This Privacy Notice explains how ARRAN’S Bagels (“ARRAN’S”, “we”, “us” or “our”) collects, uses, stores and shares your personal information when you visit our shops, use our website or online services, join Bagel Club, get in touch with us, or take part in our events, competitions and promotions.

We take your privacy seriously and are committed to handling your personal information responsibly and in accordance with applicable data protection law. This notice explains what information we collect, why we collect it, how we use and protect it, and who we may share it with. It also explains your rights and how you can contact us if you have any questions or want to exercise those rights.

The organisation responsible for your personal information (the data controller) is:

Registered office:

Company Registration:

ICO Registration Number:

Contact Details: hello@arransbagels.com

Personal data means information that identifies you or can be linked to you, such as your name, email address, date of birth or phone number.

Services means our shops, website, online ordering, Bagel Club, customer communications, events and promotions.

Bagel Club means our customer loyalty and rewards programme, including membership, visit tracking, rewards and, where applicable, marketing and communications.

You means the individual whose personal information is covered by this Privacy Notice.

Contact details, such as your name, email address, date of birth and phone number, for example when you sign up to Bagel Club or contact us.

Loyalty and transaction information, such as Bagel Club membership details, visits, rewards, vouchers and relevant purchase information, where applicable.

Marketing preferences, including whether you have opted in or out of particular communications.

Event, competition and promotion information, such as entries or details needed to administer a giveaway, promotion or event.

Messages and feedback, including customer service enquiries, reviews and complaints you send to us.

Technical and usage information, collected through our website or digital services where applicable, such as device, browser and cookie information.

We will only collect information that is relevant to the purposes explained in this Privacy Policy. The exact information we collect will depend on the service you use and how you interact with ARRAN’S.

10

12

Managing Bagel Club, including creating and managing memberships, tracking eligible activity and providing rewards or vouchers.

Processing orders and transactions, and responding to questions about purchases.

Sending marketing communications about menu launches, offers, events and ARRAN’S news where we are permitted to do so and, where required, you have given consent.

Managing your communication preferences, including recording and respecting opt-out requests.

Running competitions, giveaways, events and promotions, including contacting winners where relevant.

Responding to customer service enquiries, feedback and complaints.

Understanding how our services and promotions are used so we can improve our customer experience.

Maintaining security and preventing misuse, as well as meeting our legal and regulatory obligations.

Working with marketing partners, where appropriate and where you have provided the relevant consent or otherwise permitted us to do so in accordance with your communication preferences.

Our website may use cookies and similar technologies to help it function, improve your browsing experience and understand how visitors use our website.

For more information about the cookies used on our website and how to manage your preferences, please refer to our Cookie Policy or our cookie settings, where available.

We may share information with trusted third party service providers who help operate our loyalty programme, payments, website or provide technical services for day to day operating.

Data protection law requires us to have a lawful basis for using your personal information. Depending on the purpose, this may include:

• Contract: where information is needed to provide a service or fulfil the terms of a membership or transaction.

• Consent: where you have given permission for a specific use, such as certain marketing communications or non-essential cookies.

• Legitimate interests: where using your information is necessary for our legitimate business interests, provided those interests do not override your rights and interests.

• Legal obligation: where we need to use or retain information to comply with a legal or regulatory requirement.

The applicable lawful basis depends on the specific processing activity.

We retain personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, including where necessary to meet legal, accounting or reporting requirements.

When personal information is no longer required, we will securely delete it or anonymise it where appropriate.

Under UK data protection law, you have a number of rights in relation to your personal information. These include:

• The right of access: you can ask us for a copy of the personal information we hold about you.

• The right to rectification: you can ask us to correct information that is inaccurate or incomplete.

• The right to erasure: you can ask us to delete your personal information in certain circumstances.

• The right to restrict processing: you can ask us to limit how we use your personal information in certain circumstances.

• The right to data portability: you can ask for certain personal information to be provided to you, or transferred to another organisation, in a commonly used and machine-readable format.

• The right to object: you can object to certain ways we use your personal information, including direct marketing.

• Rights relating to automated decision-making and profiling: in certain circumstances, you have rights in relation to decisions made about you using automated processes.

Some of these rights only apply in certain circumstances and may be subject to exceptions.

If you would like to exercise any of your rights, please contact us using the details provided in this Privacy Notice. We may need to keep certain information where we have a legal obligation or other lawful basis to do so.

Our website and communications may include links to websites, apps or services operated by third parties. These services have their own privacy policies and practices, so we recommend checking their privacy information before providing them with your personal information.

We are not responsible for the privacy practices or content of websites and services that we do not operate.

We may update this Privacy Notice from time to time. The latest version will always be available on the ARRAN’S Bagels website, with the date of the latest update shown at the top of the notice.

If you have a question or concern about how we use your personal information, please contact us using the privacy contact details provided in this Privacy Notice (hello@arransbagels.com)

6

7

8

9

11

13