CONFIDENTIALITY AND PROTECTION OF PERSONAL DATA

CONFIDENTIALITY AND PROTECTION OF PERSONAL DATA

 

Contents

1.    General provisions and scope of application.

2.    Composition, content and sources of personal data collection.

3.    Purpose, grounds and terms of personal data processing.

4.    Location of personal data.

5.    Access to personal data.

6.    Transfer of personal data to third parties.

7.    Measures to protect personal data.

8.    Rights of Buyers as subjects of personal data.

9.    Procedure for handling requests from Buyers and third parties regarding access to personal data.

10.    Deletion of Buyer's personal data.

11.    Withdrawal of consent to the processing of personal data.

12.    Personal data of order recipients.

13.    Amendments to the Regulations.

1. General provisions and scope of application

Limited Liability Company ‘BETTER PIT’ (hereinafter referred to as the ‘Company’), located at: Ukraine, 01033, Kyiv, pl. Sportivna Square, Building 3, processes the personal data of individuals who purchase and/or order goods for themselves, order recipients, as well as visitors to the online platform ‘https://shop.newproducts.com/’ (hereinafter referred to as ‘Buyers, Users’) on the online platform

‘https://shop.newproducts.com/’ (hereinafter referred to as the ‘Online Platform’), which includes the website: https://shop.newproducts.com/ (hereinafter referred to as the ‘Website’) and/or related services, in accordance with these Regulations on the processing and protection of personal data of users (buyers) of the Online Platform (hereinafter referred to as the ‘Regulations’).

The Company is the owner of the personal data of Buyers.

Personal data in these Regulations means information or a set of information about an individual who is identified or can be specifically identified.

The Company's processing of personal data of Buyers includes, but is not limited to, the following actions: collection, registration, accumulation, storage, adaptation, modification, renewal, use and dissemination (distribution, sale, transfer), depersonalisation, destruction of personal data, including through the use of information (automated) systems.

Other terms in these Regulations are used in the meanings given in the Law of Ukraine ‘On the Protection of Personal Data’ dated 1 June 2010 No. 2297-VI.

By registering on the Website and starting to use the Online Platform, or by placing an order without prior registration, the Buyer gives permission and voluntary unambiguous consent to the processing of their personal data under the terms and conditions set out in this Policy, and also confirms that they have carefully read and fully understood this Policy.

The Website may contain links to other websites. When following links to other websites, these Regulations shall not apply to such websites. Therefore, the Company recommends that you familiarise yourself with the privacy and personal data policies of each such website before submitting personal data that could identify you as a Buyer.

Separate user accounts may be created on the Online Platform, including for the convenience of authorisation and order placement, speed of order processing and payment for goods.

2. Composition, content and sources of personal data collection

The Company may process the following personal data of Buyers and order recipients:

first name, last name, telephone number, email address, language of communication, delivery address, presence of an account on social networks/online platforms.

This list of personal data is not exclusive or mandatory, but depends on the needs and desires of the Buyer and the operations they perform on the Online Platform.

The Company collects most personal data directly from Buyers when Buyers provide personal data when using (registering) the Online Platform, or during verbal communication between the Buyer and the Site administration, or when making payments on the Online Platform (including when purchasing goods on credit/payment in instalments). However, the Company may also collect personal data of Buyers from third parties – through online platforms (for example, through Facebook, Google, AppleID accounts).

Personal data also includes other information obtained by the Online Platform on legal grounds from third parties and/or available from the Buyer's accounts on social networks – in the case of registration on the Online Platform using social network authentication services. In this case, the Buyer consents to the processing of information available from the relevant social media accounts.

Buyers are responsible for all information posted by them in publicly available accounts. Buyers are aware of all risks associated with disclosing their address or information about their exact location. If the Buyer decides to log in to the Online Platform using a third-party authentication service, such as Facebook, the Company may receive additional information to which such third party has granted access.

The Company does not process special categories of personal data (so-called ‘sensitive data’) relating to racial or ethnic origin, political, religious or philosophical beliefs, membership of political parties and trade unions, criminal convictions, as well as health, sex life, biometric or genetic data. Information characterising the physiological characteristics of Customers, on the basis of which their identity can be established, is also not processed.

3. Purpose, grounds and terms of personal data processing

The Company processes the personal data of Buyers, in particular, for the following purposes:

•    ensuring the implementation of civil, economic and tax relations;

•    performing the functions, powers and duties assigned to the Company in accordance with the current legislation of Ukraine;

•    identifying the Buyer as a User of the Online Platform;

•    providing services to Buyers for the purchase and ordering of goods and/or services on the Online Platform

processing payments, conducting settlement operations, providing reports, maintaining accounting and management records;

•    creation and implementation of bonus programmes and loyalty programmes;

•    provision of financial services to Buyers (provided by third parties and/or partners of the Company);

•    improvement of the quality of goods/provision of services;

•    forming ratings of goods and offers on the Online Platform, analysing Buyer activity, performing keyword searches, managing traffic on the Online Platform, analysing and forecasting Buyer preferences and interests in order to form the most relevant and advantageous personal offers or promotional offers;

•    conducting research and analytical activities;

•    protecting the legitimate interests of the owner of personal data or a third party to whom personal data is transferred;

•    creating personalised buyer accounts by partner companies of the Online Platform;

•    sending information and marketing mailings (commercial offers, news, notifications about promotions, loyalty programmes, bonus programmes, promo codes, discounts, personal recommendations, personal discounts and offers) containing information about goods and/or services offered on the Online Platform, and/or sending notifications about the functioning of the Online platform, by post, email, telephone number (Viber, SMS), as well as by sending information messages and notifications via the Online Platform

The Buyer may at any time refuse to receive information and marketing mailings – through the appropriate settings on the Website, (User's personal account – my mailings) and/or by sending a message to the Online Platform's email address: shop@newproducts.com with the subject line ‘Personal data’.

The Company processes the personal data of Buyers on the following grounds:

•    conclusion and execution of a contract between the Company and the Buyer or for the implementation of measures preceding the conclusion of the contract;

•    the need to fulfil the Company's obligations under the law;

•    the need to protect the legitimate interests of the Company;

•    the Buyer's (unambiguous) consent to the processing of their personal data as provided for in these Regulations, to the extent that such consent is required by the current legislation of Ukraine. In particular, consent is required when registering on the Online Platform;

Buyers' personal data may be processed only if at least one of the above grounds is present.

Terms of processing of Buyers' personal data. Buyers' personal data shall be stored for no longer than is necessary to achieve the purpose of their processing as defined above, unless otherwise provided by legislation in the field of archiving and record keeping.

4. Location of personal data

Buyers' personal data is stored on the servers of New Products.

5. Access to personal data

The following persons (and only in cases of official necessity) may access the personal data of Buyers:

•    Company personnel – Company employees who need to work with such data in order to perform their job and functional duties;

•    related persons of the Company, if it is expedient and necessary to achieve the purpose set forth in these Regulations;

•    Sellers for the fulfilment of orders to the extent necessary to identify the Buyer, fulfil and process the Buyer's order (including for the purpose of proper payment for goods and/or services, ensuring that the Buyer receives financial services, registering the Buyer's personal accounts on the Seller's resources, etc.);

•    State, regulatory and law enforcement authorities, if necessary for the purposes specified above and if provided for by law, or if the Company is obliged to fulfil a duty established by law or to protect its legitimate interests.

6. Transfer of personal data to third parties

The Company may transfer personal data to third parties, including foreign entities involved in personal data processing, in particular, related parties of the Company for the purpose of personal data processing as defined in these Regulations. For example, data may be transferred to the Company's partners and contractors who provide services to it to ensure the Company's economic activities. In doing so, the Company shall make the necessary and reasonable efforts to ensure the protection of the personal data being transferred, including by entering into appropriate agreements. In this case, the Buyer gives their unambiguous consent to the transfer of their personal data to any third party for the purpose of processing personal data in accordance with these Regulations outside Ukraine to countries that are not recognised as providing adequate protection of personal data. No transfer of personal data will require the separate consent of the Buyer or the provision of a separate notification to the Buyer.

7. Personal data protection measures

The Company takes measures to ensure the protection of Buyers' personal data at all stages of its processing, including through organisational and technical measures.

The organisational measures taken by the Company include:

7.1 Control of access to the personal data of Buyers by employees/authorised persons of the Company:

•    The Company keeps records of employees/authorised persons who have access to the personal data of Buyers.

•    The Company has developed and implemented levels of access for Company employees to data subjects. Each of these employees has access only to the personal data (or part thereof) of Customers that is necessary for them to perform their professional, official or employment duties. All other employees of the Company have the right to full information only regarding their own personal data.

•    Employees/authorised persons who have access to personal data give a written undertaking not to disclose personal data entrusted to them or which has become known to them in connection with the performance of their professional, official or employment duties. This undertaking shall remain in force after the termination of their activities related to personal data, except in cases established by law.

• The Company takes measures to prevent access to the personal data of Customers by third parties.

7.2 Keeping records of operations related to the processing of Customers' personal data and access to it:

•    The Company stores information about the date, time and source of personal data collection; changes to personal data; viewing of personal data; any transfer (copying) of personal data of the subject; the date and time of deletion or destruction of personal data; the employee who performed one of the specified operations; the purpose and grounds for changing, viewing, transferring and deleting or destroying personal data.

•    The relevant information is stored by the Company for one year from the end of the year in which the specified operations were performed, unless otherwise provided by the legislation of Ukraine.

7.3 The Company has developed an action plan in case of unauthorised access to personal data, damage to technical equipment, or emergencies.

• The Company regularly organises training for its employees involved in personal data processing to raise awareness of international legal standards and national legislation in the field of personal data protection, and to ensure effective implementation of and compliance with the Company's internal rules on the collection, storage, use or other actions constituting personal data processing.

The technical protection measures taken by the Company include the following:

• The Company is equipped with system and software and hardware means and means of communication that prevent loss, theft, unauthorised destruction, distortion, falsification, copying of information and meet the requirements of international and national standards. The software products used by the Company in the process of processing personal data to achieve the purpose of their processing have built-in mechanisms to protect information from unauthorised access to ensure the identification and authentication of Buyers, the integrity of electronic documents, the registration of Buyers' actions, the management of Buyers' access to information and individual functions.

•    The Company also complies with the requirements of the Standard Procedure for the Processing of Personal Data, approved by Order of the Verkhovna Rada of Ukraine No. 1/02-14 dated 08.01.2014 (link), to the extent that it applies to personal data.

8. Rights of Buyers as subjects of personal data.

In accordance with Article 8 of the Law of Ukraine ‘On the Protection of Personal Data’, the Buyer has the right to:

• know the sources of collection, location of their personal data, the purpose of its processing, the location and/or place of residence (stay) of the owner or controller of this personal data, or to give appropriate instructions to authorised persons to obtain this information, except in cases established by law;

•    receive information about the conditions for providing access to personal data, in particular information about third parties to whom his personal data is transferred;

•    access their personal data;

•    receive, no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, a response as to whether their personal data is stored, as well as receive the content of their personal data;

•    submit a reasoned request to the personal data controller objecting to the processing of his personal data;

•    submit a reasoned request for the modification or destruction of his personal data by any personal data controller or processor if such data is processed unlawfully or is inaccurate;

•    to protect their personal data from unlawful processing and accidental loss, destruction, damage in connection with intentional concealment, non-provision or untimely provision, as well as to protect against the provision of information that is inaccurate or defamatory to the honour, dignity and business reputation of an individual;

•    to lodge complaints about the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights (hereinafter referred to as the ‘Commissioner’) or with a court;

•    apply legal remedies in case of violation of the legislation on the protection of personal data;

•    make reservations regarding the restriction of the right to process their personal data when giving consent;

•    withdraw consent to the processing of personal data;

•    know the mechanism of automatic processing of personal data;

•    protect themselves against automated decisions that have legal consequences for them.  

9. Procedure for handling requests from the Buyer and third parties regarding access to personal data.

The Buyer has the right to receive any information about themselves from the Company. The Buyer's access to their data is free of charge.

The Buyer submits a request for access (hereinafter referred to as the ‘Request’) to personal data to the Company.

The Request shall specify:

•    surname, first name and patronymic, place of residence (place of stay) and details of the document certifying the Buyer's identity;

•    surname, first name and patronymic, as well as other information that allows the identification of the individual to whom the Request relates;

•    information about the personal data to which the Request relates, or information about the owner or controller of the personal data;

•    a list of the personal data requested;

•    the purpose and/or legal grounds for the Request.

The period for reviewing the Request for its satisfaction may not exceed 10 working days from the date of its receipt.

During this period, the Company shall notify the Buyer that the Request will be satisfied or that the relevant personal data is not subject to disclosure, indicating the grounds specified in the relevant regulatory act.

The Request shall be satisfied within 30 calendar days from the date of its receipt, unless otherwise provided by law.

 10. Deletion of the Buyer's personal data

The Buyer's personal data may be destroyed at the Buyer's request by submitting a written request to delete personal data to the email address shop@newproducts.com with the subject line ‘Personal data’;

The Buyer's personal data shall also be deleted in the following cases:

•    issuance of a corresponding order by the Authorised Person or officials of the Authorised Person's secretariat designated by him;

•    a court decision on the deletion or destruction of personal data becomes final.

The destruction of the Buyer's personal data is carried out in a manner that excludes the possibility of further restoration of such personal data, as well as identification of the Buyer, and is the basis for the immediate termination of the processing and storage of such personal data by the Company.

In the event of inactivity in the Buyer's account for a period exceeding 5 (five) years, the Company reserves the right to delete the Buyer's account, including all personal data stored in the account, which means that the Buyer will no longer be able to access and use it. The procedure for deleting the Buyer's personal data from the Company's internal databases is governed by the Company's internal policy.

If you have any questions regarding the grounds, conditions, procedures for changing or deleting the personal data of Buyers, please contact the Online Platform at shop@newproducts.com with the subject line ‘Personal Data’. 

11. Withdrawal of consent to the processing of personal data

The Buyer may withdraw their consent to the processing of personal data at any time by sending a request to the email address: shop@newproducts.com with the subject line ‘Personal data’. In this case, the Company's employees will review such a request for the deletion of personal data and delete the Buyer's personal data from the Company's information systems.

The withdrawal of the Buyer's consent to the processing of their personal data will not affect the processing of personal data that was carried out prior to such withdrawal and will not prevent the processing of personal data on other legal grounds.

12. Personal data of order recipients

Informing personal data subjects about the processing of their personal data is important to the Company. The Company is bound by this obligation even if the personal data is not obtained from the personal data subject, namely if the personal data is obtained from the Buyer about the order recipient. In some cases, the Company does not have sufficient information about the recipient of the order (including the absence of contact details), so the Company cannot directly contact the recipient of the order and/or inform them immediately after the Company receives data about them from the Buyer.

In cases where the Buyer is not the subject of the personal data, the Company suggests and recommends that the Buyer inform the recipient of the order about the existence of this Policy. The Buyer is obliged to share a link to this Policy with the recipient of the order in advance, and by doing so, the Buyer confirms that they have done so and have received the unambiguous consent to the processing of personal data in accordance with this Policy from the recipient of the order and that they will provide such consent at the request of the Company.

13. Amendments to the Policy

The Company may unilaterally update this Policy from time to time. The Company will notify Buyers of any material additions or changes to this Policy. If the Buyer does not agree with any such significant additions or changes that may be made in the future, they should not use the Website. The Company may also make other changes to these Terms and Conditions without prior notice to the Buyer, so the Company recommends that you check these Terms and Conditions regularly.

The new version of the Terms and Conditions shall come into force from the moment it is posted on the Online Platform, unless otherwise provided by the new version of the Terms and Conditions. The current version of the Terms and Conditions is always available at: ADDRESS.

Date of last revision: 14 August 2024