Privacy Notice

Bensons (“we”, “us” or “our”) takes its obligations with regard to data protection seriously. As such, we are providing this notice (“Privacy Notice”) to you so that you are provided with information about how Bensons collects and uses your personal data in accordance with applicable data protection law.

Please read this Privacy Notice, as it contains important information of which you should be aware and applies to you if we process our personal data. For example, if you visit our website bensonsforbeds.co.uk (regardless of where you visit it from), if you enquire about our products or services, purchase our goods or services or otherwise interact with us.

Who we are

Bensons, a company registered in England with company registration number 12528962, is the controller of your personal data. The controller is the entity that determines how and why personal data is processed.

We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice or if you would like to make a request to exercise your legal rights, please contact the DPO at gdpr@bensonsforbeds.co.uk.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK regulator for data protection issues (<www.ico.org.uk>). In certain circumstances you might also have the right to bring a complaint to other regulators or in the Courts although we would hope that you give us the chance to deal with any concerns you might have first by contacting our DPO.

Third party links

This website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites and are not responsible for their privacy policies. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Children’s data

Our website is not intended for children and we would ask users to not provide such personal data to us via the website. Please contact the DPO on the contact details above if this raises any concerns.

What personal data do we collect and process?

In order for Bensons to deliver its products and services to you and manage its business efficiently, it is necessary for us to collect, maintain and process personal data about you. Personal data means any information that identifies an individual, or from which an individual can be identified.

The term “processing” means any action taken, also with the help of electronic means, in connection with personal data, including collection, handling, use, transfer and disclosure by transmission, dissemination or otherwise making available, as well as recording, organisation, storage, retention, adaptation or alteration, access, retrieval, consultation, alignment or combination, blocking, anonymising, erasure, disposal or destruction.

The types of personal data which we process may include the following and which we have grouped together as follows:

• Identity Data, which includes your first name, last name, username or similar identifier, title, date of birth and gender.
• Contact Data, which includes your delivery address, billing address, telephone numbers and email addresses.
• Financial Data, which includes the last 4 digits of your payment card details.
• Transaction Data, which includes details of any credit requested on any purchase(s) and details about payments and products relating to current and past purchases and orders made by you.
• Profile Data, which includes your username and password, purchases or orders made by you, the details of your online account with us and your interests, preferences, feedback and survey responses.
• Technical Data, which includes your IP address, login data, browser type and version, time zone setting and your location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access the website.
• Usage Data, which includes information about how you interact with and browse our website, products and services.
• Marketing and Communications Data, which includes your preferences in receiving marketing from us and your communication preferences.

We may also collect, use and share aggregated anonymous data such as statistical or demographic data for any purpose. For example, we may convert your Technical Data into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from that data and use this aggregated data to conduct research and analysis, including to produce statistical research and reports. We may share such anonymous aggregated data with third parties. Aggregated and anonymous information does not personally identify you and is therefore not personal data. However, if we combine or connect aggregated anonymous data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.

Please note that you are under no obligation to provide Bensons with your personal data; however, when we rely on the lawful bases of complying with a legal obligation or entering into/performing a contract with you, not providing some of the personal data described above could prevent Bensons from performing its obligations in relation to your purchase of goods and services (and any related services) from us and/or we may not be able to enter into or continue ## How will we collect your personal data?

Personal data will primarily be collected from you directly. You may give us your personal data by filling in forms or corresponding with us by post, phone, email or otherwise. This includes personal data you provide to us when you:

• purchase goods or services from us;
• create an account on our website;
• track the delivery of your orders of goods purchased from us;
• give us feedback;
• fill out a survey;
• enter a promotion or prize draw;
• sign up to our newsletter; and
• contact us.

As you interact with our website, we will automatically collect your Profile Data and Technical Data. We collect this data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookie Policy for further details.

Some personal data may, where lawful to do so, be collected by Bensons from third parties or publicly available information about you. We will only accept and use information about you from reputable organisations who have either obtained your permission to share your information with us or who have collated information about you from publicly available sources.

Why and for what purpose do we use your personal data and special category personal data and what is our lawful basis for doing so?

We use your personal data for different purposes depending on how you interact with us and the goods or services that we provide to you. Data protection law requires us to have a legal basis to process your personal data for each particular purpose. We will only use your personal data when we have a legal basis for doing so. Most commonly, we will rely on one of the following legal bases:

• Performance of a contract with you. Where it is necessary to perform the contract, we are about to enter into or have entered into with you.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests**.**
• Legal obligation. Where we need to comply with a legal obligation.
• Consent. We may rely on your consent.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of purposes for which we may use your personal data, which of the legal bases we rely on to do so, the types of personal data processed for each purpose and the third parties we might share your personal data with. We have also identified what our legitimate interests are, where appropriate.

In some cases, we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your personal data. Please contact us if you would like more detailed information about how we process your personal data.

We may also inform you of additional purposes for processing your personal data when that information is collected from you

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is lawful and compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we intend to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that, in limited circumstances, we may process your personal data without your knowledge or consent where this is required or permitted by law.

Special category personal data

In general, we will not process special category personal data about you unless it is necessary for performing or exercising obligations or rights in connection with your relationship with us. There may also be other reasons for processing, such as where it is in the public interest to do so. Where we process your special category personal data we will comply with applicable data protection laws, including obtain your consent where this is required.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please refer to our Cookie Policy.

To whom will your Personal Data be disclosed?

We may share your personal data where necessary with the specific third parties listed in the table above for the specified purposes. Where we refer to our “Group Companies” in the table above, these are companies that have BensonsForBeds BidCo as its ultimate parent company.

We may also, in the course of our business, disclose personal data to third parties that are performing services under contract for Bensons, such as I.T. hosting, marketing optimisation, maintenance providers, and organisations that we instruct to deliver the products you have purchased from us. For example, your personal data may be shared with BigCommerce, who is a software-as-a-service supplier that assists with the operation of our website.

Personal data may also be disclosed (upon lawful request) to government authorities, law enforcement and regulatory authorities, courts, court-appointed persons/entities, and where required or permitted by relevant local law and for tax or other purposes. Further, personal data may be disclosed to third parties in response to legal process and when required to comply with laws, or to enforce Bensons’ agreements and corporate policies or to protect the rights, property or safety of Bensons, its employees, agents and third parties (including to legal advisors, other professional advisors and insurers).

We may share your personal data with a prospective purchaser or purchaser of any part of our business, on the basis of our legitimate interests and the interests of our purchaser, so that they can appropriately value the business and assess any risks and continue doing business with you after the acquisition. Alternatively, we may share your personal data if we seek to acquire other businesses, merge with them or are involved in other corporate restructurings or reorganisations.

International Transfers

We store and process your personal data in the UK and outside the UK. In addition, some of our third parties are based outside the UK so their processing of your personal data will involve a transfer of the data outside the UK.

The locations of the third parties outside the UK may not have adequate data protection laws equivalent to those in place within the UK. For transfers of your personal data to third parties outside the UK that have not been deemed to provide an adequate level of protection for personal data by the UK, we take additional steps where required in line with data protection laws, which may be to:

• use approved standard contractual clauses which give personal data the same protection it has in the UK; or
• transferring when one or more of the conditions set out in Article 49 of the UK GDPR are met.

Security of your Personal Data

We have implemented technical, physical and organisational measures to help us keep personal data accurate, up to date and protected against unauthorised or accidental destruction, alteration or disclosure, accidental loss, unauthorised access, misuse, unlawful processing and/or damage. These include limiting access to your personal data to our employees, contractors, agents and other third parties who have a business need to access it. We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data Retention

We will only retain your personal data for such period as is necessary to perform the purpose(s) for which it was collected. We may also retain your personal data if we reasonably believe it may be needed in relation to a complaint or in order for us to exercise or defend a legal claim.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, as well as any other relevant legal, regulatory, tax, accounting or other requirements.

In many cases, this means that personal data will be retained for the duration of the time that we provide goods and services to you and then for a reasonable time thereafter in order to manage any problems, process any returns, manage our relationship with you, defend any claims, for tax purposes and/or for any other record keeping purposes. This period is typically a period of not less than 6 years from the date of delivery of your last order with us.

In some circumstances you can ask us to delete your personal data – see paragraph 9 below for further information.

Your Legal Rights

You have certain legal rights, which are briefly summarised below, in relation to any personal data about you which we hold. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
  • if you want us to establish the data's accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or, where technically feasible, another data controller where you have provided it in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you would like to exercise any of your rights as described above, please contact our DPO.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. It could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

What we ask of you

• Keeping your information accurate and up to date. Please inform us if there is a change in your contact details or any other information that you have provided to us so that we can ensure our records are kept accurate and up to date.
• Third party personal data. If you provide us with personal data about another person, please make sure that you have informed them of our identity, the purposes for which their personal data will be processed; and obtained their permission and/or complied with any other data protection requirements. If you are unsure whether their personal data can be shared with us, please contact us before providing us the data.

Updates to this Privacy Notice

Bensons may change this Privacy Notice from time to time. If we make changes to our Privacy Notice, we will update this page and would therefore ask that you check it from time to time and contact us if you have any queries. If we make material changes to our Privacy Notice, we may also provide you with additional notification of those changes by email and therefore we would also ask that you notify us if your contact details change.

Privacy Notice last updated July 2025