PERSONAL DATA PROCESSING AND PROTECTION POLICY
In accordance with art. 13 of Regulation (EU) 2016/679 (“GDPR”), Opstrup, whose registered office is at København, Vester Voldgade 102, Sal 2tv, VAT n. DK25380754 (“Opstrup”), in its capacity of Data controller, hereby provides this policy on the processing of your personal data to explain the purposes and modalities according to which your personal data are collected and processed, the categories of data concerned, your rights as data subject and how they can be exercised.
This information is valid for this website only (“Website”), Opstrup assumes no responsibility with respect to other websites on which you may land through hyperlinks found on the Website.
By browsing the Webite, users accept this Policy and are, thus, asked to read it before providing any personal data.
1. Data Controller
Opstrup is the data controller (“Controller”) of the personal data collected through the Webite.
In order to carry out specific processing operations, Opstrup avails itself of employees, reps and collaborators who act under its authority, and of partner companies or professional firms which provide accounting, administration, legal, tributary or financial advice based in the European Union and duly appointed as data processors under art. 28 of GDPR.
The updated list of data processors and subjects acting under the authority of the Controller is kept at the Controller’s headquarters.
2. Categories of personal data
Opstrup processes personal data collected during and/or after the purchase or at the time of subscribing to the newsletter (“Data”). For example, the Controller collects the following categories of personal data:
demographic information, such as name, surname, gender, place and birth date, residential address;
contact details, such as shipping address, phone number and email address;
banking data (e.g. IBAN), if provided for a possible refund;
navigational data, such as IP address, Site access and /or platform registration time, server access mode, server response number code (successful, error, etc.);
purchase data, such as the country, the date, the product type and the monthly average purchase value in the reporting semester/year.
The Controller does not process data belonging to the special categories mentioned in art. 9 of the Regulation nor data relating to criminal convictions and offences.
Your data are processed by Opstrup for the purposes specified in the following paragraph.
3. Purposes and legal basis of the process
Opstrup will process your data for the following purposes:
a. for the performance of the contract
The Data indicated in paragraph 2, nn. 1-4, are processed by Opstrup in order to allow you to register to the Website and enjoy the services it provides. For example, your data will be processed for the purposes of managing purchase orders, for technical maintenance and support and to improve the quality of the services provided through the Website. The data are, thus, processed for the performance of the contract between you and the Controller.
The provision of data is necessary for the establishment and management of our contractual relationship; in default, we will not be able to perform the contract and provide the service in question.
b. for marketing purposes
Subject to your specific consent, Opstrup might process your Data for the purposes of sending advertising or commercial emails regarding promotions or market researches.
These emails may be sent through either automated systems (emails, SMS) or traditional mail. For this purpose, the categories of Data concerned are those mentioned in paragraph 2, nn. 1 and 2.
You may withdraw your consent at any time, also with reference to the automated systems only, by writing to firstname.lastname@example.org.
The Data mentioned in paragraph 2, n. 2, provided at the time of subscription to our newsletter, may be used by Opstrup for the sole purposes of sending the newsletter. The data are, thus, processed for the provision of the service you requested.
You may unsubscribe at any time from the newsletter by following the instructions provided in each communication or by writing to email@example.com.
The Data mentioned in paragraph 2, n. 2, obtained in the context of the sale of our products through the platform, may be used for direct marketing of similar products. Such processing operation does not need your express consent pursuant to art. 130 of LD 30th June 2003, n. 196, as amended.
You may object at any time to such processing following the instructions provided in each communication or by writing to firstname.lastname@example.org.
c. for profiling purposes
Opstrup may process your data in order to understand your purchase habits and preferences with respect to the products and the services offered through the platform. This is for the purposes of offering you products and services which are in line with your profile.
For such purposes, Opstrup may process the data mentioned in paragraph 2, nn. 1-2 and 5.
These data will be processed by Opstrup on the basis of its legitimate interest in fine-tuning the purchase process and offering products and services which meet the specific needs of the clients. Opstrup’s legitimate interest has been duly balanced with your interests and expectations during the performance of a data protection impact assessment, which set forth specific technical and legal measures in order to minimize the impact of profiling on your rights and freedoms.
We remind you that, pursuant to art. 21 of GDPR, you can object to such processing at any time on grounds relating to your specific situation, by writing to email@example.com.
4. Storage period and duration of processing
Your Data will be stored for the duration of the contractual relationship with Opstrup. Following the termination of such relationship, the Data will be stored for a period of 10 years exclusively for the purposes of allowing the Controller to enforce its rights or comply with legal obligations.
With reference to processing for marketing purposes mentioned in paragraph 3(b), we inform you that your Data will be stored for the duration of the contract, unless you decide to withdraw your consent or to exercise your right to object.
With reference to processing for profiling purposes, we inform you that your Data will be processed for up to 12 months or for the different period that should be provided by the law or by the Privacy Authority, unless you exercise your right to object. After this period or in case of objection, your data will be stored if they are necessary in order to pursue other purposes or will be permanently deleted.
5. Disclosure for law enforcement
Under certain circumstances, Opstrup may be required to disclose your Data if required to do so by law or in response to valid requests by public authorities.
6. Credit card information
Opstrup does not collect payment or other banking information from you directly because they are kept private by your banking system.
7. Cookies Data
8. Rights of the data subject
We inform you that, pursuant to the current legislation, you can:
ask and obtain from Opstrup information about your personal data and your right to access to such data;
with respect to data processed through automatic systems, ask for them to be transmitted to another controller;
ask and obtain from Opstrup the rectification of your personal data if you believe they are incorrect or incomplete;
ask and obtain from Opstrup the erasure – or the restriction of processing – of your data if you believe they are not necessary – or no longer necessary – for the above mentioned purposes, hence after the expiry of the storage period mentioned above.
You can contact Opstrup at firstname.lastname@example.org or by mail to Opstrup København, Vester Voldgade 102, Sal 2tv.
Pursuant to the current legislation, you may lodge a complaint with the Data Authority for the alleged infringement of your rights with respect to the use of your personal data.