5.1VIXII is the controller of personal data collected by VIXII at the pop up, unless otherwise stated in a privacy notice made available to customers.
5.2VIXII may collect customer contact details, including email addresses, for purposes such as issuing receipts, responding to enquiries, managing purchases, administering the VIXII Gems loyalty programme, and sending marketing communications.
5.3VIXII will only send marketing communications where it has a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR), including:
- where the customer has given express consent at the point of data collection, via a clear opt in mechanism (such as a checkbox or digital confirmation); or
- where VIXII is permitted to rely on the soft opt in under Regulation 22 PECR, meaning the customer’s details were collected in the course of a sale or enquiry, the marketing relates to similar goods or services, and the customer was given a clear and simple opportunity to opt out at the point of collection and did not do so.
5.4Customers may opt out of marketing at the point their details are collected and may unsubscribe at any time using the opt out instructions in VIXII’s communications.
5.5Participation in the VIXII Gems loyalty programme is optional. Where separate terms or a separate privacy notice apply to the loyalty programme, those terms or notice will be made available to customers before or at the point of enrolment.
5.6VIXII and/or the venue may operate CCTV at the pop-up for security, safety, and loss prevention purposes. VIXII relies on legitimate interests under Article 6(1)(f) UK GDPR as the lawful basis for CCTV processing, having conducted a Legitimate Interests Assessment and determined that such processing is necessary and proportionate and does not override customers’ rights and freedoms. Where VIXII or the venue operates CCTV that captures personal data, clear signage will be displayed at entry points to the venue. Where the venue operator processes CCTV data independently of VIXII, the venue operator is an independent data controller for that processing.
5.7In addition to CCTV, VIXII uses an AI assisted analytics system to monitor customer movement within the store and to track customer interaction with and attention given to specific products ("AI Analytics"). The AI Analytics generates aggregated footfall analytics, zone dwell data, and heatmap analytics. The purpose of the AI Analytics is to inform product development, store layout, marketing strategy, and future sales and promotional events. VIXII does not use the AI Analytics to make automated decisions that produce legal or similarly significant effects on individual customers. VIXII relies on legitimate interests under Article 6(1)(f) UK GDPR as the lawful basis for AI Analytics processing, having conducted a Legitimate Interests Assessment and determined that such processing is necessary and proportionate and does not override customers’ rights and freedoms. Customers have the right to object to processing based on legitimate interests at any time (see Clause 5.10(e)).
5.8VIXII offers an optional Membership programme. Customers who choose to enrol at an in store desk provide their name and email address and consent to having a facial image captured and a biometric face embedding generated for the purpose of recognition on subsequent visits (in store or online). This processing involves biometric data as defined under Article 4(14) UK GDPR and is carried out on the basis of the customer’s explicit consent under Article 6(1)(a) and Article 9(2)(a) UK GDPR. Consent is collected through a clearly worded opt in mechanism at the point of enrolment. Customers may decline to enrol or withdraw their consent at any time without being refused entry, service, or any other benefit. Member biometric records (face embeddings) are deleted after 12 months of inactivity or upon withdrawal of consent, whichever is earlier.
5.9Personal data collected through CCTV or analytics will be processed in accordance with applicable data protection law. CCTV footage is retained for a maximum of 7 days unless a longer period is required in connection with an incident, investigation, legal claim, or legal obligation. Customer contact details and purchase records are retained for 5 years following the relevant transaction, or such longer period as required by law or legitimate business need.
5.10VIXII may share personal data with service providers and professional advisers where necessary, including payment providers, email service providers, loyalty programme providers, IT and analytics providers, venue operators, insurers, legal advisers, and regulatory advisers for the sole purpose of assisting VIXII and not for any other purposes. VIXII does not sell customer personal data.
5.11Where VIXII uses service providers that process personal data outside the United Kingdom, VIXII will ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the International Data Transfer Agreement or equivalent mechanism.
5.12Customers have rights under applicable data protection law, which may include:
- the right of access to their personal data;
- the right to correction of inaccurate data;
- the right to erasure of their personal data in certain circumstances;
- the right to restriction of processing;
- the right to object to processing, including processing for direct marketing purposes;
- the right to data portability in certain circumstances;
- the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
- the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.