Introduction
Euro CCTV is the data controller for the personal information collected through this website and through trade-account onboarding. In practice, that means we decide how the information is used and are responsible for it. The law we process it under is the Data Protection Act 2018, read together with the UK GDPR.
Information we collect
Opening a trade account, placing an order and contacting us each involve some personal information, and we collect what is needed to deal with the request in hand:
- Your name and business name, with billing and delivery addresses
- A work email address and a contact telephone number
- Payment details, which our payment provider processes; we never store full card data ourselves
- Your order history, your quotes and any correspondence with our team
Lawful basis for processing
Data protection law asks for a lawful basis behind each use of personal data, and we rely on three. The first is performance of a contract, which applies once you have placed an order or opened a trade account. The second is legitimate interest, which covers fraud prevention, account administration and product correspondence with active trade buyers. The third is consent, which applies to optional marketing communications.
How we use your information
Personal information is put to work processing orders, running your trade account, giving customer and technical support and sending correspondence about your orders. It is also used to meet our legal obligations, the VAT records and statutory retention periods among them.
Data security
Protecting personal data from unauthorised access, loss and misuse takes both technical and organisational measures, and we apply both as appropriate. Whenever data is in transit it is encrypted with TLS, and payment data is handled by a PCI-DSS compliant provider.
Records of website activity
Quite apart from analytics, we keep a record of what happens on the website. The reason is evidential: when an order is disputed, an account looks to have been taken over, fraud is suspected or our catalogue and pricing are being scraped by automated tools, this record is what we investigate with.
In practice the record notes the kind of device in use, with its operating system and browser (for instance “phone, Android, Chrome”); which pages were visited, and when; what was done there, whether signing in, an unsuccessful sign-in or signing out, adding to the basket, requesting a quote, beginning checkout, placing an order or downloading a file; and the IP address the visit came from. Where the account belongs to a member of staff, it also notes any edit made to a record, what the edit altered, and any attempt to open something that was refused.
Just as deliberately, some things are never recorded. Web addresses are cut short at the “?” before they are stored, because the part after it may hold a sign-in link or a password-reset token. Card numbers, passwords and security codes are removed before anything is kept. Nor does the record capture how you move the mouse and scroll, your keystrokes or what you type.
Which lawful basis applies depends on whether you are signed in. If you are, the record is associated with your account and we rely on legitimate interest, namely the security of accounts and payments, the prevention of fraud and the settling of disputes about an order: what it contained and who placed it. We do not rely on consent here, the reason being that a protection any visitor could disable would protect no one. We have weighed that interest against yours: the record holds no more than those purposes require and nothing of what you type; searching it is open only to staff specifically authorised to do so; it lapses once six months have passed; and each search made in it is itself recorded.
For a visitor who is not signed in, consent takes the place of legitimate interest. Nothing is recorded unless you accept analytics cookies through the cookie banner. Making no choice counts as refusing, and refusal stays open to you at every point. What is recorded is then keyed to a random browser identifier and carries no name, email address or postal address.
As a rule, an activity record is deleted automatically once it is 180 days old. The exception is a short list of events that matter most for security: each of these is copied, in addition, into an audit log that is kept for longer.
- a change to anyone’s permissions
- money returned to a customer
- a sign-in
- any occasion on which staff open a customer’s records
- data taken out of the system in an export
The reason for keeping those longer is that a legal claim may one day need defending or resolving, and the audit log is the evidence we would rely on.
Access is deliberately narrow. Only named Euro CCTV staff can open the record, and only once they have been explicitly given access in order to provide support, maintain security or investigate fraud. Colleagues without that grant cannot see it, advertisers never receive it, and it is not for sale.
You are entitled to a copy of your record and to have it deleted, and, in so far as legitimate interest is the basis, you may object to our keeping it. As for the analytics part, your consent to it can be withdrawn whenever you wish, from your browser’s cookie settings. The support panel below is the place to make any of these requests, and a complaint to the ICO, as described in clause 8, is open to you about this record too.
Your rights
Whatever personal data of yours we hold, you are entitled to see it, correct it or have it deleted. Certain processing can also be objected to or restricted at your request, and your data can be provided to you in a portable form. The support panel below has the details to use for any of these requests.
Separately, you have the right to lodge a complaint with the ICO, the UK’s Information Commissioner’s Office, whose website is ico.org.uk.