Privacy Policy - Kiosk
Introduction
ecoATM International Limited (“ecoATM UK”, “we”, “us” and/or “our”), with a business address of 5A Frascati Way, Maidenhead SL6 4UY, is an affiliate of ecoATM, LLC, with a business address of 10121 Barnes Canyon Rd, San Diego, CA 92121, and operates the ecoATM kiosk (“Kiosk”) in the UK, to purchase used consumer electronics, such as tablets, mobile phones, or MP3 players (“Devices”). This Privacy Policy may use the term “Services” to describe the functionality and use of the Kiosk, as well as use of associated services, such as contacting our customer support team.
We collect personal information to provide you with the products and services you request as well as information on other products and services offered by or through us. We are committed to protecting the privacy of your personal information.
ecoATM UK will be the controller in respect of any personal data collected through the use of the Kiosk and Services, which means we control the way information is used and processed. We may be contacted via the following email address: ecoatmlegal@ecoatm.com
Please read this Privacy Policy carefully before submitting any information about yourself to us. If you do not wish to have your personal data processed as described in this policy, you should not use the Kiosk or Services.
About this Policy
This Privacy Policy explains how and why we acquire and use your personal information when you use our Kiosk Services. When you use any of our websites, please refer to the privacy policy for that website.
Types of Information Collected and Processed
We may collect, store, and use the following categories of personal information about you:
Identity Data
Title, first name, last name, username or similar identifier, date of birth, identification card number and gender, copy of your driver’s license and related details such as your name, address, place of birth, driver number, and photograph,
Contact Data
Address, email address and telephone numbers.
Financial Data
Bank account and payment card details.
Transaction Data
Details about payments to and from you and other details of the transaction in which you used the Kiosk. These include:
• the time, date and location of sale of your Device;
• the details of the Device we buy from you, to include model, make, carrier, and memory size;
• CCTV, video and photographic footage, video and still photographs of you at the kiosk; and
• any vouchers, coupons or other alternative means of payment you may request that we use, as well as relevant payment method information such as Paypal account, sort code and account number, mobile phone number, credit or debit card number.
Usage Data
• Your behavior on our Kiosk, for example time spent on each page, time to click through, if and when you discontinued the transaction, etc
Technical Data
• IMEI, MEID, and/or serial numbers from any phone or device which is offered for sale (“Device”);
• Device operating system and version;
• Device model;
• Device name;
Marketing and Communications Data
• Your preferences in receiving marketing from us, our third parties, and your communication preferences where you choose to receive marketing from us.
Information we receive:
We may receive information about you if you use any of our other websites that we operate (such as ecoATM.com and gazelle.com). In this case we will have informed you when we collected that data that it may be shared internally and combined with data collected on this Kiosk. Please refer to the applicable privacy policy where you have used one of our other sites.
Aggregated Data
We also collect, use and share statistical or demographic data (purpose). We may aggregate your Usage Data to calculate the percentage of users accessing a specific kiosk or kiosk feature. If we combine of connect aggregate data in such a way that it can directly or indirectly identify you, we will treat the combined data as personal data which will be used in accordance with this Privacy Policy and applicable data protection laws.
Special Category Personal Data
We do not collect, store or use the following "special categories" of more sensitive personal information such as your physical and mental health details, sexual life, racial or ethnic origin, trade union membership and/or offences, and we ask that you do not to supply us with any special category personal data
Collecting data through Direct Interactions
You may give us your Identity, Contact, and Financial Data by using the Kiosk, providing your drivers license, filling in forms, providing information via the Kiosk, or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
• utilize the kiosk;
• insert your identification card into the kiosk;
• fill in forms or fields at the kiosk;
• provide information for payment for your Device either at the kiosk or to a customer service representative;
• speak to or contact customer services;
• request marketing to be sent to you;
• contact us through our call centre;
• enter a competition, promotion or survey;
• give us some feedback;
• by filling in forms, for example when you sign up to offers, news or a competition;
• by sending us emails and text messages (SMS or MMS);
• by adding posts, reviews and other comments to any of our websites, mobile apps or other community forums;
• by communicating with our customer service representatives and technical support personnel either over the telephone or via email. For example, when requesting technical assistance performing a transaction, asking for information about our kiosks, reporting an issue, or making a complaint.
Collecting data through Automated Technologies
As you interact with Kiosk, we may collect technical data about your Device. We collect this data by electrically examining the Device using cables that you connect to your Device and other similar technologies.
When you visit our Kiosk, we employ CCTV in our Kiosks, we therefore may video or photograph you by CCTV, camera or video equipment for security purposes,
When you insert your driver’s license into our Kiosk, we may automatically collect personal data about you. We collect this data by electrically examining and viewing the driver’s license/ identification card.
Where you select to verify yourself through our third party provider Bottomline, your data will be collected from you. This process will involve electronically examining your details you have supplied via the Kiosk and matching them against the details Bottomline has. If you would like to know more please visit Bottomline’s privacy policy: https://www.bottomline.com/uk/privacy
Collecting data through Third parties or Publicly Available Sources.
We may receive personal data about you from such third parties as set out below:
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as Paypal, Paypoint, or Bottomline Technologies based inside and outside of the EEA.
Collecting through Telephone recordings
We may also record telephone conversations to offer you additional security, resolve complaints, for staff training purposes, to improve our service standards and for fraud prevention measures.
How we Use the Information we Collect
We use your information in the following ways:
o to respond and/or deal with your request or enquiry including individual rights requests;
o To make decisions on your transaction, such as verifying your identity and your phone;
o Reply to any requests for information that you ask us for or deal with enquiries and responses to those;
o To contact you for service related purposes;
o To process your transaction, and such things as payment;
o To manage our relationship with you;
o To send you service marketing information or updates about market conditions on a regular basis which we feel would be of interest or use to you; and
o for compliance with our legal, regulatory and other good governance obligations
o To protect the security of the kiosk and prevent fraudulent transactions.
Fair and lawful processing
We are required by law to process personal data only if we have a lawful basis to do so. The lawful basis are specifically set out within data protection law and any processing which we do must fit within one of those basis. We cannot create a new reason because what we want to do does not fit within the lawful basis set out in the data protection law. The types of lawful basis that exist are:
• where an individual gives us their consent to process their personal data in a particular way;
• where we need to process your personal data because it is necessary for the performance of a contract;
• where it is necessary to comply with law;
• where we need to protect the vital interests of a customer; or
• where it is necessary for our legitimate interests and for the legitimate interests of another party.
We have set out in the table below examples of how we use your personal information and the lawful basis for doing so as described in this policy.
| Activity | Data used | Lawful basis for processing |
|---|---|---|
| Providing our Kiosk service to you and device trade in | Identity, Contact Financial, Transactional, Technical | Performance of Contract
Necessary for our legitimate interests to provide our services |
| Internal administration of Kiosk, internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes | Identity, Contact Financial, Transactional, Technical , Aggregated, Marketing and communications | Necessary for our legitimate interests for running our business and provision of Kiosk. |
| Improving the service | Identity, Aggregated, Technical, Usage | Necessary for our legitimate interests of to help with product development, |
| Maintaining the Security of Kiosk | Identity, Contact, Technical, Usage | Necessary for our legitimate interests of ensuring the security of our Services |
| Marketing - to deliver relevant advertising to you and make offers to you | Marketing and communications, Contact, technical, Usage | Consent- where you have opted in to receive marketing |
| Complying with a court order, or to exercise or defend legal claims | Identity, Contact | To comply with a legal obligation |
| Complying with other requests from third parties where required and lawfully permitted | Identity, Contact, Aggregated, Technical, Usage | To comply with a legal obligation |
Disclosing your information
We may disclose your information to third parties from time to time, the categories of recipients are as follows:
• our partner companies such as ecoATM, LLC;
• third party suppliers;
• law enforcement agencies, where this is requested;
• third party payment providers such as Paypal and Bottomline; and/or
• our insurers.
We may also share your personal data in the event that our business, or substantially all of its assets are acquired by a third party, (in which case personal information about customers might be one of the transferred assets).
Transferring your Information
The data that we collect from you at the Kiosk may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the provision of support services.
If data is transferred by us from within the EEA to a jurisdiction outside the EEA, it is done so in accordance with applicable data protection laws. We rely on the following appropriate safegaurds to transfer your information:
a. Model Clauses: The European Commission has adopted standard contractual clauses (also known as Model Clauses), which provide safeguards for personal information that is transferred outside of Europe. We may use these Model Clauses when transferring personal information outside of Europe.
b. Privacy Shield: We may rely on the EU-US Privacy Shield to transfer personal information to some of our third party service providers in the United States, where they are certified to receive such information under the Privacy Shield Program.
Your rights
You have the following rights under certain circumstances:
• Right to request correction - to make changes or corrections to your information to make sure it is accurate and up to date;
• Right to object to processing - ask us to stop processing your information;
• Right to restrict processing - limit our use or processing of your information;
• Right to request erasure – to ask us to delete your information (we are not obliged to do this in relation to information we need as part of our contractual relationship or for compliance with other laws, such as taxation or accounting laws);
• Right to request access - receive a copy of the information we hold about you - you may request details of personal information which we hold about you at any time (a Data Subject Access Request or DSAR). No fee will be required, although reasonable fees can be charged for manifestly unfounded or excessive requests;
• Right of portability - transfer your information to a third party; and
Where you have provided consent for data processing, you can withdraw this consent at any time.
If you have any requests to exercise your data information rights you can send an email to ecoatmlegal@ecoatm.com
You have the right to lodge a complaint about us to the UK Information Commissioner's Office (https://ico.org.uk/) or the relevant authority in your country of work or residence.)
Security
We take commercially reasonable steps to protect and secure information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction.
Retention of information
We may keep your details on record for as long as is reasonably necessary for the purposes for which it may use your personal data, as set out above and as allowed in accordance with applicable data protection law.
The criteria we use to determine data retention periods for your personal data includes the following:
• retention in case of queries – for example, where you contact us to receive further information about the way we handle your data;
• retention in case of claims - for the period in which you might legally bring claims against us which can be 7 years;
• retention in accordance with legal and regulatory requirements - after your agreement with us has come to an end; and
• to stay in touch about your requirements on an ongoing basis, where you have selected to receive these.
Please note that we reserve the right to retain certain information for our own record-keeping (for example, to ensure that you do not receive marketing communications that you have opted-out of receiving) and to defend ourselves against any claims.
Third Party websites
We may, from time to time, provide you with links to and from the websites of others, to include partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these privacy policies before you submit any personal data to these websites.
Marketing
We will send you marketing according to what you have indicated you would like to receive. We determine your marketing preferences during the sign up process. If you would like to stop receiving marketing, to do this you will need to contact ecoatmlegal@ecoatm.com by email to withdraw your consent or click the “unsubscribe” link in the direct marketing email you may have received. Please note that if you do withdraw your consent and there is no alternative lawful reason which justifies our processing of your personal data for a particular purpose, it may mean that you cannot receive some marketing communications.Changes to this Privacy Policy
We will occasionally update this Policy as our business and products evolve. If we make changes, we will provide notice of such changes by revising the date at the top of this Policy and, in some cases, we may provide you with more prominent notice (such as sending you a notification). We encourage you to review this Policy from time to time to stay informed about our information practices and the ways you can help protect your privacy.
Contact us
If you have questions, concerns or suggestions, please feel free to send an email to: ecoatmlegal@ecoatm.com
You can also address questions, comments and requests to: ecoATM International Ltd., 5a Franscati Way, Maidenhead, Berkshire, SL6 4UY
Last updated May 4, 2019