Data Subjects Rights Policy
Last updated: February, 2021
We value the privacy rights and therefore designed this Data Subjects Rights Policy (“Privacy Rights Policy” or “Policy”) as an overview of individuals rights under the EU General Data Protection Regulation (“GDPR”); and the California Consumer Privacy Act of 2018 (“CCPA“).
Please note that any Data Subject Requests submitted to us shall be processed by us in our capacity as a “Data Controller”. Please note that if you are an End-User (i.e., a user browsing our Customer’s website in which our cookie is placed) the “Data Controller” is the Customer (i.e., the retailer website you visited). In this case, we will refer you to the relevant Customer and act in accordance with the Customer’s instructions as required by law.
ACCESS TO SPECIFIC INFORMATION AND DATA PORTABILITY RIGHTS
You have a right to request us to confirm whether we process certain Personal Data related to you, as well as a right to obtain a copy of such Personal Data, with additional information regarding how and why we use this Personal Data. The GDPR and CCPA provide different protections for this right. The GDPR enables access to all Personal Data processed by the controller, however the CCPA “Access Right” applies only to Personal Information collected in the 12 months prior to the request. After we receive such request, we will analyze and determine the veracity and appropriateness of the access request and provide you with the applicable confirmation of processing, the copy of the Personal Data or a description of the Personal Data and categories of data processed, the purpose for which such data is being held and processed, and details about the source of the Personal Data that was not provided by you. Our response detailed above will be provided within the period required by law (please see additional information under the “Response Timing and Format” section below).
DELETION REQUEST RIGHTS
Depending on your jurisdiction, the Company is legally obligated to comply with a request to delete Personal Data if:
The right to erasure is not absolute. Even if a data subject falls into one of the categories described above, the Company is entitled to reject the data subject’s request and continue processing the Personal Data, subject to applicable law, if such processing is:
RIGHT TO OBJECT / RIGHT TO OPT OUT
Under the lawful basis of our legitimate interests and with regards to Personal Data processed by us (such as direct marketing), you may object to our processing on such grounds. However, even if we receive your objection, we will be permitted to continue processing the Personal Data in the event that (subject to applicable laws and regulations):
YOUR RIGHT TO BE INFORMED
THE RIGHT OF RECTIFICATION
The Company must ensure that all Personal Data that it holds and uses about a data subject is correct. If such data is not accurate, a data subject has the right to require that the Company updates such data so it will be accurate. In addition, if the Company has passed on incorrect information about a data subject to a third party, the data subject also has a right to oblige the Company to inform those third parties that this information should be updated.
THE RIGHT OF RESTRICTION
A data subject may limit the purposes for which the Company may process its Personal Data. The Company’s processing activities may be restricted if: the accuracy of the data is contested; the processing of the Personal Data is unlawful and the data subject requests restriction instead of erasure; the Company no longer needs the data for its original purpose, but the data is still required to establish, exercise or defend legal rights; or in consideration of overriding grounds in the context of an erasure request.
You may request us to send or “port” your Personal Data held by us to a third-party entity, however it is important to note, that the GDPR and the CCPA apply differently to this right, thus, we will handle this according to applicable laws in your jurisdiction.
Under the CCPA, you must not be discriminated against for exercising any of your rights, including by being denied goods or services, charging you different fees for goods or services, including through the use of discounts or other benefits or imposing penalties or by it being suggested to you that you will receive a different price or rate for goods or services.
Notwithstanding the above, it is permitted to set up schemes for providing financial incentives and you can opt-in to become part of them.
RESPONSE TIMING AND FORMAT
We aim to respond to a verifiable consumer request without undue delay. If we require more time, we will inform you of the reason and length of the extension period in writing. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Data that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.
Further, please note that under the CCPA your rights only apply to the Personal Information collected 12 months prior to your request to exercise them and you are not entitled to submit more than 2 requests in a 12 month period.
This Policy solely applies to your rights concerning your Personal Data / Personal Information (as defined under the applicable law in your jurisdiction) that is processed by us.
PLEASE SUBMIT A REQUEST BY EITHER: