1. Introduction
The purpose of this privacy policy is to provide information about how we, Thule Outdoor Limited, process your personal data in connection with the use of our website (https://www.thule.com) and the services we provide through this website. We respect your privacy and protect the personal data we process about you.
We protect children’s integrity. Therefore, we do not intentionally process personal data relating to anyone under the age of 18.
The following describes, among other things, how we collect, process and share your personal data.
2. Purpose and legal basis for the processing of your personal data
In this privacy policy you will find a description of the personal data we process about you, the purposes for which we process your personal data and the legal bases we base our processing of personal data on.
- (i) What personal data is being processed and why?
- Personal data collected through strictly necessary cookies is processed to provide a functioning website.
- Personal data collected through performance cookies is processed to develop our website and improve its functions.
- Personal data collected through functional cookies is processed to improve usability and enable personal settings.
- Personal data collected through marketing cookies is processed to provide you with relevant offers via other channels. The information may be used for customer segmentation for advertising and online advertisements to advertise relevant products to you.
- (ii) What is the legal basis for the processing?
- When you send us a request
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When you buy a product online
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When registering or logging in to a user account
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When making a return
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When making a compensation claim
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When making a product registration
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When we need to send product safety notices or conduct product recalls
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When we send out-of-stock emails
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- When we send you marketing materials and similar information
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
- Verifying your identity for legal compliance and sanctions checks
- (i) What personal data is being processed and why?
- (ii) What is the legal basis for the processing?
When you visit our website, we can collect and/or store information about your visit by placing cookies. Cookies are small text files that a website or its service provider transfer to your computer's hard drive through your web browser. They enable us to recognise your browser and capture and remember certain information. Personal data collected through cookies include your Internet Protocol (IP) address, browser language, geographical location data, demographic information, date and time, information about webpages, weblinks, and any other information on our website accessed by you.
Our processing of personal data collected through strictly necessary cookies is based on our legitimate interest in providing you with a functioning website, as the basic website functions would not work properly without these cookies. If you want more information regarding how we made this assessment please contact us at privacy@thule.com.
Our processing of personal data collected through performance, functional and marketing cookies is based on your consent.
For more information about how we use cookies and similar technologies on our website please see our Cookie Policy.
When you send us a request regarding, for example your orders or purchased products, either via the contact form available through our support function or directly to one of our employees listed as contact persons on the website, we process the following personal data to answer and fulfil your request: your email address, name and telephone number if you choose to provide it, the country you come from, which category/contact reason the question concerns and a description of the topic and your question. We may use the information to contact you regarding your request by email or telephone and to administer and handle your request.
The processing of your personal data for this purpose is based on our legitimate interest to enable us to provide you with a good service and to answer your request. When you contact us with a request, it is also in your interest that we process your personal data to provide you with the information and service that you have requested. Furthermore, the personal data is necessary for us to assist you and answer your request.
In certain cases, the processing is also necessary to enter into or fulfil an agreement with you, for example to handle cancellations of orders before delivery.
If you want more information regarding how we made this assessment please contact us at privacy@thule.com.
In order to administer your order, to deliver the products you have purchased online and to follow-up on your order and any potential issues or requests concerning it, we process your name, billing address, delivery address, email address, telephone number, payment method and information about the products you have ordered.
Personal data relating to your payment (including personal identity number, bank details and account information or information about other payment methods) is processed by our collaboration partner, Wordline, which acts as a separate controller for its processing of personal data. For information about Wordline’s processing of your personal data please see its privacy policy.
The processing of your personal data for the purpose of fulfilling your order is necessary to fulfil the agreement we enter into with you. If you do not provide your personal data in connection with the purchase, we will not be able to administer your purchase or delivery in accordance with your order.
The processing of your personal data for the purposes of being able to follow up on your order and handle issues and requests is based on (i) our legitimate interest to provide you with good customer service and a good shopping experience, and (ii) in certain cases, depending on the type of request made, our obligation to fulfil the agreement entered into with you regarding the purchase.
Personal data relating to your purchase is also processed based on our obligation to keep records according to specific legal requirements. If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
In order for you to register and use a user account, we process your email address and your password, as well as your name, delivery address and telephone number if you choose to provide it.
The processing of your personal data for this purpose is based on our legitimate interest to provide you with a user account and the features that follow from you registering a user account, for example to provide you with order history, order status, delivery information and a quicker order checkout process. This is information that we provide to make your shopping experience better as Thule always strives to provide you with the best possible service.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
When you make a return, we process your order number, information about purchased products, financial information relating to the purchase, your name, address, signature (if applicable) and email address to administer and follow-up on your request to return the product you purchased and to provide you with good customer service.
The processing of your personal data for the purpose of fulfilling and administering your request is necessary for us to comply with applicable consumer law if you exercise your right of withdrawal, and to enable us to comply with our contractual obligations in this respect. We also process your personal data based on our legitimate interest to keep records of the returns in order to provide you with good customer service. Personal data relating to your purchase is also stored based on our obligation to keep records according to specific legal requirements.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
When you make a compensation claim (including incident claims and warranty claims), we process your order number, information about purchased products, post code for billing address, phone number and your email address to be able to administer and follow-up on your compensation claim relating to the product you purchased and to provide you with good customer service. We also process the name of your bank and your bank account number to administer and complete the compensation payment.
The processing of your personal data for this purpose is necessary for us to comply with applicable consumer law if you exercise your right to compensation. The processing is also necessary to fulfil our obligations in the agreement we enter into with you that includes our own product guarantees through the “Thule Guarantee” or “Thule Extended Warranty”. We also process your personal data based on our legitimate interest to keep records of compensation claims to provide you with good customer service.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
Warranty” the product must be registered. For the product registration service we process your name, email address, country, purchased products, date of purchase and telephone number if you choose to provide it in the free text field.
The processing of your personal data for this purpose is based on our legitimate interest to provide the service and to simplify warranty matters. The processing conducted to offer you “Thule Extended Warranty” is necessary for us to fulfil our obligations in the agreement entered into with you including our future warranty commitment in relation to you.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
To provide you with product safety notices and to notify you about product recalls, for example if the product was defective, we process your name, address, email address, purchased products and telephone number. The processing is also carried out to document recalls and safety notices.
The processing of your personal data for this purpose is necessary for us to fulfil our obligations in accordance with applicable product safety and liability laws to prevent risks to your health and safety. We also store records of product safety notices and product recalls based on our legitimate interest to exercise and defend legal claims.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
To provide you with out-of-stock emails requested by you, we process your email address, product information as well as the date and time of the request.
The processing of your personal data for this purpose is necessary for us to provide you with the requested relevant stock information and the features that follow from your request.
In order to provide you with our marketing information such as newsletters and similar marketing communication and advertisement and abandoned cart emails, we process your name, email address, language, country, product information and the date and time of consent.
The processing of personal data for sending newsletters and similar communication and advertisement and abandoned cart emails is based on our legitimate interest in promoting our business, brand and product range. We also do this in the legitimate interest of our subscribers and customers in being able to stay in touch with you, so that we can keep you advised of new products, events and special offers.
If you want more information regarding our legitimate interest assessment please contact us at privacy@thule.com.
To ensure compliance with legal obligations, particularly with regard to international sanctions, we may carry out customer due diligence when there is a need to verify your identity. The purpose of the processing is to confirm your identity and to ascertain that you are not an individual subject to any international sanctions. This activity may involve processing of your date of birth and place of birth to crosscheck with applicable sanction lists.
The processing of your personal data for customer due diligence is based in our legal obligation to comply with laws and regulations pertaining to international sanctions and anti-money laundering (Art. 6(1)(c) (GDPR). These laws require us to not engage in business with individuals who are subject to international sanctions.
3. Who has access to your personal data?
3.1 Sharing within the Thule Group
The number of people who have access to your personal data is limited. Only Thule employees who need to process your personal data in accordance with the purposes stated above have access to your personal data.
We share your personal data with companies within the Thule group if it is necessary to fulfil the purposes mentioned above, for example for engaging global consumer service and technical support. Such Thule companies might be located inside or outside of the UK. Please find information about the group companies that we share your personal data with here.
3.2 Sharing to third parties outside the Thule Group
We also share your personal data with suppliers and partners who perform services on our behalf or who in other ways co-operate with us. Such partners may either act as a separate personal data controller (including for example our partners providing tax calculation, our payment service providers and third party cookie providers) or as a personal data processor (including for example our business system providers, our website host supplier, fraud protection services and our system development partners). Such partners may be located outside the UK but, in any case where we intend to share your personal data with a recipient located outside the UK, we will comply with the relevant requirements with respect to international data transfers. Please find information about the partners that we share your personal data with here.
When service providers act as separate personal data controllers, you will be provided with their privacy notice containing information on their processing of your personal data in connection with their collection of your personal data. When service providers act as personal data processors, processing personal data on behalf of Thule, relevant data processor agreements are entered into.
If you would like to obtain more detailed information on who your data is shared with, please contact us at the contact information provided in section 5.
3.3 Sharing outside of the UK/EEA
Thule’s own processing of personal data by Thule entities within the EEA/UK primarily takes place within the UK/EEA, but for some services and support involve Thule entities outside the UK/EEA (third countries). Personal data may also be processed in a third country by some of our business partners and suppliers (section 3.2above). Third countries may have a lower level of protection of personal data than the one offered within the UK/EEA. When your personal data is shared with countries outside the UK/EEA, we use standard contractual clauses that have been approved by the European Commission as well as supplementary measures necessary to ensure an adequate level of protection for your personal data.
Furthermore, in certain cases we also rely on adequacy decisions made by the ICO for international transfers of personal data, meaning that we may transfer personal data to countries outside the UK/EEA which have been deemed to have an adequate level of data protection. Please see information on the adequacy decisions here: https://www.gov.uk/government/publications/uk-approach-to-international-data-transfers/international-data-transfers-building-trust-delivering-growth-and-firing-up-innovation.
If you would like to obtain a copy of any of our agreements, or further information as to which adequacy decision that applies for a certain transfer, or detailed information regarding our third country transfers and where your data has been transferred, please contact us using the contact information provided in section 5.
4. For how long do we store your personal data?
Type of processing | Time period or criterion for determining the storage period |
---|---|
Personal data processed in connection with a request. | Deleted continuously taking into account the type of request in question. However, stored for a maximum period of three years. |
Personal data processed in connection with online purchases. | Stored for a maximum period of seven years. Certain personal data relating to your purchase will be stored for as long as required according to specific legal requirements. |
Personal data processed through cookies in connection with usage of the website. | For more information on how long we store cookies on our website please visit our Cookie Policy. |
Personal data processed in connection with registration and use of user account. | One year initially. Thereafter, you will be asked annually whether or not you wish us to continue processing your personal data for this purpose. If you do not wish continued processing or if you do not answer the request within the time frame stated in the request, your personal data will be deleted. |
Personal data processed in connection with a return. | Stored for a period of seven years in accordance with applicable limitation and legal retention periods. |
Personal data processed in connection with a compensation claim. | Stored for a period of seven years in accordance with applicable limitation and legal retention periods. |
Personal data processed in connection with a product registration. | During the period of the Thule Extended Warranty applicable to the product you have registered. |
Personal data processed in connection with product safety notices and product recalls. | 10 years after we sent out the product safety notice or did the product recall. |
Personal data used for sending out newsletters and similar marketing communications and advertisement. | Two years initially (provided you do not withdraw your consent). Thereafter, you will be asked every two years whether you wish us to continue processing your personal data for this purpose. If you do not wish continued processing or if you do not answer the request within the time frame stated in the request, your personal data will be deleted. |
Personal data used for sending out-of-stock emails. | Stored for a period of three months. |
Personal data processed in connection with an initiated not completed purchase (abandoned cart). | Stored for a period of two weeks. |
Personal data processed for the fulfilment of legal obligations under relevant accounting legislation. | Stored for a period of 10 years, unless otherwise required by applicable limitation and legal retention periods. |
5. What are your rights?
Thule Outdoor Limited (registered number 3210726 and registered address Units 1-3 Two Counties Estate, Falconer Road, Haverhill, Suffolk CB9 7XZ) is the data controller of the processing of your personal data. However, in relation to the processing taking place when we send product safety notices or conduct product recalls, the data controller will be the Thule entity that is the legal manufacturer of the product you purchased. You may always contact Thule Outdoor Limited if you have any questions or concerns regarding the processing of your personal data. A data controller is responsible for your personal data being processed correctly and in accordance with applicable laws. See more about your rights below.
- The right to access: You have the right to know which personal data we process about you, for what purposes the personal data is being processed and who we share your personal data with etc. You also have the right to access your personal data and request a copy of the personal data being processed.
- The right to rectification: If you notice that we have incorrect, inaccurate or incomplete personal data about you, you can request that we correct this personal data without undue delay. Additionally, taking into account the purposes for which we process your personal data, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
- The right to erasure: Subject to certain limitations, in the following cases, you may request that we delete your personal data;
- (i) when the personal data are no longer necessary in relation to the purposes for which we collected or otherwise processed them;
- (ii) when our processing is based on your consent and you withdraw such consent;
- (iii) when you object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing for direct marketing purposes;
- (iv) we have processed your personal data unlawfully; or
- (v) the personal data have to be erased for compliance with any specific legal requirement to which Thule is subject.
- The right of restriction: Under the following circumstances, you have the right to request that we limit our processing for a certain period of time:
- (i) if you contest the accuracy of the personal data, we shall restrict our processing until we are able to verify the accuracy of the data;
- (ii) if the processing is shown to be unlawful and you request restriction of our use of your personal data instead of erasure;
- (iii) if we no longer need the personal data for the purposes of the processing as stated in this notice, but we are required by you to do so for the establishment, exercise or defence of legal claims; or(iv) if you objected to our processing, for the time pending the verification whether the legitimate grounds of the controller override those of the data subject.
- The right to object: You have the right to object to the processing we perform based on our legitimate interest. To the extent we process your personal data for direct marketing purposes, you also have the right to, at any time, object to such processing.
- The right to data portability: In cases where we base our processing on your consent or on the fulfilment of an agreement, you have the right to receive your personal data in a structured, commonly-used and machine-readable format and have the personal data transferred to another controller.
- Withdrawal of consent: If you have given your consent to processing your personal data, you may withdraw your consent at any time by contacting us using the contact information below. However, please note that a withdrawal of your consent would not affect the legality of any processing which had already validly occurred on that basis.
Please note that deleting your personal data may result in us not being able to, for example, deliver not yet shipped orders or provide you with the services offered in connection with product registration.
Where our processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed by us with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the UK.
Please note that restricting your personal data may result in us not being able to, for example, deliver not yet shipped orders or provide you with the services offered in connection with product registration.
If you have any questions about our processing of your personal data or wish to exercise any of your rights set out above, you can contact us at privacy@thule.com. If you have any objections or complaints regarding how we process your personal data, you also have the right to contact or file a complaint with the ICO. You can also contact the ICO through its website at https://ico.org.uk/global/contact-us/contact-us-public/ and by telephone on 0303 123 1113.
6. Does the privacy policy apply to external linked websites?
Our website may contain links to other websites such as charitable organisations. Such third parties are beyond our control and are not covered by our privacy policy. If you enter such other websites through links provided, administrators of those websites may collect your personal data. Please review the websites' privacy policies before providing your personal data.
7. Changes in the privacy policy
If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy policy on the website. If we make material changes to this privacy policy, we will inform you by active means, for example by sending you an email or similar.