Privacy Policy

Theo Paphitis Retail Group encompasses Ryman Limited, Robert Dyas Holding Limited, Boux Avenue Limited and London Graphic Centre.

• Robert Dyas Holding Limited began as an ironmonger’s 150 years ago, but today Robert Dyas sells a huge range of home and garden items in 93 stores and a vast online shop, from kitchen electricals to outdoor furniture and everyday essentials.

• Ryman Limited are the market-leading stationery and office supplies specialists on the high street.

• Boux Avenue Limited specialises in lingerie, swimwear, nightwear and activewear.

• London Graphic Centre Limited is considered a premier destination for art and graphic supplies and is the largest art and graphic supplies store in Prime Central London, located in the heart of the busy Covent Garden shopping district.

• When you visit any of our websites, and use your account to buy products and services

• When you make an online purchase and check out as a guest or when you purchase a product or service in store or by phone

• When you create an account with us or when you join our loyalty programme

• When you shop online, we may capture information through cookies and similar technologies, you can manage these when you visit our site

• When you engage with us on social media, discussion boards etc. or enter prize draws or competitions or participate in surveys or review our products and services

• When you contact us by any means with queries, complaints etc.

• When you fill in any forms

• When you subscribe to our marketing

• When you apply for a job via our site

• When you’ve given a third-party permission to share with us the information they hold about you

• When you use our shops or their car parks which usually have CCTV systems operating for the security of both customers and colleagues. These systems may record your image during your visit. In cases of body worn cameras, they may also record your voice

• Personal Identification: Personal details such as your name, address, date of birth, email address, phone number. Copies of documents you provide to prove your age or identity where the law requires this (including your passport and driver's licence). This will include details of your full name, address, date of birth and facial image. If you provide a passport, the data will also include your place of birth, gender, and nationality.

• Account information: Your username, password, loyalty card number and other identifiers you use to access your account. Any items you may have added to your Wish List.

• Transaction & order information: Products you purchased, their price, billing/delivery address, orders, receipts, your method of payment and your payment details which are anonymised as per PCI DSS recommended standards.

• Marketing information: Your marketing preferences, open rates, click through rates on email marketing campaigns using Pixels.

• Information obtained from your interactions with us: Details of your interactions with us through contact centres, in store, your comments and product reviews, your social media username if you interact with us through those channels, to help us respond to your comments, questions or feedback.

• Browsing & cookie information: Details of your visits to our websites, and which site you came to ours from. Information gathered using cookies in your web browser. Learn more about how we use cookies and similar technologies.

• Technical information: To deliver the best possible web experience, we collect technical information about your internet connection and browser as well as the country where your computer is located, the web pages viewed during your visit, the advertisements you clicked on, and any search terms you entered.

• Surveillance/monitoring: Your image may be recorded on CCTV when you visit a shop or car park. We may also record audio when body worn video is in use.

• Third party information: We may use personal data from other sources, such as specialist companies, media partners, retail partners and public registers (such as the electoral register). When we work with specialist companies that provide us with personal data about you, they'll have told you about this data sharing at the time it was collected. We use this and our own data to better understand our customers. We also use this personal data to make sure we have up-to-date details about you. We don't give personal data we’ve collected or created from you back to these companies.

• Special categories of personal data: If you provide us with any of the special categories of personal data (that is to say information as to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, sex life or sexual orientation or genetic or biometric data) or personal data relating to criminal convictions and offences in relation to a job application or in the context of your work with us, the information will only be used so that we can monitor our compliance with the law and best practice in terms of equal opportunities and non-discrimination and, where applicable to review and keep under review your ability and suitability to carry out the work for which you may be employed and any health and safety issues.

To deliver our services

• Better shopping experience: We want to ensure you have a positive experience every time you shop with us, to do this we need to provide the goods or services you have asked for, take payment from you, and manage any refunds or charges, communicate with you about key information directly related to the product or service we are providing you with.

• Loyalty programme: We need to register and maintain your Loyalty account and provide you with access to your order history, marketing preferences, your points, and other rewards.

• Customer service: Provide and manage our customer service relationship with you, for example, when you communicate with customer services in-store, via the customer contact centre or through online feedback forms.

• Customer feedback: Invite you to provide feedback on our products and the service you have received, then use your feedback to understand your views on our products and services.

• Personalised experience: We want you to have an experience that is personalised to you, for example we may use your location to show you products which are available in your local store, ensure your orders and parcels are ready for you when you arrive in store, remind you of favourite items you may have forgotten in your basket.

To understand you better

• Your needs: We want to ensure we’re constantly delivering the very best for you, to achieve this, we may use information to understand how our products and services are performing, and what changes we should make, who our customers are, and what kinds of things they like, how different groups of customers shop with us, how to best meet and exceed your expectations etc.

• Understand you across all our channels: We want to know who you are and want to provide you with an ecosystem of offers relevant to you across all our channels. To do this, we combine information across all our services using various identifiers such as name, email address, phone number etc.

• Improve our partnerships: We partner with other retail stores, companies within the TPRG group (further information provided in the privacy notice about the companies that form part of the group) etc, to provide you with offers, services that we may not directly provide but think could be useful to you. We’re always looking to understand how we can make these partnerships better.

To market relevant products & services

• Personalised marketing: We may contact you with personalised offers about products and services we think you'll love by email, SMS or post.

• Personalised ads on our sites and on other sites: When you’re shopping online, we may display offers, suggestions, and news about products and services we believe are most relevant to you. You may also see our ads on other sites, we routinely partner with social media and advertising partners who may show our advertising on their platform and help us to understand the effectiveness of our advertising.

• Understanding & improving our marketing: We want to understand the effectiveness of our marketing, for example to know what types of customers have responded well to a particular event, or whether customers responded to an offer, so we can market the right product and services to our customers.

To manage and improve our operations

• System maintenance: There’s a lot of technology powering what we do, from the systems that keep our stores stocked to the websites you interact with when you shop online.

• Use of your interaction with us: To deliver a robust customer service, we review your interactions with us and identify areas we could do better.

To manage safety, security, and our legal obligations

• Legal obligations: We may need to process information to comply with a legal obligation, or defend, manage, or process legal claims.

• Fraud & Theft: We continuously monitor for, and respond to, fraudulent or suspicious activity so that we can protect our property and assets and protect our customers and their accounts when shopping online.

• CCTV: We capture CCTV footage from cameras operating at all our sites and at times on body worn cameras to protect the safety and security of our customers, colleagues, suppliers, and visitors, protect our assets and investigate incidents and learn from them.

Visitor management

• If you’re a visitor, rather than a customer, at one of our sites we’ll make a record of your visit allowing us to effectively manage your safety and security of our site during your visit.

Security or other incidents

• In the unlikely event if you are involved in a safety or security incident, we collect information to allow us to investigate and record the incident.

Data Protection Law requires us to meet at least one “legal ground” for processing, currently set out in Article 6 of the General Data Protection Regulation. The grounds applicable to the personal data to which this notice relates are:

Performance of a contract

• Where the processing is necessary for us to perform a contract that you are party to, or to take steps at your request prior to entering a contract, example we use your personal information to process your orders and payments or to give you a refund, send communications to you about your orders, purchases or accounts and bill you for using our products or services, to administer your Loyalty account.

Legal obligation

• Where the processing is necessary for compliance with a legal obligation to which we are subject for example we need to identify you when you contact us, verify the accuracy of data that we hold about you or assist HMRC and/or the Police and/or other regulatory bodies in relation to an investigation by a public authority.

Vital Interest

• In certain circumstances it is in your vital interests for us to process your personal information. We may need to contact you if there are any urgent safety or product recall notices or where we otherwise reasonably believe that the processing of your personal information will prevent or reduce any potential harm to you.

Legitimate interest

• Where processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party. As a Company we are often required to process your personal data in order to carry out certain tasks relating to our business activities. In such cases, processing of personal data can be justified on grounds of legitimate interest.

• Communications

• To provide customer support and to respond to, and communicate with you about your requests.

• To contact you if we need to obtain or provide additional information.

• To check our records are right and to check every now and then that you’re happy and satisfied (e.g., customer surveys).

• For marketing activities (other than where we rely on your consent) e.g., personalising marketing messages through social media and other third-party platforms.

• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this to be able to comply with your request).

• To interact with you through social media.

• Personalise & Improve our Service

• To personalise your experience on our online services.

• To help us understand more about you as a customer, the products, and services you use, the way you use them and how you shop across the group.

• Improve the content and appearance of the Website(s), and to make sure that content is presented in the most effective manner for you.

• To operate, evaluate and improve our business, including the development of new products and services; to determine the effectiveness of our sales, marketing, and advertising; and the analysis and improvement of our products, offers, and promotions.

• To show you relevant ads by using data collected from your devices, including your searches, location, ads that you have seen and personal information that you have given us, such as your age range, gender, and topics of interest. Depending on your Ads Settings, this data informs the ads that you see across your devices. So, if you visit our website on your computer at work, you might see ads about our products or services on your phone later that night.

• Provide you with a seamless experience across all our services and channels. This means a more joined up customer experience whether you are shopping in-store, online or over the phone.

Consent

• If you have given your consent to our processing the data for example we use email, text messages and post to communicate with you about our products and services, competitions, offers, promotions, or special events.

To achieve the purposes mentioned in this Privacy and Cookies Policy, we must give access to your personal data to members of the Theo Paphitis Retail Group and to other third parties that provide us with support or collaborate in delivering the services that we or our partners offer you.

Selected third parties including:

• If you choose to pay using one of Klarna’s payment options, we will pass some of your personal information (such as name, delivery address, billing address (if different), email address, and order details) to Klarna so they can assess whether you qualify for their payment options and tailor the payment options for you. Your personal data is handled by Klarna in accordance with applicable data protection law and in accordance with the information in Klarna’s Privacy Policy (Klarna’s Privacy Notice).

• Payment services providers for the purposes of authorising funding of the orders you place.

• Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. This requires you to accept our cookie policy when you first visit our website.

• Companies that provide insights and analytics services for us so we can stock the right products, send the right marketing campaigns, and understand our business and customers better.

• Analytics and search engine providers that assist us in the improvement and optimisation of our site.

• Marketing partners to send emails on our behalf, and/or for co-branded and/or co-sponsored marketing and promotional events (such as conference events) offered in conjunction with another company or companies. If you register for or participate in such marketing and promotional events, we and the relevant partner companies may receive information collected in conjunction with the co-branded and/or co-sponsored marketing and promotional events. Our Privacy Notice will apply to our use of your personal information. We have no control over any other companies’ privacy practices, so please read their applicable privacy policy.

• Social media partners (who may act as independent/joint controllers in certain cases), advertisers and advertising networks, who may act act as independent/joint controllers, (e.g. Google, Facebook & Instagram (aka Meta), TikTok, Microsoft and others) that require the data to select, serve and report on the effectiveness of relevant adverts to you and others. Personal data shared with these marketing providers for targeting and reporting will be pseudonymised where possible and only where opted into marketing communications (both online and through signing up in store/registering an account). We may also provide aggregate information to help advertisers reach the kind of audience they want to target.

• Advertising to "lookalikes": We work with our retail partners to find potential customers who "look like" our existing customers on platforms such as Facebook and Google for advertising purposes ('platform'). To do this, we use information about your general shopping habits (and those of similar households) to create large groups of customers that may be interested in seeing different advertisements of retail partners. If you're within one of these groups for a given campaign, we may share some basic data about you (and the other customers in the group) with the platform. This is so that the platform can find and show adverts to other users of its platform who have similar interests to you. The data we share for these purposes will be pseudonymised to protect your identity and is promptly deleted in line with our retention policy and that of our partners . You can stop our use of your data in this way by opting out of all marketing or unsubscribing from our marketing emails. You can also opt out of being included in a platform's lookalike audiences directly via them.

• Referral marketing services: We operate a refer-a-friend programme to enable our customers to recommend Boux Avenue to their friends and family. Our refer-a-friend programme is operated on our behalf by Mention Me Limited. We have a contract in place to manage all data processing undertaken on our behalf by Mention Me Limited as their Client. For information about how your personal data is processed by Mention me please see here.

• When we work with specialist companies that provide us with personal data about you, they'll have told you about this data sharing at the time it was collected and in their privacy notices. We use this and our own data to better understand our customers. We also use this personal data to make sure we have up-to-date details about you. We don't give personal data we’ve collected or created from you back to these companies.

• If required by law, under any code of practice by which we are bound by, or we're asked to do so by a public or regulatory authority such as the Police or the Department for Work and Pensions.

• Information may also be shared with fraud prevention agencies to prevent fraudulent claims.

• If we need to do so in order to exercise or protect our legal rights, users, systems and services.

• In response to requests from individuals (or their representatives) seeking to protect their legal rights or the rights of others.

• With emergency services (if you make an emergency call), including your approximate location.

• Companies that enable us to collect your reviews and comments, both online and offline.

• Third party vendors who help us to manage and maintain the Group IT infrastructure.

Additionally, we may disclose your personal information to third parties:

• If we outsource any aspect of our business or systems, then we may disclose your personal data to our service provider(s).

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

• If we or a substantial part of our assets are acquired by a third party, in which case personal data held by us about our customers may be one of the transferred assets.

• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply the terms of any agreement or policy to which we are a party, or to protect the rights, property, or safety of our business, our customers, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

We know how important it is to protect and manage your personal data. We use technical and organisational security measures to protect the personal information supplied by you against loss, destruction, and any unauthorised access by third parties. This section sets out some of the measures we have in place:

• We make sure staff are trained and rules are in place to make sure that data is used in line with our data protection and information security policies.

• We have physical protections and digital/electronic systems in place to keep what we hold secure.

• When data is moved or transferred, we make sure it's encrypted.

• We use computer safeguards such as firewalls and data encryption to keep this data safe when it's not being moved.

• We only allow access to colleagues and trusted partners.

• Systems are proactively monitored for possible weaknesses, and we carry out tests (penetration testing) to see what can be improved.

• We ask for proof of identity before we share your personal data with you.

• Any payment transactions will be encrypted as per the PCI standards. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential, and for all use made of your account with such password. We ask you not to share a password with anyone.

• All appropriate organisational and security measures have been implemented to prevent unauthorised access and to ensure transmission of information is secure. As information is transmitted via the internet, any transmission is at your own risk.

The data that we collect from you will be stored on our servers or those of our service providers in the UK/EEA. From time to time, we may transfer your personal information to our suppliers, service providers and other company offices based outside of the European Economic Area (EEA) for the purposes described in this privacy policy.

If we do transfer information to our suppliers, agents or advisers outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. We'll use one of these safeguards:

• We'll transfer it to a non-EEA country with privacy laws that give the same protection as the EEA i.e., the country in question has been deemed by the European Commission to provide an adequate level of protection for personal data. Learn more on the European Commission Justice website.

• We'll put in place a model contract with the recipient that means they must protect it to the same standards as the EEA. Read more about this here on the European Commission Justice website.

Our policy is to ensure that personal data is only stored for as long as is necessary for the purposes set out in the section titled “Why do we need this information and how do we use it?”. This may vary according to the type of information and the specific applicable purpose(s). We have a detailed data retention and destruction policy which governs the length of time for which we hold your data in personally identifiable form. The timing of our retention, anonymisation and/or destruction of your personal data is determined according to the criteria set out in that policy. We can provide you with relevant details applicable to your data on request – please see the section below to understand how to request this information.

You have various rights under Data Protection Law. These include:

• The right to ask us not to process your personal data for direct marketing purposes, even if you have given consent; You can click onto the "unsubscribe" link in any communication that we send to you by email which will automatically unsubscribe you from that type of communication. Each "unsubscribe" link only relates to that specific type of communication. Please also note that you may continue to receive Service communications in relation to the product and services we have sold to you.

• If our processing is based on your consent, the right to withdraw any consent you may have given for our processing of your data – if you exercise this right, we will be required to stop such processing if consent is the sole lawful ground on which we are processing that data;

• The right to ask us for access to the data we hold about you also known as Subject Access Request;

• The right to ask us to rectify any data that we hold about you that is inaccurate or incomplete;

• The right to ask us to delete your data in certain circumstances;

• The right to ask us to restrict our processing of your data in certain circumstances;

• The right to object to our processing of your data in certain circumstances; Where we rely on our legitimate interests, as set out under “How do we justify the collection of this information?”, you may object to us using it for these purposes. If we agree that your objection is justified in accordance with your rights under data protection laws, we’ll permanently stop using your data for those purposes. Otherwise we’ll provide you with our justification as to why we need to continue using your data.

• In certain circumstances, the right to require us to give you the data we hold about you in a structured, commonly used and machine-readable format so that you can provide the data to another data controller.

• You have the right not to be subject to a decision based solely on automated processing.




You can exercise any of the rights set out above, free of charge, by clicking here.

In respect of certain of the rights referred to above, we may need more information from you, which we will ask you. We are required by law to confirm your identity before sharing any data with you as such please make sure you provide one proof of identity (we suggest either a utility bill in your name or your driver's licence, but other similar formal documents may be accepted, please note the documents cannot be older than 6 months) as part of your request.

Under certain circumstances, we may be required by law to retain certain information.

Please also note that if you submit unfounded or excessive (for example repetitive) requests to exercise any of these rights, we reserve the right to make a reasonable charge for providing the requested information or taking the requested action, or to decline your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk) if you are concerned that we are not respecting your rights under Data Protection Law. The Information Commissioner’s Office is the authority in the UK which is responsible for overseeing the application of, and enforcing, Data Protection Law.

You have the right to obtain from us:

• Confirmation as to whether we are processing (including holding) personal data about you; and if we are processing personal data about you, you are entitled to be provided with:

• Information as to the purposes for which we process the data;

• Information as to the categories of the data that we are processing;

• Information as to the recipients or categories of recipients to whom the data has or will be disclosed;

• Information as to the envisaged period for which we will store the data, or the basis on which that period will be determined;

• A copy of the data (further copies are available at a reasonable charge, which we will inform you of should you request further copies). Please note that this right is subject to the rights of others in relation to their own personal data, meaning that we cannot disclose data to you if it would involve disclosing data about someone else.

Please see the section above as to how to exercise your rights under this section. Section above applies in full to the exercise of these rights.

Our website uses cookies and similar industry standard tracking technologies (collectively “Cookies”) to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our site. For detailed information on the cookies and similar tracking technologies we use and the purposes for which we use them see our Cookie policy

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites

Any changes we make to our privacy notice in the future will be posted on this page, in case of significant changes we will email you the relevant information.

This notice was last updated on 22-03-2023

Any other questions, comments and requests regarding this privacy notice are welcomed and should be addressed to: GDPRenquiries@bouxavenue.com or contactable at Fourth Floor, 1 St. Georges Road, Wimbledon, London, SW19 4DR. If you would like to submit a request to erase your data please submit this form and select "the right to erasure" under which right. This will ensure a quicker response and process to erase your data vs. an email request