The BSW Group (BSW, we, us, our) respects privacy and is committed to protecting personal information. We have developed this Privacy Notice to inform all our customers, business partners, suppliers, service providers and other third parties that we interact with in the course of providing our products and services, as well as our website users whose information we collect as a result of navigating or interacting with us through the site (collectively you, your), about how we collect and use personal information.

Important information about this Notice

While we always aim to provide complete and transparent information about how we process your personal information, we reserve the right to update this notice from time to time or to create additional notices in order to accurately reflect changed circumstances or new legal requirements.

As a result, it is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your personal information. Please note that this Privacy Notice supplements the other notices and is not intended to override them.

To assist us in ensuring that we can provide the most accurate information possible, we ask that you check this Notice for updates. We also ask that where we have an ongoing relationship with you and any of the data you have provided become or are no longer accurate, you keep us informed of this so that we can amend our records accordingly.

We do not provide products or services to children and do not knowingly collect or otherwise process the personal information of children. Accordingly and to assist us with this, we ask that any personal information that you submit or otherwise provide to us relates only to adults.

Who are we?

BSW is a group of companies offering a range of specialty timber and forestry related products and services. This Notice is provided for and on behalf of each data controller within our group which includes the companies listed below. As part of our commitment to the protection of personal data, each data controller is registered with the Information Commissioner’s Office (ICO) where required and the corresponding registration numbers are also provided below.

• BSW Timber Limited (ZA327673)
• Tilhill Forestry Limited (Z8470439)
• Alvic Plastics Limited (ZA722445)
• Maelor Forest Nurseries Limited (ZA244758)
• Bayram Timber Limited (Z7744560)
• BSW Timber Solutions Limited (Z69885966)
• Dick Brothers Forestry Limited (ZA794437)
• BSW Energy Limited

What personal information do we collect about you & how do we collect it?

Personal information includes any information about you that can be used to contact or identify you. It does not however include data which has been permanently anonymised to prevent identification or aggregated statistical data which we may generate to monitor the performance of our business and to help improve our service and product offering.

When using our website, communicating with us regarding our products and services or otherwise interacting with us in the context of our business, then we may collect, use, store and otherwise process the following categories of personal information:

• Identity Data: this may include first name last name.
• Contact Data: this may include your email address and telephone number. Where you represent or otherwise act on behalf of one of our corporate customers, then this may also include the identity of your employer, your position/role and geographical location of employment.
• Transaction Data: this may include financial institution, bank account and payment card details. It may also include details about payments to and from you and other details of your purchasing history.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Usage Data: includes information about how you use our website.

What if you fail to provide the personal information requested?

There may be cases where we need certain information in order to comply with our legal obligations or to enter into a contract with you. In such cases, if you fail to provide the information when requested, then we may not be able to enter into that contract with you, or may otherwise be prevented from providing our goods and services to you. However, in any such case we will advise you of the reason(s) why we need the information.

On what basis do we use your personal information?

We will use your personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where necessary to enter into or perform an existing a contract with you.
• Where we need to comply with a legal or regulatory obligation. In rare cases, on the basis that you have provided your consent.

In the limited circumstances that we rely on your consent in order to process your personal data, we will only do so where your consent is clear, unambiguous and informed. In addition, you can withdraw your consent at any time, although please note that withdrawal of your consent would not affect the legality of any processing which has already occurred.

For what purposes will we use your personal information?

We will process different types of information for different purposes depending on the nature of the information and your relationship with us. We have created the table below in order to provide a description of all the ways we plan to use your personal information and our basis for doing so. Where we process your information on the basis of our legitimate interests then we have also identified what those interests are. Please note that we may process your personal information on more than one basis depending on the specific purpose for which we have collected or are otherwise using your information.

How do we use your personal data for marketing?

We may send you direct marketing communications from time to time including news, updates, offers and other promotions relating to our products, services and activities. We will only send marketing messages where the law allows us to do so and, in the event that you no longer wish to receive marketing from us, then you can always unsubscribe using the option provided in the footer of the communication you have received or by contacting us using the information provided below. We will never sell your information to third party data brokers or marketing companies.

What are cookies and do we use them?

Cookies are small text files that are placed on your computer when you visit websites and use other digital services. Website operators commonly place cookies on your computer or device when you access the site and can also choose to allow third parties to do this. Cookies are generally used to ensure the security and effective operation of the website, so that it works properly when you visit and navigate the site. However, sometimes cookies are also placed to help make improvements to the site, by helping the operator to understand how users interact with it or to provide advertisements based on your areas of interest.

This website uses cookies and other tracking technologies to help us make improvements to our site and enhance your user experience. This can involve the collection and processing of your Technical Data and User Data as described above. Details of the cookies used on this site and their respective functions are included in the table below.

Will we share your information with others?

Sometimes it may be necessary to share your personal data with trusted third parties, including:

• Service providers we use to facilitate our business operations and administration. These third parties have access to your personal information only to perform specific tasks on our behalf and are obliged not to disclose or use it for any other purpose. Our service providers include (i) IT and system administration providers (ii) marketing and advertising agencies; (iii) data analytics providers and (iv) payment institutions that we use to process payments.
• Endless LLP, as the manager of funds that have invested in our business. For more information about Endless LLP and how they may process your personal data, please refer to the relevant Endless privacy notice which can be accessed at: https://www.endlessllp.com/privacy-statement
• Regulatory and governmental authorities, law enforcement agencies and courts.
• Our professional advisors.
• Other entities within our group of companies.
• In the event of a disposal of all or part of our business, the purchaser and its professional advisors.

How do we ensure the security of your personal information?

We have implemented appropriate technical and organisational measures to protect your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and service providers who have a business need to know. They will only process your information on our instructions and are subject to a formal duty of confidentiality. Any third parties involved in handling your personal information will only do so for specific purposes and will be subject to contractual obligations of confidentiality.

In the event that we experience any intrusion of our information systems or otherwise suffer a breach of our data security, then the Group has in place specific procedures designed to deal with such a breach, including protecting the personal information within our control and, where we are legally obliged to do so, notifying you and the relevant authorities.

Please note however that despite our best efforts we cannot guarantee the security of information being exchanged over the internet and, where our website contains links to other sites plug-ins and applications that are not operated by us, clicking on those links or enabling those connections may allow third parties to collect or share data about you. Once you leave our website then we have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party sites or services.

How long will we keep your personal information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or other mandatory reporting requirements. To determine the appropriate retention period we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means and the applicable legal requirements. To the extent data is held in connection with contractual rights and obligations, then we will also take into account any specific limitation periods that apply.

Will we transfer your personal information internationally?

There may be cases where we need to transfer your personal data overseas, including to destinations outside the UK and the European Economic Area (EEA). However, we will only transfer your data to another country where we are confident that an appropriate degree of protection will be provided.

In particular, we will only transfer your personal data to countries that have either been deemed to provide an adequate level of protection for personal data, or where there are specific contractual clauses in place to protect the transfer of your data. For more information about how we use approved Standard Contractual Clauses, please contact us using the details provided below.

What are your legal rights in connection with your personal information?

Under the GDPR you have certain rights in relation to your data which are listed below. However, please note that not all of these apply in all circumstances:

• Right of access: subject to certain exceptions, you have the right of access to your personal information that we hold. However, please note that if you are requesting access to your data then in order to protect the rights of others we may require you to validate your identity before we can release that information to you.
• Right to rectify your personal information: if you discover that the information we hold about you is inaccurate or incomplete, you have the right to have this information rectified (i.e. corrected).
• Right to be forgotten: you may ask us to delete information we hold about you in certain circumstances. This right is not absolute and it may not be possible for us to delete the information we hold about you, for example, if we have an ongoing contractual relationship or are required to retain information to comply with our legal obligations.
• Right to restriction of processing: in some cases you may have the right to have the processing of your personal information restricted. For example, where you contest the accuracy of your personal information, its use may be restricted until the accuracy is verified.
• Right to object to processing: you may object to the processing of your personal information (including profiling) when it is based upon our legitimate interests. You may also object to the processing of your personal information for the purposes of direct marketing and for the purposes of statistical analysis.
• Right to data portability: you have the right to receive, move, copy or transfer your personal information to another controller when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means.

In the event that you wish to exercise any of the rights identified above, then please get in touch using the contact details provided below.

Questions or complaints?

If you have any questions regarding the ways in which we process your personal data, then you can always contact us using the contact information provided below.

You also have the right to make a complaint at any time to the relevant supervisory authority in your jurisdiction.

Contact Us

If you have any questions about this Privacy Notice or about how we handle your personal information, then you can always contact us by email at dpo@bsw.com.