PRIVACY POLICY

• Scope of Application

1.1. This Privacy Policy applies to personal data collected and processed at OREA platform. The Privacy Policy is construed in accordance with the Regulation (as defined hereinafter) and other legal acts regulating the personal data protection in the Republic of Croatia.

1.2. Personal data is each data related to identified or identifiable person. Accordingly, this Privacy Policy will be applied to all users of OREA platform – private persons, while it will be applied to the users of OREA platform – business entities only to the extent applicable for the private persons (e.g. name and surname and contact data of the contact person within the business entity).

1.3. For the purpose of easier understanding, the terms in this Privacy Policy will have the following meanings:

• Definitions

“OREA” means OREA platform at which the manner and purposes of data processing are defined by the company Orea Bazaar d.o.o. having the seat in Zagreb, Lanište 18, Republic of Croatia, registered with the Court Registry of the Commercial Court in Zagreb under the registration number (MBS): 081451658, PIN: 23385133976

“User” means each private person having registered user's profile at OREA, as well as business entity only to the extent to which it, in its User's profile, discloses personal data of a private person (e.g. contact person)

“Supervisory body” means the public body with the investigative, corrective and consultative competences for data protection topics; the supervisory body in the Republic of Croatia is the Agency for Personal Data Protection

“Privacy Policy” means this policy by which OREA provides a complete information to the Users on the processing of their personal data

“Recipient of personal data” means any private or business entity to whom OREA proceeds or make available the personal data collected and processed at OREA platform

“Regulation” means the Regulation (EU) 2016/679 of European Parliament and Council (General Regulation on Data Protection) which has entered into the force on 25 May 2018

2.1. OREA processes Users' personal data taking into account the following personal data protection principles:

• personal data is processed in a lawful, fair and transparent manner,

• personal data is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes,

• personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed,

• personal data is accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay,

• personal data can be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed,

• personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

OREA can process the Users' personal data on one of the following legal basis:

• processing is necessary for the performance of a contract to which the User is party or in order to take steps at the request of the User prior to entering into a contract;

• processing is necessary for compliance with a legal obligation to which OREA is subject;

• processing is necessary in order to protect the vital interests of the User or of another natural person;

• processing is necessary for the performance of a task carried out in the public interest;

• processing is necessary for the purposes of the legitimate interests pursued by the OREA or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data

• Processing having the purpose of service providing at OREA

3.1. OREA processes the Users' personal data disclosed directly by the User in its User's profile, as it follows:

a) Name and surname, delivery address, e-mail address, contact number

b) Date of the birth

3.2 Personal data stated in Art 3.1.a) are necessary for the purposes of performing the service due to which the User has registered its account at OREA. Legal basis for this processing is performance of contractual obligations, having in mind that, by creating the User’s account, the User has accepted the General Terms and Conditions and, therefore, has entered into the contractual relationship with OREA.

3.3. OREA processes the data stated in Art 3.1.b) for the purpose of sending the birthday greetings and/or birthday benefits. Disclosing this data is optional i.e. the Users are not due to disclose these data to register the User’s account.

3.4. Besides the data disclosed directly by the Users, as defined in Art 3.1., OREA processes User’s personal data collected in indirect manner, i.e. based on the User’s activity at the platform as it follows:

• Data on realized purchases – time of the purchase, type of the purchased product and purchase price amount

OREA processes these data with the purpose of providing the customer’s support in course and after the sale and purchase process, after which OREA creates statistical data with the purpose of market examination and improvement of the sale process. From these statistical data it is not possible to identify the person who realized specific purchase of the product at OREA platform.

3.5. Data related to the bank account used for purchasing the product at OREA platform are encrypted i.e. anonymized. Therefore, OREA does not have access to this category of personal data of the buyers. OREA has access to this category of personal data of the sellers, exclusively for the purpose of transferring the monetary funds achieved by selling the product at OREA to the seller’s bank account.

3.6. OREA does not process the special categories of Users’ personal data (data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation).

• Newsletter delivery

3.7. OREA will, from time to time, send the newsletter to the Users and/or unregistered visitors. Legal basis for sending the newsletter is explicit consent. Users and/or unregistered visitors can, at any time, waive the consent i.e. deregister themselves from the list of newsletter recipients. Deregistration from the newsletter list does not affect the lawfulness of OREA's operations in the period before the consent has been waived.

• Personal data collected via contact form

3.8. Personal data sent to OREA via contact form will be visible and available only to persons authorized by OREA and will be processed only pursuant to the purpose with which the User has directed the message or inquiry via contact form. Your contact data sent to OREA via contact form will be processed only with the purpose of replying to your inquiry

• Personal data collected via customer service chat

3.9. After the communication at service chat is finished, OREA will remember the content exchanged via chat within next 2 weeks only with the purpose of creating the short-term evidence and trying to remove the obstacles that the User had in course of using the platform, and which the User exposed to the customer service via chat.

4.1. In case where the User wants to deactivate the user’s account at OREA, this can be done at any time by selecting the option “Deactivate the User’s account” which is available at user’s profile. By deactivation of the account, all User’s personal data will be erased.

4.2. OREA will deactivate the user's account of the User who is passive at platform, i.e. who has not been using the platform in time period longer than a year. In such case, OREA will, upon the expiry of such time period, inform the User of the lack of the activity and warn that the User's account will be deactivated in case where there would be no visible User's activity on the account within 30 days as of the day of sending such warning. In case where, upon the expiry of 30-day period, there would be no visible User's activity on the account, OREA will deactivate the User’s account. By the deactivation of User’s account, all User’s personal data will be erased.

4.3. The Users who deactivated their User's account, as well as the Users to whom the User's account was deactivated by OREA pursuant to this Article, can activate the User's account again, whereas they will be requested to disclose all personal data again.

• Personal data recepients

5.1. The categories of OREA's business partners who can have acces to the personal data processed by OREA are as it follows:

• The Sellers who sell their products at OREA

• Hosting service provider

• Newsletter service provider

• IT support

5.2 OREA has the contracts with the suppliers which regulate and warrant personal data protection.

5.3 Buyers’ personal data protection will be processed by the Sellers whose products were bought at OREA. Having registered the virtual shop at OREA, the Sellers confirm and warrant that they will process the Buyers’ personal data pursuant to personal data protection principles according to the Regulation. OREA neither warrants, nor is liable for obeying the personal data protection rights by the Sellers.

• Links to other web-pages and social media

5.4 OREA can publish the links to the web-pages of its partners or to social media profiles where OREA has the user’s account (Facebook, LinkedIn, Instagram, Twitter, YouTube).

5.5. OREA can not warrant and is not liable for personal data protection status on such web- pages and/or social media. The Users are due to get familiar with the privacy policy at those pages and/or social media and use it on their own liability. OREA will not bear any liability for any unlawfulness, including the lack of compliance of the web-pages and/or social media with the Regulation.

6.1. OREA uses the cookies. A cookie is a text file that a OREA stores on your computer. The cookies are neither directed to spying of you as a user, nor represent a malware code or virus. Also, the cookies are not connected with the spam messages. Some of the cookies are intended for the marketing purposes, some of them are not. Information such as your name and other information enabling your identification will not be stored. Web page cannot have access to your personal information of files in your computer.

• Functional cookies – we use these cookies in order to make this web page functional, i.e. that you can browse it and use all its features normally. For example, these cookies enable the moving on web page or they are necessary to send the inquiry via contact form functionally. Also, these are so-called „session cookies“, meaning that they are placed on your computer only during your visit to this web page, after which they are deleted.

  You do not have a possibility to manage the functional cookies by adapting the properties of your browser. Using the functional cookies is a necessary prerequisite for visiting our web page and in relation to them the consent is not collected.

• Analytical cookies – these cookies collect your IP address, the time of the visit to the web page, as well as the time spent on it, the data about specific content you approached on the web page and the data about the model of the machine from which you approach to the web page. We do not collect your personal data with which we can identify you directly, such as user name, email address etc. The aim of using the analytical cookies is to, without discovering our identity, establish the statistics of visiting the web page in order to understand which contents you like the most, to develop the web page accordingly and to make it, as much as possible, adapted to your needs.

  You have a possibility to manage these cookies on your cookies’ bar visible at OREA web page. These cookies are active only upon your opt-in (consent). You can revoke the consent (opt-out at any time).

7.1. The User has a right to the access, deletion and limitation of personal data processing. The Users can object to processing the personal data processed on basis of the legitimate interest. The Users can, at any time, waive the consent for the processing based on consent.

7.2. The Users can get the information on collection of personal data, as well as to file objections and requests for the realization of the personal data rights through contact form at web-page or by sending the inquiry at email [email protected]. The Users can file the objection to the Supervisory body in the Republic of Croatia – Agency for Personal Data Protection via email [email protected] or to the Supervisory body in the country of the User’s domicile.

7.3. n case where the inquiry would be related to the reclamation and/or quality of the service and/or would in any manner related to the product/service bought at OREA or related to the personal data processing by the Seller, the Users are due to direct such complaints/inquiries directly to the Seller on contact data stated in the Seller’s profile or in email with the confirmation order. In case where the User would direct such complaint/inquiry to OREA, OREA will forward the complaint/objection to the Seller in matter and inform the User thereof. OREA will not be authorized for giving the response and/or undertaking any other activity upon receipt of such complaint/ objection.

8.1. OREA reserves the right to amend and supplement this Privacy Policy.

8.2. All amendments and supplements of this Privacy Policy will be created and published in the same manner as this Privacy Policy. The Users will be informed of the amendments and supplements during the first next visit to OREA or via e-mail.

This Privacy Policy has been updated on 4 November 2022.