At Change of Scandinavia, we take utmost care about the security of any information you provide to us. Therefore, we want to inform you that the Data Controller of your personal data is Change of Scandinavia A/S, based in Farum Denmark, Farum Gydevej 73, 3520 Farum, CVR 28711328. In all matters related to the protection of personal data, you can contact us by sending an e-mail to [email protected], by sending a letter to the address of the Data Controller or to: Change of Scandinavia Canada Retail Inc. 9961 Boulevard Saint-Vital, H1H 4S5. Montréal, QC. The personal data collected by the Data Controller are processed only for the purposes described in these regulations.
Purposes and scope of processing personal data:
- to be able to process an order placed in the stores by a customer, we will need the following information:
- The Customer's personal details: name, surname, e-mail address, telephone number, address details.
- If the shipping address is not the same as the billing address: first name, last name, e-mail address, telephone, address details, company name (optional). If you place an order on behalf of your company, additionally: company name, Tax ID number.
- to handle complaints and refunds related to customer orders: name, surname, e-mail address, telephone number, billing address, shipping address (if not the same as billing address).
- as we are issuing accounting documents such as invoices and related tax obligations: name, company name (is used), [CM1] full address, Social Security number, or Tax ID number, if required by law.
- as customers sign up for membership to Club Change: name, surname, address, country, telephone number, e-mail address, gender, and size of underwear.
- To deliver e-mail correspondence with the Customer: name, last name, e-mail address, additional data provided by the person during the correspondence necessary to settle the matter.
- When participating in competitions on social media profiles created by Change of Scandinavia: name, surname, delivery address, telephone, e-mail address.
- in connection with the fulfilment of legal requirements, e.g. withdrawal of products or the need to take other measures: data required by law, or data necessary for the performance of tasks imposed by law, administrative or judicial decisions.
- for technical and store statistics: IP-address, location (if provided by the user), type of device, operating system, and browser.
- for marketing and commercial purposes including sending newsletters to the customers: name, surname, e-mail address, telephone number.
Legal basis for data processing:
- due to the necessity of implementing the contract of sale, handling of complaints and returns, technical needs of the website: the legal basis for data processing is Art. [AHB2] 6(1)(b) GDPR: the processing is necessary for the performance of the contract to which the data subject is a party, or to take action at the request of the data subject before the conclusion of the contract, and (f) the processing is necessary for the purposes of legitimate interests pursued by the controller, which is to pursue claims arising from the concluded contract or take action related to the improvements in the operation of the website, including ensuring the security of data.
- to deliver e-mail correspondence: the legal basis is Art. 6(1)(f) GDPR: processing is necessary for purposes arising from the legitimate interests pursued by the controller, which is to receive and reply to the correspondence.
- to handle the Customer's membership to Club Change, participation in competitions on the Change profile on the Facebook platform, for marketing and commercial purposes and sending a newsletter: the basis for data processing is the consent given by the data subject.
- in connection with the fulfilment of legal requirements: the legal basis for the processing of data, depending on the purpose are specific legal provisions or decisions of state institutions.
Obligation to provide data:
- In the case of issuing an invoice, the provision of personal data is a statutory requirement pursuant to local legal requirements.
- Personal data provided as a necessity to fulfill the sales contract, handling complaints and returns, registering an account on the website, technical needs of the website are provided voluntarily, but are necessary for the purpose for which they were collected. Failure to provide data will result in the inability to make a purchase on the website, the inability to process the complaint or return the product.
- Personal data collected related the Customer's membership to Club Change, participation in competitions on the Change profile on social networks, for marketing and commercial purposes, and sending the newsletter are provided voluntarily based on the consent given. Customers may revoke consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.
Transferring of data[CM3]
Personal data, depending on the purpose and given consent, will be transferred to other recipients, i.e.: technical service partners, business partners, telecommunications companies, hosting and consulting companies, payment service companies, marketing services companies conducting SMS campaigns, sending newsletters, document archiving companies, postal operators, carriers, companies printing correspondence or handling correspondence only to a necessary extent for the purposes of which the data was collected. Data may also be made available to public authorities such as administrative authorities, ordinary courts, police.
The Data Controller will during cooperating with external companies, ensure that the Customer's data is processed in accordance with the highest standards of data protection. The data from the Customer and the data controller are confidential and may not be used for other purpose or in any other context than the one intended.
In accordance with the Data Protection Regulation, the Customer has the following rights:
- the right of access to personal data.
- the right to rectification, i.e., to correct incorrect data or complete incomplete personal data.
- the right to erase personal data.
- the right to restrict the processing of personal data.
- the right to object to the use of personal data for direct marketing.
- the right to object to automated, individual decisions, including profiling.
- the right to transfer personal data.
- the right to withdraw consent at any time – in the case of data processing based on consent, without affecting the lawfulness of processing carried out based on consent before its withdrawal.
- the right to lodge a complaint with a supervisory authority in your particular country, place of work, or place of alleged infringement, where it believes that the processing of personal data conflicts with these regulations.
Storage of personal data:
- Customer data is stored according to the time allowed by law. This time depends on the type of data and the purposes for which the data was collected.
- The Data Controller will process the Customer's personal data for accounting purposes for a period of 5 years from the end of the year in which the VAT invoice or other financial documents was issued, or longer if such longer period is required by law.
- The data of Clients registered in Club Change, where Data Controller will not see any traffic within three years from the last activity, will be deleted.
- If the Customer exercises the right to erasure, the data will be deleted immediately. However, data of which further storage required by law (e.g. fiscal law) will be deleted only after the expiry of the period during which the law requires the Data Controller to store such data. The Data Controller will anonymize them, and non-personally identifiable information will be processed for statistical purposes only.
- In any case, the data is deleted from the database when it is no longer needed to achieve the purposes for which it was collected.
- Personal data related to the customer's correspondence, depending on the type of correspondence, will be processed until the case is settled. However, no longer than one year after its completion, and in the case of correspondence related to security or redress, up to 6 years.
- Cookies provided by change.com/ca are deleted once a year.