Privacy Policy

Data Protection Notice for the Bosch gift with purchase promotion

1. Data Protection Notice: This data protection notice is for the purposes of gift with purchase promotion run by the promoter, Robert Bosch Limited, its power tools division, a company incorporated and registered in Scotland with company number SCO13418 whose registered office is at C/O Bosch Rexroth, Viewfield Industrial Estate, Glenrothes KY6 2RD (“Bosch” or “we”). We thank you for your interest in our company and our products. This data protection notice refers to data processed for the purposes of the gift with purchase promotion. For information about how your data is processed on the website where the claim form in relation to the promotion is located, please refer to the privacy notice of The Marketing Lounge Partnership Limited see https://www.boschpowertoolspromotions.co.uk/privacy.

2. Bosch respects your privacy
   The protection of your privacy throughout the course of processing personal data as well as the security of all business data are important concerns to us. We process personal data that will be gathered during your participation in the promotion confidentially and only in accordance with statutory regulations. Data protection and information security are included in our corporate policy.

3. Controller
   Robert Bosch Limited is the controller responsible for the processing of your data in relation to the Bosch promotion; exceptions are outlined in this data protection statement.
   Our registered office details are as set out in section 1 above and our contact details are as follows: Robert Bosch Limited, P.O. Box 98, Uxbridge UB9 5HN
   Or
   Email: DSO@uk.bosch.com
   Telephone: +44(0)344 892 0115.

4. Collection, use and processing of personal data
   4.1 Categories of processed personal data:
   We process the following categories of personal data:

   • Communication data: Contact details (name, telephone number, email, postal address, IP address)
   • Promotion administration data: Sales invoice/receipt which may contain contact details and payment card information

4.2 Principles:
Personal data consists of all information related to an identified or identifiable natural person, this includes, e.g. names, addresses, phone numbers, email addresses.

We collect, process and use personal data (including IP addresses) only when there is either a statutory legal basis to do so or if you have given your consent to the processing or use of personal data concerning this matter, e.g. by means of registration.

4.3 Processing purposes and legal basis:
We, as well as the service providers commissioned by us, process your personal data for the following processing purposes:
4.3.1 Conducting and administering the promotion via online site, validating your claim and, where your claim is successful, complying with the reward delivery commitments in accordance with the promotion terms and conditions
(Legal basis: Fulfillment of contractual obligations).
4.3.2 Safeguarding and defending our rights.
(Legal basis: Legitimate interest on our part for safeguarding and defending our rights).
4.3.3 Self-promotion and promotion by others as well as market research and reach analysis done within the scope of statutory permitted or based on consent.
(Legal basis: consent or legitimate interest on our part in direct marketing if in accordance with data protection and competition law)
4.3.4 Resolving service disruptions as well as for security reasons.
(Legal basis: Fulfilment of our legal obligations within the scope of data security and legitimate interest in resolving service disruptions as well as in the protection of our offers).
4.4 Registration
If you wish to use or get access to benefits requiring to enter into the fulfilment of a contract, we request your registration. With your registration we collect personal data necessary for entering into the fulfilment of the contract (e.g. first name, last name, address, email address, telephone number) as well as further data on voluntary basis, if applicable. Mandatory information is marked with an *.

4.5 Children
The promotion is not available for anyone under the age of 18.

4.6 Data transfer to other controllers:
Principally, your personal data is forwarded to other controllers only if required for the fulfilment of a contractual obligation, or if we ourselves, or a third party, have a legitimate interest in the data transfer, or if you have given your consent. Particulars on the legal basis and the recipients or categories of recipients can be found in the Section 4.3 – Processing purposes and legal basis and in this Section 4.7.
Additionally, data may be transferred to other controllers when we are obliged to do so due to statutory regulations or enforceable administrative or judicial orders.

4.6.1 Service providers (general)
We involve external service providers with tasks such as provision and management of online claims site (the website you visit to claim the reward), data hosting and contract management (including validating claims and delivering rewards) for the promotion. We have chosen those service providers carefully and monitor them on a regular basis, especially regarding their diligent handling of and protection of the data that they store. All service providers are obliged to maintain confidentiality and to comply with the statutory provisions. Service providers may also be other Bosch group companies.

4.6.2 Provision and management of online claims site, usage of cookies
We use an external provider, The Marketing Lounge Partnership Limited, to provide and manage the online claims site for the promotion (the website you visit to claim the reward) and to validate your claims on behalf of Bosch. Therefore we transfer personal data to The Marketing Lounge Partnership Limited in scope of fulfilment of the contractual obligations.
For more information on how The Marketing Lounge Partnership Limited manages your personal data, including information on the cookies on the website, please refer to the privacy notice of The Marketing Lounge Partnership Limited see https://www.boschpowertoolspromotions.co.uk/privacy.
4.6.3 Parcel announcements
For the announcement of your parcels, we (or our service providers) transfer your email address and phone number within the scope of the fulfilment of the contractual obligations to:
DX Network Services Limited
Ditton Park, Riding Court Road, Datchet, Slough SL3 9GL
This company processes data as a data controller.

4.7 Transfer to recipients outside the UK and EEA (European Economic Area):
We might transfer personal data to recipients located outside the UK and the EEA into so-called third countries. In such cases, prior to the transfer we ensure that the data recipient provides an appropriate level of data protection.
You are entitled to receive an overview of third country recipients and a copy of the specifically agreed-provisions securing an appropriate level of data protection. For this purpose, please use the statements made in the Contacts section 10.

4.8 Duration, storage and retention periods
Principally, we store your data for as long as it is necessary in order to provide the promotion in accordance with the promotion terms and conditions or for as long as we have a legitimate interest in storing the data. In all other cases we delete your personal data with the exception of data we are obliged to store for the fulfilment of legal obligations (e.g. due to retention periods under the tax and commercial codes we are obliged to have documents such as contracts and invoices available for a certain period of time).

5. Security
Our employees and the companies providing services on our behalf, are obliged to confidentiality and to compliance with the applicable data protection laws.
We take all necessary technical and organizational measures to ensure an appropriate level of security and to protect your data that are administrated by us especially from the risks of unintended or unlawful destruction, manipulation, loss, change or unauthorized disclosure or unauthorized access

6. User rights
To enforce your rights, please use the details provided in the Contact section 10. In doing so, please ensure that an unambiguous identification of your person is possible.

Right to information and access
You have the right to obtain confirmation from us about whether or not your personal data is being processed, and, if this is the case, access to your personal data.
Right to correction and deletion
You have the right to obtain the rectification of inaccurate personal data. As far as statutory requirements are fulfilled, you have the right to obtain the completion or deletion of your data.
This does not apply to data which is necessary for billing or accounting purposes or which is subject to a statutory retention period. If access to such data is not required, however, its processing is restricted (see the following).
Restriction of processing
As far as statutory requirements are fulfilled you have the right to demand for restriction of the processing of your data.
Data portability
As far as statutory requirements are fulfilled you may request to receive data that you have provided to us in a structured, commonly used and machine-readable format or if technically feasible that we transfer those data to a third party.

Objection to direct marketing
Additinoally, you can object at any time to the processing of your personal data for marketing purposes at any time. Please take into account that due to organisational reasons, there may be an overlap between the submission of your objection and the use of your data during a campaign that is already ongoing.

Objection to data processing based on the legal basis of “legitimate interest”
In addition, you have the right to object to the processing of your personal data at any time, insofar as this is based on “legitimate interest”. We will then terminate the processing of your personal data, unless we demonstrate compelling legitimate grounds according to legal requirements which override your rights.

Withdrawal of consent:
In case you have consented to the processing of your personal data, you have the right to revoke this consent at any time with effect for the future. The lawfulness of data processing prior to your withdrawal remains unchanged.

7. Right to lodge complaint with supervisory authority:
You have the right to lodge a complaint with a supervisory authority. You can appeal to the supervisory authority which is responsible for your place of residence or your state of residency or to the supervisory authority responsible for us.
The supervisory authority for the UK is Information Commissioner’s Office (ICO)

Their address is:
First Contact Team
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

or
Phone: +44 (0)303 123 1113
or
Email: casework@ico.org.uk

8. Changes to this Data Protection Notice
We reserve the right to change our security and data protection measures. In such cases, we will amend our data protection notice accordingly. Please, therefore, notice the current version of our data protection notice, as this is subject to changes.

9. Contacts
If you wish to contact us, please find us at the address stated in the "Controller" section.

To assert your rights and to notify data protection incidents please use the following link: https://request.privacy-bosch.com/entity/RBGB/?app=00303ee8-577a-473c-b786-19df4d562740

To notify us of data protection incidents please use the following link: https://www.bkms-system.net/bosch-dataprotection.

For suggestions and complaints regarding the processing of your personal data we recommend that you contact our data protection officer:
Data Protection Officer
Information Security and Privacy (C/ISP)
Robert Bosch GmbH
Postfach 30 02 20
70442 Stuttgart
GERMANY
or
mailto:DPO@bosch.com.

10. Effective date
Effective date is 29.07.2024

Privacy Notice of The Marketing Lounge Partnership

1. Introduction

This Website (the “Service”) is operated by The Marketing Lounge Partnership Limited (MLP) registered in England and Wales with Company Registration Number 06467245 and having its registered office address at The Cow Shed, Walnut Tree Farm, Lower Stretton, Warrington, Cheshire WA4 4PG ("MLP") on behalf of Robert Bosch Limited (“client“) and is committed to protecting and respecting your privacy. To view their full Privacy Notice click here(Link opens in a new tab).

The personal information you input on this website (e.g. first name, last name, e-mail address, postal address, telephone) will be used by MLP to submit your rewards claim and to help manage any queries about this website or the Reward you are entitled to.

MLP is committed to protecting your right to privacy as a user of their online documents. It is their policy to respect the privacy of private communication.

The information you provide to MLP will be held by MLP on servers based in the UK, and, except as explained below, MLP will not transfer it, or authorise its transfer, outside the UK. Excluding where contact is made via the Telephone, the voice Data is held primarily in the UK with a fall over within the EEA.

MLP will always adhere to UK Data Protection Legislation, including but not limited to, the Data Protection Act 2018 and EU Regulation 2016/679 General Data Protection Regulation (“GDPR”).

Other than as stated below, MLP do not hold or use any information that you provide, or which MLP collect, outside the UK nor do MLP transfer it to, or share it with, others within or outside the UK (except when MLP believe in good faith that the law requires it).

In respect of the personal data collected and processed from you when you use the Website and the Services, the Data Controller is Robert Bosch Limited, and MLP acts as the Data Processor.

Robert Bosch Limited is authorised by the Prudential Regulatory Authority and regulated by the Financial Conduct Authority and the Prudential Regulatory Authority. Registered in C/O Bosch Rexroth, Viewfield Industrial Estate, Glenrothes KY6 2RD (“Bosch” or “we”).

2. Collection of personal data

MLP collect personal data for one or more of the following purposes:

• To provide you with information that you have requested.
• To fulfil a contract that MLP have entered into with you or with the entity that you represent.
• To ensure the security and safe operation of their websites and underlying business infrastructure.

MLP’s Cookie Policy describes in detail how Cookies are used.

In section 8 below, MLP identify your rights in respect of the personal data that MLP collect and describe how you can exercise those rights.

Lawful basis for the processing of personal data

In order for MLP to fulfil their contractual and customer obligations, there is a requirement to collect specific personally identifiable information.

There are legal bases for the processing of such personally identifiable information; primarily personal information is processed on the basis of consent. MLP retain evidence of consent which has been collected by MLP or provided by Robert Bosch Limited. Where consent cannot be obtained for various reasons, MLP may legally process the information you provide because they have a legitimate interest in doing so.

Legitimate interests
MLP have a legitimate interest in further processing the information which is provided by you or Robert Bosch Limited. MLP may also use your information for other specific legitimate purposes such as:

• To ensure that content from the Website is presented in the most effective manner for you.
• To provide you with information, products or services that you request from MLP.
• To carry out their obligations arising from any contracts entered into between you and MLP.
• To notify you about changes to the service.

Information collection and use
While using the Website, MLP may ask you to provide them with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). The data MLP collect about you may include, but is not limited to:

• Name (first, surname, other)
• Email address
• Postal address
• Telephone numbers
• If you contact MLP, a record of that correspondence will be retained for training and quality purposes

• Details of your visits to the Website and the resources that you access

  Other identifiers

• Account Identifiers such as funeral plan number
• Insurance product

MLP may also collect information on how the Website is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of the Website that you visit, the time and date of your visit or an email opened, the time spent on those pages, unique device identifiers and other diagnostic data. From time to time, MLP may use technologies, such as tracking pixels (also called 1x1 pixels or pixel tags)

4. Do MLP share your Personal Data?

MLP share your personal data with selected third parties exclusively to provide services to you and their contractual obligations with Robert Bosch Limited.

Data being supplied is also limited with the minimum being used for each of the below services:

Google Analytics
Used to tracking page views. Sending the 3rd party Page Information (URL, Title), Browser Information (Browser name, Viewport or Viewing pane, Screen resolution, Java enabled, Flash version), User Information (Location - IP address, Language). More information can be found here (https://policies.google.com/privacy?hl=en-US). This is only collected if you consent by accepting Cookies.

The legal basis for processing your personal data is based on the performance of a contract (Article 6 (1) (b) GDPR).

5. Storage of personal data

MLP is a UK-domiciled organisation whose offices are in the UK.

• Their websites and web applications are hosted in the UK and are accessed only by their UK staff.
• Their Customer Services team are UK-based, however may use system’s that reside within the EEA. As stated in Section 1 of this Privacy Notice.
• MLP may use 3rd party services, where data leaves the EEA. These are Tracking (Google analytics). Data transfers are made in accordance with the requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation or “EU GDPR”) and may be based on the use of the European Commission’s Standard Contract Clauses for transfers of personal data outside the EEA.
• MLP use a range of CSPs (Cloud service providers) as part of their processing environment. Unless MLP specifically state otherwise, MLP are, in respect of all these CSPs, the data processor for Legal & General.
• Unless specifically stated otherwise, all the CSPs that are utilised are UK processing facilities.
• All backups of MLP’s systems and data reside within the UK.

6. Removal of your data

MLP will store your personal data and other non-personal data relating to your submitted rewards claim or submitted query on the Website, insofar as is necessary to service your Rewards claim.

MLP will delete and remove all your personal data gathered during the campaign period, relating to your submitted rewards claim from MLP hosted systems, within 6 months of the last customer contact.

7. Security measures

To manage any communication between you and MLP.

MLPs ISMS (Information Security Management System) is certified to ISO/IEC 27001.

MLP have what they believe are appropriate security controls in place to protect personal data. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of their ISMS. They do not, however, have any control over what happens between your device and the boundary of their information infrastructure. You should be aware of the many information security risks that exist and take appropriate steps to safeguard your own information. They accept no liability in respect of breaches that occur beyond their sphere of control.

8. Your rights as a data subject
As a data subject whose personal information MLP hold, you have certain rights. If you wish to exercise any of these rights, please email dco@mlp.agency or use the information supplied in the ‘Contact us’. To process your request, MLP will ask you to provide two valid forms of identification for verification purposes. Your rights are as follows:

The right to be informed
As a Data Processor, MLP are obliged to provide clear and transparent information about their data processing activities. This is provided by this Privacy Notice and any related communications MLP may send you.

The right of access
You may request a copy of the personal data MLP hold about you free of charge. Once MLP have verified your identity and, if relevant, the authority of any third-party requestor, MLP will provide access to the personal data they hold about you as well as the following information:

• The purposes of the processing.
• The categories of personal data concerned.
• The recipients to whom the personal data has been disclosed.
• The retention period or envisioned retention period for that personal data.
• When personal data has been collected from a third party, the source of the personal data.

If there are exceptional circumstances that mean MLP can refuse to provide the information, MLP will explain them. If requests are frivolous or vexatious, MLP reserve the right to refuse them. If answering requests is likely to require additional time or occasions unreasonable expense (which you may have to meet), MLP will inform you.

The right to rectification
When you believe MLP hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data.

This may be used with the right to restrict processing to make sure that incorrect/incomplete information is not processed until it is corrected.

The right to erasure (the ‘right to be forgotten’)

Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that MLP delete the personal data. This includes personal data that may have been unlawfully processed. MLP will take all reasonable steps to ensure erasure.

The right to restrict processing
You may ask MLP to stop processing your personal data. MLP will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing:

• The accuracy of the personal data is contested.
• Processing of the personal data is unlawful.
• MLP no longer need the personal data for processing but the personal data is required for part of a legal process.
• The right to object has been exercised and processing is restricted pending a decision on the status of the processing.

The right to data portability
You may request your set of personal data be transferred to another Controller or Processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.

The right to object
You have the right to object to MLP processing of your data where:

• Processing is based on legitimate interest;
• Processing is for the purpose of direct marketing;
• Processing is for the purposes of scientific or historic research; or
• Processing involves automated decision-making and profiling.

9. Contact MLP

Questions, comments and requests regarding this Privacy Notice are welcome and should either be emailed to dco@mlp.agency or addressed to Data Compliance officer, The Marketing Lounge Partnership Limited, The Cow Shed, Walnut Tree Farm, Lower Stretton, Cheshire, WA4 4PG.

10. Changes to this Privacy Notice

MLP may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if MLP change their business in a way that affects personal data protection.

This Privacy Notice was last updated on 30/07/2024.