Countryside Ski & Climb Privacy Policy & Cookies

1. Who We Are and What This Policy Covers

Countryside Ski & Climb Limited, trading as Countryside and countryside.co.uk ("Countryside", "we", "us", "our"), is the data controller responsible for your personal data. We are a company registered in England and Wales (company number 2979298) with our registered address at 118–120 High Street, Stevenage, Hertfordshire, SG1 3DW. We are registered with the Information Commissioner's Office (ICO) under registration number Z1711535.

This policy covers the personal data we collect when you use our website, place an order online, sign up to our emails, contact our customer services team, or visit our store in Stevenage. It explains what we collect, why, how we look after it, and the rights you have over it. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you have any questions about this policy or how we handle your data, please contact us using the details in section 14.

2. The Personal Data We Collect

We collect and process the following categories of personal data:

• Identity and contact data — your name, billing and delivery addresses, email address and telephone number, provided when you place an order or contact us.
• Order and transaction data — details of the products you buy from us, delivery information, returns and refunds, and your purchase history. Where this is linked to you as an individual, it is personal data and we protect it as such.
• Payment data — your card payment is captured and processed by our payment provider, CitrusPay powered by Adyen, in a secure, encrypted environment under the Payment Card Industry Data Security Standard (PCI DSS). Your full card details bypass our own systems and are never stored on them.
• Age-verification data — where you order an age-restricted item such as a knife, multi-tool, ice axe or fuel, confirmation that you are aged 18 or over, as required by law including the Offensive Weapons Act 2019.
• Correspondence — records of your communications with our customer services team by email, telephone or post.
• Marketing preferences — whether you have opted in to receive our marketing emails.
• Technical and usage data — information about how you use our website, such as your IP address, browser type and pages visited, collected through cookies and similar technologies (see section 6).
• CCTV images — if you visit our store in Stevenage (see section 8).

We collect your personal data directly from you. We do not buy in data about you from third parties, and we do not carry out profiling or data enrichment. We do not collect any special category data (such as health, religious or biometric data).

3. How and Why, We Use Your Data

UK data protection law requires us to have a lawful basis for every use of your personal data. We use your data as follows:

• To process and deliver your order, take payment, and handle returns, refunds, exchanges and guarantee claims — because this is necessary to perform our contract with you.
• To verify your age when you order an age-restricted item, and to keep business, accounting and tax records — because we are under a legal obligation to do so.
• To respond to your enquiries and provide customer service, to prevent and detect fraud, to maintain the security of our website, systems and store, and to keep our customer records accurate and up to date — because we have a legitimate interest in running our business efficiently and protecting our customers and ourselves.
• To send you marketing emails about our products and offers — only where you have given your consent by opting in (see section 5).
• To understand how our website is used and to improve it, using analytics cookies — only where you have given your consent (see section 6).

We do not use your personal data for automated decision-making or profiling.

4. Who We Share Your Data With

We share your personal data only where necessary to fulfil your order and run our business, with:

• Our payment provider, CitrusPay powered by Adyen, and your card issuer, as part of the normal process of authorising and taking payment for your order.
• Our delivery carriers — Royal Mail and Parcel Force — who receive your name, delivery address and contact details so that your goods can be delivered and you can receive tracking updates.
• Our IT, website hosting and retail systems providers, who support the systems on which our business runs.
• Our email marketing platform, Omnisend, where you have opted in to marketing, solely for the purpose of sending you, our emails.

All service providers who process personal data on our behalf do so under contracts that require them to keep it secure, use it only on our instructions, and never for their own purposes. We do not sell your personal data to anyone, and we do not share it with third parties for their own marketing or advertising purposes.

We may also disclose personal data where we are legally required to do so — for example, to the police or another regulatory or government authority investigating suspected illegal activity — or to our professional advisers and insurers where necessary to protect our legal rights.

5. Marketing

We send marketing emails only to customers who have opted in to receive them. We will never add you to our marketing list without your consent, and consent you give for one purpose (for example, completing an order) is never treated as consent for marketing.

You can withdraw your consent and stop receiving marketing emails at any time, free of charge, by clicking the "unsubscribe" link included in every marketing email we send, or by contacting us using the details in section 14. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it, and it will not affect service messages we need to send you about your orders.

If you have not opened or clicked any of our marketing emails for 26 months, we will treat your interest as having lapsed and automatically remove your email details from our marketing system, keeping only the minimum needed to ensure we respect your removal.

6. Cookies and Analytics

Our website uses two kinds of cookies:

• Essential cookies — strictly necessary for the website to function, for example to operate your shopping basket, keep your checkout session secure and remember your cookie preferences. These do not require your consent.
• Analytics cookies — we use Google Analytics to understand, in aggregate, how visitors use our website (for example, which pages are most popular and how people move through the site) so that we can improve it. This information does not directly identify you. We do not use advertising, behavioural targeting or social media tracking pixels on our website.

Analytics cookies are set only with your consent, which you can give or refuse through the cookie banner when you first visit our website, and change at any time through the cookie settings link on our site. You can also block or delete cookies through your browser settings, although blocking essential cookies may prevent parts of the website (such as the basket and checkout) from working.

Google Analytics may transfer data to servers outside the UK, including in the United States. Google is certified under the UK Extension to the EU–US Data Privacy Framework, and transfers are made subject to safeguards recognised under UK data protection law. We do not make any other transfers of your personal data outside the UK.

7. How Long We Keep Your Data

We keep your personal data only for as long as we need it:

• Order, transaction and accounting records — for six years after the end of the financial year to which they relate, as required for tax and legal purposes, and to deal with guarantee claims and any disputes.
• Age-verification records for restricted products — for as long as required to demonstrate compliance with the law, including the Offensive Weapons Act 2019.
• Marketing email data — until you unsubscribe, or automatically after 26 months of inactivity (see section 5), after which we keep only the minimum needed to respect your opt-out.
• Customer service correspondence — for as long as necessary to resolve your enquiry and for a reasonable period afterwards.
• Analytics data — retained in accordance with the retention settings of our analytics provider, after which it is deleted or aggregated.
• CCTV recordings — for a short period (typically no more than 31 days) unless footage is needed for the investigation of an incident.

In addition, if your entire commercial relationship with us appears to have ceased for five years — no orders, enquiries or other contact — we will anonymise your personal data so that it can no longer be linked to you, keeping only the anonymised transactional records we are required to retain for accounting purposes.

8. CCTV at Our Store

CCTV operates at our retail store in Stevenage to protect the safety of our customers and staff and to prevent and detect crime. CCTV images of identifiable individuals are personal data, and we handle them in accordance with UK data protection law and the ICO's guidance on video surveillance. Signage at the store tells you where CCTV is in operation. Recordings are held securely, accessed only by authorised staff, retained only for a short period (see section 7), and shared only with the police or other law enforcement agencies where required for the investigation of an incident. You have the same rights over CCTV images of yourself as over any other personal data (see section 10).

9. How We Keep Your Data Secure

We hold your personal data in secure environments and apply appropriate technical, physical and organisational measures to protect it against unauthorised access, loss or misuse — online and in store. Our website uses SSL/TLS encryption — shown by the "https://" prefix and padlock symbol in your browser — so that information you send us is encrypted in transit. Card payments are processed by a payment provider certified to PCI DSS standards, and full card details are never stored on our systems. Access to personal data within our business is limited to staff who need it to do their jobs.

No transmission of data over the internet can be guaranteed to be completely secure, but we review our security measures regularly. In the unlikely event of a personal data breach likely to result in a high risk to your rights, we will notify you and the ICO as required by law.

10. Your Rights

Under UK data protection law, you have the following rights over your personal data, all of which can be exercised free of charge by contacting us using the details in section 14:

• Access — to ask for a copy of the personal data we hold about you (a "subject access request").
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to ask us to delete your data in certain circumstances (the "right to be forgotten").
• Restriction — to ask us to limit how we use your data in certain circumstances.
• Portability — to receive the data you have provided to us in a structured, machine-readable format.
• Objection — to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdrawal of consent — to withdraw any consent you have given (for example, to marketing emails or analytics cookies) at any time.

We will respond to any request within one calendar month. In rare cases we may need to extend this by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why. We may need to verify your identity before acting on a request, to protect your data from fraudulent access. Where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, explaining our reasons and your right to complain to the ICO.

Some rights are subject to legal limits. In particular, if you ask us to erase your data, we must still retain transaction and accounting records for the periods the law requires — but we will anonymise them so they are no longer linked to you wherever possible, and if you return to us in future your previous data will not be available to restore.

11. Children

Our website is intended for use by adults. Age-restricted products may only be ordered by, and delivered to, persons aged 18 or over. Where any of our online services rely on consent, UK law allows a child aged 13 or over to give that consent themselves; we do not, however, direct any of our services at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Social Media

We post news, product launches and event announcements on our social media channels, including Facebook, Instagram and X. We use these channels to engage with customers and followers, not as a means of gathering personal data. If you interact with us on social media, your data is also handled by the platform concerned under its own privacy policy, over which we have no control. If you raise a customer service matter with us through social media, we may ask you to continue the conversation by email so that your details are handled securely.

13. Complaints and Changes to This Policy

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 14 and we will do our best to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk

We review this policy at least once a year and whenever our business practices or the law change, and we update the issue number and date each time. The current version will always be published on our website. If we make significant changes to how we use your data, we will take reasonable steps to bring them to your attention.

14. How to Contact Us

Countryside Ski & Climb Limited, trading as Countryside and countryside.co.uk

118–120 High Street, Stevenage, Hertfordshire, SG1 3DW

Telephone: 0800 298 9975 (UK) or +44 1438 353086 (outside the UK).

Registered in England and Wales, company number 2979298. VAT registration number GB 906 4373 27. ICO registration number Z1711535.

We endeavour to respond to customer emails within one working day. Working days are Monday to Friday, excluding bank holidays.