Privacy Policy

Updated November 2024

We take the protection of your personal data seriously and will process your personal data fairly, lawfully and transparently. This privacy policy describes the personal data we are collecting about you and how it's used.

Who we are

payplusit.com Limited, of 49-51 Dale Street, Manchester M1 2HF (collectively referred to as “DebenhamsPay+”, “we”, “us” and “our” in this privacy policy) is the controller and responsible for your personal data collected through the www.payplusit.com website (the “website”), the DebenhamsPay+ app (the “app”), when you pay using DebenhamsPay+ on other third party platforms and if you otherwise share your personal data with us. Details of our Data Protection Officer responsible for overseeing questions in relation to this privacy policy, and our details are set out in the “Contact Us” section at the end of this notice. DebenhamsPay+ is part of the Boohoo Group (“Group”) and, as part of the Group, is affiliated with a number of brands, including Karen Millen, Warehouse, Oasis, Coast, Dorothy Perkins, Debenhams, Burton, Wallis, Miss Pap, boohooMAN, boohoo, PrettyLittleThing and Nasty Gal. In this privacy policy, such brands together with any other brand which is acquired into the Group shall be referred to as the“affiliated group companies”.

How we collect your data

We'll collect your personal data in the following ways:

Direct - we'll collect the personal data you entered when you use any DebenhamsPay+ products and enter your information. This includes when you register for an account, get in touch with us, enter a competition or join a loyalty programme
Third parties - we'll collect the personal data provided through third parties such as a credit reference agency (CRA) during the account set up process, and we'll share transaction data with these agencies including details of your DebenhamsPay+ payment history
Automated technologies or interactions - as you interact with our websites, we'll automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies (see 'Cookies' section below) and other similar
Public Sources - we may collect data from publicly available sources, when you have given your consent to share information or for instances where the information is made public as a matter of law

The kinds of personal data we collect

Personal data means any information about an individual from which that person can be identified. It doesn't include anonymised data, where the identity and identifying information has been removed.

The following groups of personal data are collected:

Personal data - your name, date of birth, biometrics and your credit history which we're given by Credit Reference Agencies (see 'CRAs' section below)
Personal data - which we collect from Fraud Prevention Agencies
Contact data - your address, email address and phone number
Employment details - your current employment status
Residential details - your current living situation
Dependents data - the number of people under 18 who rely on you financially
Transaction data - your DebenhamsPay+ purchases, order details and account information
Contact history - records of when and how you've contacted us including your IP and MAC address
Information about your devices and the technology you use

The legal basis for processing your personal data

We'll only collect and process your personal data where we have a legal basis to do so. This is when:

We have your consent to do so
We need your personal data to perform a contract with you. For example, to process or collect a payment from you, manage your credit or provide customer support
The processing is in our legitimate interests and not overridden by your rights
We have a legal obligation to collect or disclose personal data from you

As a data controller, the legal basis for our collection and use of your personal data varies depending on the manner and purpose for which we collected it.

Why we process your personal data

We'll only collect and process your personal data where we have a legal basis to do so. As a data controller, the legal basis for our collection and use of your personal data varies depending on how and why it's been collected.

For some processing, more than one legal ground may be relevant (except where we rely on a consent).

Here are the legal grounds that are relevant to us:

Purpose/ Activity	Type of data	Lawful basis for processingincluding basis of legitimate interest
To create an account and register you as a new customer	Identity Contact Financial	Consent for the intial account creation and registration Performance of a contract with you (for the ongoing management, access and services we provide)
To check your eligibility for credit at the point of application and for future applications	Identity Financial	Consent
To manage your credit, including to process payments and refunds and to collect money owned to us	Identity Contact Financial Transaction	Performance of a contract with you
To inform you about offers, promotions, product and services that may interest you.	Identity Contact Financial Transaction Marketing and communication preferences	Consent Legitimate interests where we're permitted to market similar product or services that we think you will be interested in, without consent.
To protect our customers, website, app, and DebenhamsPay+ group companies from fraud and theft, which invloves automated decision making to assist such fraud prevention and detection.	Identity Contact Financial Transaction	For automated decision making we consider that fraud detection and prevention is a legal obligation that we have to comply with
To manage our relationship with you, including customer service queries, providing you with any information and services that you reuqest from us, notifying you about changes to our services, terms and coditions or privacy policy	Identity Contact Profile Marketing and Communication preferences	Performance of a contract with you
To enable you to take part in competition, event, survey, or receive a reward for shopping with us.	Identity Contact Profile Usage Marketing and Communications	Consent
To administer, protect and improve our business, our services our website/app and your account, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data, setting default options for you, such as language and currency.	Identity Contact Profile Technical Transaction Marketing and Communications	Consent (when you consent to the use of analytical cookies on our website) Legitimate interests for on-going use to deliver an efficient service
To personalise and improve your experience when you use our website/app and services, including to deliver relevant website content, online advertisements and information to you, and measure the effectiveness of the advertising provided.	Identity Contact Profile Usage Marketing and Communications Technical	Consent (when you consent to the use of analytical and advertising cookies on our website)
To use data analytics across our affiliated group companies to improve our website, app, services and marketing, and the website, app, products, services and marketing of our affiliated group companies.	Identity Contact Profile Marketing and Communications Technical Usage	Consent (when you consent to the use of analytical and advertising cookies on our website)
To recommend products of our affiliated group companies, services, discounts and offers that may be of interest to you, including to send you such information by email or SMS.	Identity Contact Technical Usage Profile Marketing and Communications	Consent Legitimate interests where we're permitted to market to you without consent (see 'Marketing' section below)
To share data with credit reference agencies to ensure the credit products offered are suitable. Please see 'How we share your data' section for more information on third parties.	Identity Contact Technical Usage Profile Marketing and Communications Transaction Data	Consent Legitimate interests when we share data with credit reference agencies, to ensure credit products are offered to customers who are suitable for it (see 'Marketing' section below)
To inform or remind you by email of any task carried out via our website which remains uncompleted, such as incomplete credit applications.	Identity Contact Usage	Performance of a contract with you
We may disclose your information to other companies in connection with any merger, acquisition, insolvency situation or otherwise, in which case we'll only disclose your information so far as is necessary.	All Data	Legitimate interest (we have a legitimate interest in processing your information in connection with any mergers, acquisitions or reorganisation of our business, in which case some of your information may be shared with a prospective buyer or otherwise but only so far as is strictly necessary for the purposes of such sale or administration)

Your rights

Here are your rights under data protection laws. There may be reasons why you can't exercise your rights, but we'll always tell you if this is the case and explain in more detail when your request is made.

Right to be Informed - the right to know we're processing your personal data
Right to Access - the right to request access to the personal data we hold about you
Right to Rectification - the right to request we update and correct any out of date or inaccurate personal data we hold about you
Right to Erasure ('The Right to be Forgotten') - the right to request that we remove all personal data we hold about you, if there is no need for us to keep it
Right to Restrict Processing - the right to request we restrict the processing of your personal data
Right to Object to Processing - the right to request we stop processing your personal data
Right to Data Portability - the right to request us to provide personal data you've supplied to a third party
Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you

If you want to contact us to exercise these rights, please email us at DPO@payplusit.com.

How we share your data

We may share your personal data with the parties set out below for the purposes set out in the table above:

Affiliated Group Companies so that they can provide personalised experiences when you shop with them
External Third Parties including service providers who provide business administration services to us, professional advisors, regulators and other authorities
External third parties if it's necessary to protect your or another person's life or if they need to know you're a vulnerable customer, for example your carer or relatives and anyone who has power of attorney over your affairs
Credit Reference Agencies (CRAs) and Fraud Prevention Agencies (FPAs). See 'CRAs' and 'FPAs' sections below
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this policy

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We don't allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

How we use Credit Reference Agencies (CRAs)

In order to process a product application, we'll perform credit and identity checks on you with one or more credit reference agencies (CRAs). CRAs collect and maintain information about customers' financial behaviour.
DebenhamsPay+ uses soft searches, also known as 'quotation searches', to work out whether you're eligible for an account. We'll only register a full search once you've chosen to open an account and have given us permission to do so. When CRAs receive a full search from us they will place a search footprint on your credit file that may be seen by other credit providers.
We'll also inform the CRAs about your settled accounts. If you borrow and don't repay in full and on time, CRAs will record any outstanding debt and they may share this information with other organisations. We may also carry out further regular searches with CRA's to allow us to manage your account with us.

This is explained in more detail by following the links below:

TransUnion: www.transunion.co.uk
Equifax: www.equifax.co.uk/privacy-hub/crain
Experian: www.experian.co.uk/crain/index.html

How we use Fraud Prevention Agencies (FPAs)

The personal data we've collected from you will be shared with fraud prevention agencies (and CRAs) who will use it to:

Prevent fraud
Prevent money-laundering
Verify your identity

If fraud is detected, you could be refused certain services, finance, or employment. Further details on how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found by following the links below:

CIFAS: www.cifas.org.uk/fpn
Action Fraud: www.actionfraud.police.uk/privacy/data-sharing

Where we store your personal data

The personal data we collect from you may be transferred to, and stored at, destinations outside the UK using legally provided mechanisms to lawfully transfer data across borders. It may also be processed by staff operating outside the UK who work for us or for one of our suppliers. We'll take all steps necessary to ensure that your data is treated securely and in accordance with this privacy policy
Whenever we transfer personal data outside the UK, we'll ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards, as required by law, are in place. We'll be able to transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. More information can be found at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/. Otherwise, we may use specific contractual clauses approved for use in the UK which give personal data the same protection as it has in in the UK. More information about this can be found at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/sccs-after-transition-period/.
Please contact us if you want further information on the countries to which we may transfer personal data and the specific mechanism used by us when transferring your personal data outside the UK

How long we keep your data for

We'll keep your personal data for no longer than is necessary for the purpose(s) it was provided for and to meet our legal obligations

Marketing

If you opt in to receive our marketing communications, we'll use your personal data to contact you and provide you with product details and offers that are relevant to you.

You can change your preferences at any time by updating them online on the DebenhamsPay+ app or website.

We may check your details with appropriate third parties (for example credit reference agencies, such as Experian) before we send you promotions for financial services products. This is to ensure your information is accurate, that the product is suitable for you, and to tailor those offers to you. We'll process all opt-out requests as soon as possible, but please note that due to the nature of our IT systems and servers you may continue to receive marketing in the short term.

Our website uses cookies to distinguish you from other users of our website and to keep track of your visits. They help us to provide you with the very best experience when you browse our website and to make improvements to our website. They also help us and our advertising networks to make advertising relevant to you and your interests.

When we include links to other websites, please bear in mind they will have their own privacy and cookie policies that will govern the use of any information you submit. We recommend you read their policies as DebenhamsPay+ isn't responsible or liable for their privacy practices. You'll be given the option to view and manage your cookie preferences whenever you visit our website.

Below is a list of cookies used by a third party partner that hosts the servicing platform customers log into and manage their account online and in the DebenhamsPay+ app.

Cookie type	Cookies	Cookies used
Functional	userName	1st
Analytical	ai_session	3rd
Analytical	ai_user	3rd
Essential	Identity_Cookie	1st
Essential	XSRF-TOKEN	1st
Essential	.AspNetCore.Antiforgery.*	1st
Essential	nbbid_*	1st
Essential	ASLBSA	3rd
Essential	ASLBSACORS	3rd
Essential	cookieConsents	1st
Essential	featureFlags	1st
Essential	optimizelyUserId	3rd
Essential	hasViewedTrustedRetailerBanner	1st
Essential	Identity_Cookie	1st

Use of cookies

The type of cookies placed and the preferences available to you will depend on the functionality of the relevant cookie.

Essential Cookies are essential for our website to remain working and secure. These cannot be disabled and don't require consent to be placed on your device. Other cookies (known as non-essential cookies) require your prior consent before being placed on your device. We categorise the non-essential cookies we use as Functional Cookies, Advertising Cookies and Analytical Cookies.

We'll seek your consent to non-essential cookies on your first visit to our landing page and, unless you have adjusted your preferences or browser setting so that it will refuse the non-essential cookies, our system will issue cookies and download them onto your device in accordance with the cookies preferences you have most recently indicated to us.

You can find more information about cookies and how to disable them at https://ico.org.uk/for-the-public/online/cookies/ and www.allaboutcookies.org.

Complaints

If you're not happy with any aspect of the way that we process your information or fulfil our obligations, you have the right to complain to the Information Commissioner's Office who enforce data protection laws. They can be found at https://ico.org.uk/.

We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please do contact us in the first instance.

We welcome feedback and are happy to answer any questions you may have about your data.

Please send any questions, comments or requests for more information to our nominated representative and Data Protection Officer, who can be contacted at DPO@payplusit.com.

payplusit.com Limited Registered Company Number: 14126560