At Serendi and the company that owns the brand, Nawasa Mahal International Limited (NMI), We value the privacy and security of our customers and consider them as our top priority.

Our team would like to ensure your experience is safe, enjoyable and one that You will want to repeat and recommend to your family and friends. One part of our continued commitment to you is to respect and look after the privacy of your personal information. This privacy policy will inform You of what information We collect, why We collect it, how We use it, and the choices you have around how We store and use Your personal information.

1. Introduction

NMI operates Serendi and its Platform www.serendi.co.uk. ( “We”, “Our” and “Us”) refers to the head office of NMI at Our address at 9 Arran House, Releana Road, London, England E14 9RN. and its affiliates.

The term “You”, “Yours” refers to the user or viewer of this Platform.

Serendi and Platform www.serendi.co.uk provide a wide variety of pre-made and custom-made jewellery products as well as ancillary services.

We are committed to having the correct procedures in place to protect and respect Your privacy, in line with the guidelines of the EU General Data Protection Regulation (“GDPR”)

For the purposes of the Data Protection Act 1998 and the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and all successor legislation to the Data Protection Act 1998 and the GDPR (the “Data Protection Legislation”), the data controller is NMI registered in England and Wales under registration number 11364359 and Our principal place of business is at 9 Arran House, Releana Road, London, England E14 9RN.

We may need to gather and use certain information about individuals. This Privacy and Data Protection Policy explains in detail the data We collect, along with how it is handled, stored and how We keep it safe. These individuals can include customers, suppliers, business contacts, employees, users of Our clients’ websites and other people that the organisation has a relationship with or may need to contact.

The policy applies to all NMI employees and all Personal Data processed at any time by NMI. The objective of the policy is to ensure that:

• We process Personal Data in compliance with the GDPR.
• NMI and all its staff members are aware of all obligations and protocols when processing Personal Data.
• We protect the rights of the staff, customers and partners along with Your own Personal Data.
• NMI protects itself from the risks of a data breach.

By visiting Our Platform www.serendi.co.uk You are accepting and consenting to the practices described in this policy.

2. Terminology

Data Controller

The organisation that determines the manner and purposes for which Personal Data is to be processed.

Data Processor

The organisation or individual who processes Personal Data on behalf of the Data Controller.

Data Subject

An individual who is the subject of Personal Data (also referred to as ‘You’, ‘Your’, ‘Yourselves’).

Personal Data

Information relating to an individual who can be directly identified from the information. Personal Data includes factual information as well as expressions of opinion or intentions.

Personal Data Breach

Loss, theft or unauthorized access, use or disclosure of Personal Data.

3. Legal Basis For Data Collection

There are a number of various reasons that the law allows collection and process of personal data.

Consent

Certain situations allow us to collect Your personal data, such as when You tick a box that confirms You are happy to receive email newsletters, or ‘opt in’ to a service.

Contractual Obligations

We may require certain information from You in order to fulfil Our contractual obligations and provide You with the promised service.

Legal Compliance

We’re required by law to collect and process certain types of data, such as fraudulent activity or other illegal actions.

Legitimate Interest

We might need to collect certain information from You to be able to meet Our legitimate interests – this covers aspects that can be reasonably expected as part of running Our business, that will not have a material impact on Your rights, freedom or interests.

4. Policy Statement

NMI Ltd will only collect and process information where We have gained consent, We have contractual obligations or legitimate interests, or for legal compliance. We will:

Comply with the Data Protection Legislation and adhere to the following eight Data Protection Principles:

Data

• Must be processed fairly and lawfully.
• Must be obtained only for specific and lawful purposes.
• Must be adequate, relevant and not excessive.
• Must be accurate, and kept up to date.
• Must not be held for any longer than necessary.
• Must be processed in accordance with the rights of data subjects.
• Must be protected in appropriate ways.
• Must not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection.
• Comply with the statutory requirement to maintain accurate entries on the Information Commissioner’s public register of Data Controllers which describes the purposes for which Personal Data is processed.
• Comply with all other relevant legal requirements which apply to its processing of Personal Data.
• Implement appropriate structures, systems and processes to manage all Personal Data fairly and lawfully.
• Be transparent about how Personal Data is processed, providing clearer privacy notices at the point it is collected, providing users with an option.
• Ensure that procurement processes and contractual arrangements with external service providers also adhere to adequate measures to ensure compliance with the Data Protection Principles.
• Approach the identification, control, mitigation and elimination of Privacy risk in the same way as financial and operational risk.
• Provide customers with an opportunity to opt in to receiving future marketing communications at the point at which their Personal Data is collected and provide a simple process to unsubscribe should they change their mind.
• Ensure that requests from customers to change the use of their data for the purposes of marketing/ the provision of service updates are acted upon promptly.
• Not disclose Personal Data to third parties except where disclosures are permitted or required by law.
• Label Personal Data in accordance with its Information Security Classification Standard for protectively marking information.
• Ensure that any complaint about NMI’s or Serendi’s processing of Personal Data or non-compliance with the policy will be passed to the Privacy and Data Protection Team. The complaint will then be dealt with promptly in accordance with the Data Protection & Incident Response Policy.
• Provide training to any relevant member of staff and ensure that training is kept up to date.
• View serious or repeated breaches of this policy by a NMI’s employee as misconduct that will be managed and resolved in accordance with relevant disciplinary policies and procedures.

Privacy By Design

NMI has adopted the principle of privacy by design and will ensure that the definition and planning of all new or significantly changed systems that collect or process personal data will be subject to due consideration of privacy issues, including the completion of one or more data protection impact assessments.

The data protection impact assessment will include:

• Consideration of how personal data will be processed and for what purposes
• Assessment of whether the proposed processing of personal data is both necessary and proportionate to the purpose(s)
• Assessment of the risks to individuals in processing the personal data
• What controls are necessary to address the identified risks and demonstrate compliance with legislation
• Use of techniques such as data minimisation and pseudonymisation will be considered where applicable and appropriate.

Breach Notification

It is NMI’s policy to be just and proportionate when considering the actions to be taken to inform affected parties regarding breaches of personal data. In line with the GDPR, where a breach is known to have occurred which is likely to result in a risk to the rights and freedoms of individuals, the relevant supervisory authority will be informed within 72 hours. This will be managed in accordance with Our Information Security Incident Response Procedure which sets out the overall process of handling information security incidents.

5. Information We collect from You

Personal data, or personal information, means any information about an individual (data subject) from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer the following data about You:

Information You give us

This is information about You that You give us by filling in forms on Our site or by corresponding with us by phone, e-mail, in person (for instance in Our showroom) or otherwise. It includes information You provide when You request a quote or other marketing material from Our site or in person, purchase Our products and/or services, search for a product and/or service and when You report a problem with Our site or give us some feedback. The information You give us may include but is not limited to Your name, gender, address, e-mail address, phone number, and financial information.

Information We collect about You

When You visit Our Platform, We measure visits using Google Analytics and standard web server log files. These records:

• Technical information, including the Internet protocol (IP) address used to connect Your computer to the Internet, Your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• Information about Your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from Our site (including date and time), products You viewed or searched for page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call Our customer service number.

User ID for Google Analytics

• Google Analytics makes use of a feature called “User ID.” This setup allows for a more accurate tracking of users by associating that user with the same ID over various sessions and devices. It is set up in a way that does not allow Google to personally identify an individual or permanently identify a particular device. The User ID extension might make it possible to connect data from Google Analytics with other data about the user collected through this Platform. The opt-out link below will only opt You out for the device You are on, but not from tracking performed independently by the Owner.;
• To opt out of tracking through Google Analytics, please contact us via the contact information provided at the end of this Policy. You can also learn more about this technology and how to opt-out of this feature by installing the Google Analytics Opt-out Browser Add-on.

Cookies

Our platform uses cookies to distinguish You from other users of Our platform. This helps us to provide You with a good experience when You browse Our Platform and also allows us to improve Our site. Our cookie policy explains this in more details and Our cookie table details the cookies We collect and why.

Managing Cookies

Most browsers allow You to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:

(a) https://support.google.com/chrome/answer/95647?hl=en (Chrome);

(b) https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);

(c) http://www.opera.com/help/tutorials/security/cookies/ (Opera);

(d) https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);

(e) https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac (Safari); and

(f) https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).

Please be aware that if You block cookies, You may not be able to use all the features on Serendi.co.uk

Email Contact

Any email sent to NMI or Serendi.co.uk., including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that You have a responsibility to ensure that any email You send to us is within the bounds of the law.

Information We receive from other sources

We may have access to certain information if You use any of the other services We provide or if You interact with Our social media pages.

We may also work with some third parties that You have permitted to share the information they hold about You with us, such as: business partners, subcontractors, payment services, ad networks, analytics providers, search engine providers, credit reference agencies, so We could receive information about You from them if it is necessary.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from Your personal data but is not considered personal data in law as this data does not directly or indirectly reveal Your identity. However, if We combine or connect aggregated data with Your personal data so that it can directly or indirectly identify You, We treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any special categories of personal data about You (this includes details about Your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about Your health and genetic and biometric data). Nor do We collect any information about criminal convictions and offences.

Where We need to collect personal data by law, or under the terms of a contract We have with You and You fail to provide that data when requested, We may not be able to perform the contract We have or are trying to enter into with You (for example, to provide You with goods or services). In this case, We may have to cancel a product or service You have with us but We will notify You if this is the case at the time.

6. How We use Your information

We will only use Your personal data when the law allows us to. Most commonly, We will use Your personal information:

• To carry out Our obligations arising from any contracts entered into between You and us or to take steps at Your request before entering into any contracts
• To comply with any legal obligations to which We are subject; or
• Where it is necessary for Our or a third party’s legitimate interests, including for the purposes of preventing fraud, except where such interests are overridden by Your interests or fundamental rights and freedoms.
• Examples of how We may use Your data include but are not limited to:
• Providing You with information, products and services that You request from us.
• Providing You with information about other goods and services that We offer that are similar to those You have already purchased, enquired about, or that We would recommend.
• Administering the Platform and for internal operations such as troubleshooting, data analysis, testing, or for research purposes.
• Improving the Platform in order to ensure that content is presented in the most effective manner for You and Your computer.
• Developing and testing the products and services We provide You with.
• Allowing You to interact with features of the service.
• Helping us keep the Platform safe and secure.
• Measuring the effectiveness of advertising served to You.
• Processing payments.
• Generally, We do not rely on consent as a legal basis for processing Your personal information other than in relation to sending direct marketing communications to You via email.
• If necessary, legal and in Your best interests, We may share Your personal information with selected third parties including:
• Business partners, suppliers and sub-contractors for the performance of any contract We enter into with them or You.
• Our investors and advisors.
• Analytics and search engine providers that assist us in improving Our business or Platform.
• Credit reference agencies for the purpose of assessing Your credit score where this is a condition of us entering into a contract with You.

When might this be necessary?

In the event that We sell any business or assets, in which case data may be disclosed to the seller or buyer of such business/assets.

In the circumstance that NMI or all its assets are acquired by a third party. Personal information would be one of the transferred assets.

If We have a duty to disclose information in order to comply with legal obligations.

In order to apply agreements between us, to protect Our rights, property, safety and customers. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Marketing

We strive to provide You with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use Your identity, contact details, usage data and marketing preferences to form a view on what We think You may want or need, or what may be of interest to You. This is how We decide which products, services and offers may be relevant for You (We call this marketing).

You will receive marketing communications from us if You have requested information from us or purchased goods or services from us or if You provided us with Your details when You entered a competition or registered for a promotion and, in each case, You have not opted out of receiving that marketing.

We will get Your express opt-in consent before We share Your personal data with any company outside of the NMI for marketing purposes.

You can ask us or third parties to stop sending You marketing messages at any time by contacting us at any time.

Where You opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.

Change of purpose

We will only use Your personal data for the purposes for which We collected it, unless We reasonably consider that We need to use it for another reason and that reason is compatible with the original purpose. If You wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If We need to use Your personal data for an unrelated purpose, We will notify You and We will explain the legal basis which allows us to do so.

Please note that We may process Your personal data without Your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

7. Disclosure of Your information

Sometimes We may share Your personal data with trusted third parties, for example business partners or for fraud management.

We may share Your data with:

• Google Analytics based in the USA
• Salesforce, a CRM software provider based in the USA
• Yesware, an email CRM software provider based in the USA
• Hubspot, Our marketing provider in the USA
• Wufoo, a survey software provider in the USA
• Typeform, a survey software provider in the USA and Germany.
• Professional advisors including lawyers, bankers, auditors and insurers based in the UK.
• Regulators and other authorities who require reporting of processing activities in certain circumstances.
• Third parties to whom We may choose to sell, transfer or merge parts of Our business or Our assets. Alternatively, We may seek to acquire other businesses or merge with them. If a change happens to Our business, then the new owners may use Your personal data in the same way as set out in this privacy notice.
• Fraud prevention agencies.
• We require all third parties to respect the security of Your personal data and to treat it in accordance with the law. We do not allow Our third-party service providers to use Your personal data for their own purposes and only permit them to process Your personal data for specified purposes and in accordance with Our instructions.

8. International transfers

Many of Our external third parties, including Salesforce and Google Analytics, are based outside the European Economic Area (“EEA”) so their processing of Your personal data will involve a transfer of data outside the EEA to the USA for example.

If this is necessary, We have procedures in place to ensure that this data receives the same process as We follow for the EEA. We will treat the information the same as We would for EAA companies under the stipulations of this Privacy Notice.

9. Data security

We have put in place appropriate security measures to prevent Your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, We limit access to Your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process Your personal data on Our instructions and they are subject to a duty of confidentiality.

However, the transmission of information via the internet is never completely secure. Although We will do Our best to protect Your personal data, We cannot guarantee the security of Your data transmitted to Our site; any transmission is at Your own risk.

We have put in place procedures to deal with any suspected personal data breach and will notify You and any applicable regulator of a breach where We are legally required to do so.

10. How long will We keep Your data?

We will only retain Your personal information for as long as is necessary to carry out the purpose for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, We consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of Your personal data, the purposes for which We process Your personal data and whether We can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances We may anonymize Your personal data (so that it can no longer be associated with You) for research or statistical purposes in which case We may use this information indefinitely without further notice to You.

11. Your Rights

Under the Data Protection Legislation, You may be entitled to the following rights:

• Where You have provided Your consent to the processing of Your personal data for any purpose, You have the right to withdraw such consent at any time by contacting us at Nawasa Mahal International Ltd, 9 Arran House, Releana Road, London, England E14 9RN, or by email to enquiries@serendi.co.uk
• You can ask us to rectify any inaccuracies in the personal information that We hold about You.
• To request the erasure of personal information that We hold about You where there is no good reason for us to continue processing it, where You have successfully exercised Your right to object to processing, where We may have processed You information unlawfully or where We are required to erase Your personal data to comply with local law.
• To object to Our processing of Your personal data where We are relying on a legitimate interest (or that of a third party) and there is something about Your particular situation which makes You want to object to processing on this ground as You feel it impacts on Your fundamental rights and freedoms. You also have the right to object where We are processing Your personal data for direct marketing purposes. In some cases, We may demonstrate that We have compelling legitimate grounds to process Your information which override Your rights and freedoms.
• To restrict Our processing of Your personal data
• (a) if You want us to establish the data’s accuracy;
• (b) where Our use of the data is unlawful but You do not want us to erase it;
• (c) where You need us to hold the data even if We no longer require it as You need it to establish, exercise or defend legal claims; or
• (d) You have objected to Our use of Your data but We need to verify whether We have overriding legitimate grounds to use it.
• To request a copy of Your personal data from us in a commonly used and machine-readable format or that We transmit Your personal data to another data controller.
• Not to be subject to automated decision-making, including profiling, which has legal or other significant effects on You.
• To access information held about You. You will not have to pay a fee to access Your personal data (or to exercise any of the other rights). However, We may charge a reasonable fee if Your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with Your request in these circumstances.

You can direct Your subject access requests or correction requests to: enquiries@serendi.co.uk

Or in writing:

Data Protection Officer
Nawasa Mahal International Ltd
9 Arran House, Releana Road
E14 9RN
London
England

Questions, comments and requests regarding this privacy policy are welcomed and should be submitted via the method above.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Further information can be found at www.ico.org.uk.

If We choose not to action Your request We will explain to You the reasons for Our refusal. If the task is deemed onerous and unreasonable by the ICO, We may ask You to reduce Your request to something more specific or alternatively, if approved by the ICO, the full request may become chargeable.

To protect Your information, We will require You to verify Your identity before We proceed with any request. If You have authorized a third party to make this request (such as a solicitor) on Your behalf, We must still be provided with verification of Your identity and reasonable proof that they have Your permission to act on their behalf. We will provide the requested information directly to the subject of the data subject access request and not to the third party.

Links to and from Our site

NMI may contain links to and from websites We partner with such as advertisers or affiliates. If You do follow these links, it is important to be aware that these websites use their own privacy policies so NMI will be unable to accept any responsibilities for these policies.

12. Data Accuracy

• It is the responsibility of all employees at NMI who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.
• Data is held in as few places as necessary. Staff are advised against creating any unnecessary data sets and if this is required they must dispose of this data by either shredding the paper copy or thoroughly deleting the additional copy.
• Staff take every opportunity to ensure that data is updated. For instance, by confirming a customer’s details when they call, or if they change their contact information in their email footer.
• NMI makes it easy for data subjects to update the information NMI holds about them. A data subject may request access, a change or request the right to be forgotten at enquiries@serendi.co.uk. We would aim to update this data or delete this data as promptly as possible within 14 days but no longer than 30 days.
• Data is updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it is removed from the database.
• You have the right to contact us at any time to correct the data We hold about You. For example, if You had recently married and changed Your name, We will update this and inform any relevant third parties or suppliers who need to also update records.

13. Changes to Our privacy policy

Any changes We make to Our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to Our privacy policy.