usage guidelines for specific products or services, or threaten the rights, property, or safety of our Company or others).

6.8 If our business or any part of it is sold or integrated with another business, your details may be disclosed to our advisers and those of any prospective purchaser and will be passed to the new owners of the business.

7 International transfers of personal data

7.1 From time to time, it may be necessary for us to transfer your information internationally. Your information may be transferred to and/or stored on the servers of our Affiliates or other third parties identified in paragraph 6 which are based outside of the EEA.

7.2 However, we will not transfer your personal data outside of the EEA unless:

7.2.1 such transfer is to a country or jurisdiction which the UK Government and EU Commission has approved as having an adequate level of protection;

7.2.2 appropriate safeguards are in place as set out in Article 46 GDPR or equivalent provisions of other data protection laws. These safeguards can include the use of standard contractual clauses, the UK Addendum or the International Data Transfer Agreement or binding corporate rules;

7.2.3 the transfer is otherwise allowed under applicable data protection laws (including where we have consent, the transfer is necessary for important reasons of public interest, is necessary for the establishment, exercise or defence of legal claims or is necessary for the performance of a contract with the data subject).

8 Your data protection rights

8.1 Under UK data protection law, you have the following rights in respect of your personal data:

8.1.1 Right of access – you have the right to request information regarding the personal data that we hold about you and the source(s) of that information. You can request a copy of any personal data we hold about you. This service is usually free of charge, although we have the right to charge a ‘reasonable fee’ in some circumstances and there are some exemptions which means you may not receive all the information you ask for.

8.1.2 Right to rectification - you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

8.1.3 Right to erasure - you have the right to ask us to delete your personal information or object to the processing of your data

8.1.4 Right to restriction of processing - you have the right to ask us to limit how we can use your personal information.

8.1.5 Right to object to processing - you have the right to object to the processing of your personal data.

8.1.6 Right to data portability - you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

8.1.7 Right to withdraw consent – when we use consent as our lawful basis you have the right to withdraw your consent at any time.

8.2 If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at paragraph 12.

9 Storage and retention of your personal data

9.1 As a minimum, we need to store your data for as long as is necessary to enable us to provide you with the products and services that you have requested from us (or to support other functions, such as maintaining your account(s)). Accordingly, we will usually store your personal data for as long as you have an account with us, and will usually delete it when you delete your account.

9.2 However, we will retain certain of your personal data for longer if we think it is reasonably necessary to do so in the circumstances, taking into consideration factors such as:

9.2.1 our need to perform any agreements between you and us (including order fulfilment);

9.2.2 our need to answer any queries or resolve any problems you may have;

9.2.3 your continued consent to receive marketing and other emails and communications from us;

9.2.4 our continued provision of any content or services to you; and

9.2.5 our need to comply with legal requirements (e.g. relating to record keeping).

9.3 If you tell us that you would like to delete your account, we will take steps to delete all the personal data we hold about you once it is no longer necessary for us to hold it (e.g. to fulfil any outstanding orders, resolve disputes, or as is permitted by applicable law or regulation).

9.4 For as long as we do store your data, we follow generally accepted industry standards and maintain reasonable safeguards to attempt to ensure the security, integrity, and privacy of the information you have provided. We have security measures in place designed to protect against the loss, misuse, and alteration of the information under our control.. Personal data collected by us is stored in secure operating environments that are not available to the public through our UK and EU hosting and storage providers outlined above at paragraph 6.3.

9.5 You are responsible for maintaining the strength and confidentiality of any login credentials.

9.6 We will notify you as soon as reasonably practicable if we have reason to believe that there has been a personal data breach by us which could adversely affect your rights and freedoms.

10 Links to third parties

10.1 Our website may link or redirect to other websites, apps, social media accounts or other content which is not in our control. Such links or redirections are not endorsements of such websites or representation of our affiliation with them in any way and such third-party websites are outside the scope of this notice.

10.2 If you access such third-party websites, please ensure that you are satisfied with their respective privacy policies before you provide them with any personal data. We cannot be held responsible for the activities, privacy policies or levels of privacy compliance of any website operated by any third party.

11 Questions and complaints

11.1 For all questions or complaints about this notice, we would appreciate the chance to deal with your concerns before you approach the relevant data protection authority. Please contact us in the first instance using the details provided in paragraph 12.

11.2 You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner's Office (ICO) (www.ico.org.uk).

12 Our contact details

12.1 You can contact us and/or our Data Protection Officer by post, email or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

12.2 Our contact details are shown below:

Our contact details	Our Data Protection Officer's contact details
Citizen Watch UK Ltd, Citizen House, 7 Ashville Way, Wokingham, Berkshire, England, RG41 2PL sales@citizenwatch.co.uk 0118 989 0333	Citizen Watch UK Ltd, Citizen House, 7 Ashville Way, Wokingham, Berkshire, England, RG41 2PL privacy@citizenwatch.co.uk 0118 989 0333