The policy articulates the legal justifications for the processing of your personal data and sets out your data subject rights under the Cayman Islands’ Data Protection Law, 2017 (“DPL”).
We use your information to provide the products and services you request, as well as to understand how and why our users engage with us. This allows us to personalise content, show you relevant adverts, and improve your experience of our products and services.
Hurley’s respects your privacy, and you are entitled to have your personal data processed in accordance with the DPL. Below are the privacy principles Hurley’s applies when processing your personal data:
- Lawfulness: Hurley’s will only collect your personal data in a fair, lawful and transparent manner.
- Data minimisation: Hurley’s will limit the collection of your personal data to what is directly relevant and necessary.
- Purpose limitation: Hurley’s will only collect your personal data for specified, explicit and legitimate purposes.
- Accuracy: Hurley’s will keep your personal data accurate and up to date while there continues to be a customer relationship, and in certain circumstances, after that relationship has ended.
- Data security and protection: Hurley’s has implemented technical and organisational measures to ensure an appropriate level of data security and protection considering the sensitivity of the personal data it processes. Such measures provide for the prevention of any unauthorized or unlawful processing of your personal data and against accidental loss or destruction of, or damage to that data.
- Access and rectification: Hurley’s will process your personal data in line with your legal rights under the DPL.
- Retention limitation: Hurley’s will retain your personal data in a manner consistent with applicable data protection legislation and regulation (including the DPL) and no longer than is necessary for the purposes for which it has been collected in accordance with its retention policy.
- Protection for international transfers: Hurley’s will ensure that if your personal data is transferred outside the Cayman Islands, it is adequately protected.
What personal data does Hurley’s collect?
Hurley’s collects various personal data about you which may include the following (this list is not exhaustive):
- name and address
- date of birth
- telephone number
- email address
- identification details (for example, your driver’s license or passport)
- details of phone usage including numbers called and duration of calls
- general internet traffic data related to your IP address
- information about your computer and about your visits to and use of this website or mobile APP (including your P address, geographical location, browser type and version, operating system, referral source, date and time and length of visit, page views and website or mobile APP navigation paths)
- details of your downloads using peer to peer file sharing software
- financial information such as credit card numbers or certain banking information
- your communications with us, including emails and phone calls (and any recordings made for training or security purposes), including the communication content and metadata associated with the communication
- details of the products and services you use and how you use them
- information voluntarily provided to Hurley’s by a data subject on a social media platform such as Facebook, Twitter or a chat application such as WhatsApp, including username, profile pictures and reviews
- any other personal data you choose to send us.
How does Hurley’s use the personal data it collects?
Hurley’s may use your personal data to (this list is not exhaustive):
- respond to your inquiries
- manage our relationship with you
- send invoices and collect payment for goods or services rendered
- undertake or assist with credit and fraud prevention checks (including requesting information about you or responding to requests about you from other providers)
- conduct promotional activities
- conduct surveys
- market goods and services and directly send you marketing communications relating to our business or the businesses of carefully-selected third parties which we think may be of interest to you, by post or by email or similar technology (you can inform us at any time if you no longer require marketing communications)
- engage with you on social media platforms
- send you email notifications or our email newsletter, upon your request
- handle your complaints
- prevent or verify fraud or other criminal activity or breach of terms
- manage bandwidth usage
- administer, maintain, develop and test our mobile app, website (including managing the traffic on our network), business, products and services, to provide you with a better service
- personalise our website or mobile app for you
- enable your use of the services available on our website or mobile app
- train our employees to provide you with products and services
- comply with any regulatory reporting obligations
- prevent the use and transmission of viruses and other impediments to the provision of service to you
- record health and safety details if there is an incident at one of Hurley’s establishments or a Hurley’s event
- undertake the specific purpose that it is requested for.
When does Hurley’s disclose your personal data?
Hurley’s may disclose your personal data in the following circumstances (this list is not exhaustive):
- to employees and contractors of Hurley’s for the purposes of the business and provision of services
- on social media where you may have already made the personal data public
- where you submit personal data for publication on our website, mobile app or social media
- if Hurley’s uses a third-party service provider for marketing, marketing research, payment management or client relationship management
- to other market providers for the purpose of credit and fraud prevention checks
- to debt collection agencies or other third parties for the purposes of debt collection
- if you request or consent to your personal data being disclosed to a third party
- to a third party that Hurley’s partners with for special events so that the third party might contact attendees for marketing purposes
- if there is a legal request or regulatory, civil or criminal investigation or dispute or in order to defend our legal rights
- if it is required to seek legal advice from Hurley’s legal counsel or to other advisors including auditors and insurers
- any other circumstance where it may be required by law or regulation
International transfer of personal data
The legal basis for processing your personal data
The DPL sets out some different reasons for which a company may process personal data, and Hurley’s does so under the following legal conditions:
- Consent: In specific situations, Hurley’s may collect and process your personal data with your consent. For example, if you tick a box to receive email newsletters or information on promotions and events.
- Contractual obligations: In certain circumstances, Hurley’s may need to process certain your personal data to comply with contractual obligations. For example, Hurley’s will process your personal information to ensure that you abide by your contract or to comply with the terms of a Hurley’s competition.
- Legal compliance: If the law requires, Hurley’s may need process your personal data. For example, Hurley’s may be required to disclose your personal information if there is a legal request or law enforcement or regulatory investigation.
- Legitimate interest: In specific situations, Hurley’s may process your personal data to pursue its legitimate interests in a way which might reasonably be expected as part of running its businesses and which does not materially impact your rights, freedom or interests.
How long does Hurley’s retain your personal data?
Hurley’s retains your personal data for as long as a customer relationship exists and the personal data is necessary to manage that relationship. When there is no longer a customer relationship, Hurley’s will retain certain types of personal data for varying periods depending on legal requirements and business needs.
Hurley’s will retain documents:
- To the extent required to do so by law
- If we believe that the documents may be relevant to any ongoing or prospective legal proceedings or investigation
- To establish, exercise or defend our legal rights including providing information to others for the purposes of fraud prevention and reducing credit risk.
Personal data that is no longer needed will be securely destroyed. Hurley’s will always hold your personal data for the least amount of time it considers necessary in accordance with its retention policy.
If we no longer need your personal information in full we will make efforts to anonymise or aggregate it, thereby removing all details that identify you.
If we have asked for your consent to process your personal information and you withdraw your permission, if we have no other lawful grounds to continue with that processing, we will securely delete your personal information. When you unsubscribe from marketing communications, we will keep your email address to ensure that we comply with your request.
How does Hurley’s secure your personal data?
Hurley’s employs appropriate technical and organizational measures to protect against unauthorised processing, accidental loss or destruction of, or damage to, your personal data in accordance with its Information Technology and physical security policies.
Please keep in mind that it is not possible to achieve a perfect state of data security. Although we maintain reasonable administrative, physical and electronic security measures designed to protect your personal data from unauthorised access, we cannot ensure absolute security of any information you transmit to us or guarantee that this information will not be accessed, disclosed, altered, or destroyed. We will make any legally required disclosures of any breach of the security, confidentiality, or integrity of your un-encrypted electronically stored personal data.
Change of control
Contact with you
If we have your permission, we may send you materials we think may interest you, such as new services and updates. You can decide not to receive these emails at any time by contacting us at email@example.com, or by following the unsubscribe instructions in the relevant communication.
Loyalty Card Program
Hurley’s may, from time to time, enter into loyalty card programs with its affiliates, including C3, Clean Gas Ltd and the Hurley’s Group of companies (including Hurley’s Media Ltd and Hurley’s Food Store) (together “the Group”) in order to reward customers of these companies for their loyalty. By their nature, loyalty card programs involve the collection of personal data, including, but not limited to, name, date of birth, contact and shopping habits. The data will be used by the Group for purposes including marketing, targeted advertising, tracking customer purchases and building consumer profiles. Personal data may be shared between member companies of the Group for the same purposes. By requesting a loyalty card from any Group member company, the customer specifically acknowledges that such company will collect and process the personal data specified in the loyalty card program form as well as data regarding purchases and may share such data with the Group. If you do not wish to have your data collected, processed or shared, in this way, please do not enter any loyalty card program with any member of the Group.
What rights do you have in respect to your personal data?
You have choices when it comes to the technology you use and the data you share. When we ask you to provide personal data, you can decline to provide personal data. If you choose not to provide data which is necessary in order to furnish you with a product or feature such as our mobile app, you will not be able to use that product or feature. Where providing the data is optional, and you choose not to share personal data, features like personalisation (or other features that require personal data that use such data) may not work for you.
You have rights (with certain restrictions) to request access to your personal data, request rectification/correction of your personal data, request that processing of your personal data be stopped or restricted and to require Hurley’s to cease processing your personal data for direct marketing purposes. If you wish to exercise any of these rights, you should contact firstname.lastname@example.org.
If you feel that your personal data has not been handled correctly, or you are not satisfied with Hurley’s responses to any requests you have made to Hurley’s regarding the use of your personal data, you have the right to complain to the Cayman Islands’ Ombudsman. The Ombudsman can be contacted by calling 1-345-946-6283 or by email at email@example.com.
Other people’s data
California privacy rights
If you are a California resident, the California Consumer Privacy Act (CCPA) may provide you with additional rights regarding the use of your personal information. These rights include:
- The right to access the personal information we process about you;
- The right to know what personal information is collected about you and if any information is sold or disclosed, and to whom;
- The right to request the deletion of your personal information, if applicable;
- The right to opt-out from the sale of your personal information, if applicable; and
- The right to not be discriminated against for exercising any of the rights above.
You can exercise any applicable rights by emailing firstname.lastname@example.org or contacting us at email@example.com. You may be required to submit proof of your identity and/or address, if we are unable to confirm your identity or cannot verify that you are a California resident. We endeavour to respond to a verifiable consumer request within 45 days. You may also designate an authorised agent to make a request on your behalf, subject to proof of identity and authorisation.
Changes to policy
A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Cookies do not typically contain any information that personally identifies a user, but personal data that we store about you may be linked to the information stored in and obtained from cookies. Cookies can be used by web servers to identify and track users as they navigate different pages on a website or mobile app and identify users returning to a website or mobile app.
Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed. We may use only session cookies, or only persistent cookies, or both session and persistent cookies on our website or mobile app. Our website or mobile app may also use third party cookies.
We use Google Analytics and/or similar facilities to analyse the use of our website or mobile app. Our analytics service provider generates statistical and other information about website or mobile app use by means of cookies. Google Analytics stores information about: the pages you visit, how long you spend on each page, how you got to the site, what you click on while you’re visiting the site and your behaviour on website. The information generated relating to our website or mobile app is used to create reports about the use of our website or mobile APP. Google Analytics privacy notice is available at: http://www.google.com/policies/privacy/
Most browsers allow you to refuse to accept cookies. For example: in Internet Explorer (version 10) you can block cookies using the cookie handling override settings available by clicking “Tools”, “Internet Options”, “Privacy” and then “Advanced”; in Firefox (version 24) you can block all cookies by clicking “Tools”, “Options”, “Privacy”, selecting “Use custom settings for history” from the drop-down menu, and unticking “Accept cookies from sites”; and in Chrome (version 29), you can block all cookies by accessing the “Customise and control” menu, and clicking “Settings”, “Show advanced settings” and “Content settings”, and then selecting “Block sites from setting any data” under the “Cookies” heading.
You can delete cookies already stored on your computer. For example: in Internet Explorer (version 10), you must manually delete cookie files (you can find instructions for doing so at http://support.microsoft.com/kb/278835); in Firefox (version 24), you can delete cookies by clicking “Tools”, “Options” and “Privacy”, then selecting “Use custom settings for history”, clicking “Show Cookies”, and then clicking “Remove All Cookies”; and in Chrome (version 29), you can delete all cookies by accessing the “Customise and control” menu, and clicking “Settings”, “Show advanced settings” and “Clear browsing data”, and then selecting “Delete cookies and other site and plug-in data” before clicking “Clear browsing data”.
Blocking or deleting cookies will have a negative impact on the usability of many websites and could also negatively impact mobile apps. If you block or delete cookies, you may not be able to use all the features on our website or mobile app.