This Notice sets out our commitments to safeguarding your privacy and establishes how we will collect, process, and store your Personal Data when using the Website.

Within this policy-

‘Content’ means any information, articles or images included within the Website;

‘Personal Data’ means any information in any format or medium, from which you can be personally identified;

 ‘we’, ‘us’ or ‘our’ means Gemma Hutton.

‘Website’ means https://www.sleeping-bunnies.com

‘you’ or ‘your’ means the visitor or user of the Website;

We are providing this information as part of our on-going efforts to provide transparency and clarity when collecting, processing, storing, sharing and retaining your Personal Data by

1. ensuring that you have all the information regarding your privacy when using the Website; and
2. to comply with our obligations and your rights created by applicable law.

We pride ourselves on keeping up to date with regard to advances in technology and legal developments which can result in us needing to change this Privacy Notice, if we make any changes, we shall make the new notice available on the Website which shall apply from the date of publication so you are encouraged to revisit this Notice periodically to ensure that you agree to the version that is current at the time of your visit.

Your trust is important to us and we want to be clear and transparent about

1. What Personal Data we collect;
2. How we use that Personal Data;
3. Who we share the Personal Data with;
4. How we store and retain your Personal Data;
5. Your rights in respect of that Data.

Whether or not you are personally identifiable from the data that we gather, store, or process you can be assured the data will only be used in accordance with this notice.

You will be asked to agree to this Privacy Notice before using the Website or our Services, if you do not agree with anything within this Privacy Notice, you must not use our Website.

1. Your Personal Data
   • We will only gather, collect, process, or store any Personal Data –
2. with a lawful purpose;
3. that is necessary for processing an enquiry;
4. that is necessary to deliver the website to the device used by you;
5. to take the necessary steps to enter into and in the performance of a contract with you;
6. that is necessary for the administration of an account;
7. for the recording of a financial transaction;
8. for internal records that we are legally obliged to keep;
9. to deal with complaints, disputes, and legal actions;
10. where necessary to protect the vital interest of you or another person;
11. to send commercial communications from us (including newsletters and notifications), where you request or consent to such communications.

2. Use of the Website

• If you make an enquiry about the Company, its services, the Website or its Content whether using the facility on the Website or otherwise, you will need to provide us with your Name, Email address and telephone number.

• This information is processed with

1. a legitimate interest – in order that we can respond to your enquiry; or
2. with your consent to send commercial communications including the availability of new Products, special offers and discounts, newsletters, and notifications..

3. When using our services

• If you use our services we will need to collect the following personal data when submitting an order, Name, Email address, geographical address, telephone number, payment details and the digital photograph to which the artwork is to be applied

.

• This information is collected and processed

1. for the purposes of entering into and performing a contract;
2. to contact you in relation to the contract or services;
3. to deliver the completed artwork to you;
4. for the processing of a payment transaction;
5. for maintain records we need to keep in law, for example accounting purposes;
6. dealing with a complaint or dispute;

• Your payment card details will be shared with the payment processor using a secure SSL connection.

• We do not retain or store any payment card details provide by you.

4. Sharing your Personal Data

• We will not share your Personal Data with anyone except as stated within this paragraph.

• We may use a third-party software to perform certain functions, this is considered to be sharing your Personal Data with the software.

’

• We may store your Personal Details in software on our computers or third party servers or on the cloud, although the third party does not access the Personal this is still classed as sharing.

• We will share you name and email address with our email service provider when we communicate with you through email.

• We may share your Personal Data with our employees, officers, agents, consultants, suppliers, or subcontractors insofar as reasonably necessary

1. for dealing with an enquiry;
2. for performance of a contractual obligation;
3. to the extent that we are required to do so by law;
4. in connection with any legal proceedings or prospective legal proceedings;
5. to establish, exercise or defend our legal rights;

• We may also engage other businesses for website, IT or analytic support and maintenance who may, whilst performing their services have access to your Personal Data. These businesses will be working under a contract for services that contain strict conditions in relating to accessing Personal Data and will be subject to confidentiality undertakings.

5. Consent

• Where any personal data belongs to a child or baby, consent can only be given by someone with a parental responsibility.

• If you do not have parental responsibility, for example the photograph is a gift, then you will be required to confirm that you have obtained consent from someone with parental responsibility and if requested, ask the person with parental responsibility to give consent themselves.

6. Automated Processing

• We shall not use automated processing of your Personal Data to form or make decisions except where authorised or required by law (for example for the calculation of taxes due from a purchase); or you have given your express consent. If we use automated processing you are entitled to request details of the automated process.

7. Data Security

• We will take all reasonable technical and organisational precautions to prevent the loss, misuse, or alteration of Personal Data, including

1. storing of data on a secure, password protected, and firewall protected device;
2. limiting access to data to only personnel who need access for the performance of a contract or the administration and management of an account;

8. Data transfers outside the EU

• We shall not generally transfer or process any personal data outside the boundaries of the E.U. If any data is transferred outside of the E.U. we shall ensure that the county has sufficient security measures and guarantees in place to protect the security of your Personal Data.

9. Data retention

• Personal Data shall be retained for as long as necessary to fulfil the purpose which it was collected.

• We may retain Personal Data for longer than is necessary for the purpose which it was collected to comply with a legal obligation, for example the retention of financial transactions for accounting purposes or where we may need to exercise or defend our legal rights which means that some information may be retained for up to six years.

10. Advertising and promotion

• We may use your Personal Data to promote or advertise our services, for example where you give your consent for us to use your digital photograph on our website or social media platforms, however we may use a part of your digital image that does not show a person in the photograph in a way that they are identifiable without obtaining consent.

• We may publish any feedback or reviews that you provide where you provide your consent, however we will if you request, anonymise your feedback or reviews by using only your first name or replacing your name with a letter, for example ‘Mrs X from London says…..’ therefore you will not be personally identifiable.

11. Commercial communications

• We may use your Personal Data where you give your consent to occasionally send you newsletters, notifications of events, the availability of new services or products and special offers or discounts from us:

• You can opt out of receiving such communications either by placing a check mark in the box when making an enquiry via our website or by clicking the unsubscribe link within the communication.

12. Your rights

• Under data protection regulations you have the right

1. to know the identity and contact details of the Data Controller and Data Protection Officer (where applicable);
2. to know the purpose and legal basis for processing your Personal Data, and where processing is based on the legitimate interests of the Data Controller, what those legitimate interest are;
3. to know whether your Personal Data is transferred or processed beyond the EU and that appropriate safeguards are in place.
4. to access your Personal Data
5. to erase Personal Data.
6. to restrict processing.
7. to portable data.
8. to withdraw consent
9. to complain.

• The right of access.

1. You may require us to provide you with any Personal Data we hold about you. To obtain a copy of any Personal Data we hold contact the Data Controller.
2. The Personal Data will be provided free of charge except where a request is manifestly unfounded or excessive (for example it is a repetitive request, or where we need to process large amounts of data) in which case we shall make a charge for our reasonable administrative costs in dealing with the request or refuse to respond but we must provide a justifiable reason for refusing to respond.
3. We shall provide the requested Personal Data within one month of receipt of the request, however where there is a substantial amount of information or it is difficult to collate we may extend this timeframe by one month by providing you notice.
4. As we take the issue of protecting your Personal Data seriously, we follow strict storage and disclosure procedures which mean that we may require proof of identity from you prior to disclosing such information.

• The right to erase Personal Data

1. You have the right in certain circumstances to instruct us to erase your Personal Data where;
2. The Personal Data is no longer necessary in relation to the purpose for which it was originally collected/processed.
3. You withdraw your consent.

• You object to the processing and there is no overriding legitimate interest for continuing the processing.

1. The Personal Data was unlawfully processed or obtained.
2. The Personal Data must be erased to comply with a legal obligation.
3. The Personal Data is processed in relation to the offer of information services to a child.

1. Where you have the right and you issue an instruction to erase your Personal Data we shall use all reasonable efforts to
2. Inform all third parties to whom we have disclosed your Personal Data of the requirement to erase your Personal Data which they hold;
3. In the event that your Personal Data has been published online we shall endeavour to ensure that any links or references are also removed, however due to the Cashing of information it may take same time before the Data is no longer visible or available, for example in search engine;

1. We may refuse to erase your Personal Data only
2. to exercise the right of freedom of expression and information;
3. to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;

• for public health purposes in the public interest;

1. archiving purposes in the public interest, scientific research historical research or statistical purposes; or
2. the exercise or defence of legal claims.

• The right to restrict processing

1. We shall, upon your request, restrict the processing of your Personal Data if the following circumstances arise
2. Where you contest the accuracy of the Personal Data we shall restrict the processing until we have verified the accuracy of the Personal Data.
3. Where you have objected to the processing where it was necessary for the performance of a public interest task or purpose of legitimate interests, and we are considering whether our legitimate grounds override your grounds.

• When processing is unlawful and you oppose erasure and you request restriction instead.

1. If we no longer need the Personal Data but you require the information to establish, exercise or defend a legal claim.

1. Where processing of your Personal Data is restricted, the information shall be stored but no further processing shall occur.

1. We shall inform any third party to whom we disclosed your Personal Data that the Information is restricted.

1. We shall inform you when and restricted period comes to an end.

• The right to portable data

1. Any Personal Data where the lawful purpose for processing is consent or for the performance of a contract which is stored by us electronically, we shall hold that Personal Data in a portable format (readable in a format that will be commonly used on other computer systems) and we shall provide this information to you or directly to another organisation (where technically feasible) upon your request.

• The right to complain.

1. If you are not happy with the way we collect or store your Personal Data you can make a complaint to the Information Commissioners Office, however we would appreciate you contacting us first to give us the opportunity to provide an explanation or put things right.

• The right to withdraw consent

1. If you provide your consent to process your Personal Data in a particular way, you may withdraw your consent at any time by informing the Data Controller at the address at the bottom of this notice.

1. Upon receipt of a notice withdrawing your consent to process your Personal Data we shall stop processing the Data except:
   1. Where is it necessary for the performance of a contract.
   2. Where there are compelling legitimate grounds for the processing, which override your interests, rights, and freedoms; or

• the processing is for the establishment, exercise, or defence of legal claims; or

1. where the processing of the Personal Data is carried out under an obligation in law.

You can contact us regarding any aspect of the collection, use or storage of your Personal Data at the address at the top of this notice.