Fair processing notice (“Privacy policy”)

Consent

We ask for your consent before using any user generated content on our Website and/or on our social media channels. If you give us your consent, you will be able to withdraw it at any time by messaging us on the platform we used to contact you requesting your consent, or by contacting us using the contact details provided below in Section 10.

We will also request your consent prior to implementing any optional cookies, push notifications, content cards and, where required, other online marketing technologies on our Website, App or Digital Services, where those technologies access, collect or store data on your device. You can reject the use of these technologies and/or withdraw your consent at any time in the ways listed below.

We ask for your consent to send you marketing and promotional material via post, telephone, email and SMS so that we can send you free gifts, discount vouchers, invitations to events, special offers and other marketing material that we believe may be of interest to you.

If you give consent, you will be able to withdraw it any time:

• by using the unsubscribe link in each communication we sent out which will opt you out of receiving marketing emails, or SMS messages, as applicable;
• where you are a registered user of our Website, by using the My Account section on our Website and logging in using your username and password;
• by emailing us at dataprotection@b-and-q.co.uk; or
• by writing to B&Q Customer Services, B&Q House, Chestnut Avenue, Chandlers Ford, Eastleigh, Hampshire, SO53 3LE, United Kingdom or by using the Contact Us enquiry form on our Website.

When you use your payment card to make a purchase with us (either instore or online) we will link details of that purchase with other purchases made with the same payment card. For security purposes, we don’t keep your payment card details for this purpose. We use this information to better understand how our customers purchase from us. If you join the B&Q Club, or if you opt in to receiving marketing communications from us, we will link details of your purchases with us (including, if you have joined the B&Q Club, details of the purchases made before joined the B&Q Club) with other details that we hold about you, and we may use this information to make our communications with you more relevant. You can opt-out of this use of your personal information by contacting us using the details set out in Section 10.

We may also provide you with offers and marketing information about our products and services printed with your till receipt. We may use your personal information we hold about you, including details of the items you’ve bought, in order to provide you with offers and information that we believe may be of interest to you in this way. You can opt-out of this use of your persona information by emailing us at: dataprotection@-b-and-q.co.uk. You do not have to give us permission in order to use our Website.

Please note that, even if you choose not to receive this marketing information from us, we may still use your personal information to provide you with important services communications, including communications in relation to any orders you submit or products you purchase. We may also offer you the opportunity to indicate specific types of marketing communications you are particularly interested in receiving from us; where possible, we will tailor the communications you receive to reflect your choices, but we may send you other communications that may be of interest to you. If you are a B&Q Club member, please note that by opting out of marketing communications from us, you will also opt-out of receiving B&Q Club communications.

Please note that where we have indicated in this section that our processing of your personal information is either:

• necessary for us to comply with a legal obligation; or
• necessary for us to take steps, at your request, to potentially enter into a contract with you, or to perform it

and you choose not to provide the relevant personal information to us, we may not be able to enter into or continue our contract of or engagement with you.

Please note our Digital Services are not intended for children and we do not knowingly collect data relating to children.

6. How long we keep your personal information

We are required by law to keep your personal information only for as long as is necessary for the purposes for which we are using it. The period for which we keep your personal information will be determined by a number of criteria, including the purposes for which we are using the information, the amount and sensitivity of the information, the potential risk from any unauthorised use or disclosure of the information, and our legal and regulatory obligations.

Please note that third party sellers on the Online Marketplace and our partners in connection with the B&Q Energy Saving Scheme may have different retention periods for the personal information they process. Please refer to the relevant third party’s privacy notice.

In respect of body worn camera footage (including audio), we retain footage for 28 days, unless the footage is required for our purposes, in which case the footage will be deleted once it is no longer needed for our purposes.

We retain your Digital Services tracking data for the period necessary to verify transactions and process cashback claims. This is typically for 13 months, unless a longer retention period is required for dispute resolution or legal obligations.

7. Who we share your personal information with

We are a member of the Kingfisher Group of companies including B&Q, Screwfix, Castorama and Brico Dépôt (for more information on the Kingfisher Group please visit: www.kingfisher.com).

We may share your personal information with other members of the Kingfisher Group in connection with the purposes above and those listed below. In particular, the data we collect from our customers is stored on a customer management system that is owned by the Kingfisher Group. Therefore, members of the Kingfisher Group may, where appropriate, have access to necessary customer data we collect and may also use the personal information we share with them to improve our and their websites and other digital services, for analysis purposes and to offer you products and services that they believe may be of interest to you. [Where other Kingfisher entities are using your personal data in a way that is separate from our use and is for their own purposes (such as their own marketing or analytical purposes), they will be acting as an independent controller. You can review the Kingfisher privacy notice accessible here (Privacy policy – Kingfisher plc), to see how Kingfisher process your personal data.]

We may use automated decision-making when we make decisions by technological means without significant human involvement, and non-automated processes, to help generate business insights based on the customer experience and evaluate or predict customer purchasing preferences. This will include sharing information with Kingfisher plc (our parent company), and other members of the Kingfisher Group who will then, having received this information, use their own similar processes and then share the results with us for the same purposes and to help improve overall customer experience. This means Kingfisher plc and other members of the Kingfisher Group will each be receiving and processing your information in their own right and subject to their own privacy notices which are available on their respective websites. For more information, please visit https://www.kingfisher.com.

We may share your personal information with the following categories of third parties:

• Third party service providers, to whom we outsource certain functions: We use third parties to carry out certain activities on our behalf which involve the processing of personal information. For example, we may engage third party service providers to fulfil orders, deliver packages, send postal mail, SMS text messages and email, maintain and update our databases of customer details (including the removal of repetitive or incorrect information), analyse data to help us develop, provide and improve our products and services, provide marketing assistance, process card payments, process payments online, carry out surveys and installations, provide customer service, process the booking of appointments, handle claims and respond to data right requests (see below for further details). These third parties have access to personal information needed to perform their functions but may not use it for other purposes. We may use the information we receive from third parties to supplement, improve and add to our databases of customer details, for purposes such as credit checking and fraud prevention.
  
  Where we allow customers to pay for products and services via our Digital Services using online payment methods and digital wallets, customer personal information may be shared with providers of those services for payment purposes in order to process the transaction, for example with PayPal when you choose to use PayPal for your payment. For more information on how PayPal uses personal information that it collects from you, please see PayPal’s Privacy Policy .
   
• Third Parties who work with us to respond to Data Subject rights: We use third parties, and also the broader Kingfisher Group, to assist us with responding to certain data rights, including right of erasure requests and data subject access requests. We may therefore share your personal data in relation to these requests with these third parties and group companies to allow us to respond accordingly. Our third party suppliers are based in Europe and around the world, which may change from time to time.
• Third Parties who market for us. We may share information that we hold about you (for example, your email address and information about your purchases) with third parties that also hold your information or have an existing online relationship with you in order to identify you and to enable us (or Kingfisher Group companies or other third parties on our behalf) to provide you with relevant marketing and advertising online. For instance, we may share your information with social networking sites such as Facebook, Google, Reddit, YouTube, Twitter, Instagram, LinkedIn and Pinterest so that they can identify you as a customer of ours and can tailor the marketing we send you via their sites and products.

We may also share, and receive from, third party advertising partners, such as Citrus and Quantcast, information about how you have interacted with an advert which we have displayed to you via our Digital Services or while you are visiting a third party site. Where third party advertisers advertise on our site, we may share information with them about your interaction with the ad for measurement and/or payment purposes. This information may be shared with them directly or via our third party advertising partners.

We partner with affiliate networks and cashback providers to track purchases made via our website and ensure cashback rewards are correctly attributed. This involves the use of tracking technologies, such as cookies and unique identifiers, which help verify transactions.

• To facilitate cashback tracking, we may share transaction details with third party affiliate networks and cashback providers. These partners act as data processors or joint controllers, depending on the agreement. We ensure that they comply with the UK GDPR and provide appropriate safeguards.
• Our business and brand partners. We may also share information that we hold about you with third parties with whom we have a commercial arrangement or shared business interest such as third parties who sell products through our Digital Services. We will only share this information where there are appropriate safeguards in place with the third party – please see following section.
• Third-party sellers on the Online Marketplace. When you use the Online Marketplace, we share personal information with third party sellers to enable them to undertake their own activities. This may include sharing data via an Aggregator (e.g Octopia, Shoppingfeed, ChannelAdvisor or similar) to third party sellers. To the extent an Aggregator acts as a separate data controller for certain or all processing purposes, it will provide more detail about how they use your personal information in their own privacy policy.
• Background checks. We share information such as name and registered address of third party sellers with background check service providers (such as Dow Jones) where we feel such checks are required in relation to third party sellers.
• Law enforcement. We may pass personal information to external agencies and organisations (including the police and other law enforcement agencies) for the purposes of operational efficiency, analytics and preventing and detecting fraud (including fraudulent transactions) and criminal activity. This includes for the investigation of accidents, incidents, criminal activities and breaches of our policies. These external agencies may check the information we give them against public and private databases and may keep a record of such checks to use in future security checks. We may also disclose personal information to the police and other law enforcement authorities in connection with the prevention and detection of crime and with government departments, statutory and regulatory bodies and Her Majesties Revenue and Customs.
• Prevention, detection, investigation and mitigation of crime: We may also share personal information with the Kingfisher Group and law enforcement agencies to allow us to identify and mitigate risk and prevent crime.
• Cookie tracking / consent: We may share your personal information in relation to consent choices with Google (for the purposes of Google Consent Mode) and other third parties such as Meta.

Where you take part in the B&Q Energy Saving Scheme, we may share your information with the Energy Saving Trust and our partners for the purposes of arranging for quotations, surveys and works to be carried out at your property in connection with the scheme.

• Our insurers, insurance brokers and corporate transactions. We may pass personal information to our insurers in the event that a claim is made or could be made against us. For example, we may send CCTV footage (including footage and audio from body worn cameras) and information contained in our accident logs to our insurers. In the event that we sell or buy any business or assets, we may disclose personal information held by us to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party (or subject to a reorganisation within our corporate group), personal information held by us will be one of the transferred assets.
• Our professional advisors and legal obligations. We may pass your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply our Digital Services Ts&Cs, Terms and Conditions of Sale, Supply & Install Terms and other agreements we have with or otherwise concerning you (including agreements between you and us (or one or more of our affiliates)); or to protect our rights, property or safety or those of our customers, employees or other third parties. We may also share personal information with our consultants and professional advisors including legal advisors and accountants.

We may share anonymous or aggregate data (such as aggregated statistics or other anonymised data) with third parties.

Links to external sites

We may also provide links to the websites of other Kingfisher Group companies from our Digital Services. Your use of those websites is subject to the terms of use and policies available on those websites.

From time to time we may also establish relationships with third parties that will enable you to access the websites or applications (such as video players) of such third parties directly from our Digital Services. Each third party operates its own policy regarding the processing of personal information and the use of cookies on its website(s) or through its applications and you are advised to read the third party's privacy policy and cookies policy.

Please note that third party websites and applications are not under our control. When you click through to these websites or access these applications you leave the area controlled by us. Similarly, where you have contacted us or shared user generated content with us using a third party platform (for example a social media platform), the third party(ies) that provide these platforms will use your information in accordance with their own privacy notices. We do not accept responsibility or liability for any issues arising in connection with the third party's use of your data (including your personal information).

8. Where your personal information will be processed

Your personal information may be transferred to, and stored and processed in, one or more countries outside the country in which we are established (see Section 1: Who we are, above), including countries which do not provide equivalent protection for personal information, such as the US and Poland (see the above section and details of third party suppliers assisting with responding to data subject rights requests). In these circumstances, we will take reasonable steps and implement appropriate measures to ensure that your personal information is adequately protected in accordance with applicable data protection laws.

These measures generally include either:

• Transferring personal information to countries that have been deemed to provide an adequate level of protection for personal information under applicable data protection law; or
• Transferring personal information where the recipient has agreed to an approved data transfer agreement in the form of the EU standard contractual clauses, where applicable, the UK International data transfer addendum.
• Occasionally, we may transfer your personal information in circumstances where there are no adequate safeguards where this is permitted by data protection law.

Please contact us using the details below if you want further information on the specific safeguards used by us when transferring your personal information out of the country in which we are established (including if you would like to request a copy of the standard contractual clauses mentioned above). Where we share data with third parties, we will ensure to place on that third party obligations around data deletion and data retention, in accordance with our retention practices, to ensure your personal data is not kept for longer than required.

9. Your rights in relation to the personal information that we hold about you

You have the right to ask us to:

• Confirm what personal information we hold about you and provide you with a copy of that data (right of access);
• Correct any personal information that is inaccurate (right to rectification);
• Remove/erase your personal information where there is no good reason for us to continue to hold that data (right of erasure);
• Temporarily stop using your personal information if you are questioning our right to use that data and in other circumstances where that right is applicable (right of restriction);
• Stop using your personal information unless we can demonstrate a valid reason why we need to continue to hold that data e.g. to support a product warranty (right to object);
• Stop using your personal information to send you marketing materials such as our catalogue, marketing emails, discounts or vouchers;
• Provide you with the personal information that you have provided to us, in a structured and commonly-used electronic format, or transmit that information directly to another company if that is technically feasible. This applies where we are using your personal information on the basis of your consent or because it is necessary to perform a contract with you (see How do we use your personal information, above) (right to data portability);
• Stop using your personal data in automated decision making (including profiling) in certain circumstances;
• You can manage your cookie preferences via our Cookie Settings page or adjust your browser settings to disable tracking cookies;
• You can opt out of receiving online marketing advertisements and content cards by managing your consent preferences in our Website or App; and
• Lodge a complaint with us if you believe your rights under data protection laws, including the UK Data (Use and Access) Act 2025, have been infringed. We will investigate your complaint and respond in line with our legal obligations.

Our security procedures mean that we may request proof of identity before we are able to disclose your personal information to you or comply with other requests.

Where our processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal information for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent wont impact any of our processing up to that point.

We want to make sure that the personal information we hold about you and your preferences as to how we contact you are accurate and up to date. If any of the details are incorrect, please let us know (by contacting us using the details below) and we will amend them.

You also have the right to make a complaint to the supervisory authority if you’re not happy with how we’ve handled your personal information. The websites for the supervisory authorities that regulate our processing of your personal information are set out below: