Privacy policy
CONTENTS
Below is the contents preview of this Privacy Policy so that you can easily find the information on the processing of your personal data that concerns you.
1. . DATA CONTROLLER AND DATA PROTECTION OFFICER
2. PERSONAL DATA PROCESSED
а. Browsing data
b. Data voluntarily provided by the user
c. Data processed to fulfil services rendered online
d. Third-party data voluntarily provided by the user
e. Cookies
3. PURPOSES OF DATA PROCESSING
4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING
5. RECIPIENTS OF PERSONAL DATA
6. TRANSFER OF PERSONAL DATA
7. RETENTION OF PERSONAL DATA
8. RIGHTS OF DATA SUBJECTS
9. COMPLAINT TO THE DATA PRIVACY GUARANTOR AUTHORITY
10. AMENDMENTS
11. CONTACT US
12. DISCLAIMER
Personal data processing Policy is pursuant to Law of Ukraine 2297-VI dated 27.04.2024 “On Protection of Personal Data” (hereinafter “Law of Ukraine”), Articles 13 and 14 of EU Regulation 2016/679 on the processing of personal data (hereinafter “GDPR”)
KORA Llc., as Data Controller (hereinafter: “KORA” or “Data Controller”) pursuant to Law of Ukraine “On Protection of Personal Data” and Regulation EU 2016/679 (so-called The General Data Protection Regulation, hereinafter referred to as the “GDPR”) – considers privacy and the protection of personal data as one of its primaries. Consequently, we request you to carefully read this Privacy Policy before disclosing any personal data to the Data Controller.
This Privacy Policy refers to the websites https://www.kora.ua and https://www.kora.eu (hereinafter referred to as the “Website”).
This Privacy Policy is an integral part of the Website and the services we offer.
This Privacy Policy is intended to assist you in understanding what information we gather when you visit this Website, whether you are a registered user or not, and to describe how we use that information. If applicable, this Privacy Policy describes also how we process the information you may provide us or we collect about you, when you visit our Official Stores, or in the context of any other contacts you may have with us. This policy in supplemental to any other information you may have been provided in those and other circumstances.
This Privacy Policy applies to those who interact with the Website services, both during simple consultation and the use of specific services made available through the Website (by way of example, the purchase of products, the compilation of online information forms or newsletter subscriptions), as well as the use of other services provided through the Website (telephone assistance and assistance via WhatsApp, Viber, Instagram, FaceBook).
By visiting, registering on the official KORA Website, by using its services or, otherwise by interacting with us in our Official Stores, the User confirms that he has read and understood the terms of this Privacy Policy, the purpose of processing personal data specified in this Policy, the rights granted to the subjects of personal data and agree that KORA may collect, use, store, transmit and disclose the personal data collected through the Websites, Official Stores in accordance with this Privacy Policy by ticking the box “I agree to the Privacy Policy”.
If you do not agree to the terms of this Privacy Policy, please do not visit this Website, create an account and do not otherwise use or submit personal data to this Website, or do not opt-in when this option is offered to you pursuant to the applicable laws.
Please take into account that, on actively making your personal data available to us through any procedure, you guarantee that they are true and accurate, and you undertake to notify to us any change or modification of your data. You will be liable for any loss or damage caused by reporting erroneous, inaccurate or incomplete information in the registration forms. Please remember that, as a general rule, you must provide us only with your own data, not with those of third parties, other than to the extent otherwise permitted in this Privacy Policy.
The processing of personal data shall be governed by the principles of lawfulness, fairness and transparency, purpose and retention limitation, accuracy, integrity and confidentiality, as well as the principle of accountability, pursuant to Article 5 of the “GDPR”. Your personal data will therefore be processed in compliance with personal data protection legislation and the envisaged confidentiality obligations.
“Personal data processing” means any operation or set of operations which is carried out on personal data or sets of personal data, by automated means or otherwise, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1. DATA CONTROLLER AND DATA PROTECTION OFFICER
The Data Controller is KORA Llc., registered in May 20,1999 with registered office on Kutuzova 2A, 69071, Zaporozhye, Ukraine, date and number of entry in the Unified State Register of Legal Entities (Enterprises and Organizations of Ukraine) 1001037780026001302, September 23, 2021, identification number of the legal entity 22116246;
The KORA LLC employee responsible for data protection can be contacted at the legal address of the Operator specified above and by e-mail: info@kora.ua.
2. PERSONAL DATA PROCESSED
We inform you that the personal data we collect and process may consist of an identifier such as a name, surname, an identification number, gender, age/date of birth, location data, an online ID, one or more characteristic elements of physical, physiological, psychical, financial, cultural or social identity, which are necessary for identifying the needs of the interested party (a data subject) or making him/her identifiable, according to the type of services requested (hereinafter simply “personal data”).
KORA also collects and processes the details of your orders, returns, purchases and the services used by you, including the spending volume and items purchased, as well as your status as a customer and your purchase tastes and preferences.
The following personal data is processed through the Website:
- а. Browsing data
During their normal course of operations, the computer systems and software procedures used to operate this Website acquire certain personal data passively, the transmission of which is implicit in the use of internet communication protocols and tracking tools like browser cookies and other similar technologies. This information is not collected with the intent of associating it with identified users but, by its nature, it could lead to the identification of users through processing and association with data held by third parties. This category of data includes IP addresses or domain names of computers used by users who connect to the Website, URI addresses (Uniform Resource Identifiers) of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in reply, the numerical code indicating the status of the reply given by the server (successful, error, etc.) and other parameters regarding the user’s operating system and computer environment. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Website to check its correct functionality, to identify anomalies and/or abuses; in any case, they are deleted immediately after processing. The data may be used to ascertain responsibility in the event of computer crimes against the Website.
- b. Data voluntarily provided by the user
Except for references to specific information that may be available in the various sections of the Website, this Privacy Policy also addresses the processing of data voluntarily entered by you in the various forms on the Website, such as:
– the information request form in the “Contact Us” section, in which you will be asked to enter your name, your surname and your contact details – address, email address and telephone number – as well as to submit your specific request, which itself may contain further personal data;
– chats and messaging services, through which you may connect with KORA operator who will be able to assist you by responding in real time to your requests for information.
Regarding such data, we request you to enter in such forms and in chats and messaging services, only the personal data strictly necessary for the purposes of managing your request, thus excluding irrelevant information and/or details that may fall within the special categories: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data relating to the person’s health, sexual behavior or sexual orientation.
- c. Data processed to fulfil services rendered online
This Privacy Policy also addresses the processing of data voluntarily provided by you for the purpose of performing the services rendered online, with particular reference to the following:
– registration and access to your Personal Account which stores the data you have saved enabling processing of your personal data, contact information, shipping addresses and your product preferences;
– conclusion and execution of purchase contracts (including the order status verification service), in the context of which your personal data, contact details and information related to the delivery address of purchased products will be processed as well as any information concerning your shopping experience, including date, products or services provided, place of purchase, product codes, amount, total of sales, VAT number and confirmation of payments for Orders. Please note that, should you choose the Online payment method, WayForPay as independent data controllers will transmits information about the payment status and the data necessary for the shipment of the order to «KORA»;
– handling any returns/exchanges, in the context of which we shall process your personal data, such as complaints, returns, refunds, contact details and information regarding the returned products collection address, as well as any information related to your purchase and return/exchanges experience as allowed by applicable laws;
– customer-specific assistance to meet requests for guidance on sizes, product categories in the collections, body fit, new arrivals or other information;
– the «Wishlist» service, through which you can add items to your list of desired items to purchase.
Furthermore and in general, the Data Controller will process any information relating to your purchases (your purchase history including Official Stores, type and quantity of products, date of purchase, amount spent as well as, in general, your purchase choices, preferences, habits and profiles, wish list, preferred categories of products, color, style, sizes, materials and your browsing behavior on the Website) and, for profiling purposes, data obtained from your Website online activities, with and without personalized consequences, as better specified below.
- d. Third-party data voluntarily provided by the user
When using the services of the Website, personal data of third parties transmitted by you to the Operator may be processed (for example, in the case of purchasing goods to be sent to third parties, payments made using the bank details of third parties, invoicing and upon request for information in the “Contact us” section of the Website). In such cases, you act as an independent data controller and assume all the applicable legal obligations and responsibilities. To this effect, you fully indemnify us against any dispute, claim, request for compensation for processing-related damages/losses, etc. the Data Controller may receive from third parties whose personal data has been processed, through your use of the Website’s services, in violation of the applicable the personal data protection rules. In any case, if while visiting the Website you provide or otherwise use personal data of third parties, you assume all responsibility for this. Where necessary, you ensure that you have obtained the third party’s prior consent to the use of their personal information.
- e. Cookies and other tracking technologies
Information about cookies and other tracking technologies used on the Website is available here.
3. PURPOSES OF DATA PROCESSING
The main reason is that we need to process your data to perform the contract that you accept with us when you register and when you make a purchase or enjoy any of our services or functionalities.
We will process your personal data for the purposes mentioned below depending on how you interact with us, depending on the services, products or functionalities that you wish to enjoy.
We process, with your consent, only those personal data that are strictly necessary to achieve the following purposes:
3.1. to enable navigation of the Website, to manage the registration in the Personal Account, the deactivation of your account (following your request) and the provision of all other associated services provided by the Data Controller (including but not limited to, the «Wishlist» service, the “Contact us” section in relation to your requests, the verification of order status, the saving of the preferred delivery addresses of the goods purchased on the Website etc.), with the goal of management of Website security.
Providing your personal data for the purposes above is necessary, denial thereof would make it impossible to complete your request.
Unless otherwise required to comply with local applicable laws, data may be processed for these purposes without seeking your consent because this is necessary to follow up your request.
3.2. development, performance and execution of the purchase contract that you executed with us, product returns as well as fulfillment of contractual, administrative, accounting obligations and after-sales services, e.g. administrative activities, accounting, returns, warranties, fraud prevention, communicating with you, including by e-mail, for any problem relating to the handling of the order or to subsequent requests relating to the order.
Providing your personal data for the purposes above is necessary, denial thereof would make it impossible to complete your purchase.
Unless otherwise required to comply with local applicable laws, data may be processed for these purposes without seeking your consent because this is necessary to comply with the contractual and legal obligations;
3.3. to follow up specific requests addressed to the Data Controller, including after-sales service, requests to the customer support service and information sent by completing the relevant contact forms on the Website (for example, “Online return form”), as well as through chats in messengers;
We only process the personal data that are strictly necessary to manage or resolve your request or application.
The Website provides additional assistance services to the Customer, including, in particular, the telephone, Viber, WhatsApp, Facebook and Instagram Chats assistance services through which you can submit specific requests and receive assistance from «KORA»’s customer service.
When using social network chats or other partners as communication channels with KORA Customer Support, some of your personal data (including your name or username, phone number) will be imported from your social network or partner account. Also, be aware that the data you submit on these services will be available to the social network or partner and may be used in accordance with their privacy policy.
With reference to telephone assistance, we remind you that, subject to your consent, calls may be recorded to check, improve the quality of service and for internal training purposes;
Please note that, with respect to the Store locator service, the data controller for data relating to your geographical location and other information provided by you as part of this service is represented by Google.
3.4. to fulfil any obligations under applicable laws, regulations or legislation, or EU legislation (including anti-money laundering laws), or to satisfy requests from authorities, regulations;
3.5. to provide for direct sending – via post and email – of advertising, promotional materials and commercial proposals and announcements in relation to products or services similar to those purchased by you, unless you deny your consent to receive such material, which you can express during registration on the Website or on subsequent occasions;
3.6. to send you newsletters through automated tools (SMS, MMS, email, instant messaging and chats) and otherwise (post, telephone). Please note that the Data Controller collects a single consent declaration for the marketing purposes described here. If, in any case, you wish to oppose the processing of your data for marketing purposes carried out with the means indicated here, you can do so at any time by contacting the Data Controller at the addresses indicated in the “Contacts” section of this disclosure, without prejudice to the lawfulness of the processing undertaken prior to your opposition;
3.7. personalization of the services offered by us to provide you with recommendations based on the analysis of personal data, your user profile, information about product choices and preferences (for example, based on your purchase and browsing history), behavior when using the Website for the purpose of sending personalized messages, commercial and advertising offers, as well as for profiling in general;
3.8. showing you advertisements in the Internet:
The advertisements you see while visiting our Website and social media may be random, and in other cases may be related to your preferences or purchase and browsing history. If you use social media, we may provide certain information to the companies we collaborate with so that they , as joint controllers, can show you our brand advertisements and generally offer you and users like you advertising based on your profile on the relevant social networks. If you want to know about the use of your data and how social media advertising works, we recommend that you review the privacy policies of the social media sites on which you have profiles.
We also use your data to carry out measurement and segment analyses on the advertisements, which we show users on some of our collaborators’ platforms. To do this we collaborate with these third parties who offer us the necessary technology (for example, cookies, pixels, SDK) to use these services. Keep in mind that we may need to provide them with certain information or some form of identifier each time (for example, the advertising ID associated with the device, an identifier associated with a cookie, etc.). If you would like more information in this respect, please review our Cookies Policy. Likewise, you can reset your advertising ID or disable personalized ads on your device, adjusting your preferences in settings section of your device;
Your data which is processed for marketing and commercial communications on products, surveys and researches, market analysis (personal details, contact details, data regarding your habits and profile) is optional and free (based on your selective opt-in). You may unsubscribe or opt-out at any time. Denial to provide your personal data for both or one of these purposes does not prevent you, in any way, from using our services or making your purchases. However, we will not be able to inform you on the marketing initiatives and events described above and we could not understand your interests and offer you a more personalized shopping experience.
3.9. disseminating through our social media channels photographs or images that you have shared publicly with us and for which you have expressly consented to be used for the relevant purposes;
3.10. Data enrichment:
When we gather your personal data from a variety of sources, we may consolidate them under certain circumstances for the purpose of improving our understanding of your needs and preferences related to our products and services (including for the purposes of analyses, generating user profiles, marketing studies, quality surveys and improving our interactions with our customers). This refers, for example, to the way we may combine your information if you have a registered account and, using the same email linked to your account, you make a purchase as a guest, or to information which is automatically compiled (such as IP and MAC addresses or metadata) which we may link with the information you have provided us directly through your activity on the Website, Facebook, Instagram or in any of our stores (for example, information related to your purchases in physical stores or online, your preferences, etc.);
3.11. general profiling purposes, without personal implications, by means of generalized analyses (including predictive or strategic orientation) aimed at creating statistical processing and calculation models representative of the entire customer base. This purpose implies the processing of your data on an aggregate basis, in pseudonymised form, as a direct prerequisite and instrumental means for the pursuit of the purposes referenced in sections 3.5 and 3.6 of this disclosure albeit distinct from them;
3.12. to meet requirements related to any defensive needs of the Operator, to establish or defend a legal claim;
3.13. for statistical assessment and monitoring purposes. This purpose implies an analysis of aggregate information not referable to identified or identifiable natural persons and which, therefore, does not constitute personal data and does not in any way enable the Data Controller to trace your identity.
3.14. analysis of your user experience, to assess the level of satisfaction of our customers and users with the Site’s functions, as well as to determine areas for our improvement and to obtain the possibility of its implementation.
Specific security measures have been implemented to prevent data loss, illicit or incorrect use of data and unauthorised access.
4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING
The legal terms on which we are permitted to process your personal data also depends on the purpose for which we process them.
The legal basis for the processing of personal data for the purposes referenced in sections 3.1, 3.2 and 3.3 is Article 6, par. 1, point «b» of the “GDPR” (… processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), since the processing is necessary for the provision of services.
In order for you to register as a user of the Website and create a Personal Account on the KORA Website, we need to process your personal data, since we would otherwise be unable to manage your registration (section 3.1). We consider we have a legitimate interest to link to your account your purchases and the data collected through different channels your activity to your account.
Processing of Data for Contractual Purposes is mandatory since it is necessary to purchase products, as well as use the functionalities available on the Website and specific services offered by KORA (including but not limited to the online chat, delivery service etc.).
Failure to provide personal data for these purposes would make it impossible to activate the requested services themselves.
With respect to KORA’s customer support services, we consider that we have legitimate interest in answering the requests or queries raised by you through the existing different contact channels (section 3.3). We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised.
When you get in touch with us, in particular, for the management of incidents related to your order or the product acquired, the processing of your data is necessary to perform the purchase contract. When your request is related to the exercise of your rights on which we inform you below, or to claims on our products, we are legally permitted to process your data for compliance with our legal obligations.
With specific reference to the telephone assistance service referenced in section 3.3, please note that the recording of calls to check the quality of the service can be disabled upon your request.
The purpose referenced in section 3.4 represents a legitimate processing of personal data pursuant to Article 6, par. 1, point «c» of the “GDPR” (..processing is necessary for compliance with a legal obligation to which the controller is subject). In fact, once the personal data has been submitted, the processing must comply with the legal obligations incumbent on the Data Controller.
Processing of Data for Law Purposes is mandatory since it is required by the applicable laws. If you do not provide your Data, it would not be possible for KORA to provide the products or services that you request.
The processing performed for the purposes referenced in sections 3.5, 3.6, 3.7 and 3.8 is based on your consent pursuant to Article 6, par. 1, point «a» of the “GDPR” (… the data subject has given consent to the processing of his or her personal data for one or more specific purposes) and to Article 22, par. 2, point «c» of the “GDPR”. This consent can be revoked at any time without prejudice to the lawfulness of the processing carried out prior to the revocation in accordance with the provisions of Article 7 of the “GDPR”.
Therefore, the provision of your personal data for these purposes is not mandatory, is entirely optional, is subject to your prior consent, and does not affect the use of the services and which, in any case, may be withdrawn at any time. If you wish to object to the processing of your data for Marketing, Profiling or Communication purposes, you may contact the Data Controller, at any time, using the contact details provided in the “Contact Us” section of this Privacy Policy disclosure or, where available, via the Privacy Settings found within your Personal Account.
With reference to the purpose referenced in point 3.5, please note that the Data Controller uses details provided by the data subject (post or email information) for the purposes of direct sales of its products or services. In doing so, we may refrain from requesting the consent of the data subject, provided that the products or services are similar to those purchased by the data subject who is properly informed and does not refuse such use, initially or on the occasion of subsequent communications.
We are legally permitted to process your data for marketing purposes due to the consent that you give us, for example when you accept receiving customized information through various channels, when authorizing the sending of push notifications in your device, when you configure it in the privacy settings of your device, when you consent through the cookies settings, to offer you personalized services or to show you customized information, as well as to engage in data enrichment (clause 3.10).
We consider that we have a legitimate interest to conduct a profiling (clause 3.7) with the information that we have about you (such as your browsing, preferences or purchase history) and the personal data that you have provided us, such as the age range or language, since we understand that the data processing of these data is also beneficial to you because it allows you to improve your user experience and access the information in accordance with your preferences.
The processing, referenced in section 3.11 is carried out in order to pursue the legitimate interest of the Data Controller pursuant to Article 6, par. 1, point «f» of the “GDPR”.
It is also specified that the processing, referenced in section 3.12 is carried out to meet any defensive needs of the Data Controller pursuant to Article 6, par. 1, point «f» of the “GDPR”. It should be noted that the processing, referenced in section 3.13, since it does not address personal data, does not fall under the scope of personal data protection regulations and can therefore be freely undertaken by the Data Controller.
5. RECIPIENTS OF PERSONAL DATA
We will only provide to third party companies and organizations only the personal data required to deliver the services and will prohibit them from using that personal data for any other purpose.
Our affiliated companies will process your personal data as data processors upon our instructions.
Your personal data, which is strictly necessary to fulfil the purposes set out in section 3 of this Privacy Policy disclosure, may be shared with:
5.1. persons and employees authorised by the Data Controller to process personal data (e.g. staff operating in sales, administration and accounting, after-sales assistance, CRM and IT systems management);
5.2. third parties, service providers (by way of example: technological services, assistance and consultancy services in accounting, administrative, legal, tax and financial matters, technical maintenance, transport services, banking, insurance and IT services), which typically act as data processors pursuant to Article 28 of the “GDPR”. The Data Controller keeps an up-to-date list of the appointed data processors and guarantees that this list may be viewed by the data subject at the aforementioned office or upon request to the addresses indicated in «Contact us» section of this Policy.
5.3. companies and entities within the “KORA” group, including but not limited to its official partners and representatives, official distributors, dealers, and retail representatives (hereinafter: “KORA”; may be referred to as “us ” and “we”) acting on the basis of legitimate goals and interests in accordance with Art. 6, par. 1, point “f” and considering Art. 47 and 48 of the “GDPR” in the interests of itself and other companies within the “KORA” group;
5.4. third parties responsible for carrying out the activities referenced in this Privacy Policy with which «КORA» has entered into commercial agreements;
5.5. individuals, entities or authorities who require the disclosure of your personal information as mandated by law of the EU or of a Member State or by order of the authorities in response to legal proceedings, in response to a request from a law enforcement agency under legitimate basis, or to protect our rights, privacy, safety or property, or the public.
5.6. companies providing payments management, and anti-fraud controls acting independently as data controllers, for providing you with the online sales services.
5.7. third parties (to the extent permitted by law) in the event of a complaint about your use of the Website and, where we deem it necessary to investigate, prevent or take measures regarding illegal activities, suspected fraud, or where we believe, at our sole discretion, that your use of the Website is incompatible with the terms of the Website. These subjects are collectively defined as “Recipients”.
6. TRANSFERS OF PERSONAL DATA
Some of your personal data is shared with Recipients who may be situated outside the European Economic Area. The Data Controller ensures that these Recipients process your personal data in compliance with Articles 44–49 of the “GDPR”. With regard to the transfer of personal data to third countries, the Data Controller declares that the processing will be undertaken according to one of the methods permitted by current legislation, such as the consent of the concerned party, the adoption of Standard Clauses approved by the European Commission, the selection of subjects adhering to international programmes for the free dissemination of data or operating in countries considered as secure by the European Commission based on an adequacy decision. Further information is available by sending a written request to the Data Controller at the addresses indicated in the «Contact Us» section of this Privacy Policy.
7. RETENTION OF PERSONAL DATA
The time for which we will keep your data will depend on the purposes for which we process them.
Your personal data will be entered and stored, in accordance with the principles of minimization and retention limitation in the information systems and on servers of the Data Controller (Article 5, par. 1, point «c» and «f» of the “GDPR”).
The personal data processed for the purposes referenced in sections 3.1 and 3.2 will be retained for the time strictly necessary to achieve those same purposes (in case of a Personal Account created on the KORA Website), i.e. for the time necessary for the execution of the contract, for the provision of legal or conventional guarantees, in accordance with the conservation required by law for accounting purposes (mandatory requirements regarding the storage periods of documents for tax purposes, etc. – 10 years), as well as for the time, which is necessary to resolve issues with the products you have purchased, including possible returns, complaints or claims about those products.
To manage your user registration and Personal Account we will process your data for the time during which you remain a registered user (meaning, until you decide to cancel your registration and unsubscribe).
Personal data processed for the purpose described in section 3.3 will be stored for the time necessary to meet your request, application or inquiries.
Personal data, processed for the purposes set out in section 3.4, will be retained for the time stipulated by the specific obligation or applicable law.
For the Law Purposes, your Data are stored in accordance with the specific limitation periods defined by law.
For the purposes set out in section 3.5, your personal data will be processed until you present an objection to its processing.
As for the newsletter service (section 3.6), your Data will be processed until you unsubscribe from the service and/or you exercise your right to oppose to such communications by clicking on the link available in the end notes of each communication received.
Conversely, for the purposes referenced in sections 3.6 and 3.7, your personal data will be retained until the revocation of your consent and, in any case, limited to the purpose referenced in section 3.7 and the activities connected to it, for no more than seven years, starting from their registration in acceptance of the preliminary verification request presented by the Data Controller.
We will show you personalized advertisement (section 3.8) until you change your device, browser and or cookies settings so that permission to do so is revoked.
For all Marketing Related Legitimate Interest Purposes, Profiling and Communication Purposes your Data are stored for a for a limited period of time in accordance with the time limits permitted by applicable law (7 years from the last purchase done and/or from the last contact with you) notwithstanding your right to object to the processing at any time.
Upon revocation of consent or expiry of the seven-year retention period (if preceding), the data processed for the purposes referenced above will be permanently deleted, aggregated or anonymized.
In general and in any case, the Data Controller reserves the right to retain your data for the time necessary to fulfil any regulatory obligation to which it is subject or to meet any defensive needs (Article 3.12). In any case, the Data Controller may retain your personal data for the time provided and allowed for by law to protect their interests.
It should be noted that, if your account is deactivated, your personal data will continue to be processed by «КORA» in compliance with the criteria and principles highlighted above for the entire period coinciding with this deactivation (equal to 12 months). It should also be noted that, compatibly with the aforementioned criteria and principles, КORA will retain such data also after the expiry of this term and in the event of total removal of your account. Therefore, please note that the expiry of the aforementioned term and the total removal of your account will not necessarily involve the deletion of your personal data or the revocation of the privacy consents legitimately provided by you. For more information regarding requests for data cancellation and withdrawal of consent, please refer to point 8 “Rights of data subjects” of this Privacy Policy.
Further information regarding the data retention period and the criteria used to determine this period may be requested via a written request sent to the Data Controller at the addresses indicated in the “Contact Us” section of this Privacy Policy.
8. RIGHTS OF DATA SUBJECTS
We undertake to keep your personal data confidential and to ensure that you may exercise your rights.
As a Data Subject, you can exercise the rights referenced in the Law of Ukraine 2297-VI dated 27.04.2024 “On Protection of Personal Data”, in Articles 15–22 of “GDPR” 2016/679 (GDPR – General Data Protection Regulation), and revoke the consent given at any time without prejudice to the lawfulness of the processing undertaken before the revocation.
In particular, you may request access to your Personal Data (Article 15 GDPR), its rectification (Article 16 GDPR), cancellation (Article 17 GDPR), restriction of processing in the cases envisaged by Article 18 of the GDPR as well as to obtain the portability of data related to you in the cases envisaged by Article 20 of the GDPR.
You may submit a request for opposition to the processing of your Personal Data pursuant to Article 21 of the GDPR, in which you may evidence the reasons justifying the opposition. the Data Controller reserves the right to assess your request, which may not be accepted if there are legitimate compelling reasons to proceed with the processing that prevail over your interests, rights and freedoms.
Requests should be sent in writing to the Data Controller at the addresses indicated in the “Contact Us” section of this Privacy Policy.
If you created a Personal Account on KORA Website, you can exercise your privacy rights at any time by changing your privacy preferences and setting in the dedicated section of your Personal Account.
9. COMPLAINT TO THE DATA PRIVACY GUARANTOR AUTHORITY
If you have doubts, questions or complaints with regard to the collection and processing of your Data, or your wish to exercise one of your privacy rights above, please contact KORA by sending an e-mail to the following address info@kora.ua.
If you believe that the processing of your personal data by the Data Controller is undertaken in violation of the provisions of the “GDPR” mentioned above, you have the right to lodge a complaint with the Data Privacy Guarantor Authority, as envisaged by Article 77 of said “GDPR”, or to seek redress through the appropriate legal channels and judicial bodies (Article 79 of the GDPR).
You have the right to file a claim before the responsible data protection regulatory authority:
- to contact the Human Rights Commissioner of the Verkhovna Rada of Ukraine: http://www.ombudsman.gov.ua
- to the European Data Protection Board (EDPB):https://edpb.europa.eu/aboutedpb/board/members_en,
- to contact the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html .
Please note that, notwithstanding anything stated in this document, you retain all rights established by the Law of Ukraine “On Personal Data Protection.”
10. AMENDMENTS
The Data Controller reserves the right to modify or simply update the content of the Privacy Policy, wholly or partially, also as a result of variations in the applicable legislation. Therefore, the Data Controller invites you to regularly visit this section to keep up-to-date with the most recent and updated version of the Privacy Policy in order to always be informed on the data collected and how «KORA» uses it.
11. CONTACT US
To exercise the above rights or for any other requests, please write to the Data Controller at the physical address indicated above, or by e-mail info@kora.ua, or via the dedicated contact forms on the Website, preferably writing “request for the exercise of privacy rights” in the subject field.
12. DISCLAIMER
We have implemented appropriate measures designed to secure your personal data from accidental loss and from unauthorized access, use, alteration and disclosure. For example, when you provide any order information, we use Secure Socket Layer (SSL) technology, an encryption tool that provides security while transmitting this information over the Internet. We also use password controls, and other technological and procedural safeguards in maintaining this Website.
The KORA Website has implemented the above sufficient security measures to protect information on this Website, but please take into account that 100% security is not possible and there is no absolutely safe and error-free way of data transmission over the Internet. Therefore, your providing of your personal data is done at your own risk and, to the greatest extent permitted under applicable law, we shall have no liability as a result of the disclosure of your personal information due to errors, omissions or unauthorized acts of third parties during or after the transmission thereof to us. We recommend you to periodically update your software for protecting data transmission over networks (for example, antivirus software) and check that your provider of electronic communication services has adopted suitable means for the security of data transmission over networks (for example, firewalls and ant spamming filters); keep confidential, and not to disclose to any else, your username and password to access to your account; and to change your password from time to time.
In the unlikely event we believe that the security of your personal information in our possession or control was or may have been compromised, we will notify you of that development as required by applicable law using any of the methods prescribed thereunder (by providing us with your email address, you hereby consent to receiving any such notification in electronic form through such email address).
KORA is not responsible for the operation of servers, providers of Internet access services, the work of third parties, due to whose fault access to the site may be impossible or limited, the possible leakage of information due to the fault of third parties, as well as for the User’s disclosure of his personal data, including authorization data on the KORA Website.
Please note that, notwithstanding anything stated in this document, you retain all rights established by the Law of Ukraine “On Personal Data Protection.”
LAST MODIFIED
This policy is effective 28.12.2024
