Privacy Policy

Bright Tails is a private limited company registered in England and Wales under company number 16115430.

For the purposes of applicable UK data protection legislation, BrightTails will generally act as the data controller in relation to personal information that we determine how and why to process.

This means that BrightTails is responsible for determining the purposes and means by which relevant personal information is processed.

Questions concerning this Privacy Policy or the way we process personal information can be sent to support@brighttails.co.uk.

We process personal information in accordance with applicable UK privacy and data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and, where applicable, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), as amended or replaced from time to time.

Nothing in this Privacy Policy is intended to restrict any right that an individual has under applicable data protection law.

The information we collect depends upon how you interact with BrightTails.

We may collect information directly from you, automatically when you use our website or services, from service providers acting on our behalf, and from third parties where this is lawful and appropriate.

The categories of personal information we may process include the following.

3.1 Identity Information

We may collect information such as your:

• full name;
• title;
• date of birth or confirmation that you meet applicable age requirements;
• customer or BrightTails plan number;
• account identifiers; and
• identity documents where reasonably necessary for verification, fraud prevention or the consideration of a support request.

We will only request identification documentation where reasonably necessary and appropriate.

3.2 Contact Information

We may process contact information including:

• email address;
• telephone number;
• postal address;
• billing address; and
• other contact information supplied by you.

We use this information to administer your BrightTails plan, communicate with you, provide customer support, send important service notices and fulfil other legitimate purposes described in this Privacy Policy.

3.3 Account Information

When you create or use a BrightTails account, we may process information associated with that account, including:

• account registration information;
• BrightTails plan status;
• selected BrightTails plan plan;
• BrightTails plan commencement date;
• payment status;
• account preferences;
• account activity;
• cancellation information;
• communications relating to the account; and
• records relating to your use of BrightTails services.

Passwords should be stored using appropriate technical security measures and should not be accessible to BrightTails personnel in plain text where our systems are appropriately designed to avoid this.

3.4 Information About Your Dog

As part of providing the BrightTails service, we may collect information concerning a registered dog, including:

• name;
• date of birth or age;
• breed;
• sex;
• photographs;
• ownership information;
• veterinary practice details;
• veterinary history where relevant;
• microchip information where supplied or required;
• date and circumstances of death where relevant;
• cremation, burial, funeral or memorial information; and
• other information reasonably necessary to administer the BrightTails plan or consider a request for discretionary support.

Information about an animal is not necessarily personal data in itself. However, where information concerning a dog can be associated with or reveal information about an identifiable individual, we will handle that information appropriately as part of the relevant customer record.

BrightTails may use third-party payment processors to process recurring subscription payments and other transactions.

Depending upon the payment method and provider used, payment providers may process information such as:

• cardholder name;
• billing address;
• card details;
• bank information;
• transaction information;
• payment authorisation information;
• payment status;
• payment failures; and
• fraud-prevention information.

BrightTails may receive limited information from payment providers, such as transaction identifiers, the last digits of a payment card, card type, payment status and information necessary to reconcile transactions.

Where payment information is processed directly by an independent payment provider, that provider may act as a separate controller or processor depending upon the circumstances and its contractual relationship with BrightTails.

You should also review the privacy information supplied by the relevant payment provider.

Where a member asks BrightTails to consider providing discretionary financial support, we may collect information reasonably necessary to assess and verify that request.

This may include:

• the member's identity;
• BrightTails plan information;
• details concerning the registered dog;
• date and evidence of the dog's death;
• veterinary records where relevant;
• invoices;
• receipts;
• cremation documentation;
• burial or funeral documentation;
• memorial service documentation;
• correspondence with service providers;
• payment information;
• evidence showing that an expense was incurred;
• information concerning payments received from another source; and
• other information reasonably necessary to assess or verify the request.

BrightTails may retain appropriate records of support requests and decisions for legal, accounting, fraud-prevention, dispute-resolution and business administration purposes.

In appropriate circumstances, BrightTails may obtain or verify information from third parties.

These may include:

• payment processors;
• veterinary practices;
• crematoriums;
• pet funeral providers;
• memorial service providers;
• fraud-prevention providers;
• identity-verification providers;
• technology and hosting providers;
• professional advisers;
• public authorities; and
• other organisations where obtaining the information is lawful and reasonably necessary.

Where appropriate, we may ask you to provide permission or authority allowing a third party to disclose information to BrightTails.

We will not seek information that is excessive or unrelated to a legitimate purpose.

When you visit or interact with our website or customer portal, certain technical information may be collected automatically.

Depending upon the technologies used on our website, this may include:

• IP address;
• browser type;
• device type;
• operating system;
• approximate geographic information derived from an IP address;
• pages viewed;
• dates and times of visits;
• referring website;
• website interactions;
• session information;
• security logs;
• error information;
• cookie identifiers; and
• similar technical information.

This information may be used to operate and secure the website, diagnose technical problems, prevent fraud and abuse, understand how the service is used and improve the BrightTails experience.

BrightTails may use cookies and similar technologies on its website and customer portal.

Some cookies are necessary for the operation, security and functionality of the website.

Other cookies, such as analytics, advertising or certain preference cookies, may require consent before they are placed on your device.

Where consent is legally required, BrightTails will seek that consent through an appropriate cookie consent mechanism.

Non-essential cookies requiring consent should not be activated before valid consent has been obtained.

Users should be provided with an appropriate method of withdrawing or changing their cookie choices.

Further information concerning the specific cookies and technologies used by BrightTails may be provided in our Cookie Policy or cookie preference centre.

BrightTails may process personal information for purposes including:

• creating and administering customer accounts;
• establishing and managing BrightTails plans;
• processing subscription payments;
• communicating with members;
• verifying eligibility;
• maintaining information about registered dogs;
• administering the 24-month waiting period;
• considering requests for discretionary support;
• verifying invoices, receipts and supporting evidence;
• making discretionary support payments where approved;
• preventing and detecting fraud;
• investigating suspicious activity;
• maintaining security;
• responding to customer-service enquiries;
• dealing with complaints;
• maintaining business and accounting records;
• complying with tax obligations;
• establishing, exercising or defending legal rights;
• improving our website and services;
• administering promotions;
• sending marketing communications where legally permitted;
• protecting BrightTails, its members and third parties;
• enforcing our Terms and Conditions; and
• complying with applicable legal and regulatory obligations.

We will not use personal information for a purpose that is incompatible with the purpose for which it was originally collected unless permitted or required by law.

Under the UK GDPR, BrightTails must have a lawful basis for processing personal information.

The lawful basis used will depend upon the particular processing activity.

Contract

We may process personal information where processing is necessary to enter into or perform our contract with you.

For example, this may include establishing your BrightTails plan, administering your account, collecting subscription payments and providing BrightTails plan services.

Legitimate Interests

We may process personal information where doing so is necessary for our legitimate interests or those of another party and those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and improving BrightTails;
• protecting our business;
• preventing fraud;
• maintaining website and account security;
• maintaining appropriate business records;
• understanding use of our services;
• responding to enquiries;
• verifying information;
• establishing or defending legal rights; and
• protecting BrightTails against misuse.

Where we rely upon legitimate interests, we consider the necessity and proportionality of the processing and the potential impact upon individuals.

Legal Obligation

We may process personal information where necessary to comply with a legal obligation.

This may include obligations relating to taxation, accounting, law enforcement, court orders, fraud prevention and other statutory requirements.

Consent

In circumstances where consent is the appropriate or required lawful basis, we may process personal information on the basis of your consent.

Where processing is based upon consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

BrightTails does not ordinarily need to collect special category personal data about members.

However, information voluntarily provided in communications or documents may occasionally contain information revealing matters such as an individual's health.

We ask members not to provide special category personal information unless it is genuinely relevant and reasonably necessary.

Where BrightTails needs to process special category personal data, we will only do so where an appropriate lawful basis and additional condition under applicable data protection law are available.

BrightTails does not routinely seek criminal offence information.

Where suspected fraud, theft, deception or another potential criminal offence arises, relevant information may be processed where permitted by applicable law and where appropriate safeguards are in place.

Information may be disclosed to law enforcement or another competent authority where there is an appropriate lawful basis for doing so.

BrightTails may use information to identify and prevent fraud, abuse, duplicate reimbursement, false documentation, identity misuse or other dishonest conduct.

This may involve reviewing account information, payment information, submitted documents, previous requests, technical information and communications.

We may retain appropriate fraud-prevention records where reasonably necessary to protect BrightTails and its members and to establish, exercise or defend legal claims.

BrightTails does not intend to make decisions producing legal or similarly significant effects about members solely through automated processing unless this is permitted by law and appropriate safeguards are provided.

Automated tools may be used to assist with administrative, fraud-detection, security or verification processes.

Where applicable law gives you rights concerning solely automated decision-making, those rights will be respected.

BrightTails does not sell personal information.

We may share personal information with carefully selected third parties where reasonably necessary for legitimate business purposes or where required by law.

Recipients may include:

• payment processors;
• website hosting providers;
• cloud-service providers;
• email and communications providers;
• customer-service technology providers;
• analytics providers;
• identity-verification providers;
• fraud-prevention providers;
• veterinary practices;
• crematoriums and funeral providers;
• accountants;
• auditors;
• solicitors and other professional advisers;
• insurers used by BrightTails for its own business purposes;
• banking providers;
• prospective purchasers or investors in connection with a legitimate corporate transaction; and
• regulators, courts, law-enforcement bodies, government departments and other authorities where legally required or permitted.

We seek to disclose only information that is reasonably necessary for the relevant purpose.

Where a third party acts as our data processor, we will put appropriate contractual arrangements in place as required by data protection law.

BrightTails does not sell members' personal information in exchange for money.

We also do not permit third parties to use personal information supplied to them solely as a BrightTails processor for their own unrelated marketing purposes unless a lawful basis exists and the individual has been appropriately informed.

Some technology, payment, communications, hosting or other service providers used by BrightTails may process personal information outside the United Kingdom.

Where personal information is transferred internationally, BrightTails will take appropriate steps required by UK data protection law.

Depending upon the destination and circumstances, these measures may include reliance upon UK adequacy regulations or appropriate contractual safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.

Where required, we will also consider whether additional safeguards are appropriate.

BrightTails will not retain personal information for longer than reasonably necessary for the purpose for which it was collected, subject to legal, regulatory, accounting, fraud-prevention and dispute-resolution requirements.

Different categories of information may therefore be retained for different periods.

In determining appropriate retention periods, we may consider:

• the nature of the information;
• the reason it was collected;
• the duration of BrightTails plan;
• whether a support request was submitted;
• accounting and taxation requirements;
• fraud-prevention requirements;
• applicable limitation periods;
• actual or potential disputes;
• legal obligations; and
• whether information remains reasonably necessary for the establishment, exercise or defence of legal claims.

When personal information is no longer required, it will be securely deleted, anonymised or otherwise disposed of as appropriate.

Cancellation of a BrightTails BrightTails plan does not necessarily result in the immediate deletion of all personal information.

We may retain information after cancellation where reasonably necessary to:

• comply with legal obligations;
• maintain financial and accounting records;
• resolve disputes;
• prevent fraud;
• establish, exercise or defend legal claims;
• respond to complaints; or
• maintain appropriate records concerning the former contractual relationship.

Information that is no longer required will be deleted or anonymised in accordance with our retention practices.

BrightTails takes reasonable and appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, destruction, alteration, disclosure or misuse.

Measures may include, where appropriate:

• access controls;
• authentication measures;
• encryption;
• secure communications;
• password hashing;
• restricted administrative access;
• logging and monitoring;
• secure hosting;
• backups;
• software updates;
• staff access restrictions;
• contractual controls over service providers; and
• procedures for responding to suspected security incidents.

No internet-based system can be guaranteed to be completely secure.

Members are responsible for taking reasonable steps to protect their account credentials and should not share passwords with other people.

BrightTails maintains procedures for responding to suspected personal data breaches.

Where a personal data breach occurs, we will assess the nature and potential consequences of the incident and take appropriate steps to contain and investigate it.

Where applicable law requires us to notify the Information Commissioner's Office or affected individuals, we will do so within the applicable legal requirements.

BrightTails may contact customers about products, BrightTails plan features, promotions, offers or other marketing where permitted by law.

Where consent is required for electronic marketing, we will seek appropriate consent.

Where the law permits marketing to existing customers without separate consent, we may rely upon the applicable legal provisions provided their requirements are satisfied.

Marketing consent is separate from acceptance of the BrightTails Terms and Conditions and is not a condition of purchasing BrightTails plan where consent must be freely given.

You can unsubscribe from electronic marketing communications at any time using the unsubscribe facility included in the communication or by contacting BrightTails.

Withdrawing from marketing does not prevent us from sending necessary service communications concerning your BrightTails plan, payments, account, security, support requests or other non-marketing matters.

Depending upon the circumstances, UK data protection law provides individuals with a number of rights concerning their personal information.

Right of Access

You may ask whether we process personal information about you and request a copy of personal information to which you are entitled.

Right to Rectification

You may ask us to correct inaccurate personal information and, where appropriate, complete information that is incomplete.

Right to Erasure

In certain circumstances, you may ask us to erase personal information.

This right is not absolute. We may retain information where continued processing is permitted or required by law, including where information is necessary for legal obligations or the establishment, exercise or defence of legal claims.

Right to Restriction

In certain circumstances, you may ask us to restrict the way in which we process your personal information.

Right to Data Portability

Where applicable, you may have the right to receive certain personal information in a structured, commonly used and machine-readable format or ask for that information to be transferred to another controller.

Right to Object

You may have the right to object to certain processing based upon legitimate interests.

You also have the right to object to the processing of personal information for direct marketing purposes.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights relating to decisions based solely upon automated processing that produce legal or similarly significant effects.

Right to Withdraw Consent

Where processing is based upon consent, you may withdraw your consent at any time.

Requests concerning your personal information may be submitted to support@brighttails.co.uk.

We may request reasonable information to verify your identity before responding to a data protection request.

This helps prevent personal information being disclosed to an unauthorised person.

We will respond within the period required by applicable data protection law.

In certain circumstances permitted by law, the response period may be extended where a request is particularly complex or multiple requests have been made. Where this occurs, we will provide the information required by law concerning the extension.

We will not ordinarily charge a fee for exercising data protection rights. However, where permitted by law, a reasonable fee may be charged or a request may be refused where it is manifestly unfounded or excessive.

BrightTails BrightTails plan is intended for adults aged 18 or over.

We do not knowingly permit children to enter into BrightTails BrightTails plans in their own name.

If we become aware that personal information relating to a child has been collected in circumstances where it should not have been collected, we will take appropriate steps in accordance with applicable law.

When you contact BrightTails by email, website form, telephone, social media or another communication method, we may retain information concerning that communication.

This may include the content of messages, dates and times, contact information, customer-service notes and records of action taken.

We may retain these communications where reasonably necessary to administer your BrightTails plan, resolve disputes, improve customer service, prevent fraud or maintain appropriate business records.

BrightTails may operate accounts on social-media platforms.

Where you communicate with us through a social-media platform, both BrightTails and the operator of that platform may process information concerning the interaction.

The platform operator's processing will be governed by its own privacy terms.

We recommend reviewing the privacy information supplied by any social-media service you use.

Our website may contain links to websites operated by third parties.

BrightTails does not control the privacy practices of independent third-party websites.

This Privacy Policy applies to processing carried out by BrightTails and does not automatically apply to third-party websites.

You should review the privacy policy of a third-party website before supplying personal information through it.

If BrightTails or substantially all or part of its business or assets is sold, merged, reorganised, financed, acquired or otherwise transferred, relevant personal information may be disclosed to appropriate advisers, prospective purchasers, investors or other parties involved in the transaction.

Any such processing will be carried out subject to applicable data protection law and appropriate confidentiality and security requirements.

Where responsibility for personal information transfers to another controller, affected individuals will be provided with information where required by law.

BrightTails may disclose personal information where required or permitted by law.

This may include disclosure in response to:

• court orders;
• legal proceedings;
• statutory requirements;
• law-enforcement requests;
• regulatory investigations;
• tax requirements; or
• other lawful requests from competent authorities.

We may also process and disclose information where reasonably necessary to establish, exercise or defend legal rights.

We will not disclose personal information to an authority merely because it has requested information where we have no lawful basis for doing so.

BrightTails reserves the right to investigate suspected misuse of its services.

Where reasonably necessary and lawful, information may be used to investigate suspected:

• fraudulent support requests;
• fabricated invoices;
• altered documentation;
• duplicate reimbursement;
• identity fraud;
• payment fraud;
• unauthorised account access;
• abuse of promotional schemes; or
• other dishonest or unlawful conduct.

Information relating to confirmed or reasonably suspected fraud may be retained where lawful and proportionate for fraud-prevention and legal purposes.

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business operations or applicable law.

The latest version will be published on the BrightTails website with an updated revision date.

Where a change materially affects how we process personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required by law.

We will not retrospectively rely upon a materially different use of personal information where doing so would be incompatible with applicable data protection requirements.

If you have a concern about how BrightTails has processed your personal information, we encourage you to contact us so that we have an opportunity to investigate and resolve the matter.

You can contact us at support@brighttails.co.uk.

You also have the right to complain to the Information Commissioner's Office (“ICO”), the UK's independent data protection regulator.

You are not required to contact BrightTails before exercising your right to complain to the ICO.

Further information about UK data protection rights and how to make a complaint is available directly from the Information Commissioner's Office.

The ICO's current contact details and complaints procedure can be found through its official website.

Where BrightTails is required to register with the Information Commissioner's Office and pay a data protection fee under applicable law, BrightTails will maintain the appropriate registration and fee payment.

Any ICO registration number published by BrightTails should be verified against the ICO's official register.

This Privacy Policy explains how BrightTails handles personal information.

It should be read alongside the BrightTails Terms and Conditions, Cookie Policy and any other privacy information provided at the point personal information is collected.

Where applicable data protection law provides an individual with a mandatory right, nothing in another BrightTails document is intended to override that right.

For questions about this Privacy Policy, requests concerning your personal information, or concerns about the way BrightTails handles personal information, please contact:

Bright Tails
Company Number: 16115430
Email: support@brighttails.co.uk

When contacting us about a data protection matter, please provide sufficient information for us to understand and respond to your request.

Please do not send unnecessary sensitive information or identification documents unless we specifically request them.