Privacy and Cookies Policy
Privacy Policy
At The Gem Bank we value the privacy of our customers. We would like to ensure that your experience is one that you’ll want to repeat and recommend to your friends and loved ones. One part of our continued commitment to you is to respect and look after the privacy of your personal information.
This Privacy Policy will inform you of what information we collect, why we collect it, how we use it, and the choices you have regarding how we store and use that information.
Introduction
International Gemstones Limited, trading as The Gem Bank (‘we’, ‘us’, or ‘our’) is a natural gemstone retailer accessible via the website www.thegembank.com that provides a wide range of natural diamonds and gemstones, as well as related jewellery products.
We are committed to having the correct procedures in place to protect and respect your privacy, in line with the guidelines of the European Union’s General Data Protection Regulation (“GDPR”).
For the purposes of the United Kingdom’s Data Protection Act 1998 and, when it comes into force, the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and all successive legislation to the Data Protection Act 1998 and the GDPR (the “Data Protection Legislation”), the data controller is International Gemstones Limited, registered in England and Wales under registration number 05141720 and our principal place of business is 39 Greville Street, London, EC1N 8PJ.
We may need to gather and use certain information about individuals. This Privacy Policy explains in detail the data we collect, along with how it is handled, stored and how we keep it safe. These individuals can include customers, suppliers, business contacts, employees, users of our clients’ websites and other people that the organisation has a relationship with, or may need to contact.
The policy applies to all International Gemstones Limited employees and all Personal Data processed at any time by International Gemstones Limited. The objective of the policy is to ensure that:
- We process personal data in compliance with the GDPR.
- International Gemstones Limited and all its staff members are aware of all obligations and protocols when processing personal data.
- We protect the rights of staff, customers and partners along with your own personal data.
- International Gemstones Limited protects itself from the risks of a data breach.
By visiting www.thegembank.com (“our site”) you are accepting and consenting to the practices described in this policy.
Terminology
Data Controller - the organisation that determines the manner and purposes for which personal data is to be processed.
Data Processor - the organisation or individual who processes personal data on behalf of the data controller.
Data Subject - an individual who is the subject of personal data (also referred to as ‘you’, ‘your’, ‘yourselves’).
Personal Data - information relating to an individual who can be directly identified from the information. Personal data includes factual information as well as expressions of opinion or intentions.
Personal Data Breach - loss, theft or unauthorised access, use or disclosure of personal data.
Legal Basis for Data Collection
There are a number of reasons that the law allows the collection and processing of personal data.
Consent - certain situations allow us to collect your personal data, such as when you tick a box that confirms that you are happy to receive email communications, or ‘opt in’ to a service.
Contractual Obligations - we may require certain personal information from you in order to fulfil our contractual obligations and provide you with the promised service, i.e. delivery of purchases.
Legal Compliance - we’re required by law to collect and process certain types of data, such as fraudulent activity and other illegal actions.
Legitimate Interest - We might need to collect certain information from you to be able to meet our legitimate interests - this covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests.
Policy Statement
International Gemstones Limited will only collect and process information where we have gained consent, we have contractual obligations or legitimate interest, or for legal compliance. We will:
- Comply with the Data Protection Legislation and adhere to the following 8 Data Protection Principles:
- Data must be processed fairly and lawfully.
- Data must be obtained only for specific and lawful purposes.
- Data must be adequate, relevant and not excessive.
- Data must be accurate, and kept up to date.
- Data must not be held for any longer than necessary.
- Data must be processed in accordance with the rights of data subjects.
- Data must be protected in appropriate ways.
- Data must not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection.
- Comply with the statutory requirement to maintain accurate entries on the Information Commissioner’s public register of Data Controllers, which describes the purposes for which personal data is processed.
- Comply with all other relevant legal requirements which apply to its processing of personal data.
- Implement appropriate structures, systems and processes to manage all personal data fairly and lawfully.
- Be transparent about how personal data is processed, providing clearer privacy notices at the point it is collected, providing users with an option.
- Ensure that procurement processes and contractual arrangements with external service providers also adhere to adequate measures to ensure compliance with the Data Protection Principles.
- Approach the identification, control, mitigation and elimination of privacy risk in the same way as financial and operational risk.
- Provide customers with an opportunity to opt in to receiving future marketing communications at the point at which their personal data is collected and provide a simple process to unsubscribe should they change their mind.
- Ensure that requests from customers to change the use of their data for the purposes of marketing/ the provision of service updates are acted upon promptly.
- Not disclose personal data to third parties except where disclosures are permitted or required by law.
- Label personal data in accordance with its Information Security Classification Standard for protectively marking information.
- Ensure that any complaint about International Gemstones Limited’s processing of personal data or non-compliance with the policy will be passed to the Privacy and Data Protection Team. The complaint will then be dealt with promptly in accordance with the Data Protection & Incident Response Policy.
- Provide training to any relevant member of staff and ensure that training is kept up to date.
- View serious or repeated breaches of this policy by an International Gemstones Limited employee as misconduct that will be managed and resolved in accordance with relevant disciplinary policies and procedures.
Privacy by Design
International Gemstones Limited has adopted the principle of privacy by design and will ensure that the definition and planning of all new or significantly changed systems that collect or process personal data will be subject to due consideration of privacy issues, including the completion of one or more data protection impact assessments.
The data protection impact assessment will include:
- Consideration of how personal data will be processed and for what purposes.
- Assessment of whether the proposed processing of personal data is both necessary and proportionate to the purpose(s).
- Assessment of the risks to individuals in processing the personal data.
- What controls are necessary to address the identified risks and demonstrate compliance with legislation.
Use of techniques such as data minimisation and pseudonymisation will be considered where applicable and appropriate.
Breach Notification
It is International Gemstones Limited’s policy to be fair and proportionate when considering the actions to be taken to inform affected parties regarding breaches of personal data. In line with the GDPR, where a breach is known to have occurred which is likely to result in a risk to the rights and freedoms of individuals, the relevant supervisory authority will be informed within 72 hours.
Information that We Collect from You
Personal data, or personal information, means any information about an individual (data subject) from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer the following data about you:
Information You Give Us
This is information about you that you give us by filling in forms on our site or by corresponding with us by phone, email, in person (for example, in our showroom) or otherwise. It includes information that you provide when you request a quote or other marketing material from our site or in person, purchase our products and/or services, search for a product and/or service, and when you report a problem with our site or give us feedback. The information you give us may include, but is not limited to, your name, gender, address, email address, phone number and financial information.
Information We Collect About You
When you visit The Gem Bank, we measure visits using Google Analytics and standard web server log files. These record:
- technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number.
User ID for Google Analytics:
- Google Analytics makes use of a feature called “User ID.” This setup allows for a more accurate tracking of users by associating that user with the same ID over various sessions and devices. It is set up in a way that does not allow Google to personally identify an individual or permanently identify a particular device. The User ID extension might make it possible to connect data from Google Analytics with other data about the user collected through this website. The opt-out link below will only opt you out for the device you are on, but not from tracking performed independently by the Owner.;
- To opt out of tracking through Google Analytics, please contact us via the contact information provided at the end of this Policy. You can also learn more about this technology and how to opt-out of this feature by installing the Google Analytics Opt-out Browser Add-on.
Cookies
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. Our cookie policy below explains this in more detail.
Managing Cookies
Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:
(a) https://support.google.com/chrome/answer/95647?hl=en (Chrome);
(b) https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
(c) http://www.opera.com/help/tutorials/security/cookies/ (Opera);
(d) https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer) and
(e) https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac (Safari)
Please be aware that if you block cookies, you may not be able to use all the features on The Gem Bank.
Email Contact
Any email sent to International Gemstones Limited., including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
Information we receive from other sources
We may have access to certain information if you use any of the other services we provide or if you interact with our social media pages.
We may also work with some third parties that you have permitted to share the information they hold about you with us, such as: business partners, subcontractors, payment services, ad networks, analytics providers, search engine providers, credit reference agencies, so we could receive information about you from them if it is necessary.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
Your image may be recorded on CCTV as you enter any of our showrooms or premises, for security purposes only. Footage is kept for 30 days at which point it is automatically deleted
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
How We Use Your Information
We will only use your personal data when the law allows us to. Most commonly, we will use your personal information:
- to carry out our obligations arising from any contracts entered into between you and us or to take steps at your request before entering into any contracts (e.g. providing quotes);
- to comply with any legal obligations to which we are subject; or
- where it is necessary for our or a third party’s legitimate interests, including for the purposes of preventing fraud, except where such interests are overridden by your interests or fundamental rights and freedoms.
Examples of of how we may use your data include but are not limited to:
- Providing you with information, products and services that you request from us.
- Providing you with information about other goods and services that we offer that are similar to those you have already purchased, enquired about, or that we would recommend.
- Administer The Gem Bank and for internal operations such as troubleshooting, data analysis, testing, or for research purposes.
- Improving The Gem Bank in order to ensure that content is presented in the most effective manner for you and your computer.
- Developing and testing the products and services we provide you with.
- Allowing you to interact with features of the service.
- Helping us keep The Gem Bank safe and secure.
- Measuring the effectiveness of advertising served to you.
- Processing payments.
Generally, we do not rely on consent as a legal basis for processing your personal information other than in relation to sending direct marketing communications to you via email.
If necessary, legal and in your best interests, we may share your personal information with selected third parties including:
- Business partners, suppliers and subcontractors for the performance of any contract we enter into with them or you.
- Our investors and advisors.
- Analytics and search engine providers that assist us in improving The Gem Bank.
- Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.
When Might This Be Necessary?
- In the event that we sell any business or assets, in which case data may be disclosed to the seller or buyer of such business/assets.
- In the circumstance that International Gemstones Limited or all its assets are acquired by a third party. Personal information would be one of the transferred assets.
- If we have a duty to disclose information in order to comply with legal obligations.
- In order to apply agreements between us, to protect our rights, property, safety and customers. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
Marketing
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
We may use your identity, contact details, usage data and marketing preferences to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
You will receive marketing communications from us if you have requested information from us or purchased goods or services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.
We will get your express opt-in consent before we share your personal data with any company outside of the International Gemstones Limited group for marketing purposes.
You can ask us or third parties to stop sending you marketing messages at any time by contacting us at any time.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.
Change of Purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosure of Your Information
Sometimes we may share your personal data with trusted third parties, for example business partners or for fraud management.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
International Transfers
Some of our external third parties, such as Google Analytics, are based outside of the European Economic Area (“EEA”) so their processing of your personal data will involve a transfer of data outside the EEA to the USA for example.
If this is necessary, we have procedures in place to ensure that this data receives the same process as we follow for the EEA. We will treat the information the same as we would for EAA companies under the stipulations of this Privacy Notice.
Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
However, the transmission of information via the internet is never completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How Long Will We Keep Your Data?
We will only retain your personal information for as long as is necessary to carry out the purpose for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Your Rights
Under the Data Protection Legislation you may be entitled to the following rights:
- Where you have provided your consent to the processing of your personal data for any purpose, you have the right to withdraw such consent at any time by contacting us at The Gem Bank, 39 Greville Street, London EC1N 8PJ, or by email to gems@thegembank.com.
- You can ask us to rectify any inaccuracies in the personal information that we hold about you.
- To request the erasure of personal information that we hold about you where there is no good reason for us to continue processing it, where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law.
- To object to our processing of your personal data where we are relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- To restrict our processing of your personal data
(a) if you want us to establish the data’s accuracy;
(b) where our use of the data is unlawful but you do not want us to erase it;
(c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
(d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- To request a copy of your personal data from us in a commonly used and machine-readable format or that we transmit your personal data to another data controller.
- Not to be subject to automated decision-making, including profiling, which has legal or other significant effects on you.
- To access information held about you. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
You can direct your subject access requests or correction requests to gems@thegembank.com or in writing to Data Protection Officer, International Gemstones Limited, 39 Greville Street, London EC1N 8PJ United Kingdom
Questions, comments and requests regarding this privacy policy are welcomed and should be submitted via the method above.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Further information can be found at www.ico.org.uk.
If we choose not to action your request we will explain to you the reasons for our refusal. If the task is deemed onerous and unreasonable by the ICO, we may ask you to reduce your request to something more specific or alternatively, if approved by the ICO, the full request may become chargeable.
To protect your information, we will require you to verify your identity before we proceed with any request. If you have authorised a third party to make this request (such as a solicitor) on your behalf, we must still be provided with verification of your identity and reasonable proof that they have your permission to act on their behalf. We will provide the requested information directly to the subject of the data subject access request and not to the third party.
Links To and From Our Site
The Gem Bank may contain links to and from websites we partner with such as advertisers or affiliates. If you do follow these links, it is important to be aware that these websites use their own privacy policies, and International Gemstones Limited will be unable to accept any responsibilities for these policies.
Data Accuracy
It is the responsibility of all employees at International Gemstones Limited who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.
- Data is held in as few places as necessary. Staff are advised against creating any unnecessary data sets and if this is required they must dispose of this data by either shredding the paper copy or thoroughly deleting the additional copy.
- Staff take every opportunity to ensure that data is updated. For instance, by confirming a customer’s details when they call, or if they change their contact information in their email footer.
- International Gemstones Limited makes it easy for data subjects to update the information that they hold about them. A data subject may request access, a change or request the right to be forgotten at gems@thegembank.com. We would aim to update this data or delete this data as promptly as possible within 14 days, but no longer than 30 days.
- Data is updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it is removed from the database.
You have the right to contact us at any time to correct the data we hold about you. For example, if you had recently married and changed your name, we will update this and inform any relevant third parties or suppliers who need to also update records.
Changes to Our Privacy Policy
Any changes we make to our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our Privacy Policy.
Cookies Policy
The Gem Bank uses cookies on www.thegembank.com.
Our Cookies Policy explains what cookies are, how we use them, how third parties that we may partner with may use cookies on The Gem Bank, and your choices regarding cookies. Please read this Policy carefully, in conjunction with our Privacy Policy above, which sets out additional details on how we use personally identifiable information and your rights.
What are Cookies?
Cookies are small pieces of text sent to your web browser by a website you visit. A cookie file is stored in your web browser and allows The Gem Bank or a third-party to recognise you and make your next visit easier, and www.thegembank.com more useful to you. Essentially, cookies are a user’s identification card for The Gem Bank’s servers. Web beacons are small graphic files linked to our servers that allow us to track your use of our website and related functionalities. Cookies and web beacons allow The Gem Bank to serve you better and more efficiently, and to personalise your experience on www.thegembank.com. Cookies can be “persistent” or “session” cookies.
How The Gem Bank Uses Cookies
When you use and access www.thegembank.com, we may place a number of cookie files in your web browser.
The Gem Bank uses, or may use cookies, to help us determine and identify repeat visitors, the length of time each user spends at any particular area of our website, and the specific pages, products and functionalities that users choose to view or use. The information collected through cookies will not be used to identify you personally unless you have specifically given us your consent.
We use both session and persistent cookies on www.thegembank.com:
- Essential cookies. Necessary for the operation of www.thegembank.com. We may use essential cookies to authenticate users, prevent fraudulent use of user accounts and remember information that changes the way www.thegembank.com behaves or looks, such as a user’s language preference on the website.
- Analytical/performance/optimisation cookies. We may use those cookies to track information on how www.thegembank.com is used so that we can make improvements. We may also use such cookies to test new advertisements, pages, features or new functionality on www.thegembank.com to see how our users react to them.
- Targeting cookies. Those cookies record your website visit, the pages you have seen, and the links you have followed. This data is then used to deliver website content more relevant to you.
Third Party Cookies
In addition to our own cookies, we may also use various third party cookies to report usage statistics of www.thegembank.com and refine our marketing efforts.
- Analytical cookies. Follow on-site behaviour and tie it to other metrics allowing better understanding of usage habits.
- Optimisation cookies. Allow real-time tracking of user conversion from different marketing channels to evaluate their effectiveness.
- Targeting cookies. Those cookies record your browsing history so we can deliver you more relevant advertisements, but can also limit the number of times you see an advertisement, and be used to chart the effectiveness of an ad campaign by tracking users’ clicks.
Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical cookies or targeting cookies.
What are your choices regarding cookies?
If you’d like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser (see links above).
Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use some or all of the features of www.thegembank.com. You may not be able to log in, store your preferences, and some of our pages might not display properly.