Trends in women fashion | Autumn Winter 2019 | Oysho
ENTORNO DE PRUEBA / TEST ENVIRONMENT

OUR PRIVACY POLICY AT A GLANCE

  1. WHO WE ARE. We are ITX E-Commerce (Shanghai) Co., Ltd, OYSHO Commercial & Trading (Shanghai) Co., Ltd., and OYSHO ESPAÑA, S.A (hereinafter collectively referred to as "We") and we process your personal data as joint controllers. This means that we are jointly responsible for how we process and protect your data. See more.

  2. WHAT WE USE YOUR DATA FOR. We will use your data (collected online or in person), among other purposes, to manage your registration as a user, to manage your purchases of products or services, to respond to your queries, and, if you wish, to send you our customised communications. See more.

  3. WHY WE USE YOUR DATA. We have legal standing to process your data for various reasons. The main reason is that we need to process your data to perform the contract that you accept with us when you register and when you make a purchase or enjoy any of our services or functionalities. We also use your data for other reasons, for example, to respond to your queries or to send you newsletters that you have asked to receive from us. See more.

  4. WHO WE SHARE YOUR DATA WITH. We share your data with service providers who provide us with assistance or support, these being companies in the holding company of the Inditex Group - Industria de Diseño Textil, S.A. (Inditex, S.A.) or third party providers. See more.

  5. YOUR RIGHTS. You have the right to access, rectify or delete your personal data. In certain cases, you are also entitled to other rights, such as, for example, to object to us using your data, or to transferring your data, as explained in depth below. See more.

We encourage you to read our full Privacy Policy below to understand in depth the manner in which we will use your personal data and your rights over your data.

*******

BEFORE YOU START …

 

  1. WHO IS THE CONTROLLER OF YOUR DATA?

Your data controllers are:

In other words, the companies above (jointly “We”, “Us” or “the Joint Controllers”), are Joint Controllers of the data. This means that we have regulated and are jointly responsible for processing and protecting your personal data.

  1. WHY WE PROCESS YOUR PERSONAL DATA

Depending on the purpose for which we process your data from time to time, as explained above, we need to process one or other data, which will in general be, depending on each case, as follows:

Remember that, when we ask you to fill in your personal data to give you access to any functionality or service of the Platform, we will mark certain fields as compulsory, since this is information that we need to be able to provide the service or give you access to the functionality in question. Please take into account that, if you decide not to make such data available to us, you may be unable to complete your user registration or may not be able to enjoy those services or functionalities.

Depending on how you interact with our Platform, i.e., depending on the services, products or functionalities that you wish to enjoy, we will process your personal data for the following purposes:

PURPOSE

+ info

1. To manage your registration as user of the Platform

If you decide to become a registered user of our Platform, we need to process your data to identify you as a user of the Platform and grant you access to its various functionalities, products and services available to you as a registered user. You may cancel your registered user account by contacting us through Customer Service.

 

2. For the development, performance and execution of the purchase or services contract that you executed with Us on the Platform

This purpose includes processing your data, mainly:

  • To contact you for updates or informative notices related to the contracted functionalities, products or services, including quality surveys and to be able to establish the degree of customer satisfaction with the provided service;

  • Activate the necessary arrangements in order to control and prevent potential fraud against you and against us during the purchase process. If we consider that the transaction can be fraudulent, this processing may cause the blocking of the transaction.

  • To manage potential returns after you have purchased and manage requests of availability information for articles, reservations of products through the Platform, depending on the availability of such options from time to time.

  • For invoicing purposes and to make available to you the tickets and invoices of the purchases you have made through the Platform.

  • To ensure that you are able to use other available functionalities or services, such as the purchase, management and use of the Gift Card or of the Gift Voucher.

3. To meet requests or applications that you make through the Customer Support channels

We only process the personal data that are strictly necessary to verify your identity, and to manage or resolve your request or application.

4.  For marketing purposes.

This purpose includes the processing of your data, mainly, for:

  • If and when you subscribe to our Newsletter, we will process your personal data to manage your subscription, including to send customised information on our products or services through various means (such as e-mail or SMS). We may also make available to you this information through push notifications in case you have activated them in your mobile device.

    • Accordingly, please take into account that this data processing implies analysis of your user or customer profile to establish your preferences and therefore which products and services are most fit to your style when sending you information. For example, based on your purchases and browsing history (i.e., depending on the articles that you clicked), we will make you suggestions on products that we believe may interest you and, if you are a registered user, we will provide you with the "recover cart” functionality.

    • Remember that you may unsubscribe from the Newsletter at any time without cost through the "Newsletter" section of the Platform, in addition to through the instructions that we provide you with in each notice. If you do not want to receive push notifications, you can deactivate this option in your mobile device.

  • To perform promotional actions (for example, for the organization of competitions or to send the list of items stored to the e-mail you designate).  On participating in any promotional action, you authorise us to process the personal data that you have shared with us depending on the promotional action and disclose them through different media such as social networks or the Platform itself. In each promotional action in which you participate you will have available the terms and conditions where we will be providing more detailed information about the processing of your personal data.

  • To disseminate in the Platform or through our channels in the social networks photographs or pictures that you shared publicly, provided that you expressly give us your consent for the purpose.

5. Analysis of usability and quality to improve our services

If you access our Platform, we inform you that we will treat your browsing data for analytic and statistic purposes, i.e., to understand the manner in which users interact with our Platform and thus be capable of introducing improvements in the Platform.

In addition, we occasionally perform quality surveys and actions to know the degree of satisfaction of our customers and users and detect those areas in which we may improve.

In accordance with the relevant laws, regulations and national standards, we may collect and use your personal data without obtaining your consent in the following cases:

 

(1) Directly related to national security and defence security;

(2) Directly related to public safety, public health and major public interests;

(3) Directly related to criminal investigation, prosecution, trial and execution of judgments;

(4) For the maintenance of your or other people's life, property and other important legitimate rights and interests, but it is difficult to get your own consent;

(5) The personal data collected is disclosed to the public by yourself;

(6) The personal data is collected from lawful and publicly disclosed information, such as: legal news reports, government information disclosure and other channels;

(7) Necessary to maintain the security and stability of the services provided, such as: detection, disposal of the failure of products or services;

(8) Other circumstances stipulated in the laws and regulations.

  1. HOW WE ARE LEGALLY PERMITTED TO PROCESS YOUR DATA?

The legal terms on which we are permitted to process your personal data also depends on the purpose for which we process them, as explained in the following table:

Purpose

Legal standing

1. To manage your Platform user registration

We process your data because this is necessary on the terms regulating the use of the Platform. In other words, for you to be able to register as a user on the Platform, we need to process your personal data, since we would otherwise be unable to manage your registration.

2. Development, performance and making of the purchase or services contract

We process your data because their processing is necessary for us to make the purchase or services contract with you.

Certain processing of data related to the purchase process is activated only because you request or authorise it, as is the case of the storage of payment (card) data for future purchases or the processing of data necessary to provide you with the Coming Soon / Back Soon functionalities. In these cases, our processing of your data is supported by your own consent.

We consider that we have a legitimate interest to carry out the necessary verifications to detect and prevent potential fraud when you make a purchase. We understand that the processing of these data is positive for all the participating parties when a purchase is paid and in particular for you, since this allows us to establish measures to protect you from fraud attempts by third parties.

3. Customer Support

We consider that we have legitimate interest in answering the requests or consultations raised by you through the existing different contact channels. We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the consultations raised.

When you get in touch with us, in particular, for the management of incidents related to your order or the product/service acquired through the Platform, the processing of your data is necessary to perform the purchase contract.

When your consultation is related to the exercise of your rights on which we inform you below, or to claims on our products or services, we are legally permitted to process your data for compliance with our legal obligations.

4. Marketing

 

We are legally permitted to process your data for marketing purposes due to the consent that you give us, for example when you accept receiving customized information through multiple channels, when authorizing the sending of push notifications in your mobile device or when accepting the legal terms and conditions to participate in a promotional action or to publish your pictures on the Platform or on our social networks' channels.

In order to show you customised information. we consider that we have a legitimate interest to conduct a profiling with the information that we have about you (such as your browsing, preferences or purchase history) and the personal data that you have provided us, such as the age range or language, since we understand that the data processing of these data is also beneficial to you because it allows you to improve your user experience and access the information in accordance with your preferences.

5. Analysis of usability and quality

We consider that we have a legitimate interest in analysing the Platform usability and the user's satisfaction degree, since we understand that the processing of these data is also beneficial for you because the purpose is to improve the user experience and provide a higher quality service.

  1. HOW LONG WILL WE KEEP YOUR DATA?

The time for which we will keep your data will depend on the purposes for which we process them, as explained below:

Purpose

Time for which the data are kept

1. To manage your Platform user registration

We will process your data for the time during which you remain a registered user (meaning, until you decide to unsubscribe).

2. Development, performance and execution of the purchase or services contract

We will process your data for the time necessary to manage the purchase of the products or services that you buy, including potential returns, complaints or claims related to the purchase of the product or service in question.

Sometimes, we will only process the data until the time when you decide, as is the case of payment (card) data that you requested us to store for future purchases.

3. Customer Support

We will process your data for the time necessary to meet your request or application.

4. Marketing

We will process your data until you unsubscribe or cancel your subscription to the newsletter.

If you participate in promotional actions, we will keep the data during a six (6) months period from the end of the action.

5. Analysis of usability and quality

We will process your data occasionally for the time during which we proceed to carry out a specific quality action or survey or until we anonymise your browsing data.

Notwithstanding the fact that we will process your data for the time strictly necessary to achieve the purpose in question, we will subsequently keep them duly stored and protected for the time during which liability may arise for their processing, in compliance with legislation in force from time to time. Once each of the potential actions is time-barred we will proceed to delete the personal data.

  1. DO WE SHARE YOUR DATA WITH THIRD PARTIES?

1) Sharing

To achieve the purposes mentioned in this Privacy Policy, we must give access to your personal data to entities of the Inditex Group and to third parties that provide us with support in the services that we offer you, i.e.:

For service efficiency purposes, some of these providers are located in territories outside the People's Republic of China that do not offer a level of data protection comparable to that of the People's Republic of China, as the European Union and the United States of America. In such cases, we inform you that we will transfer your data with adequate safeguards and always keeping your data safe.

2) Transfer of control

We will not transfer the control of your personal data to any company, organization or individual, except in the following cases:

(1) Obtaining your explicit consent in advance;

(2) In accordance with the laws and regulations or mandatory administrative or judicial requirements;

(3) In the case of asset transfer, acquisitions, mergers, reorganization or liquidation, if the transfer of personal data is involved, we will inform you of the situation and require new companies and organizations holding your personal data to continue to be bound by this policy. If the purpose of the collection and use of your personal data is changed, we will require the new company and organization to regain your explicit consent.

In this sense, we inform you that we need to share your data with our parent company, Industria de Diseño Textil, S.A. (Inditex, S.A.), Inditex Group holding company, for compliance with the obligations of the parent company.

3) Public disclose

In principle we will not disclose your personal data publicly. In the event of public disclosure, we will inform you of the purpose and type of the disclosure, and the sensitive information that may be involved, with your explicit consent.

4) In accordance with the relevant laws, regulations and national standards, we may share, transfer or publicly disclose your personal data without obtaining your consent in the following cases:

(1) Directly related to national security and defence security;

(2) Directly related to public safety, public health and major public interests;

(3) Directly related to criminal investigation, prosecution, trial and execution of judgments;

(4) For the maintenance of your or other people's life, property and other important legitimate rights and interests, but it is difficult to get your own consent;

(5) The personal data collected is disclosed to the public by yourself;

(6) The personal data is collected from lawful and publicly disclosed information, such as: legal news reports, government information disclosure and other channels.

  1. WHAT YOUR RIGHTS ARE WHEN MAKING YOUR DATA AVAILABLE TO US

We undertake to keep your personal data confidential and to ensure that you may exercise your rights. Bearing that in mind, we Joint Controllers have agreed that you may exercise your rights free of charge by writing us an e-mail to a single e-mail address (dataprotection@oysho.com), simply informing us of the reason for your request and the right that you wish to exercise. If we consider this necessary to be able to identify you, we may request you to provide a copy of a document evidencing your identity.

In particular, notwithstanding the purpose or legal basis we use to process your data, you have the following rights:

If you have given us your consent to process your data for any purpose, you also have the right to withdraw such consent at any time. Some of the circumstances in which you may withdraw your consent are detailed in section 2 where we explain for which purposes we process your data.

In addition, where the processing of your data is based on our legitimate interest, you will also have the right to object to the processing of your data.

  1. HOW WE PROTECT YOUR PERSONAL DATA?

We are committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities. When we transmit highly confidential data (such as card number or password) over the Internet, we protect it through the use of encryption.

In the event of a personal information security incident, we will promptly inform you, as required by laws and regulations, of the basic situation and possible impacts of the security incident, the measures that we have taken or will take, the suggestions you may be able to prevent and mitigate the risks, and the remedies for your actions. We will timely inform you of the event through email, SMS and other channels. If it is difficult to inform the personal information subject individually, we will take a reasonable and effective way to publish the announcement. At the same time, we will take the initiative to report the disposal of information security incidents according to the requirements of local authorities.

Please take good care of your login account and password. When you use our service, we will identify you through your login account and password. Once you have disclosed the foregoing information, you may suffer loss and may have legal consequences that are unfavourable to you. If you find that your login account and/or password may or have been compromised, please contact us immediately so that we can take appropriate measures to avoid or reduce the related loss.

We have established a public user management mechanism, including the tracking procedure. If you have any questions, opinions or suggestions on this Privacy Policy, you may contact us through the postal addresses listed in the Article 1 of this Privacy Policy. We also set up a full-time personal information protection department (or personal information protection officer) and you may contact by emailing to dataprotection@oysho.com. For security purpose, we may require you to submit written application or use other methods to prove your identity. In general, after the validation of your identity, we will reply to your request within 30 days or within the time limit stipulated in the laws and regulations.

If you are not satisfied with our reply, especially our processing of your data infringes your legitimate interest, you may complain or report to relevant regulatory authorities, or bring a lawsuit before the competent court.  

In principle, we won’t charge you for your reasonable request. However, we will charge a certain amount of cost for repeated requests that exceed a reasonable limit. We may reject those requests that are duplicative, require excessive technical means (for example, developing new systems or fundamentally changing current practices), pose risks to the legitimate rights and interests of others, or are very unrealistic.  

Notwithstanding the above agreement, we may not be able to respond your request in the following cases in accordance with the relevant laws, regulations and national standards:

(1) Directly related to national security and defence security;

(2) Directly related to public safety, public health and major public interests;

(3) Directly related to criminal investigation, prosecution, trial and enforcement of sentences;

(4) There is sufficient evidence that you may maliciously abuse your rights;

(5) Responding to your request will cause serious damage to the lawful rights and interests of other individuals and organizations;

(6) Involving business secrets.

  1. WHAT HAPPENS WHEN YOU PROVIDE US WITH DATA OF THIRD PARTIES?

We offer functionalities or services that require us to process the personal data of a third party that you must provide, such as in the case of activation and sending of the Gift Voucher or the management of the application for the Gift Voucher. If you provide us with personal data of third parties, you confirm that you informed them of the purposes and of the manner in which we need to process their personal data, and that you have obtained their relevant express consent.

  1. HOW WE PROCESS CHILDREN’S PERSONAL DATA

Our products, websites and services are mainly for adults. A child may not create his or her own user account without the consent of the parent or guardian.

In cases where a child's personal data is collected with the consent of the parent or guardian, we will only use or disclose this information in a case where the law allows, the explicit consent of the parents or guardians has been obtained, or it is necessary to protect the children.

Although the laws in different countries or regions have different definitions for children, we treat anyone under the age of 14 as a child. If we find ourselves collecting the child's personal data without prior consent of the parent or guardian, we will try to delete the relevant data as soon as possible.

  1. CHANGES TO THE PRIVACY POLICY

We may amend the information contained in this Privacy Policy when we consider this appropriate. Should we do so, we will notify you by various procedures through the Platform (for example, through a banner, a pop-up or a push notification), or we may even send you a notice to your e-mail address when the change in question is relevant to your privacy, for you to be able to review the changes, assess them and, as the case may be, object or unsubscribe from ay service or functionality. In any case, we suggest you to review this Privacy Policy from time to time in case minor changes are made or we make any interactive improvement, taking the opportunity that you will always find it as a permanent point of information on our Website and our App.

  1. INFORMATION ON COOKIES

We use cookies and similar devices to facilitate your browsing in the Platform, understand how you interact with us and, in certain cases, to be able to show you advertisements in accordance with your browsing habits. Please read our Cookies Policy to understand with greater detail the cookies and similar devices that we use, their purpose and other information of interest.