Privacy Notice

1. Important information about this privacy notice

Welcome to the COOP Mobile privacy notice (“Notice”). The Channel Islands Co-operative Society Limited and its subsidiaries make up the CI Coop group. These include The Channel Islands Co-operative Society Limited (“Society”) and Offshore Leisure Limited (“OLL”).

The Society is registered under the Co-operative and Community Benefit Societies Act 2014 with the Mutuals Public Register of the FCA and is governed by the Industrial and Provident Societies Act 1965-1978 (Industrial and Provident Societies (Channel Islands) Order 1965-1978). CI Coop’s registered office is at Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR.

Controller

For the purposes of the mobile telecommunication services referred to in this Notice, OLL is the data controller.

OLL (registered number 77830), whose registered office is Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR, is licensed by the Jersey Competition Regulatory Authority (“JCRA”) and Guernsey Competition & Regulatory Authority (“GC&RA”) to provide mobile virtual network operator (“MVNO”) services in the Channel Islands.

OLL operates and trades in the Channel Islands under the business name “COOP Mobile”. References in this Notice to “we”, “us”, “our” and the “Company” are to OLL as the licensed operator and data controller.

DPO

To assist us in managing our data protection obligations and ensuring our compliance with this Notice we have appointed a Data Protection Officer (“DPO”). If you have any questions in respect of this Notice and how we manage or process your personal information please contact the Data Protection Officer at Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR or on 01534 879822 or by email to: dpo@channelislands.coop.

MVNO services in the Channel Islands

An MVNO offers mobile telecommunications services to retail customers operating under a wholesale arrangement with a licensed mobile network operator (“MNO”) in Jersey and Guernsey and which does not itself own or operate any part of the core mobile network infrastructure. For the purposes of the COOP Mobile services, OLL is the MVNO and Sure (Guernsey) Limited and Sure (Jersey) Limited (together “Sure”) is the MNO.

Information regarding Sure’s privacy policies in the Channel Islands can be found at: sure.com/jersey/privacy-policy and sure.com/guernsey/privacy-policy.

About this Notice

We understand that your privacy and the security of your personal information is extremely important. This Notice sets out why we collect your personal information, what we do with it, how we keep it secure, how and where we collect it from, how long we keep it, as well as what your rights are in relation to the personal information we hold about you.

This Notice applies no matter how you interact with us as a (prospective) COOP Mobile customer—over the phone, by email, in writing, online through our website, via social media channels, or when entering our competitions. References to personal information also mean personal data and vice versa.

Changes to this Notice and your duty to inform us of changes

From time to time we may change this Notice. You should check this Notice occasionally to make sure you understand how we handle your personal information. Substantive changes to the Notice will be notified to you.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Other privacy notices

Where we are required to do so, we will issue separate privacy notices covering your personal information. We have separate privacy notices for other aspects of the Society’s activities and operations, including our general retail offering, and pharmaceutical and funeral services.

2. The sorts of personal information we hold about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, store, transfer, and otherwise use personal information about you when you contact us, become a COOP Mobile customer or provide us with your information for another specific purpose. We may collect, use, store and transfer different kinds of personal information about you which we group as follows:

• Identity Data – first name, last name, former names or aliases, username or similar identifier, marital status, title, date/place/country of birth, identification number (passport or national identity card), gender, share number, nationality and signature.
• Contact Data – addresses (e.g. billing and deliveries), email address and telephone numbers.
• Financial Data – bank account and payment card details related to your transaction data.
• Transaction Data – purchases and payments to and from you for goods/services; administration of your membership account; where permitted, categories of websites/apps visited for advertising (see cookie policy).
• Technical Data – IP address, login data, browser type/version, time-zone setting and location, plug-in types/versions, operating system/platform and other technology on the devices you use to access our sites/apps.
• Profile Data – username/password, interests, preferences, educational status, feedback/survey responses; details of when/where/how you redeem offers and promotions; store visit details.
• Usage Data – amounts/volumes of usage or spend, numbers called or texted (not content), numbers calling/texting you, cell location from which a call is made, time/duration of services (voice, SMS, MMS, data) in Jersey, Guernsey, the UK and abroad.
• Marketing and Communications Data – your preferences in receiving marketing from us/third parties and your communication preferences.
• Images – CCTV when visiting our stores, or images you provide at member counters.

Where not already noted above, when contracting with us for mobile services, we may obtain information to manage your subscription.

Aggregated data

We also collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law as it does not directly or indirectly reveal your identity. If we combine or connect Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data.

Special category data

Special Category data includes information relating to race/ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic/biometric data, and criminal record or alleged criminal activity. Where we collect Special Category data we will have a clear legal basis or your explicit consent. You can withdraw consent at any time by contacting our DPO.

If you fail to provide personal information

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract. We will notify you if this is the case.

3. How we collect your personal information

Direct interactions

You may give us Identity, Contact, Transaction and Financial Data by buying our goods/services, filling in forms or corresponding with us by post, phone, email or otherwise. This includes when you:

• purchase COOP Mobile services;
• create an account on our website or app;
• request marketing to be sent to you;
• enter a competition, promotion or survey; or
• give us feedback.

Automated technologies or interactions

As you interact with our website, we may automatically collect Technical Data via cookies, server logs and similar technologies. See our cookie policy for details.

Third parties or publicly available sources

We may receive personal data about you from various third parties and public sources, including:

• Technical Data from analytics providers, advertising networks and search information providers (e.g., Google);
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services;
• Identity and Contact Data from data brokers/aggregators and publicly available sources; and
• Usage Data from the MNO.

Withdrawing your consent

Where we rely on your consent, you may withdraw it at any time by contacting our DPO at DPO@channelislands.coop. Once we receive notice, we will no longer process your information for that purpose unless another lawful basis applies.

4. How we use your personal information

We will only use your personal information when the law allows us to (the legal basis). Most commonly:

1. Legal obligation
2. Contract – to provide services to you (e.g., your OLL contract for COOP Mobile services)
3. Legitimate interests – e.g., assisting emergency services, debt collection, credit referencing, fraud prevention

We may also rely (in limited situations) on your consent and, in emergencies, your vital interests.

Opting out

You can withdraw consent to marketing at any time (see section 10 contact details, or email hello@channelislands.coop, or update preferences in your Member Portal, or use the unsubscribe links in our communications).

Purposes for which we use your personal information

Third-party marketing

We may share your personal data with other legal entities within the CI Coop group for marketing of goods/services/products available to you as a member. We will get your express opt-in consent before sharing your personal data with any company outside CI Coop group for marketing purposes.

Cookies

Please see our cookie policy.

Change of purposes

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis.

5. Sharing your personal information

We only transfer your information to third parties when it is safe and necessary, and your information is protected to the same standard we apply. Where a third party is our processor, they act only on our instructions and must protect your data. Where they are a controller alongside us, they must meet their own controller obligations.

We may share your personal information with Internal Third Parties (other CI Coop entities) and External Third Parties for the purposes in section 4, including:

• Emergency services (e.g., States of Jersey Police, Jersey Ambulance Service, Jersey Fire and Rescue Service, Jersey Coastguard)
• Non-statutory emergency services (e.g., RNLI Coastguard charity, St John Ambulance)
• The MNO (presently Sure) regarding network operations, wholesale services and certain customer care actions
• Regulators (e.g., GFSC, JFSC, JCRA, GC&RA, FIU, JCSC)
• Professional service providers:
  • Onboarding (Vaiie)
  • Customer service support (Sure)
  • Billing and payments (Lifecycle and Elavon)
  • Mobile number portability (PortingXS)
  • Retail vouchering (VME Coop)
• Third parties involved in potential sale/transfer/merger of our business/assets (subject to appropriate safeguards)

International transfers

Personal data may be transferred to, and stored at, destinations outside Jersey, Guernsey, the UK and the EEA. Where we do so, we ensure your rights are protected via approved transfer mechanisms (e.g., adequacy decisions or Standard Contractual Clauses). OLL typically relies on the SCCs via the Jersey Office of the Information Commissioner data transfer addendum. For further information, contact us (section 10).

6. CCTV

We use CCTV across our stores, fuel courts, public areas and car parks for protection and security, including investigating accidents/incidents, prevention/detection of crime and internal investigations, including compliance with the Health and Safety at Work (Jersey) Law, 1989.

Our legal bases are Legitimate Interests and Legal Obligation. Cameras are positioned to cover our property where possible; some may capture public areas. We may disclose images to Police (evidence) and in disciplinary proceedings, and occasionally to public/regulatory authorities or individuals seeking to protect rights/prevent crime and nuisance where appropriate.

7. For how long we keep your personal information

We retain personal data only as long as necessary for the purposes collected, including legal/accounting/reporting requirements. Retention depends on the amount/nature/sensitivity of data, risk of harm, purposes and legal requirements. Details are in our retention policy (available on request via section 10). In some circumstances you can ask us to delete your data (see section 9).

8. Keeping you informed about our products and services

Where we have consent or legitimate interests, we may contact you about COOP Mobile offers, ideas, products and services via post, email, SMS, phone, online advertising or other electronic means. We will not send marketing if you tell us not to or if we lack consent; you may still receive service messages and surveys (you can opt out within the survey).

Please note some marketing already in transit may not stop immediately after you opt out.

9. Your rights

By law you have the right to:

1. Access your personal information (data subject access request).
2. Rectification of inaccurate/incomplete information.
3. Erasure where no good reason for continuing processing.
4. Object to processing based on legitimate interests or for direct marketing.
5. Restriction of processing in certain cases.
6. Portability – transfer your personal information to another party.

To exercise your rights, contact our DPO at DPO@channelislands.coop (see section 10).

No fee is usually required

You will not have to pay a fee to access your personal information (or to exercise other rights). We may charge a reasonable fee or refuse requests that are clearly unfounded or excessive.

Requesting your personal information

You may request your personal information at any time (DSAR) via our DPO.

What we may need from you

We may request specific information to verify your identity and right to access your data as a security measure.

How long do we have to respond?

We will respond within 4 weeks after satisfactory verification of your identity.

Right to make a complaint

We would like the chance to resolve complaints, but you may complain to the Jersey Office of the Information Commissioner or the Office of the Data Protection Authority in Guernsey:

• Office of the Information Commissioner – Jersey
  2nd Floor, 5 Castle St, St Helier, Jersey JE2 3BT
  Tel: +44 (0)1534 716530 · Email: enquiries@jerseyoic.org
• Office of the Data Protection Authority – Guernsey
  Block A, Lefebvre Court, Lefebvre Street, St Peter Port, Guernsey GY1 2JP
  Tel: +44 (0)1481 742074 · Email: info@odpa.gg

Where your complaint concerns one of our products/services, we may need to share relevant data with a supplier/producer as part of the investigation. Your data will be protected as outlined in this Notice. If you do not want your data shared, please tell the staff member handling your complaint or contact our DPO.

10. Contact us

The Data Protection Officer
Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR
Tel: 01534 879822
Email: dpo@channelislands.coop