Safe shopping

1. Introduction

Scope

1.1. This Privacy Policy applies to personal data collected and processed through the OREA platform. It has been drawn up in accordance with the Regulation (as defined below) and other legal acts governing the protection of personal data in the Republic of Croatia.

1.2. Personal data means any information relating to an identified or identifiable individual. Accordingly, this Privacy Policy applies to users of the OREA platform who are natural persons, and to business users only to the extent that the data relates to natural persons (for example, the name and contact details of a contact person at the business).

1.3. For ease of reference, the terms used in this Privacy Policy have the following meanings:

Definitions

"OREA" means the OREA platform, on which the means and purposes of processing personal data are determined by Orea Bazaar d.o.o., with its registered office at Lanište 18, Zagreb, Republic of Croatia, entered in the court register of the Commercial Court in Zagreb under registration number (MBS) 081451658, OIB 23385133976.

"User" means any natural person with a registered account on OREA, and a business entity only to the extent that it enters the data of a natural person (for example a contact person) through its user profile.

"Supervisory authority" means a public authority with investigative, corrective and advisory powers over personal data protection; in the Republic of Croatia this is the Personal Data Protection Agency (AZOP).

"Privacy Policy" means this policy, which gives Users complete information about how OREA processes their personal data.

"Recipient of personal data" means any natural or legal person to whom OREA discloses or makes available personal data collected and processed through OREA.

"Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation), which took effect on 25 May 2018.

2. Core principles and legal bases for processing personal data

2.1. OREA processes Users' personal data in line with the following data protection principles:

• personal data is processed lawfully, fairly and transparently;
• personal data is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes;
• personal data is adequate, relevant and limited to what is necessary for the purposes of processing;
• personal data is accurate and, where necessary, kept up to date; every reasonable step is taken to erase or rectify inaccurate data without delay, having regard to the purposes of processing;
• personal data is kept in a form that permits identification of the User no longer than is necessary for the purposes of processing;
• personal data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

OREA may process Users' personal data on one of the following legal bases:

• the User's consent to processing for a specific purpose;
• performance of a contract to which the User is a party, or steps taken at the User's request before entering into a contract;
• compliance with OREA's legal obligations;
• protection of the vital interests of the User or another person;
• performance of a task carried out in the public interest or in the exercise of official authority;
• OREA's legitimate interests, except where those interests are overridden by the User's interests or fundamental rights and freedoms.

3. For what purposes and on what basis does OREA collect users' personal data?

Processing personal data in order to provide the service

3.1. OREA processes the personal data a User enters directly into their profile, as follows:

3.2. The personal data listed under 3.1(a) is necessary for OREA to deliver the service the User registered for. The legal basis for processing it is performance of contractual obligations, given that by activating an account the User accepted the Terms of Business and thereby entered into a contractual relationship with OREA.

3.3. OREA collects the data listed under 3.1(b) in order to send the User birthday greetings and/or birthday benefits. Providing this data is optional — Users do not have to enter it to register a profile.

3.4. Besides the data OREA receives directly from the User under clause 3.1, OREA also collects personal data indirectly, from the User's activity on the platform, as follows:

Purchase data — the time of purchase, the type of item bought and the amount

OREA processes this data to provide customer support during and after a purchase, and then aggregates it into statistics for market research and improving the sales process. Those statistics do not allow any individual purchaser on OREA to be identified.

3.5. Bank account details used to make purchases are encrypted and anonymised, so OREA has no access to those categories of buyers' personal data. OREA does have access to sellers' bank details, solely in order to transfer funds earned on OREA to the seller's account.

3.6. OREA does not process special categories of personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data, or data concerning health, sex life or sexual orientation).

Sending the newsletter

3.7. OREA will occasionally send a newsletter to Users and/or unregistered visitors. The legal basis is explicit consent. Users and visitors may withdraw that consent at any time, or unsubscribe from the mailing list. Unsubscribing does not affect the lawfulness of OREA's processing before consent was withdrawn.

Personal data collected through the contact form

3.8. Personal data you send OREA through the contact form is visible and available only to authorised OREA staff, and is processed for the purpose for which you sent the enquiry or message. The contact details you provide are processed in order to reply to your enquiry.

Personal data collected through chat with customer service

3.9. After a conversation ends, OREA retains the chat content for at most 2 weeks, in order to record and try to resolve the difficulties or questions the User raised with customer service.

4. For how long does OREA process users' personal data?

4.1. A User who wishes to deactivate their OREA account may do so at any time using the "Deactivate account" option in the account interface. Deactivating the account erases all of the User's personal data.

4.2. OREA will deactivate the profile of a User who has been inactive — who has not used the platform for more than a year. In that case, once the period passes, OREA emails the User about the inactivity and warns that the account will be deactivated if no activity appears on the profile within 30 days of that email. If no activity appears after the further 30 days, OREA deactivates the account. Deactivation by OREA erases all of the User's personal data.

4.3. Users who deactivated their own account, and those whose account OREA deactivated under this clause, may reactivate it — all personal data will have to be entered again.

5. Disclosing personal data to third parties

Recipients of personal data

5.1. The categories of OREA business partners that may have access to personal data processed through OREA are:

• Sellers who sell products through the OREA platform
• The hosting provider
• The newsletter provider
• IT support

5.2. OREA has contracts in place with these providers that govern and guarantee the protection of personal data.

5.3. A buyer's personal data is also processed by the sellers whose products the buyer bought through OREA. By registering a virtual shop on OREA, sellers confirm and warrant that they will process buyers' personal data in line with data protection principles and the Regulation. OREA cannot guarantee, and is not responsible for, sellers' compliance with data protection rights outside OREA.

Links to other websites and to social networks

5.4. OREA may place links on its platform to its partners' websites or to the social network profiles where it has an account (Facebook, LinkedIn, Instagram, Twitter, YouTube).

5.5. OREA cannot guarantee, and is not responsible for, respect for Users' rights over their personal data on those websites or social networks. Users should read the privacy policies of those sites and networks and use them at their own risk. OREA bears no liability for any unlawfulness there, including any failure of those sites or networks to comply with the Regulation.

6. Cookies

6.1. The OREA platform uses cookies. A cookie is a piece of information a website you visit stores on your computer. Cookies are not there to spy on Users and are not malicious code or viruses, nor are they connected to unsolicited messages or spam. Some kinds of cookie serve advertising and some do not. Information such as a User's name, or anything else that could identify a User, is not stored. OREA cannot use cookies to reach personal information or files on a User's computer.

• Functional cookies — OREA uses these so the platform works, so a User can browse it normally and use all of its features. They make navigation possible, for example, and are required for a User to send an enquiry through the contact form. These are session cookies: they are stored on the User's computer only for the duration of the visit, and then deleted.

  Users cannot switch functional cookies off through browser settings or platform settings. They are a prerequisite for visiting the platform, which is why we do not ask Users to consent to them.

• Analytics/statistics cookies — this site collects your IP address, the time of your visit and how long you spend on the site, which content you opened, and the model of the device you use. It does not collect personal data that would identify you directly, such as a username or email address. The purpose is to build visit statistics without revealing your identity, so we can see which content you like most and develop the platform accordingly, making it as informative and as well suited to your needs as possible.

  Users can manage analytics cookies in the cookie settings. These cookies activate only after a User gives explicit consent, and that consent can be withdrawn at any time.

7. Users' rights and how to exercise them

7.1. Users have the right to access, erasure, rectification and restriction of processing. Where data is processed on the basis of legitimate interest, Users may object to the processing. Where it is collected on the basis of consent, Users may withdraw that consent at any time.

7.2. For information about the collection of your personal data, to object, or to exercise your data protection rights, write to us through the contact form on the site or at support@oreabazaar.com. You may also complain to the supervisory authority in the Republic of Croatia — the Personal Data Protection Agency, at azop@azop.hr — or to the supervisory authority in the country where you live.

7.3. Where an enquiry concerns a complaint, the quality of a product or service, or anything else about a product or service bought on OREA, or concerns a seller's processing of personal data, Users must address it solely to the seller, using the contact details shown on the seller's profile and in OREA's order confirmation email. If a User sends such an enquiry to OREA, OREA will forward it to the seller concerned and let the User know. OREA is not authorised to answer or otherwise act on such an enquiry.

8. Other provisions

8.1. OREA reserves the right to amend and supplement this Privacy Policy.

8.2. Any amendments will be prepared and published the same way as this Privacy Policy. Users will be notified of them the next time they visit OREA and/or by email.

This Privacy Policy was last updated on 4 November 2022.