1. BACKGROUND
James Finlay Limited, and its affiliates (‘Finlays’) respects, your privacy and is committed to maintaining your trust by protecting your personal data. This External Privacy Notice (Notice’’) explains how Finlays collects, uses, stores, shares, or otherwise processes personal data that, either on its own or in combination with other information, enables you to be directly or indirectly identified (‘Personal Data’) and explains the rights you may have in relation to your Personal Data.
Finlays processes personal data in accordance with applicable data protection and privacy laws, including the UK General Data Protection Regulations (UK GDPR), the EU General Data Protection Regulation (EU GDPR) where applicable, and relevant privacy laws in the jurisdictions in which we operate.
This Notice also explains the rights available to individuals in relation to their personal data and how those rights may be exercised.
Finlays is committed to processing personal data lawfully, fairly, transparently and securely and to implementing appropriate measures to protect personal data throughout its lifecycle.
2. SCOPE
This Policy applies to all Finlays third parties (customers, suppliers and/or partners), and whether you contact us through our websites linking to this Policy (collectively, ‘Sites’) or through a trade show or event, a salesperson, a promotion, or any other channel.
3. DEFINITIONS
- Direct identifier: a name, address, or other unique identifier which clearly points to a specific person.
- Indirect Identifier does not reveal a person’s identity on its own, however, when combined with other information, it can be used to identify an individual. For example, a vehicle registration number may be combined with information from the DVLA to identify the vehicle’s owner.
- Data Controller: the entity that determines the purposes and means of processing Personal Data.
- Data Processor: the entity that handles Personal Data on behalf of the Data Controller, following the Controller’s instructions. It is responsible for collecting, organising, storing and securing such data but does not decide why the data is processed.
- Personal Data: any information that relates to a living person (a data subject) who can be identified directly or indirectly through identifiers like name, addresses, IP addresses, or other data points.
- Data Subject: any living individual to whom Personal Data relates and who can be identified, directly or indirectly. Data subjects may include customers, prospective customers, suppliers, business partners, website visitors, event attendees, contractors and other individuals who interact with Finlays. Data subjects have rights regarding how their Personal Data is collected, used and protected under applicable data protection laws.
4. POLICY
James Finlay Limited and its majority owned business units are the Data Controllers, which means that we are responsible for, and control the processing of, your Personal Data. That means that Finlays determines ‘why’ and ‘how’ your Personal Data is collected and used.
We respect your privacy and take it very seriously. We ask that you read this Policy carefully as it contains important information on:
1. the Personal Data we collect about you;
2. what we do with your information; and
3. who your information might be shared with.
Our Sites may link to other websites, and we are not responsible for their data policies or procedures or their content. Please ensure you read their policies.
4.1 INFORMATION WE MAY COLLECT
The different types of Personal Data we may collect are categorized in the table below. Please note, however, that not all categories may be applicable to you.
| CATEGORY | DESCRIPTION |
|---|---|
| Contact Information | Data such as your name, email address, physical address, phone number, company, industry, product area, etc. |
| Payment information | Data about your billing address and method of payment such as bank details, credit, debit or other payment card information |
| Security Information | Data such as your image and video footage captured by closed circuit television (CCTV), your access data logs, data collected about you in connection with security incidents that involve you and other information relating to the safety and security of our locations. |
| Event Information | Data collected for purposes of registration and participation in events and webinars, such as attendee badge information (e.g., name, title and company name and image) email address, photographs and videos captured during events. |
| Website activity | Usage details about your interaction with our Sites (such as date, time, and length of visits, and specific pages or content accessed during the visits, search terms, frequency of the visits, referring website addresses), along with information about the device used to connect with our Sites (such as IP address, other device identifiers, operating system, browser type, mobile network information, and the device’s telephone number, and potentially location information your device shares with the Sites). See also the Cookies and Tracking section below. |
4.2 HOW WE COLLECT AND USE YOUR PERSONAL DATA
We collect most of your Personal Data directly from you. The categories of Personal Data that we collect depends on how you interact with us. You may provide us Personal Data when you participate in surveys, interact with our Sites, fill out questionnaires or provide services to us. You may not always be required to provide Personal Data that we request. If you do not wish to provide Personal Data to us, you may choose not to do so or opt-out of processing of your Personal Data when this option is offered to you.
Sites: We collect Personal Data about you when you contact us, or when you submit a response to an online questionnaire on our Sites or on one of our third-party provider Sites. We may collect your name, contact details, including email address and telephone number, company, industry, product area, and other information you choose to share with us, such as queries. When you use certain areas of our Sites, we will use your Personal Data for the following purposes:
- to fulfil our obligations under a contract with you or your company, or to provide you with requested information such as a response to your enquiry;
- to improve our Sites and our content (i) in accordance with your particular preferences in accordance with the Cookies and Tracking section below, and (ii) by conducting research, statistical analysis, and behavioural analysis.
- to protect against fraud, prevent abuses of our Sites and enable third parties to carry out technical, logistical, or other website functions on our behalf.
- to comply with and enforce as needed legal requirements, industry standards, our policies, and our contractual rights.
Trade shows and events: If you attend our stand at a trade show or an event we are sponsoring, we may collect Personal Data about you at our stand or from the organiser. We may collect your name, contact details (including email address and telephone number), company, industry, and product area. We may use your information to make follow up sales contact and for any other specific purpose communicated at the trade show or event.
Sales contacts: If you deal with any of our salespeople, they may collect your name, contact details (including email address and telephone number), company, industry, product area and other information you choose to share with them. We will use your information to fulfil our obligations under a contract with you or your company (if applicable), to provide you with requested information, and to manage the relationship between your company and Finlays.
Promotions: If you respond to or enter a promotion we are running, we may collect your name, contact details (including email address and telephone number), company, industry, and product area. If you enter a competition or promotion, we will use your Personal Data to administer the competition or promotion.
Direct marketing: Where you provide contact details through our websites, online forms, trade shows, events, business enquiries, sales interactions, promotions or other interactions with Finlays, we may record and maintain your communication and marketing preferences, including any consent, opt-in, opt out or unsubscribe choices, in order to comply with applicable privacy and marketing laws. Where permissible, we will use your contact details to notify you of products, promotions, news, and other matters concerning Finlays that may be of interest to you or your company. Where consent is required by local law for business-to-business direct marketing, we will only use your details in this way if you have opted in to receive marketing communications from us.
We do not knowingly collect Personal Data from minors on our Sites and will endeavour to promptly delete any information upon discovery.
You may withdraw your consent or opt out of marketing communications at any time by following the unsubscribe instructions included in our communications or by contacting us using the details set out in this Notice.
4.3 WHEN WE SHARE YOUR PERSONAL DATA
We may share your Personal Data with any company within the Finlays group of companies for the purposes listed in this Policy. We will not disclose your personal information to any third party except as follows:
1. Limited information (e.g. IP address, pageview, etc) may be collected through third party online tools such as cookies. You can take certain steps to prevent such collection, as described further below.
2. For direct marketing communications, we may share your information with our third-party service providers who provide email distribution services or with social media companies providing digital marketing services.
3. We will provide your Personal Data to our contractors and business partners who provide IT, marketing, ordering, logistics, fulfilment, and other services to process your orders, deliver your products, and provide customer care.
4. We may disclose your Personal Data (i) if we are required to do so by law or legal process, (ii) when we believe disclosure is necessary to prevent harm or financial loss, (iii) in connection with an investigation or suspected or actual fraudulent or illegal activity, or (iv) under exigent circumstances to protect the personal safety of our employees, users, or the public.
5. We reserve the right to transfer Personal Data we maintain in the event we sell or transfer all or a portion of our business or assets. If we engage in such a sale or transfer, we will make reasonable efforts to direct the recipient to use your Personal Data in a manner that is consistent with this Policy.
Any and all such disclosures would be made under contractual arrangements to ensure confidentiality and be carried out in accordance with the requirements of the applicable data protection regulations.
4.4 HOW LONG WE WILL KEEP YOUR PERSONAL DATA
We shall retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for any business, legal, accounting or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure of the data, the purposes for which we process the data and whether we can achieve those purposes through other means, as well as all applicable legal requirements. If you would like more information on our Data Retention Policy, please contact us at legalcounsel@finlays.net
4.5 LEGAL PURPOSE
We are committed to the lawful processing of your Personal Data in accordance with data protection laws, which in certain jurisdiction require us to have a valid legal basis for any such processing. In most circumstances, we rely on our legitimate interests or those of third parties for the performance of a contract with you or to comply with our legal obligations. Where we rely on your consent as a legal basis, you may withdraw your consent at any time for any processing activities that we conduct based solely on your consent. Please see section 4.8 [Your Rights] below to learn more about your rights, including your right to withdraw consent.
Finlays does not routinely use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
4.6 OUR APPROACH TO INFORMATION SECURITY
To protect your information, Finlays has policies and procedures in place that are designed to ensure only authorised personnel can access your Personal Data, that Personal Data is handled and stored in a secure and sensible manner and all systems that can access the Personal Data have the necessary security measures in place. To accomplish this, employees, contractors, and sub-contractors have defined roles and responsibilities and receive appropriate training.
We endeavour to maintain reasonable administrative, technical and physical safeguards to protect Personal Data we maintain against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, we cannot guarantee that such data will not be accessed, disclosed, altered, or destroyed in an unauthorized manner. You accept the inherent security implications of disclosing data to us and will not hold us responsible for any breach of security unless we have been negligent or in wilful default under applicable law.
In the event of a security incident, we will notify regulators and/or you as required by applicable laws and regulations. Such notice may be communicated via email.
4.7 INTERNATIONAL TRANSFER OF YOUR INFORMATION
We may need to transfer your Personal Data to other companies within the Finlays group, or to service providers, agents, subcontractors, or regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the European Economic Area. In these circumstances, we ensure that UK and EU data is adequately protected in accordance with UK and EU data protection laws, respectively.
4.8 YOUR RIGHTS
Certain data protection laws may provide additional rights with respect to the collection and use of your Personal Data, Finlays will not unlawfully discriminate against you for exercising a privacy right available under applicable law. Due to our locations, size and operations, we may not be subject to some jurisdictions’ data protection laws, but you can submit such requests to us as provided below and we will endeavour to fulfil any obligations that are legally required, otherwise we will respond to such requests in our discretion. Depending on your jurisdiction, you may have additional privacy rights under applicable laws, including rights to know what personal data is collected, used, disclosed or shared, rights to request deletion, correction or access to personal information, rights to opt out of target advertising, profiling or certain data sharing activities, and rights not to be discriminated against for exercising privacy rights.
Right of access: You may request what information we hold about you, as well as why we have that information, who has access to the information and where we obtained the information.
Right to correct and update: If the data we hold about you is out of date, incomplete or incorrect, you may inform us and request that we correct it.
Right of erasure: If you feel that we should no longer be using your data, or that we are illegally using your data, you may request that we erase the data we hold. We will confirm whether the data has been deleted or tell you the reason why it cannot be deleted.
Right to object: You may request that we stop processing your data. In some jurisdictions this may include a request that we not sell or share your data or engage in third party target advertising. We will confirm if we are able to comply with your request or if we have legitimate grounds to continue. If data is no longer processed, we may continue to hold your data to comply with other rights [e.g. open investigation]
Right to opt out of direct marketing: You may request that we stop contacting you with direct marketing.
The right to complain: You can lodge a complaint by contacting us at legalcounsel@finlays.net or by reference to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office, at https://ico.org.uk/.
4.9 COOKIES PREFERENCES
Finlays uses Cookies on its website to provide functionality, improve website performance, analyse website usage and, where permitted, support marketing activities. Some of these cookies collect information that may be considered personal data under applicable privacy laws. Where required by law, Finlays will obtain your consent before placing non-essential cookies on your device.
You can manage your cookie preferences at any time through the cookie preferences centre available on our websites. Further information about the cookies used by Finlays, including categories and purpose is available in our Cookie Policy.
4.10 LINKS TO THIRD PARTY WEBSITES AND CONTENT
Our Sites may contain links to other websites or online services, including social media. Please be aware that we are not responsible for the content or privacy practices of such other websites or online services, and we encourage you to be aware when you leave our Sites and to read the privacy statements of any other website or online service that collects personal data.
5. CONTACT DETAILS
If you have any queries about this Policy or need further information, you can contact us at legalcounsel@finlays.net
6. REVISION HISTORY
By using the Sites, you acknowledge that we may change this Policy from time to time. We will post the updated Policy on our Sites with a date or other indication of when it was most recently updated. You should check this Policy occasionally to ensure that you are aware of the most recent version.
| Editor | Version | Update date |
|---|---|---|
| Juliana Guerra | 4.0 Updated privacy rights and transparency provisions to align with applicable US state privacy laws and UK GDPR requirements | 16 October 2026 |
| Juliana Guerra and Tamie Hutchins | 3.0 Added Employee’s data section and appendix; and embedded the new values and purpose | November 2025 |
| Juliana Guerra | 2.0 Added the section ‘legal purpose’ Material changes to the policy across all sections. | February 2024 |