Visitors to our offices and premises
We collect personal information from visitors to our offices and premises including the date of your visit, your name, contact details, organisation, photograph, arrival and departure time, vehicle registration, host details, the purpose of your visit and information about any specific requirements you may have. We collect this information to facilitate your visit, to ensure building security and for safety reasons in the event of an emergency or building evacuation.
We also have security measures in place at our offices and premises, including CCTV. We use CCTV to maintain the security of our premises, prevent and investigate crime, and in the interests of health and safety. The images captured are securely stored and only accessed where necessary (e.g. to look into an incident). CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft).
In the unlikely event that you have an accident on our premises we will also collect details of the accident in order to comply with relevant health and safety legislation.
In order to meet our legal obligations, we also require visitors to our warehouse who receive a health and safety induction to complete a health and safety visitor form. This form records your name and contact details and serves as a record that you have received our health and safety induction.
Employees, contractors and freelancers
We collect personal information concerning our own personnel as part of the administration and management of our business activities. If you are an employee, contractor, consultant or freelancer, you should refer to the HR Privacy Notice available on the company intranet or otherwise provided to you.
Job applicants
When applying for a role at MDL, applicants should refer to the information made available when applying for the job and our Recruitment Privacy Notice which is available here. [Insert Link to recruitment Privacy Notice]
Sharing your personal information
We may share your personal information with selected third parties, although it is likely that the exact identity of the third parties with whom we share your personal information will change during your relationship with us. In the case of our individual and trade customers:
- We share customer data (including customer emails and contact details) with delivery service providers (such as DHL and DPD) so that the carrier can contact you directly about your order.
- We share customer data (including customer marketing preferences) with our Client Publishers.
- We share customer and invoice data with suppliers to the book industry such as Batch to enable our trade customers to use services such as Batch Payments or Batch Returns.
We may also share personal information of all groups of individuals with the following categories of third parties:
- Third parties who provide data processing and IT services to us including website hosting providers, data back-up, security and storage providers and cloud-based software providers.
- Other third party service providers who help us run and improve our business. For example providers of warehouse stock management and support services, invoicing and payment service providers, email and task management services and systems providers and debt collection providers.
- Other companies which are related to us through common ownership who provide IT and system administration services and undertake group level reporting.
- Professional advisors such as external lawyers, external auditors, insurance or tax consultants and claims handlers.
- Third parties with whom we may choose to sell, transfer or merge parts of our business or our assets.
- Any other third parties (including regulatory authorities, the police, courts and government agencies) where necessary to enable us to enforce or protect our legal rights, or where such disclosure may be permitted or required by law.
The legal reasons for using your personal information
When we collect and use your personal information, we only do so in accordance with at least one of the legal reasons allowed by Data Protection Law.
One of these is where we need to use your information to perform the contract we have entered into with you such as when we use personal information to fulfil customer orders and pay our suppliers and service providers.
Another is where using your information is necessary to comply with a legal obligation. For instance, where we are ordered by a court or regulatory authority to disclose your personal information.
Another is where we have obtained your specific consent to use your personal information. We generally do not rely on consent when handling personal information although in limited cases, where we consider it appropriate, we may approach you for your consent to a specific data processing activity.
In certain circumstances we may collect and use personal information where this is necessary in our legitimate interests or the legitimate interests of a third party. This broadly means that we can use your personal information if we have a genuine legitimate reason and we are not harming your rights and interests in doing so.
Some examples of our legitimate interests include:
- Administering and managing our business and services, for example when we use personal information in the course of managing our relationships with our customers, Client Publishers and suppliers and responding to queries and enquiries.
- Evaluating and improving our business, products and services. For example when we record telephone calls and carry out research about engagement with our website, services, and the publishing and distribution industry generally.
- Protecting against fraud and other risks to our business, for example when we collect personal information in the course of carrying out due diligence on our suppliers.
- Ensuring network and information security and the security of our premises, for example, when we use CCTV at our premises.
Whenever we process your personal information based on our "legitimate interests" we make sure that we take into account your rights and interests and will not process your personal information if we feel that there is an imbalance between your rights and interests and ours.
Where we store your personal information
MDL is based in the UK, but we are part of a global publishing group and we also use third party service providers located in other countries to help us run our business. As a result of this we may transfer personal information of individuals located within the European Economic Area (the European Economic Area being the European Union and Iceland, Liechtenstein and Norway, which is also referred to as the "EEA") outside of the EEA and may also transfer personal information of individuals located within the UK outside of the UK.
Countries outside of the EEA and the UK may not have data protection laws that provide the same level of protection as those within the EEA and the UK and so whenever we transfer your personal information outside the EEA or the UK, we take steps to ensure that all personal information is protected with adequate safeguards, such as by entering into approved standard contractual clauses.
Please contact us if you would like further information on the specific mechanism we use when transferring your personal information out of the EEA or the UK or wish to request a copy of the relevant safeguards which we have put in place.
How we keep your personal information safe
We take looking after your information very seriously. We have implemented appropriate physical, technical and organisational measures to protect the personal information we have under our control, both on and off-line, to protect it from improper access, use, disclosure, alteration, destruction and loss.
We have also put in place procedures to deal with any suspected data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long we hold your personal information
We will retain your personal information for as long as is necessary for each purpose which we use it for. We take a number of factors into account when determining the appropriate retention period for personal information, including the nature of the data, the business purposes for which it was collected, any legal or contractual obligations which require us to retain it and whether retention is necessary for the purpose of exercising or defending our legal rights.
We operate a Personal Data Retention and Disposal Policy. Please contact us if you would like to be provided with the details of the retention periods for specific aspects of your personal information.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Links to other websites
Our website contains links to other websites. Please be aware that this Privacy Notice does not apply to such websites and that we are not responsible for your information that third parties may collect through these websites. We encourage you to be aware of this when you leave our website, and to read the privacy and cookie policies of other sites that collect or use personal information.
Your legal rights
You have various rights in law in respect of the personal information we hold about you which are set out in more detail below:
- Access: You have the right to request confirmation that we are holding your personal information and to access a copy of the personal information that we hold about you. This is known as a “data subject access request” and enables you to check that we are handling your personal information lawfully.
- Correction: You can ask us to change or complete any inaccurate or incomplete personal information we hold about you.
- Erasure: You can ask us to delete or remove your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful reason for keeping it.
- Objection: You can object to our processing of your personal information where we are relying on a legitimate interest if there is something about your particular situation which makes you believe it impacts on your fundamental rights and freedoms.
- Withdraw consent: If you have given us your consent to use your personal information you can withdraw your consent at any time.
- Transfer: You can ask us to provide the personal information which you have provided to us back to you or to a third party in a structured, commonly used, electronic form, so it can be easily transferred.
- Restriction: You can ask us to suspend the processing of your personal information, for example if you want to establish its accuracy or where you have objected to our use of it.
If you wish to exercise any of these rights, you can do so by contacting us
Please note that some of these rights only apply in certain circumstances and we may not be able to fulfil every request. If this is the case you will be notified of this at the time of your request. If you make a request we may require specific information from you to help us confirm your identity. This is to ensure that personal information is not disclosed to anyone who does not have the right to receive it.
Where we are acting as a data processor on behalf of a Client Publisher, any requests which we receive to exercise these rights will be passed on to the relevant Client Publisher, who is the "data controller" for these purposes.
If your personal information changes
It is important that the personal information which we hold about you is accurate and current. Please keep us informed if your personal information changes.
If you don't provide us with your personal information
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform our contract with you or we may be prevented from complying with our legal obligations.
Cookies
Our website uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookies Policy.
Complaints
We hope that you won’t ever need to, but if you would like to complain about our use of your personal information, please contact us using the contact details set out below.
You also have the right to lodge a complaint with the competent data protection authority. If you are located in the UK the competent data protection authority is the Information Commissioner's Office ("ICO"). For further information on your rights and how to complain to the ICO, please refer to the ICO website.
How to contact us
Macmillan Publishers International Limited (trading as Macmillan Distribution (MDL)) is a company registered in England. Our company number is 02063302 and our registered office is at: Cromwell Place, Hampshire International Business Park, Lime Tree Way, Basingstoke, Hampshire, RG24 8YJ.
For further information about our privacy practices, to request to exercise any of your privacy rights described in this notice or to make a complaint please write to us using the postal address above (marking your correspondence for the attention of the Legal Team) or send an email to mdlwebeditor@macmillan.co.uk.
Updates to this Privacy Notice
We may make changes to this Privacy Notice from time to time. We will post any changes to on our website and may notify you of any material changes directly.
This Privacy Notice was last updated in 27th November 2023.
(Version 2.3)