Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 ("GDPR" or "Regulation")

Summary

Art. 1. Identity and contact details of the Holder as the owner of personal data processing.
Art. 2. Data processing for purposes of purchasing services brokered by il Titular
Art. 3. Data processing for generic marketing purposes
Art. 4. Data processing for the purpose of assistance and customer care
Art. 5. Data processing for purposes of establishing, exercising or defending a right
Art. 6. Categories of subjects to whom the Controller communicates the user's personal data (recipients)
Art. 7. Transfer to third countries
Art. 8. Right of opposition
Art. 9. Right of access
Art. 10. Right of rectification
Art. 11. Right of cancellation
Art. 12. Right to limitation of processing
Art. 13. Right to data portability
Art. 14. Timing and manner of response in case of exercise of the data subject's rights
Art. 15. Right to file a complaint with a supervisory authority

Art. 1. Identity and contact details of the Controller as the owner of the processing of personal data

Radhoot OU (the "Owner") is the owner of the processing of users' personal data illustrated in this policy and having as its object the data collected from this landing page for the purposes stated therein.
The identification and contact details of the Owner are as follows:

Radhoot OU, Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145,
E-mail: /shop/contact-7c31a2515b6/;

Art. 2. Data processing for the purpose of purchasing services brokered by the Holder

the Controller will process the user's personal data in order to allow the user to be contacted by companies that offer the services described by the landing page referred to in this privacy policy (Partner Companies) and to conclude the related contracts for the purchase of these services.
The legal basis for this processing the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b) of the Regulation).

For this purpose, the Data Controller will process the user's data for the time strictly necessary for the communication of the data to the Partner Companies, it being understood that, once this period has expired, the Data Controller may retain the data for the purposes and for the maximum retention periods set forth in the other sections of this policy, if relevant, and/or, in any case, in the cases established by the Regulations and/or the law.

The provision of data for the purpose in question is optional: that is, there is no legal or contractual obligation to communicate the data; however - since their processing is necessary to enable the Data Controller to communicate the data to the Partners Companies failure to communicate the data will result in the impossibility for the user to be contacted by the Partners Companies.

Art. 3. Data processing for generic marketing purposes

the Holder will not collect or process the user's personal data in order to send him, via e-mail, informative and promotional communications, or newsletters, referring to its own and/or third parties' products and/or services.

Art. 4. Data processing for support and customer care purposes

the Data Controller will process user data for general assistance and customer care activities and thus to respond to requests for information from users or to respond to complaints, reports, disputes as well as in order to allow the user, if he/she wishes, to give a review.

The legal basis for this processing is the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b, last paragraph, of the Regulations) or, as the case may be, the legitimate interest of il Titolare (art. 6.1.f of the Regulations).
It constitutes il Titolare's legitimate interest to respond to users' requests for information and/or reports and/or disputes and/or complaints. This legitimate interest of il Titolare also coincides with the legitimate interest of the users themselves who make the inquiries and/or reports and/or disputes and/or complaints in question and who, therefore, in the context of their relationship with il Titolare, may reasonably be expected to expect that their personal data will be used by il Titolare to provide them with a response. The legitimate interest of the Data Controller thus identified may therefore be deemed to prevail over the fundamental rights and freedoms of the data subject, also in view of these reasonable expectations and the existing relationship between the data subject and the Data Controller as well as in view of the nature of the data processed and the coinciding interest of the data subjects themselves.
The user has, in any case, the right to object, at any time, for reasons related to his or her personal situation, to the processing of personal data concerning him or her for the purpose in question (i.e. assistance and customer care).

Art. 5. Data processing for the purpose of establishing, exercising or defending a right

the Controller will process the user's data for the establishment, exercise or defense of a right in all relevant forums. The legal basis for this processing is the legitimate interest of il Titolare (Art. 6.1.f of the Regulations). Indeed, it is the legitimate interest of il Titolare to exhaust remedies to ensure compliance with its contractual rights or to demonstrate that it has fulfilled its obligations arising from its contract with the data subject or imposed on il Titolare by law. This legitimate interest is, in turn, grounded in the constitutionally protected right to defense. It may therefore be deemed to prevail over the fundamental rights and freedoms of the data subject, also because of the data subject's reasonable expectations. The user has, in any case, the right to object, at any time, for reasons related to his or her personal situation, to the processing of personal data concerning him or her for the purpose in question (i.e. defense of a right/justice purposes).
The user may exercise this right by contacting the Data Controller at the contact details indicated in Art. 1 of this privacy policy.

Art. 6. Categories of persons to whom the Controller communicates the user's personal data (recipients).

Personal data provided by the user may be communicated by il Titolare to the categories of recipients indicated below. The individuals to whom the Data Controller communicates the data, act as data processors designated by the Data Controller by means of a special contract (Data Processors) or as persons designated to process personal data under the direct authority of the Data Controller (Designates) or, in the case of third parties that the Data Processor uses, as "Sub-Processors", pursuant to Article 28.4 of the Regulations.
Users' personal data may be disclosed by the Controller to the following categories of recipients:
to Partner Companies, as defined in Article 1 of this Policy, so that the latter may contact the user and propose the conclusion of contracts having as their object the services described by the landing page to which this Policy refers;
to companies appointed by il Titolare to send commercial communications, which act on behalf of il Titolare as Data Processors;
to all those entities, including public authorities, which have access to the data by virtue of regulatory or administrative measures;

Art. 7. Transfer to third countries.

Personal data are not transferred to countries outside the European Union and the United Kingdom.

Art. 8. Right of opposition

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out for the purposes having as their legal basis the legitimate interest of the data controller.
Where data are processed for direct marketing purposes, the data subject shall also have the right to object at any time to the processing of personal data concerning him or her carried out for such purposes.

In the event that the right to object is exercised, the Data Controller shall refrain from further processing the personal data, unless the Data Controller demonstrates the existence of compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for that purpose.

Art. 9. Right of access

The data subject has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to the personal data and information set out below.
In the case of exercising the right of access, the user may obtain access to personal data and the following information:
the purposes of the processing;
the categories of personal data in question;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organizations;
when possible, the expected retention period of the personal data or, if this is not possible, the criteria used to determine this period;
the existence of the data subject's right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing;
the right to lodge a complaint with a supervisory authority;
where the data are not collected from the data subject, all available information about their origin;
the existence of automated decision-making, including profiling, which produces legal effects concerning the data subject or affects the data subject in a similar significant way, and at least in such cases, meaningful information about the logic used, as well as the importance and the expected consequences of such processing for the data subject.
the Controller shall provide a copy of the personal data undergoing processing. If additional copies are requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.

Art. 10. Right of rectification

The data subject has the right to obtain from the Controller the rectification of personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

Art. 11. Right of cancellation

The data subject has the right to obtain from the Data Controller the erasure of personal data concerning him/her without undue delay and the Data Controller is obliged to erase the personal data without undue delay if any of the following reasons exist:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based, if there is no other legal basis for the processing;
the data subject objects to processing based on the legitimate interest of the data controller on grounds relating to his or her particular situation and there is no overriding legitimate ground or objects to the processing of his or her personal data for direct marketing purposes;
personal data are being processed unlawfully;
personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject.

Art. 12. Right to limitation of processing

The data subject has the right to obtain from the Data Controller the restriction of the processing when one of the following occurs:
the data subject disputes the accuracy of the personal data for the period of time necessary for the Data Controller to verify the accuracy of such personal data;
the processing is unlawful and the data subject objects to the erasure of the personal data and instead requests that its use be restricted;
although the Data Controller no longer needs the personal data for the purposes of the processing, the personal data are necessary for the data subject to establish, exercise or defend a right in court;
the data subject has objected to the processing in cases where the processing is based on the legitimate interest of the Data Controller, for reasons related to his or her particular situation, pending verification as to whether the Data Controller's legitimate reasons prevail over those of the data subject.
If the processing is restricted, the personal data subject to the restriction shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of a right in a court of law or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.
The data subject who has obtained the restriction of processing shall be informed by the Data Controller before the restriction is lifted.

Art. 13. Right to data portability

The data subject has the right to receive, in a structured, commonly used and machine-readable format, personal data concerning him or her that he or she has provided to the Data Controller and has the right to transmit such data to another data controller without hindrance from the data controller to whom he or she has provided them, if:

processing is based on the data subject's consent or on a contract;
processing is carried out by automated means.
When exercising his or her right to data portability, the data subject has the right to obtain direct transmission of personal data from one data controller to another, if technically feasible. The exercise of the right to portability is without prejudice to the right to erasure. The right to portability must not infringe on the rights and freedoms of others.

Art. 14. Time and manner of response in case of exercise of the rights of the data subject

the Data Controller shall provide the data subject with information about the actions taken in relation to a request to exercise the rights recognized by Articles 15 to 22 of the Regulation (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) and by this Privacy Policy (Rights of the Data Subject), without undue delay and, in any case, within one month of receipt of the request. This period may be extended by two months, if necessary, taking into account the complexity and number of requests. the Data Controller shall inform the data subject of such extension, and the reasons for the delay, within one month of receipt of the request. If the data subject submits the request by electronic means, the information shall be provided, where possible, by electronic means, unless otherwise specified by the data subject.

Article 15. Right to file a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, a data subject who considers that processing concerning him or her is in violation of the Regulation has the right to lodge a complaint with a supervisory authority, namely in the Member State where he or she normally resides, works, or of the place where the alleged violation occurred. The supervisory authority to which the complaint is made shall inform the complainant of the status or outcome of the complaint, including the possibility of a judicial remedy.