1 Who we are
1.1Curated Sourcing is a trading name of BRK Trading Limited, a company registered in England and Wales under company number 08076891, with its registered office at 159 High Street, Barnet, England, EN5 5SU. In this policy, we, us and our mean BRK Trading Limited.
1.2We are the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office under registration number [to confirm].
1.3For any question about this policy or your personal data, contact us at [privacy email] or write to our registered office, marked for the attention of the Privacy Lead.
2 Scope of this policy
2.1This policy applies to personal data about website visitors, people who enquire or submit a brief, contacts at our customers and prospective customers, contacts at our suppliers and production partners, and people we meet at trade shows and events.
2.2Our consumer brands, Sips and GLOAT, have their own privacy policies on their own websites. This policy does not cover them.
2.3Our website and services are intended for businesses and are not directed at anyone under 18.
3 The personal data we collect
3.1We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity and contact | Name, job title, company, business email address, telephone number |
| Enquiry and project | Information you give us through the Contact page or Brief Builder, including project details, quantities, budgets, timelines and files you upload |
| Meeting bookings | Name, contact details, chosen date and time, and any notes you add when booking through our Meeting Calendar |
| Account | Login email, encrypted password and account activity if you register for an account on our website |
| Marketing | Your subscription preferences, Trend Deck downloads, and whether you open or click our emails |
| Transaction | Order history, invoices, payment records and delivery details for your business |
| Technical | IP address, browser and device type, pages visited, referring website and cookie identifiers |
| Event and third party | Details from trade show badge scans, business cards, referrals, LinkedIn and public sources such as Companies House and company websites |
3.2We do not ask for, and you should not send us, special category data such as health information, or information about criminal convictions.
3.3Most of this data comes from you directly. Event and third party data comes from event organisers, the people who refer you to us, and publicly available business sources.
4 How we use your data and our lawful bases
4.1We use personal data only where UK GDPR gives us a lawful basis to do so:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries, briefs and meeting requests, and preparing proposals, samples and quotations | Steps taken at your request before a contract; otherwise our legitimate interest in responding to business enquiries |
| Delivering projects: development, production, inspection, logistics and delivery | Performance of our contract. Where the contract is with your employer, our legitimate interest in performing it |
| Invoicing, accounting, tax and record keeping | Legal obligation |
| Managing our relationships with suppliers and production partners | Performance of our contract; legitimate interests |
| Following up with people we meet at events | Legitimate interest in developing our business |
| Sending business marketing such as trend insights, news and event invitations | Legitimate interests for corporate email addresses; consent where PECR requires it, including for sole traders and partnerships |
| Operating and securing our website and user accounts | Legitimate interests |
| Analytics and marketing cookies | Consent |
| Establishing, exercising or defending legal claims | Legitimate interests |
4.2Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they are not overridden. You can ask us for details of that assessment.
4.3We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5 Marketing
5.1We send business marketing only about our own services. Every marketing email includes an unsubscribe link, and you can also opt out by contacting us.
5.2If you opt out, we keep your email address on a suppression list so that we do not contact you again by mistake.
5.3We never sell personal data or share it with third parties for their own marketing.
7 International transfers
7.1Some recipients are outside the UK, in particular our production partners in China and service providers in the United States.
7.2We transfer personal data outside the UK only where the destination has UK adequacy regulations, where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework, or where we use the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
7.3You can ask us for a copy of the safeguards relevant to your data.
8 How we protect your data
8.1We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls and multi-factor authentication on our business systems, and restricting access to staff who need it.
8.2If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and, where the risk is high, tell you without undue delay.
9 How long we keep your data
9.1We keep personal data only as long as necessary for the purposes in this policy:
| Data | Retention period |
|---|---|
| Enquiries, briefs and prospect records that do not become customers | 3 years from our last meaningful contact |
| Customer and supplier records, contracts, invoices and order history | 6 years from the end of the financial year of the last transaction |
| Meeting bookings | 2 years from the meeting date |
| Website accounts | Until the account is closed, then deleted within 90 days |
| Marketing records | Until you unsubscribe; the suppression entry is kept indefinitely |
| Cookies | As set out in section 12 |
9.2When data is no longer needed, we securely delete or anonymise it.
10 Your rights
10.1Under UK GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict our use of your data in certain circumstances;
- object to processing based on legitimate interests, and object at any time to direct marketing;
- receive data you gave us in a portable format, where processing is based on consent or contract; and
- withdraw consent at any time, without affecting processing that took place before withdrawal.
10.2To exercise a right, contact us at [privacy email]. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex requests, and we will tell you if that applies. There is normally no fee.
11 Complaints
11.1If you are unhappy with how we have handled your data, please contact us first at [privacy email] so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay.
11.2You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
13 Links to other websites
13.1Our website links to other websites, including those of our customers and partners. We are not responsible for their privacy practices, and we encourage you to read their policies.
14 Changes to this policy
14.1We may update this policy from time to time. The last updated date at the top of this page shows when it last changed. Where a change materially affects how we use your data, we will take reasonable steps to tell you.