1. General

1.1 The following Terms and Conditions outline the use of the Own Comforts E Voucher Solution.

2. Definitions

2.1 “C Supplies Ltd” – The entity issuing and selling the E-Voucher Solution.

2.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd where the E-Voucher is redeemed.

2.3 “Voucher Purchaser” – A charity or business purchasing the Own Comforts E-Voucher for a Beneficiary to utilise.

2.4 “Beneficiary” – The individual who receives and uses the Own Comforts E-Voucher.

2.5 “Personal Data” – Any information that identifies or can identify a living individual, as defined under the UK GDPR and the Data Protection Act 2018. [gov.uk]

3. Acceptance of Terms

3.1 The purchase of the E-Voucher automatically constitutes acceptance of these Terms & Conditions by the Voucher Purchaser.

3.2 The use of the E-Voucher automatically constitutes acceptance of these Terms & Conditions by the Beneficiary.

4. Purpose and Use of the E-Voucher

4.1 The E-Voucher may only be redeemed at Own Comforts: www.owncomforts.co.uk.

4.2 It cannot be exchanged for cash.

4.3 No change is issued for unused balances.

4.4 The Own Comforts E-Voucher must be redeemed within 1 year of the date it is sent to the Beneficiary.

4.5 The Own Comforts E-Voucher cannot be exchanged for any other store once purchased.

4.6 Proof of identity may be required for fraud prevention.

5. Data Sharing and GDPR Compliance

5.1 Lawful Basis for Processing

Organisations must identify a lawful basis before sharing personal data. Therefore, Own Comforts will process and share the Beneficiary name and purchase data with C Supplies Ltd and the Voucher Purchaser under the lawful basis of legitimate interests (Article 6(1)(f) UK GDPR) under a Tri-Party Data Sharing Agreement— specifically:

• Ensuring proper use of charitable and gifted funds
• Preventing fraud or misuse
• Providing transparency for the Voucher Purchaser

5.2. What Data May Be Shared

Own Comforts may share with C Supplies Ltd and the Voucher Purchaser the following details relating to purchases made with the Own Comforts E-Voucher only:

• Item descriptions
• Item categories
• E-Voucher Code
• Value of items purchased with the E-Voucher
• The name of the beneficiary associated with any or all the purchase information outlined above.

Only data necessary for the stated purposes will be shared, following the GDPR requirement of data minimisation.

5.3 Payment Information and Limits on Data Sharing

Payment details relating to the purchase of the E‑Voucher are already known to all relevant parties: the Voucher Purchaser has paid for the Own Comforts E‑Voucher; C Supplies Ltd (as operator of the Own Comforts platform) has processed that payment; and the Beneficiary who subsequently uses the E‑Voucher to complete their purchase. No additional payment information from the Beneficiary will be shared with the Voucher Purchaser beyond what is necessary to redeem the E‑Voucher itself.

Any purchases made by the Beneficiary on the Own Comforts website that are not paid for using the E‑ Voucher provided by the Voucher Purchaser, will not be shared with the Voucher Purchaser. Such independently funded transactions remain private between the Beneficiary and Own Comforts and are processed in accordance with the standard Own Comforts Privacy Notice.

5.4 Transparency Requirements

Beneficiaries must be informed of how their data will be processed, which aligns with GDPR requirements for transparency and “the right to be informed.”

A Privacy Notice accompanies these Terms & Conditions.

5.4 Data Retention

Personal data will be retained only as long as necessary to fulfil the reporting obligations of the Voucher Purchaser and to prevent fraud, in compliance with GDPR principles.

5.5 Security

C Supplies Ltd and Own Comforts will ensure appropriate technical and organisational measures to secure personal data, as required under the GDPR. [gov.uk]

5.6 Data Subject Rights

Beneficiaries have the following rights under the UK GDPR:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (where applicable)
• Right to restrict processing
• Right to object

These rights are outlined under GDPR Articles 12–21.

Requests may be made to C Supplies Ltd using the contact details in the Privacy Notice and will be discussed with the Voucher Purchaser.

5.7 Data Sharing Agreements

Where required, C Supplies Ltd and Own Comforts maintain appropriate data sharing agreements consistent with ICO’s Data Sharing Code of Practice. A Tri Party Data Sharing Agreement between Own Comforts, C Supplies Ltd and the Voucher Purchaser also applies in all cases of data sharing.

6. Fraud Prevention

6.1 C Supplies Ltd and Own Comforts may refuse or cancel vouchers suspected of misuse and will notify the Voucher Purchaser.

7. Changes to Terms

7.1 C Supplies Ltd reserves the right to update these Terms. Updates will be posted on C Supplies Ltd official website.

8. Governing Law

8.1 These Terms are governed by the laws of the United Kingdom.

This Privacy Notice explains how C Supplies Ltd and Own Comforts collect, use, and share personal data related to the Own Comforts E-Voucher.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the E Voucher – C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of the E-Voucher – Own Comforts accepts the E-Voucher and fulfils the transaction.

1.3 Under the UK GDPR, both act as independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (categories, items purchased,
  transaction value)

2.2 We do not collect or share payment card details of the Beneficiary should these be added to the transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f)). To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c)). Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record, process and confirm transactions
• To report purchase details to the Voucher Purchaser
  as per the Term and Conditions
• To monitor fraud or misuse

All processing aligns with UK GDPR principles of lawfulness, fairness, transparency, accuracy, purpose, limitation, minimisation, and security. [gov.uk]

5. Who We Share Data With

• C Supplies Ltd (Voucher Issuer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

We do not sell personal data to third parties.

6. Data Retention

6.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the contact details below.

7.3 We apply reasonable security controls to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask questions:

Data Protection Officer (DPO)

customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints with the Information Commissioner’s Office (ICO).

This Privacy Notice explains how C Supplies Ltd and Own Comforts collect, use, and share personal data related to the Own Comforts E-Voucher Solution.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the E-Voucher – C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of the E-Voucher – Own Comforts accepts the E-Voucher and fulfils the transaction.

1.3 Under the UK GDPR, both act as independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (item categories, items purchased, transaction value)

2.2 We do not collect or share payment card details of the Beneficiary should these be added to the transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f)). To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c)). Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record and confirm transactions
• To report purchase details to the Voucher Purchaser
• To monitor fraud or misuse

All processing aligns with UK GDPR principles of lawfulness, fairness, transparency, accuracy, purpose, limitation, minimisation, and security. [gov.uk]

5. Who We Share Data With

• Own Comforts (Voucher Redeemer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

   
We do not sell personal data to third parties

6. Data Retention

6.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the contact details below.

7.3 We apply reasonable security controls to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask questions:

Data Protection Officer (DPO)

customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints with the Information Commissioner’s Office (ICO).

This Privacy Notice explains how C Supplies Ltd and Own Comforts collect, use, and share personal data related to the Own Comforts E-Voucher.

1. Data Controllers

1.1 C Supplies Ltd – issuer of the E-Voucher – C Supplies Ltd sells the Own Comforts E-Voucher.

1.2 Own Comforts – redeemer of the E-Voucher – Own Comforts accepts the E- Voucher and fulfils the transaction.

1.3 Under the UK GDPR, both act as independent data controllers for their respective processing activities.

2. Personal Data We Process

2.1 We may collect and process:

• Beneficiary name (where applicable)
• Voucher identification code
• Purchase item details (categories, items purchased, transaction value)

2.2 We do not collect or share payment card details of the Beneficiary should these be added to the transaction alongside the E-Voucher.

3. Legal Bases for Processing

3.1 We rely on:

• Legitimate Interests (UK GDPR Article 6(1)(f)). To allow the Voucher Purchaser to verify voucher usage and prevent misuse.
  
• Legal Obligations (Article 6(1)(c)). Where retention or reporting is required (e.g., fraud investigations).

4. How We Use Personal Data

• To redeem the E-Voucher
• To record, process and confirm transactions
• To report purchase details to the Voucher Purchaser as per the Term and Conditions
• To monitor fraud or misuse

All processing aligns with UK GDPR principles of lawfulness, fairness, transparency, accuracy, purpose, limitation, minimisation, and security. [gov.uk]

5. Who We Share Data With

• C Supplies Ltd (Voucher Issuer)
• Voucher Purchaser that funded the voucher
• Regulators or authorities, where legally required.

      
We do not sell personal data to third parties.

6. Data Retention

6.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

7. Your Rights

7.1 Beneficiaries may exercise rights under the UK GDPR, including:

• Access (Article 15)
• Rectification (Article 16)
• Erasure (Article 17)
• Restriction (Article 18)
• Portability (Article 20)
• Objection (Article 21)

7.2 Requests can be made via the contact details below.

7.3 We apply reasonable security controls to protect personal data, in accordance with UK GDPR requirements.

7.4 To exercise data rights or ask
questions:

Data Protection Officer (DPO)
customer.service@csupplies.co.uk

Unit N1, Riverside Industrial Estate, Bridge Road, Littlehampton, BN17 5DF

Beneficiaries may also lodge complaints with the Information Commissioner’s Office (ICO).

Data Sharing Agreement One

Data Sharing Agreement (DSA) between Own Comforts and C Supplies Ltd.

Purpose: To set out the information shared between the parties in connection with the Own Comforts E-Voucher solution, including its sale by C Supplies Ltd and its redemption on the Own Comforts website.

1. Definitions

1.1 “C Supplies Ltd” – The entity issuing and selling the E-Voucher Solution.

1.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd where the voucher is redeemed.

1.3 “Voucher Purchaser” – A charity or business purchasing the Own Comforts E-Voucher for a Beneficiary to utilise.

1.4 “Beneficiary” – The individual who receives and uses the Own Comforts E-Voucher.

2. Parties

2.1 This Data Sharing Agreement (“Agreement”) is entered into between:

• C Supplies Ltd (E-Voucher Issuer & Controller)
• Own Comforts (E-Voucher Redeemer & Controller)

2.2 Both parties act as independent Data Controllers in accordance with UK GDPR Article 4.7, determining their own purposes and means of processing. 

3. Purpose of Data Sharing

3.1 Own Comforts will share with C Supplies Ltd the following Beneficiary personal data:

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

3.2 This data sharing is undertaken for the following legitimate purposes:

• Verification of voucher redemption
• Prevention and detection of fraud or misuse
• Audit reporting for internal control
• Monitoring use of funds where vouchers are issued on behalf of the Voucher Purchaser – to ensure use for intended purpose.

3.3 Parties must identify and document a lawful basis before sharing personal data, in line with ICO guidance.

4. Categories of Personal Data Shared

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

4.1 Data sharing must follow the GDPR principles of adequacy, relevance, and data minimisation. Records of what data is requested shall be kept by C Supplies Ltd.

5. Roles and Responsibilities

5.1 Transparency

Own Comforts must clearly inform Beneficiaries that their name and purchase history will be shared with C Supplies Ltd and the Voucher Purchaser.

5.2 Security

Both parties must implement appropriate technical and organisational measures to protect personal data (GDPR Article 32).

Each organisation must:

• Protect data using encryption or access controls
• Limit access to necessary personnel
• Monitor for unauthorised access

This satisfies the GDPR requirement for appropriate technical and organisational measures.

5.3 Data Subject Rights

Each party is responsible for handling requests under Articles 12–21 of the UK GDPR, including rights of access, rectification, erasure, and objection. All three parties must manage data subject rights requests related to their own processing.

5.4 Record Keeping & Accountability

Each party will maintain internal documentation demonstrating compliance, in line with ICO Data Sharing Code of Practice recommendations.

5.5 Own Comforts will:

    
Collect purchase data and share with C Supplies Ltd and the Voucher Purchaser upon request of the Voucher Purchaser.

      
Inform Beneficiaries of this sharing in a compliant privacy notice, meeting GDPR transparency requirements.

     
Secure the data using measures appropriate for personal data.

5.6 C Supplies Ltd will:

Receive and process data for fraud prevention, audit trails, and reporting.

Respond to Beneficiary rights requests related to its own processing.

6. Lawful Basis & Data Protection Principles

6.1 All processing must comply with the UK GDPR principles:

• Lawfulness, fairness, transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

These principles are mandated under UK GDPR and the Data Protection Act 2018.

7. Data Retention

7.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

8. Incident Reporting

8.1 Both parties must notify each other without undue delay of any personal data breach as required under GDPR Articles 33–34.

9. Accountability & Documentation

9.1 Each party must maintain written records documenting:

• Lawful basis
• DPIA outcomes (if required)
• Decisions to share data

This follows ICO’s Data Sharing Code of Practice. 

10. Term & Termination

10.1 This Agreement remains in effect while the E-Voucher Solution operates or until terminated by either party with 30 days’ written notice.

10.2 Personal data must be deleted or anonymised after business need expires.

11. Governing Law

This Agreement is governed by the laws of the United Kingdom.

Data Sharing Agreement Two

1. Data Sharing Agreement (DSA) between Own Comforts, C Supplies Ltd and the Gift Purchaser.

Purpose: To set out the information shared between the parties in connection with the Own Comforts E-Voucher solution, including its purchase by the Voucher Purchaser, sale by C Supplies Ltd and its redemption on the Own Comforts website.

1. Definitions

1.1 “C Supplies Ltd” – The entity issuing and selling the E-Voucher Solution.

1.2 “Own Comforts” – The entity owned and operated by C Supplies Ltd where the voucher is redeemed.

1.3 “Voucher Purchaser” – A charity or business purchasing the Own Comforts E-Voucher for a Beneficiary to utilise.

1.4 “Beneficiary” – The individual who receives and uses the Own Comforts E-Voucher.

2. Parties

2.1 This Data Sharing Agreement (“Agreement”) is entered into between:

• C Supplies Ltd (E-Voucher Issuer & Controller)
• Own Comforts (E-Voucher Redeemer & Controller)
• Voucher Purchaser (E-Voucher Purchaser and advisor of Beneficiary details for distribution. Providing voucher to the Beneficiary - Controller)

2.2 Both parties act as independent Data Controllers in accordance with UK GDPR Article 4.7, determining their own purposes and means of processing.

2.3 Note for all parties: The Voucher Purchaser will introduce the Beneficiary to Own Comforts and C Supplies Ltd, by providing C Supplies Ltd the Name and Email Address of the Beneficiary when purchasing the E-Voucher Solution. C Supplies Ltd will process the E-Voucher purchase and ensure that it is sent via email to the Beneficiary for use on the Own Comforts Website.

3. Purpose of Data Sharing

3.1 Own Comforts will share with C Supplies Ltd the following Beneficiary personal data:

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

3.2 This data sharing is undertaken for the following legitimate purposes:

• Verification of voucher redemption
• Prevention and detection of fraud or misuse
• Audit reporting for internal control
• Monitoring use of funds where vouchers are issued on behalf of the Voucher Purchaser – to ensure use for intended purpose.

3.3 Parties must identify and document a lawful basis before sharing personal data, in line with ICO guidance.

4. Categories of Personal Data Shared

• Beneficiary Name
• E-Voucher Code
• Purchase History of items bought using the E‑Voucher on the Own Comforts website (Item Categories, Item Descriptions and Purchase Value)

4.1 Data sharing must follow the GDPR principles of adequacy, relevance, and data minimisation. Records of what is requested shall be kept by C Supplies Ltd.  

5. Roles and Responsibilities

5.1 Transparency

Own Comforts must clearly inform Beneficiaries that their name and purchase history will be shared with C Supplies Ltd and the Voucher Purchaser.

5.2 Security

Both parties must implement appropriate technical and organisational measures to protect personal data (GDPR Article 32).

Each organisation must:

• Protect data using encryption or access controls
• Limit access to necessary personnel
• Monitor for unauthorised access

This satisfies the GDPR requirement for
appropriate technical and organisational measures.

5.3 Data Subject Rights

Each party is responsible for handling requests under Articles 12–21 of the UK GDPR, including rights of access, rectification, erasure, and objection. All three parties must manage data subject rights requests related to their own processing.

5.4 Record Keeping & Accountability

Each party will maintain internal documentation demonstrating compliance, in line with ICO Data Sharing Code of Practice recommendations.

5.5 Own Comforts will:    

Collect purchase data and share it with C Supplies Ltd and the Voucher Purchaser upon request of the Voucher Purchaser.

Inform Beneficiaries of this sharing in a compliant privacy notice, meeting GDPR transparency requirements.

Secure the data using measures appropriate for personal data.

5.6 C Supplies Ltd will:

Receive and process data for fraud prevention, audit trails, and reporting.

Respond to Beneficiary rights requests related to its own processing.

5.7 The Voucher Purchaser will:

       
Supply Beneficiary Data and cover the cost of the E-Voucher value in full.

      
Use data solely for validating appropriate use of charitable or grant resources.

Maintain governance evidence for charity audits.

Comply with UK GDPR controller obligations.

6. Lawful Basis & Data Protection Principles

6.1 All processing must comply with the UK GDPR principles:

• Lawfulness, fairness, transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

These principles are mandated under UK GDPR and the Data Protection Act 2018. [gov.uk]

7. Data Retention

7.1 Personal data is retained only for as long as necessary to meet the reporting needs of the Voucher Purchaser and prevent misuse, in line with GDPR retention principles. Data may also be retained for the duration of a products standard warranty, active after purchase.

8. Incident Reporting

8.1 Both parties must notify each other without undue delay of any personal data breach as required under GDPR Articles 33–34.

9. Accountability & Documentation

9.1 Each party must maintain written records documenting:

• Lawful basis
• DPIA outcomes (if required)
• Decisions to share data

This follows ICO’s Data Sharing Code of Practice.

10. Term & Termination

10.1 This Agreement remains in effect while the E-Voucher Solution operates or until terminated by either party with 30 days’ written notice.

10.2 Personal data must be deleted or anonymised after business need expires.

11. Governing Law

This Agreement is governed by the laws of the United Kingdom.