Privacy Policy
This policy is effective from September 2025
1. B&M Group Customer Privacy Notice.
1.1. B&M Group (B&M UK, Heron Foods, and B&M France) are committed to protecting the privacy and security of your personal information.
1.2. This privacy notice describes how we collect and use personal information about customers in accordance with data protection law including the General Data Protection Regulation 2016 (GDPR) and Data Protection Act 2018 (DPA).
1.3. EV Retail Limited is a “data controller” for the B&M Group. This means that it is responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
1.4. It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
1.5. We may update this notice from time to time so it’s important that you should periodically check the webpage to ensure that you are aware of any changes.
2. The kind of information we hold about you.
2.1. Personal information means any information about an individual from which that person can be identified directly or indirectly. It can be placed into special categories of more sensitive data which require a higher level of protection.
What personal information do we hold about you?
Table 1:
1. Your name and title.
2. Date of birth or birthday.
3. Contact details which may include your:
Email address,
Home address,
Shipping address,
Phone numbers.
4. Preferences and interests, such as department favourites and gender (for the registered App users).
5. Marketing and communication preferences.
6. Your comments, views, and opinions.
7. Purchase history.
8. Product returns history.
9. Payment information, such as card details and billing address.
10. CCTV recording if you visit one of our stores.
11. Call recording should you speak to our customer services team.
12. Your Internet protocol address and details of your browsing activity during visits to our website (IP addresses are anonymised) including traffic and locations data (see Cookies Policy for more information. Location data is collected via the App, but only with your consent)
3. Examples of “special categories” of more sensitive personal information include:
Table 2:
1. Incident reports if you have an accident in one of our stores.
2. Information to defend any claim brought against us, this may include medical data.
3. Records of criminal activity in our stores and online fraud.
4. How is your Personal Information collected?
4.1. We collect and personal information that you give to us when you use bmstores.co.uk or heronfoods.com (“the website”), the B&M App (“the App”), when you visit one of our stores or contact our customer services team.
5. How we use your information?
5.1. We will only use your personal information when the law allows us to. We will generally use your personal information in the following circumstances:
Table 3:
1. When we need to perform the contract, we have entered into with you, for example when you purchase something from us.
2. Where you have consented to processing, for example to receive marketing.
3. Where we need to comply with a legal obligation, for example for accounting records.
4. Where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests. This could include the use of CCTV and keeping customer services records.
5. To protect your interests, for example if you had an accident in one of our stores.
5.2. The situations in which we will process your personal information are listed below.
Table 4:
1. Where it is in our legitimate interest to do so or you have given your consent to send promotions aboutnew products and latest offers by email, the App, SMS, phone, or post.
2. To contact you for market research purposes via email, the App, text, phone, or post where it is in our legitimate interest to do so.
3. Manage and respond to customer service enquiries.
4. Where necessary, resolve customer services queries by passing information to relevant third parties and between B&M departments.
5. To manage your online account and process your order.
6. Post prizes that have been won when entering competitions.
7. To send you a birthday greeting.
8. Take payment for items you have ordered and refund you when things go wrong.
9. To deliver items you have ordered from us including sending you order and delivery update messages by SMS and email.
10. To respond to your complaints or concerns.
11. To support considerations of Health & Safety.
12. Loss prevention including monitoring the use of our website for suspicious and fraudulent activity.
13. Review website and App traffic and usage to improve and develop our website, App and our products and services.
14. Notify you about changes to our website, App, products, or services and your account from time to time.
15. Carry out anonymous analysis of data on user visits, browsing patterns, trends, and preferences, for our market research purposes and to track and measure the impact, results or pattern of website traffic and preferences from other promotional and marketing activities of B&M.
16. Comply with any applicable law, legal process or enforcement by any regulatory body which is binding on B&M.
5.3. If you fail to provide some or all personal information when requested, we may not be able to perform the contract we have entered into with you (such as delivering a product you have ordered from us or issuing a refund).
6. Transactional monitoring and cookies.
6.1. We use cookies and similar technologies to enhance your browsing experience and collect information about your usage of our services.
6.2. You can manage your cookie preferences through your browser settings, or by using the cookie tool on our websites.
6.3. See Appendix 1.
7. Links to our websites.
7.1. Our websites and App may contain links to other websites or Apps of third parties.
7.2. We do not have any control over websites or Apps of third parties. Their own privacy policies will apply in relation to your personal information. You should always check the privacy notice of third-party websites and Apps before using them.
8. Social Media.
8.1. When you use our websites or App or those of trusted providers, you may be able to share information through social media networks such as Facebook and twitter, for example through “Likes” or reviews. When doing this your data may be visible to providers of social network services and their users, as well as B&M Group. We recommend that you consider the privacy settings on your social media accounts so that you are aware of how your information is processed and used.
9. Change of Purpose.
9.1. If we need to use your personal information for a different reason or an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
10. Disclosure of your data to third parties and data processors.
10.1. We do not sell, rent, loan, trade or otherwise disclose your personal information, except as described in this policy.
10.2. EV Retail may disclose your information with trusted third-party business partners so that we can provide you with the service you requested.
10.3. We may disclose your information to data processors who provide direct marketing, advertising, and market research services to us to help improve our services to customers and users of our website and App.
10.4. Third parties are not permitted by EV Retail to contact you for marketing purposes unless you have given your consent.
10.5. It may be necessary to disclose your personal information with a third party when we are required or permitted to do so by law and if the business is part of the business is sold or integrated.
11. Facial Recognition ( Facewatch)
11.1. Facewatch facial recognition is used within our premises for the lawful purpose of prevention and detection of unlawful acts including theft and violence against our colleagues and customers.
11.2. We supply incident details and CCTV images of people responsible for unlawful acts within our premises to Facewatch; and receive alerts from Facewatch if a person entering our premises is known by Facewatch to be responsible for committing an unlawful act in our premises or elsewhere.
11.3. Our lawful basis for the processing of personal data in this way is that the processing is necessary for a task carried out in the public interest, namely the prevention and detection of crime.
11.4. Our lawful basis for the processing of criminal offences committed within our premises in this way is that the processing is necessary for a task carried out in the substantial public interest, namely the prevention and detection of crime.
11.5. Facewatch is the data controller responsible for the processing of personal data by way of facial recognition.
11.6. We display clear signage in all stores where Facewatch is used, this signage details how to obtain the Facewatch privacy notice and how Facewatch can be contacted.
11.7. The Facewatch privacy notice can be found at facewatch.co.uk/privacy and explains rights under UK GDPR. To contact Facewatch DPO please contact DPO@facewatch.co.uk
12. Data Security
12.1. We have security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.
13. How long will you use my information for?
13.1. We will only retain your personal information for as long as necessary.
13.2. We may anonymise your personal information so that it can no longer be associated with you. We generally retain your data for no more than 6 years following our last contact with you.
14. Your rights, in relation to personal data.
Table 5:
1. Right to be informed
2. You have the right to be informed about the collection and use of your personal data. This is communicated via this “Privacy Notice”.
3. Right to access
4. You have the right to access and receive a copy of your personal data, and other supplementary information. This is known as a “data subject access request”.
5. Right to rectification
6.You have the right to have inaccurate personal data rectified or completed if it is incomplete.
7. Right to erasure
8. You have the right to have personal data erased unless it can be demonstrated that there is an overriding need to retain the data.
9. Right to restrict processing
10. You have the right to restrict or suppression of your personal data.This is not an absolute right and only applies in certain circumstances.
11. Right to data portability
12. This allows you to obtain and reuse your personal data for your own purposes across different services. Moving from one IT environment to another in a safe and secure way, without affecting its usability. The right only applies to information an individual has provided to a controller.
13. Right to object
14. You have the right to object to the processing of your personal data in certain circumstances.
15. Rights related to automated decision-making including profiling
16. You should receive information about the processing of personal decision-making including profiling data. Be able to obtain human intervention, express your point of view, obtain an explanation on the decision and be able to challenge it.
14.1. You will not have to pay a fee to access your personal information unless your request is clearly unfounded or excessive. We may also refuse to comply with the request in such circumstances.
14.2. We may need to request specific information from you to help us confirm your identity.
15. Right to withdraw consent
15.1. To withdraw your consent (for example if you no longer wish to receive marketing) please contact the relevant customer service team.
15.2. How to contact us:
Table 6:
Customer Services
B&M Retail Limited
The Qube
Dakota Drive
Estuary Commerce Park
Speke
Liverpool
L24 8RJ.
customerservices@bmstores.co.uk
Customer Services
B&M France
SAS B&M
8 r Bois Joli, 63800
Cournon d’Auvergne
France
customerservices@bmstores.fr
Customer Services
Heron Foods Limited
Jackson Way
Melton
East Yorkshire
HU14 3HJ
info@heronfoods.com
16. You can make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Appendix 1 – Cookie Policy
What Are Cookies?
When you visit our website, we use Cookies, which are small pieces of information that allows us to maintain your connection to our website.
Cookies are used to log traffic in various ways, which include identifying which pages are being used, what you have viewed, time spent browsing and remembering your preferences. This helps us to analyse data about web traffic to improve your experience on the website.
The websites use Cookies for detecting what kind of device you have in order to present content in the best way, for a language switch and/or for other purposes.
Cookies do not contain personal information about you.
Each Group website highlights which Cookies that they use.
There are different types of Cookies, which may include:
Session Cookies: These are temporary cookies that expire when you close your browser.
Persistent Cookies: These remain on your device for a set period or until you delete them.
First-Party Cookies: These are set by the website you are visiting.
Third-Party Cookies: These are set by a domain other than the one you are visiting, often for marketing or analytics purposes.
How We Use Cookies
We use cookies for the following purposes:
Necessary Cookies
These cookies are essential to enable you to navigate the Website and use its features. Without these cookies, certain services you have requested cannot be provided.
Performance and Analytics Cookies
These cookies collect information about how visitors use our website, such as which pages are most frequently visited, and whether they receive error messages. We use this information to improve the functionality and performance of our website.
Functionality Cookies
These cookies allow our website to remember the choices you make, such as your username, language, or region, and provide enhanced, more personalised features.
Targeting and Advertising Cookies
These cookies track your browsing habits across websites to deliver relevant advertisements. They help ensure that the ads you see are more relevant to you and your interests.
Third-Party Cookies
We may allow third-party service providers, such as analytics providers and advertising partners, to use cookies on our website.
These third parties may use the information collected by these cookies to deliver targeted advertisements on other websites.
Some of the third-party services we use include:
Google Analytics: This service helps us analyse website traffic and user behaviour. For more information, please review the official Google Analytics page.
Managing Cookies
You can control and manage cookies in several ways. Please note that removing or blocking cookies may impact your user experience and some features of the Website may no longer be fully accessible.
Most web browsers allow you to manage cookies through the browser settings.
You can configure your browser to:
Accept all cookies.
Block all cookies.
Clear cookies when you close the browser.
For more information on managing cookies, you can visit aboutcookies.org.
Cookie Consent
When you first visit our website, you will be asked to consent to the use of cookies in accordance with this Cookies Policy. You can withdraw or modify your consent at any time by adjusting your browser settings or visiting our cookie management page.
Changes to this Cookies Policy
We may update this Cookies Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this page periodically for the latest information on our use of cookies.
Cookie lists are found on each company website.
Download Privacy Policy
Don't have Adobe PDF Reader?
Download here for free.
