Own Comforts E-Voucher Documentation

1. General

1.1 The following Terms and Conditions outline the use of the Own Comforts E-Voucher Solution.

2. Definitions

2.1 “C Supplies Ltd” – The entity issuing and selling the E-Voucher Solution.

2.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd where the E-Voucher is redeemed.

2.3 “Voucher Purchaser” – A charity or business purchasing the Own Comforts E-Voucher for a Beneficiary to utilise.

2.4 “Beneficiary” – The individual who receives and uses the Own Comforts E-Voucher.

2.5 “Personal Data” – Any information that identifies or can identify a living individual, as defined under the UK GDPR and the Data Protection Act 2018. [gov.uk]

3. Acceptance of Terms

3.1 The purchase of the E-Voucher
automatically constitutes acceptance of these Terms & Conditions by the Voucher
Purchaser.

3.2 The use of the E-Voucher
automatically constitutes acceptance of these Terms & Conditions by the Beneficiary.

4. Purpose and Use of the E-Voucher

4.1 The E-Voucher may only be redeemed at Own Comforts: www.owncomforts.co.uk.

4.2 It cannot be exchanged for cash.

4.3 No change is issued for unused balances.

4.4 The Own Comforts E-Voucher must be redeemed within 1 year of the date it is sent to the Beneficiary.

4.5 The Own Comforts E-Voucher cannot be exchanged for any other store once purchased.

4.6 Proof of identity may be required for fraud prevention.

5. Data Sharing and GDPR Compliance

5.1 Lawful Basis for Processing

Organisations must identify a lawful basis before sharing personal data. Therefore, Own Comforts will process and share the Beneficiary name and purchase data with C Supplies Ltd and the Voucher Purchaser under the lawful basis of legitimate interests (Article 6(1)(f) UK GDPR) under a Tri-Party Data Sharing Agreement— specifically:

• Ensuring proper use of charitable and gifted funds
• Preventing fraud or misuse
• Providing transparency for the Voucher Purchaser

5.2. What Data May Be Shared

Own Comforts may share with C Supplies Ltd and the Voucher Purchaser the following details relating to purchases made with the Own Comforts E-Voucher only:

• Item descriptions
• Item categories
• E-Voucher Code
• Value of items purchased with the E-Voucher
• The name of the beneficiary associated with any or all
  the purchase information outlined above.

Only data necessary for the stated purposes will be shared, following the GDPR requirement of data minimisation.

5.3 Payment Information and Limits on Data Sharing

Payment details relating to the purchase of the E‑Voucher are already known to
all relevant parties: the Voucher Purchaser has paid for the Own Comforts E‑Voucher; C Supplies Ltd (as operator of the Own Comforts platform) has processed that payment; and the Beneficiary who subsequently uses the E‑Voucher to complete their purchase. No additional payment information from the Beneficiary will be shared with the Voucher Purchaser beyond what is necessary to redeem the E‑Voucher itself.

Any purchases made by the Beneficiary on the Own Comforts website that are not paid for using the E‑ Voucher provided by the Voucher Purchaser, will not be shared with the Voucher Purchaser. Such independently funded transactions remain private between the Beneficiary and Own Comforts and are processed in accordance with the standard Own Comforts Privacy Notice.

5.4 Transparency Requirements

Beneficiaries must be informed of how their data will be processed, which aligns with GDPR requirements for transparency and “the right to be informed.”

A Privacy Notice accompanies these Terms & Conditions.

5.4 Data Retention

Personal data will be retained only as long as necessary to fulfil the reporting obligations of the Voucher Purchaser and to prevent fraud, in compliance with GDPR principles.

5.5 Security

C Supplies Ltd and Own Comforts will ensure appropriate technical and organisational measures to secure personal data, as required under the GDPR. [gov.uk]

5.6 Data Subject Rights

Beneficiaries have the following rights under the UK GDPR:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (where applicable)
• Right to restrict processing
• Right to object

These rights are outlined under GDPR
Articles 12–21.

Requests may be made to C Supplies Ltd using the contact details in the Privacy Notice and will be discussed with the Voucher Purchaser.

5.7 Data Sharing Agreements

Where required, C Supplies Ltd and Own Comforts maintain appropriate data sharing agreements consistent with ICO’s Data Sharing Code of Practice. A Tri-Party Data Sharing Agreement between Own Comforts, C Supplies Ltd and the Voucher Purchaser also applies in all cases of data sharing.

6. Fraud Prevention

6.1 C Supplies Ltd and Own Comforts may refuse or cancel vouchers suspected of misuse and will notify the Voucher Purchaser.

7. Changes to Terms

7.1 C Supplies Ltd reserves the right to update these Terms. Updates will be posted on C Supplies Ltd official website.

8. Governing Law

8.1 These Terms are governed by the laws of the United Kingdom.

This Privacy Notice explains how C Supplies Ltd and Own Comforts
collect, use, and share personal data related to the Own Comforts E-Voucher.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the E-Voucher
– C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of
the E-Voucher – Own Comforts accepts the E-Gift Voucher and fulfils the
transaction.

1.3 Under the UK GDPR, both act as
independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (categories, items purchased,
  transaction value)

2.2 We do not collect or share
payment card details of the Beneficiary should these be added to the
transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f))
  
  To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c))
  
  Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record, process and confirm transactions
• To report purchase details to the Voucher Purchaser
  as per the Term and Conditions
• To monitor fraud or misuse

All processing aligns with UK GDPR
principles of lawfulness, fairness, transparency, accuracy, purpose limitation,
minimisation, and security. [gov.uk]

5. Who We Share Data With

• C Supplies Ltd (Voucher Issuer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

We do not sell personal data to third parties.

6. Data Retention

6.1 Personal data is retained only
for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after
purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights
under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the
contact details below.

7.3 We apply reasonable security controls
to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask
questions:

Data Protection Officer (DPO)

customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints
with the Information Commissioner’s Office (ICO).

This Privacy Notice explains how C Supplies Ltd and Own Comforts
collect, use, and share personal data related to the Own Comforts E-Voucher
Solution.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the
E-Voucher – C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of
the E-Voucher – Own Comforts accepts the E-Voucher and fulfils the transaction.

1.3 Under the UK GDPR, both act as
independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (item categories, items purchased, transaction value)

2.2 We do not collect or share
payment card details of the Beneficiary should these be added to the
transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f))
  
  To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c))
  
  Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record and confirm transactions
• To report purchase details to the Voucher Purchaser
• To monitor fraud or misuse

All processing aligns with UK GDPR
principles of lawfulness, fairness, transparency, accuracy, purpose limitation, minimisation, and security. [gov.uk]

5. Who We Share Data With

• Own Comforts (Voucher Redeemer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

   
We do not sell personal data to third parties

6. Data Retention

6.1 Personal data is retained only
for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after
purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights
under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the
contact details below.

7.3 We apply reasonable security
controls to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask
questions:

Data Protection Officer (DPO)

customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints
with the Information Commissioner’s Office (ICO).

This Privacy Notice explains how C Supplies Ltd and Own Comforts
collect, use, and share personal data related to the Own Comforts E-Voucher.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the E-Voucher
– C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of
the E-Voucher – Own Comforts accepts the E-Gift Voucher and fulfils the
transaction.

1.3 Under the UK GDPR, both act as
independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (categories, items purchased,
  transaction value)

2.2 We do not collect or share
payment card details of the Beneficiary should these be added to the
transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f))
  
  To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c))
  
  Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record, process and confirm transactions
• To report purchase details to the Voucher Purchaser
  as per the Term and Conditions
• To monitor fraud or misuse

All processing aligns with UK GDPR
principles of lawfulness, fairness, transparency, accuracy, purpose limitation, minimisation, and security. [gov.uk]

5. Who We Share Data With

• C Supplies Ltd (Voucher Issuer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

      
We do not sell personal data to third parties.

6. Data Retention

6.1 Personal data is retained only
for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after
purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights
under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the
contact details below.

7.3 We apply reasonable security
controls to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask
questions:

Data Protection Officer (DPO)

customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints
with the Information Commissioner’s Office (ICO).

Data Sharing Agreement One

Data Sharing Agreement (DSA) between Own Comforts and C
Supplies Ltd.

Purpose: To set out the information shared between the parties in
connection with the Own Comforts E-Voucher solution, including its sale by C
Supplies Ltd and its redemption on the Own Comforts website.

1. Definitions

1.1 “C Supplies Ltd” – The entity issuing and selling
the E-Voucher Solution.

1.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd
where the voucher is redeemed.

1.3 “Voucher Purchaser” – A charity or business purchasing the Own
Comforts E-Voucher for a Beneficiary to utilise.

1.4 “Beneficiary” – The individual who receives and uses the Own
Comforts E-Voucher.

2. Parties

2.1 This Data Sharing Agreement (“Agreement”) is entered
into between:

• C Supplies Ltd (E-Voucher Issuer & Controller)
• Own Comforts (E-Voucher Redeemer &
  Controller)

2.2 Both parties act as independent Data Controllers in accordance with UK GDPR Article 4.7, determining their own purposes and means of processing. 

3. Purpose of Data Sharing

3.1 Own Comforts will share with C
Supplies Ltd the following Beneficiary personal data:

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher
  on the Own Comforts website (Item Categories, Item Descriptions and
  Purchase Value)

3.2 This data sharing is undertaken
for the following legitimate purposes:

• Verification of voucher redemption
• Prevention and detection of fraud or misuse
• Audit reporting for internal control
• Monitoring use of funds where vouchers are issued on
  behalf of the Voucher Purchaser – to ensure use for intended purpose.

3.3 Parties must identify and document a lawful basis
before sharing personal data, in line with ICO guidance.

4. Categories of Personal Data Shared

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher
  on the Own Comforts website (Item Categories, Item Descriptions and
  Purchase Value)

4.1 Data sharing must follow the GDPR principles of
adequacy, relevance, and data minimisation. Records of what data is requested
shall be kept by C Supplies Ltd.

5. Roles and Responsibilities

5.1 Transparency

Own Comforts must clearly inform
Beneficiaries that their name and purchase history will be shared with C
Supplies Ltd and the Voucher Purchaser.

5.2 Security

Both parties must implement appropriate
technical and organisational measures to protect personal data (GDPR Article
32).

Each organisation must:

• Protect data using encryption or access controls
• Limit access to necessary personnel
• Monitor for unauthorised access

This satisfies the GDPR requirement for
appropriate technical and organisational measures.

5.3 Data Subject Rights

Each party is responsible for handling
requests under Articles 12–21 of the UK GDPR, including rights of access,
rectification, erasure, and objection. All three parties must manage data
subject rights requests related to their own processing.

5.4 Record Keeping & Accountability

Each party will maintain internal
documentation demonstrating compliance, in line with ICO Data Sharing Code of Practice recommendations.

5.5 Own Comforts will:

    
Collect purchase data and share with C Supplies Ltd and the Voucher Purchaser upon request of the Voucher Purchaser.

      
Inform Beneficiaries of this sharing in a compliant
privacy notice, meeting GDPR transparency requirements.

     
Secure the data using measures appropriate for personal data.

5.6 C Supplies Ltd will:

    
Receive and process data for fraud prevention, audit
trails, and reporting.

Respond to Beneficiary rights requests related to its own processing.

6. Lawful Basis & Data Protection Principles

6.1 All processing must comply with
the UK GDPR principles:

• Lawfulness, fairness, transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

These principles are mandated under UK
GDPR and the Data Protection Act 2018.

7. Data Retention

7.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

8. Incident Reporting

8.1 Both parties must notify each other without undue delay of any personal data breach as required under GDPR Articles 33–34.

9. Accountability & Documentation

9.1 Each party must maintain written
records documenting:

• Lawful basis
• DPIA outcomes (if required)
• Decisions to share data

This follows ICO’s Data Sharing Code of
Practice. 

10. Term & Termination

10.1 This Agreement remains in effect
while the E-Voucher Solution operates or until terminated by either party with
30 days’ written notice.

10.2 Personal data must be deleted or
anonymised after business need expires.

11. Governing Law

This Agreement is governed by the laws of the United Kingdom.

Data Sharing Agreement Two

1. Data Sharing Agreement (DSA) between Own Comforts, C
Supplies Ltd and the Gift Purchaser.

Purpose: To set out the information shared between the parties in
connection with the Own Comforts E-Voucher solution, including its purchase by the Voucher Purchaser, sale by C Supplies Ltd and its redemption on the Own Comforts website.

1. Definitions

1.1 “C Supplies Ltd” – The entity issuing and selling
the E-Voucher Solution.

1.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd
where the voucher is redeemed.

1.3 “Voucher Purchaser” – A charity or business purchasing the Own
Comforts E-Voucher for a Beneficiary to utilise.

1.4 “Beneficiary” – The individual who receives and uses the Own
Comforts E-Voucher.

2. Parties

2.1 This Data Sharing Agreement
(“Agreement”) is entered into between:

• C Supplies Ltd (E-Voucher Issuer & Controller)
• Own Comforts (E-Voucher Redeemer & Controller)
• Voucher Purchaser (E-Voucher Purchaser and advisor of Beneficiary details for distribution. Providing voucher to the Beneficiary - Controller)

2.2 Both parties act as independent Data Controllers in accordance with UK GDPR Article 4.7, determining their own purposes and means of processing.

2.3 Note for all parties: The Voucher Purchaser will introduce the Beneficiary to Own Comforts and C Supplies Ltd, by providing C Supplies Ltd the Name and Email Address of the Beneficiary when purchasing the E-Voucher Solution. C Supplies Ltd will process the E-Voucher purchase and ensure that it is sent via email to the Beneficiary for use on the Own Comforts Website.

3. Purpose of Data Sharing

3.1 Own Comforts will share with C
Supplies Ltd the following Beneficiary personal data:

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

3.2 This data sharing is undertaken
for the following legitimate purposes:

• Verification of voucher redemption
• Prevention and detection of fraud or misuse
• Audit reporting for internal control
• Monitoring use of funds where vouchers are issued on behalf of the Voucher Purchaser – to ensure use for intended purpose.

3.3 Parties must identify and document a lawful basis
before sharing personal data, in line with ICO guidance.

4. Categories of Personal Data Shared

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

4.1 Data sharing must follow the GDPR principles of adequacy, relevance, and data minimisation. Records of what is requested shall be kept by C Supplies Ltd.  

5. Roles and Responsibilities

5.1 Transparency

Own Comforts must clearly inform
Beneficiaries that their name and purchase history will be shared with C
Supplies Ltd and the Voucher Purchaser.

5.2 Security

Both parties must implement appropriate
technical and organisational measures to protect personal data (GDPR Article
32).

Each organisation must:

• Protect data using encryption or access controls
• Limit access to necessary personnel
• Monitor for unauthorised access

This satisfies the GDPR requirement for
appropriate technical and organisational measures.

5.3 Data Subject Rights

Each party is responsible for handling
requests under Articles 12–21 of the UK GDPR, including rights of access,
rectification, erasure, and objection. All three parties must manage data
subject rights requests related to their own processing.

5.4 Record Keeping &
Accountability

Each party will maintain internal
documentation demonstrating compliance, in line with ICO Data Sharing Code of
Practice recommendations.

5.5 Own Comforts will:    
Collect purchase data and share it with C Supplies Ltd and
the Voucher Purchaser upon request of the Voucher Purchaser.

Inform Beneficiaries of this sharing in a compliant privacy notice, meeting GDPR transparency requirements.

Secure the data using measures appropriate for personal
data.

5.6 C Supplies Ltd will:

Receive and process data for fraud prevention, audit trails, and reporting.

      
Respond to Beneficiary rights requests related to its own processing.

5.7 The Voucher Purchaser will:

       
Supply Beneficiary Data and cover the cost of the
E-Voucher value in full.

      
Use data solely for validating appropriate use of
charitable or grant resources.

      
Maintain governance evidence for charity audits.

      
Comply with UK GDPR controller obligations.

6. Lawful Basis & Data Protection Principles

6.1 All processing must comply with
the UK GDPR principles:

• Lawfulness, fairness, transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

These principles are mandated under UK
GDPR and the Data Protection Act 2018. [gov.uk]

7. Data Retention

7.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

8. Incident Reporting

8.1 Both parties must notify each other without undue delay of any personal data breach as required under GDPR Articles 33–34.

9. Accountability & Documentation

9.1 Each party must maintain written
records documenting:

• Lawful basis
• DPIA outcomes (if required)
• Decisions to share data

This follows ICO’s Data Sharing Code of
Practice.

10. Term & Termination

10.1 This Agreement remains in effect
while the E-Voucher Solution operates or until terminated by either party with
30 days’ written notice.

10.2 Personal data must be deleted or
anonymised after business need expires.

11. Governing Law

This Agreement is governed by the laws of the United Kingdom.