Woola OÜ
DATA PROTECTION CONDITIONS
Woola OÜ ("Woola" or "we") believes it is important that customers ("you" or "your") understand when we collect their personal information and how we use it. The purpose of this Privacy Policy is to explain the terms and conditions of our use of personal data.
This Privacy Policy applies to all individuals who visit our website www.woola.io, make a purchase from our online store, or send us a request that contains personal information.
Woola reserves the right to unilaterally modify this Privacy Policy in the event of changes in the legislation governing the protection of personal data or in our own data processing. We will notify you of any changes 1 month before the changes take effect on our website. The latest version of the Privacy Policy will always be available on our website woola.io.
Definitions
In order to help you better understand our privacy policy, we explain the main terms related to data protection.
The GDPR is the EU General Data Protection Regulation (EU) 2016/679, which became applicable on 25 May 2018 and applies to all EU Member States.
Personal data is any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, by reference to a name, an identification number, location data, a network identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing is any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, alignment or combination, restriction, erasure or destruction, by transmission, dissemination or otherwise making available.
The controller is the person who decides why and how personal data are processed.
Processor is the person who processes personal data on behalf of and under the instructions of the controller.
1. The controller of your personal data:
Woola OÜ
Registrikood: 14926072
Aadress: Võru maakond, Setomaa vald, Kostkova küla, Võsu, 64008
E-post: hi@woola.io
2. What personal data do we collect and process?
When contacting Woola - personal data included in the contact (e.g. name, e-mail address, telephone number, etc.).
When you visit our website - we collect and process information as set out in the cookie notice.
When sending direct marketing communications/offers - first and last name, email address and/or telephone number (depending on which channel you have chosen to send the communication). This is only if you have opted in to receive direct marketing communications from us.
All the data we process is provided by you voluntarily.
3. What is the purpose and legal basis for the processing of personal data?
We process your personal data for various purposes. Regardless of the purpose of the processing, there must be a legal basis for the use of the data for each purpose. In evaluating our processing of your personal data, we have identified four legal bases for our processing of your personal data as described below.
Processing of data necessary for the performance of a contract
Under this legal basis, we process data where it is necessary for the performance of a contract we have with you (e.g. to fulfil orders placed in our e-shop) or to take steps at your request prior to entering into that contract.
Processing necessary to comply with a legal obligation imposed on us
In certain cases, we have a legal obligation to process your data in a certain way (e.g. keeping accounting records, responding to requests from public authorities to the extent required by law). In such cases, neither we nor your data processing can be influenced.
Processing of personal data based on our legitimate interests
Legitimate interest means that we do not need to process your data directly for the performance of a contract, nor do we have a legal obligation to process your data, but we do need to process your data. For example, in order to develop our products and services - by profiling; to take the right business decisions - by making statistics, etc.
As we are not obliged to process data on the basis of legitimate interest by law or by contract between us, but we do not ask for your consent, you have the right under the GDPR to ask us for clarification of the processing on this basis and to object if you consider that the processing of your data on the basis of legitimate interest unduly affects your rights.
Processing of personal data based on your consent
If you consent, we will send you Woola newsletters and offers.
You will always have the right to withdraw your consent (individually or collectively) by contacting us at the email address in section 1 above. In the case of consent given for direct marketing, you can withdraw your consent via the "unsubscribe" link at the end of each marketing communication. If you withdraw your consent, we will cease to process your personal data for the purposes for which you gave your consent. Withdrawal of consent does not affect the lawfulness of the processing that was carried out on the basis of consent prior to the withdrawal of consent.
4. Who else processes your personal data?
Access to your personal data is only available to Woola employees who need to access the data in order to perform their job duties (i.e. on a need-to-know basis). Outside of Woola, the following persons have access to your data in the situations described below, where this is necessary for the purposes of the processing:
Persons providing services to us.
Public authorities and public bodies (e.g. Police and Border Guard Board, Consumer and Technical Protection Board, Data Protection Inspectorate): we will disclose your personal data only on the basis and to the extent provided by law.
We enter into data processing agreements with third parties processing data on behalf of Woola (processors) to determine the terms and conditions of data processing.
We do not store or transfer your data outside the European Economic Area.
5. How long do we keep your personal data?
We will retain your personal data for as long as required by applicable law or necessary to achieve the purposes of the processing described in these data protection conditions. Below are some examples of retention periods:
If you would like to find out more about the retention of your personal data, please send an enquiry to the email address in section 1 of this Privacy Notice.
6. Your rights regarding your personal data
Right of access - you have the right to know what data we collect about you, the purposes for which we process it, to whom we disclose it, for how long we keep it, and your rights regarding restriction, rectification, erasure and processing. In order to respond to your request, we first need to identify who you are in order to avoid sharing your data with unauthorised persons. We have the right to respond to your request within 30 days.
Right to rectification - you have the right to request rectification of your personal data if it is inaccurate or incomplete.
Right to erasure - you have the right to request the erasure of your personal data in certain circumstances, in particular where the processing of your personal data is based on our legitimate interest or your consent (e.g. where we no longer need the data or where you withdraw your consent to the processing of your personal data).
Right to restriction of processing - you have the right to prohibit or restrict the processing of your personal data for a certain period of time in certain circumstances (e.g. if you have objected to the processing of your personal data).
Right to object to processing - you have the right to object to processing of personal data based on our legitimate interests, including profiling based on our legitimate interests. We will stop processing your personal data if you object, unless your personal data is processed for important legal purposes (which will be decided on a case-by-case basis).
Right to data portability - where the processing of personal data is based on your consent or on a contract between us and the data is processed automatically, you have the right to access the personal data you have provided to us in a structured, commonly used and machine-readable format. You also have the right to request that we send such data directly to another service provider where this is technically feasible (i.e. the other service provider is able to receive the data in the form transmitted).
If you wish to exercise any of the above rights, please contact us at the email address set out in section 1 of this Privacy Notice.
7. Right to lodge a complaint with the Data Protection Authority and to a court.
If you need more information about the processing of your personal data or the exercise of your rights, please contact us at the email address in section 1 of this Privacy Notice.
If you consider that the processing of your personal data is in breach of legal requirements, you have the right to lodge a complaint with the Data Protection Inspectorate and the courts in order to protect your rights and interests.