Privacy Policy

PRIVACY POLICY

“Poppy Holdings Group” companies are committed keeping your personal data safe, used properly and stored securely. This Privacy Policy explains how we collect and use your personal data.

This privacy notice tells you what to expect when we collect personal information from you. It also explains how we will store, handle and keep your personal information safe.

We respect your privacy and are transparent about how your data is collected, stored, processed, and shared. Please read the following carefully to understand our practices regarding your personal information and how we will treat it.

This privacy policy, together with our terms and conditions of website use and cookies policy, explains how and why we use the information we collect about you.

Information about who we are

Our Group of Companies includes Poppy Investments Limited Poppy Holdings Ltd, Blu Bloodstock Limited and West Shaw Farm Limited (collectively referred to as “our Group”, “we” or “us” in this policy).

Blu Bloodstock Limited is the controller for the personal information we process unless otherwise stated and is responsible for your personal data.

Our Group companies are registered with the ICO under references: ZB650816, ZA828656, ZB650819

You can contact us at:

Postal address:

54 -56 Ormskirk Street,
St Helens,
Merseyside
WA10 2TF

Email address: dataprotection@blubloodstock.co.uk

General information

All personal data we collect or are provided with will only be held and stored in accordance with this policy and the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and any other legislation relating to the protection of personal data (data protection laws). Blu Bloodstock Limited or the relevant Group company is the data controller for the personal data we process, unless otherwise stated.

This Privacy Policy sets out how your personal data will be processed, stored and used when you visit our website, become a racing club member or otherwise engage with us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Changes to our Privacy Policy

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our Privacy Policy.

Collection of your personal data

We use different methods to collect information from and about you.

We collect personal data when you visit or register on or contact us or you request information, you may be asked to provide information about yourself.

We also collect information when you complete and / or submit information in connection with any membership applications, racing club administration and management.

We also collect personal data when you are a supplier or retailer, or we have a commercial contract with you.

When you provide personal data to us, we will treat that information in accordance with this Privacy Policy.

Information you give us.

This is information about you that you give us by filling in forms on our sites (the Website or forms) or by visiting our premises or when corresponding with us by phone, e-mail, post, social media or otherwise.

We collect and process personal data about you when you:

fill in your details on our websites, register for our services, subscribe to our newsletters or other services and participate in any interactive functions on our sites or when you report a problem with our sites;
fill in your details, register for our services or subscribe to our newsletters or other services via any of our landing pages;
become a member of the racing club;
agree to attend a hospitality event or any other function, race meeting; and / or
enter one of our competitions.

If you receive a gift racing club membership from a friend, colleague or family member then we may obtain certain information about you (such as your name and contact details) from them, instead of directly from you. We will also record the details of the person giving the gift.

Information we collect about you.

Personal information or personal data, means any information about an individual from which that person can be identified and is generally referred to throughout this Privacy Policy as “personal information”. It does not include data where the identity has been removed (anonymous data).

Personal data we may collect, use, store and transfer about you, are as follows:

Identity data, which includes your name, age/date of birth and gender;
Contact data which includes postal address including billing and delivery addresses, your location, telephone numbers (including mobile numbers) and e-mail address;
Transaction data which includes purchases and/or orders made by you and your payment card details;
Technical data which includes your on-line browsing activities on our website;
Profile Data which includes your account login details for website and/or our on-line account, including your username and password(s), your interests, preferences, feedback and survey responses;
Marketing and communications data which includes your marketing preferences from us and our third parties, your communication preferences and your correspondence to and communications with us; and
other publicly available personal data, including any which you have shared via a public platform (such as a Twitter feed or public Facebook page).

In some circumstances we may need to hold and/or use Special Category personal data. This includes information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where this is used for identification purposes), health data, sex life or sexual orientation.

It is likely that we will need Special Category personal data when it is necessary to ensure reasonable adjustments are in place. In this instance we will create a record of your adjustment requirements. These will give your name, contact details and type of adjustment required, along with a brief description of why it is required.

Our website is not intended for children and our website does not knowingly collect data relating to children.

This list is not exhaustive, and, in specific instances, we may need to collect additional data for the purposes set out in this Privacy Policy.

Information received from third parties

We sometimes combine information received from other sources with information you give to us and information we collect about you.

We will only use this information and the combined information where we have a lawful basis.

If you fail to provide personal data

Where we need to collect personal data by law, legitimate interest or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to administer your racing club membership). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

Third-party links

Our websites may include links to third-party websites, plug-ins and applications, including links to websites of our partner networks. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or policies. When you leave our websites, we encourage you to read the Privacy Policy of every website you visit.

We are not responsible for the content, function or information collection policies of these external websites.

How we use your Information:

We will only use your personal data when the law allows us to do so. The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.

When collecting your personal data, we will always make clear to you which data is necessary in connection with the particular activity.

Lawful basis for processing personal data

Most commonly we will use your personal data in the following circumstances:

Where you have consented before the processing.
Where we need to perform a contract, we are about to enter or have entered with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. In either case, just let us know. If you have received a direct marketing email from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails or email

In certain circumstances, we need your personal data to comply with our contractual obligations or to pursue our legitimate interests in a way which might be reasonably expected as part of our running our business. For example, we need to use the information you provide us to administer and / or manage your racing club membership or deliver the services to you.

We also use your information to respond to you if you contact us.

Marketing

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.

We may contact you in relation to any similar products or services we have previously supplied. Otherwise, we would rely on consent as a legal basis for processing in relation to sending direct marketing communications to customers via email or text message. You have the right to withdraw consent at any time. Where consent is the only legal basis for processing, we will cease to process data after consent is withdrawn.

Payment card information

We or our chosen third-party provider may process your personal data to process any payments made for the provision of services. The information may include information for identification and verification, such as your name, credit, debit or other card number, card expiration date, and CVV code.

Any payment transactions carried out by us, or our chosen third-party provider of payment processing services will be kept secure and encrypted where possible.

Retention

We will only retain your Information for as long as is necessary for the purpose or purposes for which we have collected it.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for analytical or statistical purposes, in which case we may use this information indefinitely without further notice to you.

How and why you information is shared

We sometimes share your personal data with trusted third parties. We will never sell your personal information.

We share your personal information to help us administer and manage your racing club membership, to provide services, including the ongoing running of our website and where required to host hospitality events or any other function, or race meeting.The reasons we may share your data with third parties are:

where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests,
if we are under a legal or regulatory duty to do so,
if it is necessary to do so to enforce our terms of use or other contractual rights, including any Racing Club Agreement,
to lawfully assist the police or security services with the prevention and detection of crime or terrorist activity,
where such disclosure is necessary to protect the safety or security of any persons, and/or
otherwise as permitted under applicable law.

We may share your personal data with any member of our Group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We also share your personal data with third parties where we have contracts with companies who provide us with other services such as IT support, data storage, payment processing organisations, delivery organisations, fraud prevention, screening and credit risk management companies, and email automation services.

We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Our contracts with third parties make it clear that they must hold information it securely, abide by the principles and provisions of data protection, and only use information as we instruct them to.

In all instances where we disclose your information to third parties, we will ensure that your information is appropriately protected.

Where the third party is processing your personal data on our behalf and we stop using their services, any of your personal information data held by them will either be deleted or rendered anonymous.

We may also share your information with co-organisers, sponsors or partners who are involved in the delivery of an event, other function or race meeting who may process your personal data as a controller and will therefore be responsible for your personal data and will adhere to the requirements of the data protection laws.

Where your personal information may be processed.

Sometimes we will need to share your personal information with third parties and suppliers outside the UK such as Europe and the USA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the UK. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact us.

Any transfer of your personal information will follow applicable laws and we will follow the guiding principles of this Privacy Notice.

Cookies

A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet.

Our websites use cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies, we use and the purposes for which we use them see our Cookie Policy.

Data Security

We work hard to keep your information safe. We use a combination of technical, administrative, and physical controls to maintain the security of your data.

All information you provide to us is stored on our secure servers or within secure filing systems. Some of the controls we have in place to protect your personal data include technological controls such as firewalls, user verification, strong data encryption. We utilise industry “good practice” standards to support the maintenance of a robust information security management system.

Any payment transactions carried out by us, or our chosen third-party provider of payment processing services will be encrypted.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

Your rights

You are also able to exercise your rights which include:

The right to be informed.

We aim to be transparent within our Privacy Policy and provide you with information about how we use your personal data.

Right of access.

You have the right to request a copy of any information that we hold about you. We try to be as open as possible as we can be in terms of giving people access to their personal data.

Individuals can find out if we hold any personal data by making a subject access request.

The right to rectification.

You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete. You can contact us, and we can amend inaccurate personal data, however, please note that in some circumstances we may ask for the documentary proof that the amendment is necessary.

The right to erasure.

You can request the erasure of your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by us is required by law to be held for a period of time. You can contact us if you wish to make a request.

The right to restrict data.

You can request that we restrict the processing of your personal data. This can be done in circumstances where we need to verify the accuracy of personal data, if you do not wish to have personal data erased or you object to the processing and we are considering this request.

The right to data portability.

Under some circumstances you can request a copy of the personal data you provided to us in a machine-readable format or ask that this data be transferred another third party.

The right to object.

In some circumstances you can stop the processing of your personal data for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. Where your details are used for marketing, you can opt out at any time.

The right not to be subject to automated decision making and profiling.

You have the right to not be subject to solely automatic decisions (i.e., decisions that are made about you by computer without any human input) in relation to any processes that have a legal or similarly significant effect on you.

Please note that we do not make solely automated decision, however, you will be notified if we a solely automated decision which produces a legal effect or significantly affects you.

Exercising your rights

You have the right to ask what personal data that we hold about you at any time. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. .

If you wish to exercise any of the above rights, please contact us.

We will ask for confirmation of identity before we disclose any personal data.

How can we help?

If you have any questions that haven’t been covered, or would like us to address any complaints, questions, comments or requests regarding this privacy policy please contact the Data Protection Officer.

For further information on data protection please visit the Information Commissioner Office (ICO) website.

The ICO regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal information, you have the right to lodge a complaint with the ICO.

You can contact them by calling 0303 123 1113 or visit the website.