Personal data processing policy
Personal data processing policy
1. General Provisions
1.1 This Personal Data Processing Policy (hereinafter referred to as the "Policy") is in force in accordance with the Law of Ukraine "On the Protection of Personal Data" No. 2297-VI dated March 20, 2020 (hereinafter referred to as the "Law") and determines the position of FLP "Aleksandrov R .IN." (hereinafter referred to as the "Provider") in the field of processing and protection of personal data (hereinafter referred to as personal data), in relation to the observance of rights and freedoms, describes the features of the collection, storage, use and transfer of personal data, the implemented requirements for their protection, as well as information about the rights of persons to whom the relevant personal data relate.
1.2 Personal data refers to any information relating directly or indirectly to a specific or identifiable natural person (citizen).
1.3 The processing of personal data means any action (operation) or a set of actions (operations) with personal data performed using automation tools and / or without the use of such tools. Such actions (operations) include, in particular: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data.
1.4 The security of personal data means the protection of personal data from unauthorized and / or unauthorized access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.
1.5 The Policy applies to all actions related to the processing of personal data on the teas-cofe.com.ua website (hereinafter referred to as the "Site"), in the Supplier's information systems. All terms used in this document have the meaning used and the Terms of Use of the site, posted in the relevant section of the site.
1.6 When placing an Order and registering on the Site, creating an Account, the User, through the relevant functionality of the Site, consents to the processing of his personal data, in the manner and under the conditions described in the Policy and provided for by applicable law. The use of the Site by the User also means their unconditional acceptance of the rules of the Privacy Policy and the conditions for processing personal data specified therein. If the User does not agree with the terms of this Policy, the User should refrain from using the Site.
1.7 This Policy applies to personal data received both before and after the entry into force of this Policy.
2. Legal grounds and purposes of the processing of Personal Data by the Provider
2.1 The Supplier processes and ensures the security of personal data for the implementation of the functions, powers and duties assigned to the Supplier by the legislation of Ukraine, including, but not limited to, in accordance with the Constitution of Ukraine, other laws, by-laws, other defining cases and features of the processing of the specified personal data laws of Ukraine, as well as the Civil Code of Ukraine, the Tax Code of Ukraine, the Law of Ukraine "On Protection of Consumer Rights", as well as the owners of personal data and local acts of the Supplier.
2.2 The Provider is the owner of personal data in accordance with the Law.
2.3 The processing of personal data may be carried out by the Provider in the following cases and on the following legal grounds:
2.3.1. processing of personal data is carried out only with the consent of the subject of personal data, expressed in any form that allows you to confirm the fact of obtaining consent, including by the methods specified in clause 1.6. this Policy;
2.3.2. to achieve the goals stipulated by an international treaty of Ukraine or the law, to implement and fulfill the functions, powers and duties assigned by the legislation of Ukraine to the owner of personal data;
2.3.3. for the execution of the contract for the sale of the Goods, or another contract between the seller and the user of the Site, which is an individual with the necessary amount of legal capacity and having the intention to place or place an Order for the Goods through the Site, (hereinafter referred to as the "Buyer"), concluded using the Site the party or the beneficiary or guarantor of which is the subject of personal data, including in the case of the owner exercising his right to assign rights (claims) under such an agreement, as well as for concluding an agreement on the initiative of the subject of personal data or an agreement under which the subject of personal data data will be the beneficiary or guarantor;
2.3.4. for the purpose of fulfilling the Terms of Use of the site https://teas-cofe.com.ua when using the Site;
2.3.5. to exercise the rights and legitimate interests of the owner or third parties or to achieve socially significant goals, provided that this does not violate the rights and freedoms of the subject of personal data;
2.3.6. for statistical or other marketing and research purposes, subject to mandatory depersonalization of personal data, incl. in connection with the need to achieve the goal specified in paragraph 4.
2.4. The subjects of personal data processed through the Site are, among other things, users of the Site, buyers and recipients of the Goods (if the buyer indicated another person as the recipient of the Goods); any other individuals applying to the Supplier with applications/appeals.
2.5 The Supplier processes personal data, including the following persons:
2.5.1. Buyers (Users) in order to:
conclusion and execution of contracts, one of the parties to which is the User, in accordance with the order and the Site, including the contract for the retail sale of the Goods, including those concluded remotely on the Site;
providing information about Products, Promotions and special offers;
informing about the status of the Order;
assistance in settling claims between the Buyer and the Seller;
fulfillment of the Seller's instructions regarding the collection and transfer of funds to him in payment for the Goods;
· fulfillment of orders of Sellers and Buyers in connection with the return of Goods;
posting by Users and Buyers of reviews about the Goods and (or) Sellers;
analysis of the quality of the service provided by the Supplier and improvement of the quality of customer service of the Supplier;
identification of Users and Buyers in Promotions, ensuring the accrual procedure, accounting, use of bonus points of loyalty programs of Users and Buyers;
· fulfillment by the Supplier of obligations to hold the Promotions; fulfillment of other Terms of Use of the site when using the Site;
in any other cases expressly provided for by applicable law.
2.5.2. Recipients of the Goods purchased by the Buyers in order to control the delivery of such Goods;
2.5.3. other persons who apply to the Supplier with statements about the alleged violation of their rights and the rights of third parties, in order to process incoming applications, transfer information about the received applications to persons whose actions could allegedly lead to a violation of the relevant rights, assist in the settlement of claims, make a decision on the application provided by the Terms of Use of the Site, the Terms of Ordering and Delivery of Goods, the Order Rules and other user documents of the Site, liability measures to Sellers or Buyers.
2.5.4. all Users of the Site in order to fulfill the Terms of Use of the Site when using the Site, to analyze and improve the quality of service for Users and Buyers.
2.5.6. Counterparties Supplier whose personal data is processed as part of the implementation of contractual relations between the parties.
3. Categories of personal data processed by the Provider
3.1 The Supplier processes the following categories of personal data of Users, recipients of the Goods: information obtained during registration and placing an order (last name, first name, patronymic, address, phone number, email address, cookie), information obtained during interaction with Buyers (gender, age of the Buyer, passport data, data of means of payment, city of residence and / or address), in connection with the placement or execution of the Buyer's Orders (information about the method of delivery of the Goods, the method and status of payment for the Goods, and if the final recipient of the Goods differs from the Buyer, also the last name, name, patronymic, delivery address and phone number of the consignee), about the Buyer's claims (transferred by the Buyer using the Site, support service or otherwise), reviews posted by the Buyer about the Goods and (or) Sellers, geolocation information.
3.2 The Supplier processes the following categories of personal data of personal data subjects who apply to the Supplier with allegations of an alleged violation of their rights: last name, first name, patronymic, passport data (data of another identity document), contact information (telephone and (or) fax numbers, e-mail address) of the right holder or other person whose right was allegedly violated, and (or) the applicant, if he acts as an authorized representative of the right holder or other person whose right was allegedly violated, information about the applications received, the progress and result of their consideration.
3.3 The personal data specified in the paragraphs of this Section above may be obtained by the Provider in one of the following ways:
provided by the subjects of personal data by filling out the appropriate forms on the Site, by sending correspondence or emails to the email addresses of the Supplier;
received from third parties in the cases provided for in this Section. In particular, the personal data of the Buyers may be obtained by the Supplier directly from the Sellers or other counterparties of the Supplier in connection with the execution of the instructions of the Seller and (or) the performance of other actions provided for by applicable law.
4. Principles and conditions for the processing of Personal Data
4.1 When processing personal data, the Supplier adheres to the following principles:
the processing of personal data is carried out on a legal basis;
personal data are not disclosed to third parties and are not distributed without the consent of the subject of personal data, except for cases provided for by the legislation of Ukraine;
determination of specific legitimate purposes prior to the processing (including collection) of personal data;
merging of databases, including databases containing personal data, the processing of which is carried out for purposes incompatible with each other, is not allowed;
the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;
the processed personal data are subject to destruction or depersonalization upon withdrawal of consent to their processing by the subject of personal data, upon achievement of the purposes of processing or in case of loss of the need to achieve these purposes, unless otherwise provided by law;
the content and scope of the processed personal data correspond to the stated purposes of processing. The processed personal data is not excessive in relation to the stated purposes of processing;
when processing personal data, the accuracy of personal data and their sufficiency, if necessary, and the relevance of personal data in relation to the stated purposes of their processing are ensured;
the storage of personal data is carried out in a form that allows you to determine the subject of personal data no longer than required by the purposes of processing personal data, if the period of storage of personal data is not established by law, an agreement to which the subject of personal data is a party, beneficiary or guarantor.
4.2 The Supplier does not process personal data related to race, nationality, political views, religious, philosophical and other beliefs, health status, personal life, membership in public associations, including trade unions, biometric data. The Supplier does not perform voice input and verification of personal data using insecure data transmission channels. The transfer of data by personal data subjects to support workers is voluntary and implies that the data received will be used in accordance with this Policy.
4.3 The Supplier ensures the recording, systematization, accumulation, storage, clarification (updating, changing), retrieval of personal data using databases located on the territory of Ukraine, and does not carry out cross-border transfer of personal data.
4.4 The Supplier has the right to entrust the processing of personal data to third parties with the consent of the subject of personal data, expressed by providing consent, on the basis of an agreement concluded with such third parties, in the following cases:
to process requests from Buyers and (or) Users, third parties through voice and non-voice communication channels, including email, online chat, applications for mobile devices and (or) social networks;
for the purpose of delivering the Goods to the Buyers and Recipients;
· in order to collect funds in payment for the Goods on behalf of the Seller.
in order to analyze the quality of the service provided by the Supplier and improve the quality of customer service of the Supplier (Users and Buyers);
in order to prepare personal offers and terms of service;
for the purpose of conducting statistical or other marketing research.
4.5 Persons processing personal data on the basis of an agreement concluded with the Supplier (order of the owner), including Sellers and delivery services, undertake to comply with the principles and rules for the processing and protection of personal data provided for by applicable law. For each third party, the contract defines a list of actions (operations) with personal data that will be performed by a third party processing personal data, the purposes of processing, establishes the obligation of such a person to maintain confidentiality and ensure the security of personal data during their processing, specifies the requirements for protecting the processed personal data in accordance with applicable law.
4.6 The Supplier has the right to transfer personal data to third parties with the consent of the subject of personal data in the following cases:
4.6.1 To sellers and delivery services for the purposes of fulfilling the Buyer's Order, including in the event of receiving a request for the return of the Goods purchased on the Site, in order to consider the requirements and return and return, in cases provided for in the Order Rules and other sections of the Site, including on condition that the Supplier receives a statement about the violation of intellectual or other rights of third parties, in order to resolve the claims received, in the event of receiving other statements, reviews, claims, complaints, messages or documents addressed to the Seller, in other cases and for the purposes described in the Order Rules;
4.6.2 in order to be able to protect the rights and legitimate interests of the Supplier or third parties in cases where the subject of personal data violates any terms of the user documents of the Site and (or) this Policy;
4.6.3 by a court decision that has entered into force or in cases established by the current legislation;
4.7 In order to fulfill the Terms of Use of the site https://teas-cofe.com.ua when using the Site, analyzing and improving the quality of service for Users and Buyers, statistical or other marketing and research purposes, the Supplier develops, improves, optimizes and implements new functionality of the Site . To ensure this, the User or the Buyer agrees and instructs the Supplier to process (including collection, recording, systematization, accumulation, storage, clarification (updating, changing), comparison, extraction, use, depersonalization, blocking, deletion and destruction) in compliance with applicable law and any other personal data of the User or the Buyer, including those at the disposal of the partner acting on behalf of the Supplier, the transfer of the credentials and any other personal data of the User or the Buyer at the disposal of the Supplier to partners in pursuance of such an instruction for processing and receiving from partners as a result of processing analytical information, including the results of automated processing of such data, including in the form of integer and/or text values and identifiers.
4.8 The Supplier has the right to transfer personal data to third parties with the consent of the subject of personal data, as well as in cases where the possibility of transferring personal data to third parties is expressly provided for by the legislation of Ukraine does not require the consent of the subject of personal data.
4.9 In order to fulfill the requirements of the current legislation of Ukraine and its contractual obligations, the processing of the Supplier's personal data is carried out both with and without the use of automation tools. The set of processing operations includes the collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data.
4.10 The Provider does not make decisions that give rise to legal consequences for the subject of personal data or otherwise affect his rights and legitimate interests, based solely on automated processing of personal data.
4.11 The Provider does not check and, as a rule, is not able to check the relevance and reliability of the information provided by the subjects of personal data received through the Site. The Supplier proceeds from the fact that personal data subjects, acting reasonably and in good faith, provide reliable and sufficient personal data and keep them up to date.
5. Rights of personal data subjects
5.1 The subject of personal data, whose personal data is processed by the Provider, has the right to:
5.1.1. at any time change (update, supplement) the personal data provided by him by going to the Personal Account in cases where this allows the functionality of the Site;
5.1.2. delete the personal data provided by him by sending the Supplier a written notice indicating the personal data to be deleted;
5.1.3. receive from the Supplier:
confirmation of the fact of personal data processing and information about the availability of personal data relating to the relevant subject of personal data;
information about the legal grounds and purposes of processing personal data;
information about the methods used by the Supplier to process personal data;
information about the name and location of the Supplier;
processed personal data relating to the subject of personal data, and information about the source of their receipt, unless a different procedure for providing such personal data is provided by law;
information about the terms of processing personal data, including the terms of their storage;
information on the procedure for the exercise by the subject of personal data of the rights provided for by the legislation on personal data;
the name and address of persons processing personal data on behalf of the Supplier;
Other information provided by the Law;
5.1.4. require the Supplier to clarify their personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
5.1.5. withdraw your consent to the processing of personal data at any time by sending an electronic message with an electronic signature to the Site administration, or by sending a written notification to the address of the Supplier. After receiving such a message, the processing of personal data of the subject of personal data will be terminated, and his personal data will be deleted, for except in cases where processing can be continued in accordance with the legislation of Ukraine. At the same time, sending such a message about the withdrawal of consent by the User and (or) the Buyer should also be considered a notification of a unilateral refusal to execute the relevant Order and entail the impossibility of its execution;
5.1.6. demand the elimination of illegal actions of the Supplier in relation to his personal data;
5.1.7. take legal measures to protect their rights and legitimate interests, including compensation for losses and (or) compensation for moral damage in court.
5.2 The rights provided for in the subparagraphs of this Section above may be limited in accordance with the requirements of the legislation of Ukraine and (or) in cases where the Supplier processes personal data on other legal grounds than the consent of the subject of personal data.
6. Obligations of the Supplier
In accordance with the requirements of the Law, the Supplier is obliged to:
1) provide the subject of personal data, at his request, with information regarding the processing of his personal data, or legally provide a refusal within thirty days from the date of receipt of the request of the subject of personal data or his representative;
2) at the request of the personal data subject, clarify, block or delete the processed personal data, if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing within a period not exceeding seven working days from the date the personal data subject provides or his representative information confirming these facts;
3) notify the subject of personal data about the processing of personal data in the event that personal data was not received from the subject of personal data. The exception is the following cases: - the subject of personal data is notified of the processing of the Supplier of his personal data; - personal data is received by the Supplier in connection with the performance of an agreement to which the subject of personal data is a party or beneficiary or guarantor or based on the requirements of applicable law;
- personal data is made public by the subject of personal data or obtained from a public source;
- The Supplier processes anonymized personal data for statistical or other research purposes, if the rights and legitimate interests of the subject of personal data are not violated;
- providing the subject of personal data with the information contained in the notification on the processing of personal data violates the rights and legitimate interests of third parties;
4) if the goal of processing personal data is achieved, immediately stop processing personal data and destroy the relevant personal data within a period not exceeding thirty days from the date of achieving the goal of processing personal data, unless otherwise provided by the contract, the party to which, the beneficiary or the guarantor of which is the subject personal data, another agreement between the Provider and the subject of personal data, or if the Provider is not entitled to process personal data without the consent of the subject of personal data on the grounds provided for by the Law or other laws;
5) in the event that the subject of personal data withdraws consent to the processing of his personal data, stop processing personal data and destroy personal data within a period not exceeding thirty days from the date of receipt of the said withdrawal, unless otherwise provided by an agreement between the Provider and the subject of personal data. The Supplier is obliged to notify the subject of personal data about the destruction of personal data;
6) in the event of a request from the subject of personal data to stop processing personal data received in order to promote goods, works, services on the market, immediately stop processing personal data;
7) when collecting personal data, including through the Internet, the Supplier ensures the recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of Ukraine using databases located on the territory of Ukraine.
7. Protection of personal data
7.1 When processing personal data, the Supplier takes the necessary legal, organizational and technical measures to protect personal data from illegal and (or) unauthorized access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in regarding personal data.
7.2 Such measures, in accordance, include, in particular:
7.2.1. application of legal, organizational and technical measures to ensure the security of personal data.
7.2.2. control over the measures taken to ensure the security of personal data and the level of security of personal data information systems;
7.2.3. assessment of the harm that may be caused to the subjects of personal data in case of violation of the requirements of the legislation on personal data, the ratio of the specified harm and the measures taken by the Supplier aimed at ensuring the fulfillment of obligations stipulated by the legislation on personal data;
7.2.4. compliance with the conditions that exclude unauthorized access to material carriers of personal data and ensure the safety of personal data;
7.2.5. familiarization of the Supplier's employees directly involved in the processing of personal data with the provisions of the legislation of Ukraine on personal data, including the requirements for the protection of personal data, local acts on the processing and protection of personal data, and training of the Supplier's employees
8. Terms of processing (storage) of Personal Data
8.1 The terms of processing (storage) of personal data are determined based on the purposes of processing personal data, in accordance with the validity period of contracts with subjects of personal data, the requirements of the current legislation: personal data of registered Users are stored for the entire period of validity of the User Account; personal data of an unregistered User and the recipient of the Goods (if another person is indicated as the recipient of the Goods) is stored for three years from the date of execution of the Order of such a User; Personal data of other persons who apply to the Supplier with statements about the alleged violation of their rights, during the entire period of processing and consideration of the relevant claims and within three years from the date of completion of the processing and (or) consideration of the claim, unless the law provides for a different limitation period for relevant disputes.
8.2 Personal data, the period of processing (storage) of which has expired, may be destroyed, unless otherwise provided by the legislation of Ukraine.
9. Procedure for obtaining clarifications on the processing of Personal Data
9.1 Personal data subjects whose personal data is processed by the Provider may obtain clarifications on the processing of their personal data by contacting the Provider in person or by sending a corresponding written request to the Provider's location.
10. Automatically collected information
10.1 The Supplier may collect and process the following information, including information that is not personal data:
Information about the interests of Users on the Site based on the entered search queries of the Site users about the goods sold and offered for sale in order to provide relevant information to Users when using the Site, as well as to summarize and analyze information about which sections of the Site and products are most in demand among Users Site;
information about the interests of Users based on the received requests from Users in order to provide up-to-date information when using the support service, as well as to summarize and analyze information about which support service features are most in demand among Users;
information that forms the system rating of the Seller: User reviews about the Seller, information about the execution of Orders, other information;
10.2 The Provider processes and stores the search queries of the Site Users in order to summarize and create client statistics on the use of sections of the Site.
10.3 The Provider automatically receives certain types of information obtained in the course of Users' interaction with the Site, e-mail correspondence, etc. We are talking about technologies and services such as web protocols, Cookies, Web marks, as well as third-party applications and tools persons. At the same time, Web marks, Cookies and other monitoring technologies do not make it possible to automatically receive personal data. If the User of the Site, at his own discretion, provides his personal data, for example, when filling out a feedback form or when sending an e-mail, then only then will automatic collection of detailed information start for the convenience of using the websites and (or) to improve interaction with users.
10.4 If the Provider can reasonably correlate the information specified in this Section with the Account of a particular User, then such information may be processed together with Personal Data and other personal information of such User.
11. Changes to the Policy; Other provisions
11.1 The Provider may amend this Policy from time to time, including to reflect changes in the scope of the Provider's services or changes in the functionality of the Site, as well as changes in legislation. The new version of the above provisions and confidentiality shall take effect from the moment of its publication, unless it specifies a different date for its entry into force.