Customer Privacy Policy

This Privacy Policy was last updated on 17th September 2024 and is version 3.0.

This privacy notice describes how we collect, store, use, and share personal data. It also explains the rights you have in relation to the personal data that we hold about you.

You can contact our Data Protection and Privacy Office by emailing us at datarequest@oxendales.ie or alternatively by writing to:

Data Protection and Privacy Office
Oxendale & Co Ltd
Woodford Business Park
Santry
Dublin 17
D17 W995

Who we are

Oxendale & Co. Limited trading as Oxendales, Jacamo & Simply Be is a limited liability company. Director: S. O'Boyle, J. Clarke (British) & D. Joy (British). Registered in Ireland No. 263438. Registered Office: Woodford Business Park, Santry, Dublin 17 WEEE Reg. no. 00460WB. We are the legal entity responsible for how your personal data is collected, stored, and processed in Ireland.

JD Williams & Company Limited is a company registered in England (registered number 00178367) with its registered office at Griffin House, 40 Lever Street, Manchester, M60 6ES.

We trade under different brands in Ireland, including Oxendales, Simply Be and Jacamo. Together with JD Williams, we are collectively known as the N Brown Group.

What data we collect

We collect several types of data, including:

Personal - your name, date, and place of birth, contact numbers, email address, home and delivery address(es), gender, and picture.
Call recordings - recordings of calls you have made to, or received from, our customer service teams.
Online identifiers - your IP addresses and MAC addresses, device information plus the cookies we store when you visit our websites.
Website - the pages of our websites you have visited and how much time you spent on them.
Order information - what you have bought from us, either over the phone or on our websites.
Communications - any emails, messages, notes from telephone calls, and letters you send us. You may send us information that relates to the circumstances of your present situation, this may include medical or financial information including bank statements.
Marketing preferences - whether you agree to let us send you marketing emails, marketing mail, social media and targeted advertising, or telemarketing.
Financial - transactions you have made, your previous addresses, data in public records and credit scoring, affordability information that you provide to us. We use this to assess any credit applications you make or any subsequent credit increases where applicable and to help you manage your repayments with us.
Payments - your bank account details and details of any other payment method you use when you shop with us.
Opinions - any feedback you give us when you complete one of our questionnaires or surveys.
Special category - where you have provided data about your specific accessibility needs and personal circumstances, we will use this data to help you access and/or manage your account and statements.

Where we get your data from

We mostly get data directly from you. But we also get data from other places, including:

The Central Credit Register - provide data about your identity, financial history, and other data. We use this to assess whether we can open a credit account for you or review your credit limit in the future.
Fraud prevention agencies - help us check that you are who you say you are, and to prevent fraud and money laundering.
Courier service providers - share data with us relating to delivery and returns enabling us to provide alternative delivery arrangements for example next day delivery, collection services and ensuring we can find remote locations.
Online marketplaces - companies like Amazon and eBay give us your order information when you buy our products directly from their website this is to ensure we can fulfil your order and, in the timescales, requested.
Regulatory bodies - such as Customs and Excise, the Central Bank of Ireland, the Data Protection Commissioner and the Competition & Consumer Protection Commission (CCPC) who will provide data to us if they have to deal with a complaint, you may have made.

And

Market research agencies - pass on information you and other customers may give them about how satisfied you are with our products and services.
Data brokers - we may buy basic postal address details from these companies. We use this data for direct mailing purposes only and to confirm your preferences, so that we tell you about our products and services, unless you have asked us not to.
Social media channels - if you interact with our brands on social media platforms, companies like Twitter and Facebook will let us know.
Online identifiers - when you access our websites, depending on your cookie or web browser settings, we may receive certain data such as IP addresses, device ID, service access logs, cookies which you can change at any time in your device or browser settings.

Why and how we use your personal data.

We are only allowed to use your personal data where we have what is called a lawful basis for doing so. This is what that means in practice.

Opening a Personal Credit Account+

When you apply for a credit account or wish to check your eligibility for a credit account, we use your personal data to help us decide whether to accept your application, and how much credit we can offer you. This involves accessing and sharing data with the Central Credit Register. We also use ID and verification, as well as fraud detection and prevention tools offered by the Central Credit Register and fraud detection service providers, where applicable.

For more information on our use of the Central Credit Register, please see Data Sharing > the Central Credit Register.

Categories of personal data

Name
PPSN
Home address
Contact details
Date of birth
Financial
Identity Checks using data provided above
Fraud checks using photographic ID e.g., passport or driving license.

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Opening a Cash Account+

We collect the personal data you provide to us when opening a personal cash account. This includes any payment methods you gave us when you set up the account.

Categories of personal data

Name
Home address
Date of birth
Contact details

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Managing Your Personal Account+

We use your personal data to administer and to operate your personal credit or cash account. We collect and use the contact details that you provide to us to communicate with you about your account and in relation to the products and services we provide to you, including sending order history and statements, service messages and other documents via email. You can add or update your payment details within the account management settings at any time.

Categories of personal data

Name
Address(es)
Contact details
Order information
Payment information

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Making a Purchase+

We collect any personal data and payment information that you provide for the purposes of processing your order. We process all card transactions securely in line with regulations and encrypt the payment details before sending to our card payment and banking provider.

Categories of personal data

Name
Delivery address
Contact details
Order information
Payment information

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Delivering Your Goods+

We use personal data such as name, delivery address, phone number and email address when we arrange delivery of the things you buy from us.

We also share this data with our select suppliers and delivery partners. These delivery partners will also use the data to contact you and arrange a delivery time, and to keep you updated about when your order will arrive.

Categories of personal data

Name
Delivery address
Contact details
Order information

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Processing Returns and Refunds+

We use your customer account and contact details to verify and process any returns and refunds.

Categories of personal data

Name
Address(es)
Contact details
Order information
Payment information

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Managing Your Credit Account and Payments+

We use your personal data to help you access your account and statements or manage your repayments. This may include processing details of any vulnerabilities; health concerns or accessibility needs (special category personal data).

We use your personal contact data, payment history and credit information that we obtain rom the Central Credit Register and any additional information that you may provide to us to determine whether and when to increase or reduce your credit limit.

We will continue to exchange information about your account and transactions with the Central Credit Register for as long as you are our credit account customer.

For more information on our use of the Central Credit Register, please see Data Sharing > The Central Credit Register.

We may also share your personal data with individuals or organisations you have authorised to act on your behalf and manage your account. For example, debt management companies, legal or financial advisors, and insolvency experts.

Categories of personal data

Name
Address(es)
Date of birth
Contact details
Marital status
Order information
Payment information
Financial information
Health data and any other special category data

Lawful basis

We need to use your data because we have a legitimate interest, including making sure we can recover any payments due.

We will ask for your explicit consent if we need to use any special category data such as health data. You can withdraw your consent at any time - please see [Right to Object] on how to withdraw your consent and what this means for your account.

Loyalty Schemes+

If you register for a loyalty scheme on a specific brand, we use your personal data like this:

We share your data with third-party partners so that they can manage and deliver your rewards on our behalf.
To tailor your rewards to you, make them available when you log in to your customer account, and send details to the email address you give us.

Categories of personal data

Name
Address
Contact details
Order information
Payment information
Financial information
Marital Status
Health data and any other special category data

Lawful basis

We need to use your data for a contract we have with you, or to enter into a contract with you.

Queries and Complaints Management+

We use your personal data and account history to check that you are who you say you are and to deal with your complaint when you contact our contact centre.

We log the details of every complaint we get and deal with them as soon as possible.

We may also share your personal data with individuals or organisations you have authorised act on your behalf and manage your account. For example, debt management companies, legal or financial advisors, and insolvency experts.

Categories of personal data

Name
Address
Contact details
Order information
Payment information
Financial information
Marital Status
Health data and any other special category data

Lawful basis

Your personal data may be processed where we have a substantial legitimate interest, including to ensure that we manage complaints and customer issues appropriately and within regulatory requirements.

We will ask for your explicit consent if we need to use any special category data such as health data. You can withdraw your consent at any time.

Insurance Claims+

If you make a claim against us, either about a product or a personal injury claim, we use your personal data plus any supporting evidence that you give to us, to deal with your claim. We share this data with our insurance companies and claims handers, too.

If your claim is not covered by our insurance policy, we may also need to share your personal data with our internal Legal team and, in some cases, outside lawyers.

Categories of personal data

Name
Address(es)
Contact details
Order information
Financial information
Health data and any other special category data

Lawful basis

We process your personal data on the basis that we have a substantial legitimate interest in managing and defending any claim.

Fraud Prevention+

Before we provide products or services to you, we run checks to make sure that you are who you say you are.

To do this, we use data from external agencies and if we identify fraud we pass the data of this activity such as name, address and email address to these agencies to help protect individuals and other businesses from the threat of fraud in the future.

Based on the Criminal Justice Act 2010 (Anti-Money Laundering Directive 4), we are required to ask the question about Politically Exposed Persons when offering a credit account to individuals.

A politically exposed person/ or connection to a politically exposed person can put a customer into a higher-risk category, however, it does not incriminate any individuals or entities.

Stating Yes to this question Will Not affect your application or our credit decision. The Central Bank of Ireland requires us to gather this information on every credit account. Please see Central Bank of Ireland | Banc Ceannais na hÉireann for further information.

We also share the data we get from you with fraud prevention and law enforcement agencies who use it to prevent fraud and money-laundering and to check your identity. If fraud is detected, we may refuse to provide you with products, services, or credit account facilities.

You can see how your information is used by us and fraud prevention agencies, and read up on your data protection rights, at CCR Data Protection Notice.

Categories of personal data

Name
Address(es)
Contact details
Date of birth
PPSN
Marital status
Order information
Employment status
Financial information
Online identifiers

Lawful basis

We process your personal data on the basis that we have a substantial legitimate interest in preventing fraud and money laundering, and to verify identity, to protect our business and comply with laws that apply to us.

Such processing is also a contractual requirement of the services or financing you have requested.

Call Recording+

We may record inbound and outbound calls from our contact centre for quality assurance/audit, regulatory compliance, due diligence, training, and monitoring purposes.

We keep all call recordings for a period of 12 months

Categories of personal data

Name
Contact details
Address(es)
Date of birth
Order information

Lawful basis

We process this information on the basis of complying with our legal and regulatory obligations to the CBI (The Central Bank of Ireland) to record all communications relating to orders and trading.

We also process your personal data on the basis that we have a substantial legitimate interest to provide the best possible service to our customers and realise any improvements that can be made to those services.

Improving our Products and Services+

We may use your personal data to contact you to ask you to complete a product review or a customer satisfaction survey. We may also invite you to research and focus groups.

We share your personal contact details with research companies who research customer satisfaction programmes for us.

Occasionally, we ask the research companies not to say that they are contacting you on our behalf, because we do not want to influence your answers. The market research company must let you know if you ask them to, at the end of the survey.

Categories of personal data

Name
Contact details
Address(es)
Order information
Date of birth
Title

Lawful basis

Your personal data may be processed where we have a legitimate interest, which is to keep improving the service we offer.

Direct Marketing - Email+

If you tell us that we can, then we will email you details of our latest products, services, and promotions. We also use marketing profiling techniques to tailor our offers to you, to make sure our marketing content is relevant for you. We also use your date of birth to send you offers on your birthday.

We create and keep records of how long you spend reading, and where you click, on the emails we send you, using industry standard technologies such as pixels and gifs.

You can opt-in or opt-out of our marketing activity at any time. Please see the Changing Your Marketing Preferences section below for more information.

Categories of personal data

Name
Email
Date of birth
Order information

Lawful basis

We use your personal data to send you marketing emails, to promote our products and services. We will only send you marketing emails where we have your consent.

Direct Marketing - Telemarketing+

If you tell us we can, we will use your telephone number to call you and tell you about our latest products, services, and promotions. We also use marketing profiling techniques to tailor our offers to you, to make sure our marketing content is relevant for you.

If you have subscribed to the Telephone Preference Service (TPS), we will not phone you, unless you have consented to get telemarketing calls from us.

You can opt-in or opt-out of our marketing activity at any time. Please see the Changing Your Marketing Preferences section below for more information

Categories of personal data

Name
Telephone number
Order information

Lawful basis

We use your personal data to contact you via telephone where we have a legitimate interest to promote products and services and you have not objected to this or if you have provided express consent (for example if you are on the TPS but still wish to hear from us in this way).

Direct Marketing - Direct Mail (Post)+

We use your name and address to mail you personalised marketing. We also use marketing profiling techniques to tailor our offers to you, to make sure our marketing content is relevant for you.

You can opt-in or opt-out of our marketing activity at any time. Please see the Changing Your Marketing Preferences section below for more information.

Categories of personal data

Name
Home address
Order information

Lawful basis

We use your personal to send you direct marketing by post where we have a legitimate interest to promote our products and services and you have not objected to this or if you have provided express consent.

Social Media+

We use social media to hear and understand what our customers think about us, and our products and services.

Sometimes, we may contact you directly on social media if we would like to share your comments or pictures with other customers or if we would like to publish them in our marketing materials. We will always ask you for consent to use your data in this way.

Categories of personal data

Name
Contact details
Reviews
Images
Social networks

Lawful basis

Your personal data will be processed to engage with you on social media where we have a legitimate interest to promote our products and services and to respond to queries raised using social medial channels.

We will also process your personal data in this way where you have provided consent.

Profiling and Interest Based Advertising+

We will use your personal data to send you online targeted marketing information about our product offers and promotions through social media.

To do this, we will share your email address in a secure manner with social media companies (like Facebook, for example) who match our advertising requirements to your social media profile.

Categories of personal data

Lawful basis

We use your personal data to send you targeted advertising, where we have a legitimate interest to promote our products and services.

We will only be able to do this if you have selected this service within your social media account marketing preference settings.

Changing Your Marketing Preferences

Email Marketing+

You can change your marketing preferences for email marketing at any time by:

Clicking unsubscribe in the body of the email sent to you.
Going online to My Account; or
Ringing the call centre on 01 8300800.

Please allow 48 hours for your changes to be processed.

Telemarketing+

You can change your marketing preferences for telemarketing at any time by:

Going online to My Account; or
Ringing the call centre on 01 8300800.

Please allow 48 hours for your changes to be processed.

Direct postal marketing+

You can change your marketing preferences for direct postal marketing at any time by:

Going online to My Account; or
Ringing the call centre on 01 8300800.

Please allow 48 hours for your changes to be processed. You may still receive direct postal marketing materials which have already been processed before we received your request for up to 2 months.

Social Media Marketing+

You can exercise your right to object to social media marketing at any time by:

Going online to My Account; or
Ringing the call centre on 01 8300800.

Please allow 48 hours for your changes to be processed.

Data Sharing

It is necessary for us to transfer personal data to other organisations, to operate our business, meet legal obligations, provide our services and to offer benefit to our customers.

When we do this, we only transfer the data that we need to, and we make sure that the personal data is protected throughout this process.

Sometimes, we are required to share personal data with third parties including government agencies, service providers, and external auditors. We will share your personal data with third parties when it is:

required by law.
requested by a regulator.
necessary to operate our business.
necessary to manage its contractual relationship with you.
in the public interest to do so.
necessary for the performance of our services.
necessary for fraud detection, crime prevention or investigating errors or issues; or
a court orders us to do so.

The third parties identified below include service providers, contractors, agents, and government bodies.

Third Party categories

Companies within Oxendales and the JD Williams & Company Ltd corporate group+

Purpose
Credit assessment purposes, for fraud prevention purposes or for the provision of other products and services.

Credit reference agencies and fraud prevention agencies+

Purpose
Check your identity, credit assessment, and prevent fraud

Operational service providers+

Purpose
To operate or support business operations and core infrastructure, such as IT services and courier delivery services.

External auditors+

Purpose
Variety of audit checks to assure compliance with policies, processes and any legal or regulatory requirements

Insurance and legal services+

Purpose
To provide insurance policy covers, handle claims under the policies, and to provide independent legal advice.

Regulatory bodies and government agencies+

Purpose
To meet legal and regulatory requirements

The Central Credit Register+

Purpose
We will request information about you from The Central Credit Register ("CCR") and we will also share your personal data with CCR.

We, CCR and fraud prevention agencies may also use credit records for statistical analysis about credit, insurance, and fraud. This is not personal data but is aggregated for the purpose of trend analysis, managing debt and fraud prevention.

You have the right to access your personal records held by the CCR by contacting the CCR directly.

Law enforcement agencies+

Purpose
To prevent, detect and aid the investigation of crime.

We may share your personal data with other third parties, like if we are selling or reorganising our business. We might also share your data to protect our business, our customers, or other people's rights, property, or safety.

We will only transfer your personal data to third parties who adhere to appropriate data security standards and controls. This may include transferring your personal data to third parties who become either joint controllers of the data, or independent data controllers. This will include organisations within the following categories:

Legal services
Regulators and other governmental agencies or law enforcement agencies (including but not limited to the Central Bank of Ireland)
External auditors

If a third-party contact you on our behalf, they can only do so to provide the services you asked for and not to advertise their own products or services. If you have any concerns about the third-party companies we work with, or you would like more information, please contact our Data Protection and Privacy Office at datarequest@oxendales.ie.

International Transfers

We do everything we can to keep your data safe and protected. If we have to transfer your data to another country, we make sure the country can keep your data safe, or we put specific measures in place to protect it ourselves. We also take extra steps to protect your data if we need to send it to countries outside of the UK or the European Economic Area, where the laws may be different.

If you want to know why we might need to send your data to places outside of the UK or the European Economic Area, please get in touch with our Data Protection and Privacy Office at datarequest@oxendales.ie. They can also give you more information about how we transfer data.

Your Rights

You have several rights under data protection and privacy laws. We explain more about your rights below. If you ever wish to exercise your rights, please contact our Data Protection and Privacy Office at datarequest@oxendales.ie.

Likewise, if you are dissatisfied with the information provided, you can complain to the Data Protection Officer at the same address.

The right to access your data+

You have the right to ask us if we use your personal data, and to see and get copies of that data. We will tell you what kind of data we have, where we got it, and who we share it with. To make things easier, we have included most of that data within this privacy policy.

We will provide any data you ask for within one month of your request. If we need more time than that, we will let you know.

Please note that for security reasons, we will not give out any bank account details that we have for you.

The right to correct your data+

If you think the data, we have on you is wrong or incomplete, you can ask us to fix it. We will correct it within one month, unless we do not think it is necessary or appropriate to make the change, in which case we will explain why.

If we need more time to fix the data, we will let you know. If you think we made a mistake, you can email us at, datarequest@oxendales.ie and we will investigate it.

The right to erasure+

You can ask us to delete your personal data in certain situations. For example, when:

We do not need it anymore.
You withdraw your consent.
We are not allowed to have it by law.
You object to us using it and we do not have a good reason to keep it.

There are some cases where we may be unable to comply with your request and delete your information. If that were to happen, we would let you know why.

The right to restrict our use your data+

Sometimes you can ask us to stop using your personal data. For example:

If you think the data, we have on you is incorrect - we will stop using it until we can confirm whether it is accurate or not.
Where you have objected to how we are using it - we will stop until we decide whether our reasons for using it override your objections.
If it is against the law for us to use it
If we do not need it anymore but you want us to keep it because you might need it for legal reasons in the future.

There are some cases where we may be unable to comply with your request. If that were to happen, we would let you know why.

The right to transfer your data+

As JD Williams & Company Limited is responsible for your personal data (what is called a 'data controller'), you have the right to ask us for a copy of it. This must be in a format that allows you to transfer it to another data controller.

Your right to transfer only applies:

To the personal data you yourself have given us
When we are using it because you agreed to it or because it is part of a contract
If the way, we are using the data is automated.

We will try to respond to your request within one month. If we need more time, we will let you know.

Right to object+

You have the right to say that you do not want us to use your personal data. You can do this:

If we are using it for our own legitimate interests, for tasks that are in the public interest, or for official purposes.
If we are using it for marketing purposes
If we are using it for research and statistics

If you object, we will stop using your data, unless we can show that our reason for using it overrides your objection.

The right not to be subjected to automated decisions+

You have the right not to have solely automated decisions made about you. A purely automated decision is when there is no human input in the decision-making process. This right only applies when those decisions have legal consequences or significantly impact you. If this happens, you can ask for a human to make the decision.

You can also ask for information about how the decision was made and what the consequences will be.

Complaints and Concerns

If you want to complain about the way we use your data, it is best to contact us first. We will investigate your complaint right away. You can complain to the Data Protection Commission in the Republic of Ireland or the Information Commissioner’s Office in the UK.

To contact The Data Protection Commission:

Visit: Data Protection Commission

Call: 01 7650100 / 1800437 737

Write to: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

Changes to this Privacy Notice

We may update this notice at any time. You will see any changes we make on this page.

How to contact Us

If you have any questions, comments, or requests to make about this privacy notice or your rights, here is how to contact us:

Data Protection and Privacy Office
Oxendale & Co Ltd
Woodford Business Park
Santry
Dublin 17
D17 W995
datarequest@oxendales.ie

Oxendale & Co Ltd is a subsidiary company of JD Williams and Company Limited.

If you are at all dissatisfied with the information provided by the Data Protection and Privacy Office, please address any complaints to the Data Protection Officer at the same address.