Last update April 20th, 2020
1.4. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
1.5. Processing of personal data refers to any operation or set of operations carried out also without the use of electronic instruments, concerning the collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blockage, communication, dissemination, cancellation and destruction of data, even where not recorded in a database.
2. DATA CONTROLLER
2.1. The personal data provided or collected through the activities done by you on the Website will be processed by Optifashion LLC, with registered office in Executive Towers - Aspect Tower, Office 2902, Business Bay, Dubai (hereinafter, the “Company” or “Optifashion”), as Data Controller.
3. TYPES OF DATA PROCESSED
3.1. Data provided voluntarily by you (when creating the user profile on the Website and/or in case of purchase of products on the e-commerce platform): the personal data entered into the Website by you like the name, surname, date of birth, email address, telephone number, the address for the delivery of the purchase products, the password, the identification data of the payment methods and the data sent by you by e-mails to the addresses indicated in the Website.
3.2. Upon express consent, your email address for sending promotional massages, including the newsletter.
3.3. Upon express consent, your buying habits.
3.4. Navigation data: the hardware and software of the Website acquire some personal data which is transmitted implicitly during the use of Internet communication protocols. This information could, if processed and associated to data held by third parties, lead to your identification. This category of data includes the IP addresses used by you when connecting to the website, the time of the request, the method used in submitting the request to the server, the size of the file obtained in reply, the numerical code indicating the state of the reply given by the server (OK, error, etc.) and other parameters concerning the operating system and computer environment of yours. This data is used only for anonymous statistical information concerning the use of the website and to check the correct operation, and is cancelled immediately after processing. Data may be used to ascertain responsibility in the case of hypothetical data processing crimes to the detriment of the website. Personal data related to the geographical location may be used to provide you with information, proposals and other customized contents based on their location. If you do not want to share information related to their geographical position, you will have to disable location services on their devices.
4. PURPOSES OF THE PROCESSING
4.1. The Company processes the personal data for the following purposes:
i. to allow the creation of your profile and the delivery of email messages for the confirmation of the creation of your profile on the Website;
ii. to allow the purchase of products in the e-commerce platform of the Website and therefore also, among other things, to finalize the transaction, deliver the purchased products, to handle any requests for exchange and/or returns or to make refunds;
iii. to manage your requests: of technical or commercial nature or of others kind;
iv. to send its customers information on previously purchased products and/or similar products (so-called "soft spam");
v. to comply with legal obligations (including those of a fiscal nature) and to protect your rights;
vi. to allow the Website navigation and for computer security purposes.
The provision of your data for the abovementioned purposes is not mandatory, but the refusal to supply them will make it impossible for the Company to provide you with the products on the site and to process your requests;
vii. upon express consent of yours, for marketing purposes, for instance to send the newsletter and/or other promotional messages by e-mail or by SMS;
viii. upon express consent of yours, to collect and use the data for profiling purposes. The provision of data that the Company could deal with for marketing and profiling purposes is absolutely optional.
Failure to agree to the processing of data for these purposes or its subsequent withdrawal of consent does not prevent the ability to surf the Website and to make purchases through the same.
5. LAWFULNESS OF PROCESSING
5.1. Optifashion treats personal data based on the following grounds:
i. for the performance of a contract to which you are party or in order to take steps at the request of yours to entering into a contract, pursuant to art. 6, letter b) of the GDPR;
ii. for compliance with a legal obligation to which Optifashion is subject, pursuant to art. 6, letter c) of the GDPR;
iii. for the purposes of the legitimate interests pursued by the Company, pursuant to art. 6, letter f) of the GDPR;
iv. upon express consent of yours, pursuant to art. 6, letter a) of the GDPR, for marketing and profiling purposes.
6. PEOPLE HAVING ACCESS TO THE PERSONAL DATA AND COMMUNICATION OF DATA TO THIRD PARTIES
6.1. The personal data collected and stored in the databases of the Company will be processed by the employees and/or collaborators of the Data Controller appointed to process such data.
6.2. Your personal data may be processed also by third parties the Company may use for certain activities (e.g. to analyze data, to store data, sending newsletter or other commercial and non-commercial communications, providing marketing assistance; market analysis purposes).
6.3. Regarding the communication of personal data, the information issued may be disclosed to the following subjects or categories of subjects: (i) public administrations to complain legal obligations; (ii) holding companies, associate companies or subsidiaries of the Company; (iii) other companies or individuals contractually bounded to the Company and appointed specifically to process the personal data of yours.
6.4. Optifashion uses third parties and individuals to perform certain activities on its behalf (e.g. hosting services, delivery of the purchased goods, platform for credit card payments and other customer services). Third parties who perform these operations have been selected and are considered to have the experience, capacity and reliability to grant a fully compliance with the current provisions on data processing.
6.5. Third parties who process users’ data on behalf of the Company have been appointed “Data Processors” by the Data Controller. You may request the list of Data Processors by writing to [email protected].
7. METHODS AND PLACE OF DATA PROCESSING
7.1. The personal data is processed using automated tools for the time strictly necessary to achieve the Purpose for which it was gathered.
7.2. The Company has adopted specific security and technical measures to grant the security of data and to prevent the loss of data, unlawful or improper use and unauthorized access.
7.3. The web services of the Website will be processed on the servers of outsourced companies offering hosting services on behalf of the Company, as well as clouds.
7.4. In the event of any transfer of personal data from the European Economic Area (EEA), the United Kingdom, and Switzerland to other countries, such transfers will take place guaranteeing adequate levels of protection of transmitted data, also in accordance with the provisions of articles 45 and 46 of the GDPR.
7.5. In particular, the Company uses Cloudways, as hosting cloud service. In the event of any transfer of your personal data to other countries outside the European Union, this supplier has declared that it will take adequate measures to protect your personal data, using legal mechanisms, including contracts with EU Standard Contractual Clauses (the EU Model Clauses) to protect personal data as though it were an intra-EEA transfer.
8. WITHDRAWAL OF CONSENT
8.1. By ticking the consent flag or any other similar method of confirmation, you give his express consent to the processing of his data, and for the transfer of such data to third parties for the achievement of the purposes, in the limits laid down above.
8.2. At any time, you may object to the processing of data for marketing and profiling purposes. You may withdraw his consent to the processing of his data by sending an e-mail to [email protected].
9. DATA RETENTION PERIOD
9.1. Personal data is stored by the Company for a limited period of time necessary for the purposes of each treatment indicated above. At the end of this period, the data will be deleted or made anonymous.
9.2. Personal data processed for the fulfillment of contractual commitments, including pre-contractual activity, is stored by the Company for 10 years from the performance of the contractual service or, in the event of non-conclusion of the contract, for the time necessary to respond to your requests.
9.3. Personal data processed for accounting management and for invoicing is stored by the Company for the time necessary to fulfill the fiscal obligations and for keeping accounting records.
9.4. Personal data processed for marketing and profiling purposes is stored by the Company for a period of time not exceeding 24 months and 12 months respectively. Beyond this deadline, the Data Controller will work to obtain a new consent, and in case of non-renewal of consent, the Personal data will delete or anonymize by the Data Controller.
10. RIGHTS OF THE PARTIES CONCERNED
10.1. The parties to which the personal data refers can exercise the rights provided by the legislation on the protection of personal data (according to the provisions of articles 15 to 22 of the GDPR), including the right to obtain the confirmation of the existence or otherwise of their data and to know the contents and origin thereof, check the exact nature, check the correctness or request the integration, updating or correction of their data.
10.2. Persons to whom the personal data refers have also the right to obtain the deletion, transformation into an anonymous form or suspension of any data processed in breach of the law, and to oppose the processing of their data for legitimate reasons.
10.3. Requests should be sent:
i. by e-mail to: [email protected]
ii. Or by post to Optifashion LLC, Executive Towers - Aspect Tower, Office 2902, Business Bay, PO Box: 116249, Dubai, UAE
11. FINAL PROVISIONS