Frasers Group consists of different brands and legal entities and the companies responsible for
the processing of your personal data is dependent on the purpose for which it is collected. For each processing purpose you will be informed of the responsible company or companies.
We take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of your personal data, including encrypting your data to applicable industry standards. This policy covers CCTV footage collected from SportsDirect stores in Malta (“the Stores”) which are operated by Hudson Malta Sales Limited (C32438) (“Hudson”).
Any changes we make to this policy will be reflected on this page.
Who we are?
Hudson and SportsDirect.com Retail Ltd., whose registered address is Unit A, Brook Park East, Meadow Lane, Shirebrook, United Kingdom, NG20 8RY (“SDI”) are joint controllers in respect of personal data collected when you visit or work at the Stores. If you have any queries regarding our use of your personal data or this privacy policy, you can write to SDI at Data Protection: Unit A, Brook Park East, Meadow Lane, Shirebrook, United Kingdom, NG20 8RY or email to [email protected]. As operator of the Stores, Hudson is a joint controller in respect of personal data collected by SDI when you visit or work at the Stores. If you have any queries regarding Hudson’s use of your personal data you can write to Privacy Team, Hudson House, Burmarrad Road, Burmarrad, SPB9060 or email to [email protected].
Information we may hold about you and how we use it
When you work at or visit the Stores we collect CCTV footage to monitor and record images for the purposes of security, the prevention and detection of crime and health and safety and to ensure compliance with the Store’s processes and procedures. These images are stored centrally.
We can only use your personal data for the above-specified legitimate interests. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests such as to ensure a safe and secure work and shopping environment.
How long we keep your information
We will only keep your personal data for seven (7) days and for a longer period if they are relevant to an incident, complaint, investigation or legal proceedings.
How we might share your personal data
We will share your personal data with other companies in the Group which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.
We may share your personal data in connection with any merger, acquisition, insolvency situation or otherwise, in which case we will only disclose your information so far as is necessary.
We may also share your personal data with our professional advisers, including, without limitation, our lawyers and/or insurers. We only allow our service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers relating to ensure they can only use your personal data to provide services to us and to you. In the event that we were to sell our business or assets, we may disclose your personal data to any prospective/actual purchaser and/or their advisers. We may also disclose your personal data where we are subject to a legal obligation to do so, in connection with the prevention or detection of crime, for the purpose of establishing, exercising or defending our legal rights, or where we consider that we receive a valid request for disclosure. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
You should be aware that we may disclose your personal data to law enforcement agencies such as the Police, or any other regulatory or government authority investigating suspected illegal activities we may disclose and exchange your personal data or any other information we obtain about you.
Where we store your personal data
The personal data that we collect from you may be transferred to and stored outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers, third party providers, including, Direct Supply partners and middleware providers. Where we do so, the third country’s data protection laws will have been approved as adequate by the European Commission, or other applicable safeguards are in place.
Your rights
You have the following rights which, in most cases, you can exercise free of charge:
| Right of Access
This is commonly referred to as a Subject Access request or ‘SAR’. |
The right to be provided with a copy of your personal data and to certain other supplementary information that this Privacy Policy is already designed to address. |
| Right to Rectification | The right to have inaccurate personal data rectified e.g., if you consider that your personal data is incorrect, out of date or incomplete. |
| Right to Erasure
This right is also known as ‘the Right to be Forgotten’. |
The right to require us to delete your personal data.
This right is not absolute and only applies in certain circumstances. |
| Right to Restrict Processing | The right to restrict the processing of your personal data where you may have a particular reason for wanting the restriction.
This right is not absolute and only applies in certain circumstances. |
| Right to Data Portability | The right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format. It also gives you the right to request that we transmit this data directly to another data controller. |
| Right to Object | The right to object to the processing of your personal data at any time. This effectively allows you to stop or prevent us from processing your personal data.
The right to object only applies in certain circumstances. You have the absolute right to object to the processing of your personal data if it is for direct marketing purposes (refer to section below). |
| Rights related to automated decision- making including profiling | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. |
| Your right to withdraw consent | Where you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent |
If you would like to exercise any of these rights, please write to the Hudson Privacy Team at Hudson House, Burmarrad Road, Burmarrad, SPB9060, Malta or email to [email protected]
If we choose not to action your request, we will explain the reasons for our refusal.
To maintain the security of our customers’ personal details, we may need to request proof of identity before we disclose personal data to you in response to any of the above requests.
How to complain
ope that the Data Protection team can resolve any query or concern you may raise about our use of your personal data.
However, if you feel that your personal data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), competent Supervisory Authority for the Controller in Malta, if you deem it necessary to do so.
The complaint may be submitted online through this link (subject to change): https://idpc.org.mt/en/Pages/contact/complaints.aspx