Supplier Privacy Notice

Percussion Play issues this Privacy Notice to all vendors, suppliers and potential suppliers for the purposes of providing clear information about collection, processing and storage of business and personal data. This Privacy Notice has been produced to satisfy our legal responsibilities in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) collectively referred to as the Data Protection Regulations. This notice doesnot form part of any contract

PURPOSE

This privacy notice describes how we collect and use personal information about you, both before, during and after your working relationship with us, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), collectively referred to as the Data Protection Regulations.

DATA CONTROLLER

Percussion Play Ltd (company registration number 07639169) is the Data Controller and responsible for personal data.

It is important that you read this notice, together with any other applicable privacy notice(s) we may provide both now and in the future, so that you are fully aware of the detail and rationale in relation to us using such information when collecting or processing personal information about you.

DATA WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about a living, identifiable individual. During most transactions with our suppliers, we will only collect business (non-personal) data.

In the event that we are required to collect personal data we will only do so when permitted by law. We will at the time of collection make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

The categories of information that we would collect, process, hold and share include:

Identity Data (e.g. your name, date of birth and other identification information)
Contact Data (e.g. your postal address, phone number, email address and mobile number)
Business Financial information (e.g., bank account details), where the supplier is a natural person
Background checks relating to the supplier (where a natural person)
Your/your employees’ interactions with us

We also collect, process, hold and share information gathered from your use of our website, including:

Usage Data regarding how you use our website
Technical Data including use of cookies (see COOKIES)

Aggregated Data such as statistical or demographic information is also collected, but is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

If you visit our social media pages or view our content on social media platforms both we and the social media platform provider collect information about you, such as:

what you say (comments) or your actions (liking and sharing)
your country or region (or your precise location if you have provided this in your user profile and you are logged in)
your device and internet connection; and
your social media profile details and user ID.

If you have allowed the use of tracking cookies on the social media platform, the information we collect will also include what you click on and what you view.

SPECIAL CATEGORY DATA

Collect special category data relating to our suppliers is expected to be rare.

Certain personal data (known as special categories of data) is subject to additional safeguards under data protection legislation. Such information includes details of

your racial or ethnic origin;
your political opinions;
your religious beliefs or other beliefs of a similar nature;
whether you are a member of a trade union;
your physical or mental health or condition;
your sexual life;
the commission or alleged commission by you of any offence, or
any proceedings for any offence committed or alleged to have been committed by you, the disposal of such proceedings or the sentence of any court in such proceedings.

It may be necessary for us to process such personal data in order to comply with legal or regulatory obligations (including making reasonable adjustments for natural persons with disabilities), because it is in the public interests, or if we need to do so in order to seek confidential legal advice, or establish or defend legal claims. In some cases we will process it on the basis that we have your consent to do so.

COOKIES

We use cookies and similar technologies on our websites and apps, and in our emails. Cookies are text files that gather small amounts of information, which your computer or mobile device stores when you visit a website or use an app. When you return to the website or app, or visit websites and apps that use the same cookies, they recognise these cookies and your device.

We use cookies to do many different jobs, like letting you navigate between pages efficiently, remembering your preferences, and generally improving your online experience. They can also make sure that the adverts you see online are more relevant to you and your interests.

We also use cookies in some of our emails to help us understand how you interact with our emails and to help us improve our future email communications.

If you’ve allowed us to use cookies that support our marketing on social media platforms, it will allow the social media platform provider (such as Facebook) to collect information about you, your device and which ofourweb pages you have visited. This information allows usto show you relevant products and services on social media platforms.

The cookies policy on our website gives you more information on cookies, how and where we use them, and how you can control them.

You can set your browser to refuse all or some browser cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see https://www.percussionplay.com/cookie-policy.

HOW DATA IS COLLECTED

We use different methods to collect data from and about our suppliers including:

Direct interaction with you
Via Automated technologies such as our use of Cookies.

We may also receive personal data from third parties and public sources, for example:

People appointed to act on your behalf
Businesses you own or with which you are associated - Identity verification services
Review websites and referees
Contact and Financial Data from providers of technical, payment and delivery services such as WorldPay.
Identity and Contact Data from publicly availably sources such as Companies House and the Electoral Register.
Analytical data from providers such as Google

HOW WE USE YOUR PERSONAL DATA (OUR LEGAL BASIS)

We must have a legal basis to process your personal data. The legal basis applicable to processing by Percussion Play will usually be one of the following:

To allow us to take actions that are necessary for us to obtain from you a product or service (for example, to make and receive payments);
To allow us to meet our legal obligations (for example, to fulfil regulatory reporting, fraud prevention or similar obligations);
To protect our legitimate interests (for example, to manage our ongoing relationship with you); or
We have your consent to use your information (for example in relation to electronicmarketing or promotional information). To the extent that any processing is based on consent, you have the right to withdraw that consent at any time.

The table below sets our main uses for personal data and the legal bases for doing so. Where our legal basis is a legitimate interest, those interests are also referenced:

Purpose for which data is processed	Legal basis for that processing
To receive products or services from you, including provision of feedback and communications with you regarding queries complaints, and action to put matters right	It is necessary to carry out our agreement or to take steps to enter into an agreement with you. It is in our legitimate interests to protect our business interests and maintain appropriate relationships with our suppliers.
To enable a merger, acquisition, change of control, joint venture or other similar arrangement involving our business.	It is in our legitimate interests to protect our business interests and conduct changes to our structure and ownership.

To the extent that we process special categories of data, relevant purposes include:

Purpose for which data is processed	Legal basis for that processing
To keep to laws and regulations that apply to us, and to co-operate with regulators and law enforcement organisations.	It is necessary in the public interest.

If you decide not to supply personal data that we have requested and as a result we are unable to comply with legal or regulatory obligations, then we may be unable to enter into a contract with you or continue communicating with you.

SHARING YOUR PERSONAL DATA

Your personal data may be seen or used by our staff in the course of their duties, or others lawfully working with us in the ordinary course of our business.

We may need to share your data with appropriate third parties, for example professional advisers, auditors, contractual counterparties in order to fulfil our legal obligations. We may share your personal data with independent third-party service providers with whom you ask us to share information.

We may also need to share your data with your advisers (such as accountants, lawyers and other professional advisers) who you have authorised to represent you, or any other person you have told us is authorised to give instructions on your behalf (such as under a power of attorney).

We may also outsource our support services or engage consultants and others to support us in our business (e.g. secretarial, marketing, courier or IT tasks). Where we do so, relevant personal data is be provided to and processed by the service provider in accordance with the terms of our contract with them and to the extent appropriate for the performance of that contract. They will not share your personal informationwith any organisation apart from us, unless required to by law. All personal data will be held securely and only retained for the period we instruct.

We might need to share or transfer your data confidentially with relevant parties and/or their professional advisers if there is a merger, acquisition, change of control, joint venture or other similar arrangement involving Percussion Play.

We may need to share your personal information to obtain necessary confidential legal advice. We may also need to share your personal data with organisations such as insurers, government and law enforcement agencies or HMRC, to comply with insurance, legal, taxation, public interest or similar obligations. We will not share your information with any third parties for the purposes of direct marketing unless you have given consent for us to do so.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will explain to you the legal basis which allows us to do so.

TRANSFER OF YOUR DATA TO OTHER COUNTRIES

In the course of carrying out the activities referred to above we may transfer your data to other countries, which may not have the same legal protections for your data as the UK.

Where data is being transferred outside of the UK and/or European Economic Area, we will take steps to ensure that your data is adequately protected in accordance with UK legal requirements and the EU GDPR (as applicable).

Otherwise, we may transfer your data if it is necessary for performance of our contractual duties to you, or because we have other legal obligations to transfer the data, or it is necessary for important reasons of public interest. If you require further detail about the protections in connection with any particular transfer, contact the Data Privacy Manager (see CONTACT).

DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Data relating to a specific events or transaction will generally be retained for a period of 6 years following that event or transaction.

We may be obliged to suspend any scheduled destruction or deletion of personal data where legal or regulatory proceedings require it or where proceedings are underway such as require the data to be retained until those proceedings have finished.

DATA SUBJECT RIGHTS

Under the Data Protection Regulations, Data Subjects have the following rights:

Access to personal data
Rectification of incorrect data
Erasure of time elapsed data
Restriction of processing under certain circumstances
To object to certain processing of data
To data portability
To complain to a supervisory authority – in the UK this is the UK Information Commissioner
To withdraw consent

Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

To request access to your data or to exercise any of your rights, please contact the Data Privacy Manager (see CONTACT), preferably in writing. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

If you have any questions about this privacy notice, the practices of our website or your dealings with our website, please contact the Data Privacy Manager (see CONTACT).

CONTACT

Data Privacy Manager Email address: privacy@percussionplay.com Postal address: Percussion Play Ltd, Unit 501 Dunsbury Park, Brooklime Way, Havant, Hampshire PO9 4FF. Telephone number: +44 1730 235180

COMPLAINTS

If you have any concerns regarding our use of your personal data, please contact the Data Privacy Manager in the first instance to allow us to address your concerns.

You have the right to make a complaint to the ICO if you are unhappy with how we have used your data or how we have addressed your concerns:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

CHANGES TO THIS NOTICE

PercussionPlay Limited reserves the right to update this privacy notice atany time, and we will publish a new privacy notice when we make any substantial updates. We may also notify you by alternative means, periodically, about the processing of your personal information.

Version 2.0 March 2024