We collect personal data in the following circumstances:
- Creating an account. You are not required to create an account to purchase our products. If you decide to create an account however, you will provide us with certain personal data, such as your name, email address, username, and password. If your account is created while placing an order, we will also request your shipping address and phone number.
- Purchasing a product from our website. When you make a purchase, you are given the option of logging into an account or checking out as a guest. In either case, when you purchase a product, you will provide us with information, such as your name, email address, phone number, and shipping address.
- Making a payment. When you make a payment to Oru Kayak in connection with a product purchase, you may need to provide personal data to our third-party payment processors. Such personal data may include your name, address, phone number, and payment information, including your credit card number.
- Information provided to Oru Kayak. We collect personal data you provide to us when you communicate with us via email, call our customer service department, participate in a survey, or join our rewards program. We may also collect your information when you post a product review, refer a friend, or post comments on social media. If you post content on public facing areas of the website or other social media you will not be subject to the privacy protections identified in this Policy.
- Automatic collection. We use (via third parties) automatic data collection technologies to collect certain information about you, your equipment, browsing actions or patterns. This information may include your Internet protocol (IP) address, location data, cookie identifier, browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our website, operating system, date/time stamp, and/or clickstream data. We use this data to analyze trends in the aggregate and to tailor our website to make a better customer experience.
- Third-party collection. Oru Kayak uses third parties to help administer the website and provide products to you. Oru Kayak may receive information about you from third parties to enhance our ability to serve you and to offer you information that we believe may be of interest to you.
We collect personal data from you in the variety of ways listed above for processing purposes, primarily to provide you with information related to our products and fulfill our obligations to you upon purchase (Art. 6 para. 1 lit. b) or f) GDPR, as applicable). We process your personal data to:
- Operate this website, including tailored content to you based upon your interests, purchases, and preferences;
- Analyze functionality of this website;
- Provide you with customer support, respond to your feedback
- Provide you with products and fulfill product orders;
- Protect the safety and interests of us or other visitors to the website;
- Notify you about changes;
- Provide product information, marketing, newsletter and other related advertising;
- Communicate with you via email or SMS (based upon your explicit consent) related to your account, products, and other services to you
- Achieve compliance with applicable laws.
How We share Personal Data
We disclose your personal data in the following situations:
- At your instruction. If you request us to make your information available to a third party, and such request furthers the purposes of our Services, we will do so.
- Vendors and Service Providers. In certain cases, we use the services of third-party vendors and service providers to assist us in providing the Services. We may share your personal data with such vendors and service providers solely for that purpose, such as fulfilling orders, processing payments, sending communications, limiting communications, conducting surveys, security reasons, fraud screening, website personalization, auditing, or developing and improving our Services, including this website. These third parties are required to maintain the confidentiality of this information and are prohibited from retaining, sharing, storing or using this information for any other purposes.
- Business transitions. If we go through a business transition, such as a merger, acquisition, liquidation or sale of all or a portion of our assets, the information we have about you will, in most instances, be part of the assets transferred. We reserve the right to transfer that information in connection with such transactions without notice to you. We will, generally, not be required to obtain your consent for such a transfer.
- Affiliates. We may share your information with our parent company, subsidiaries, affiliates, or sister companies as part of our marketing or advertising strategy.
- Legal grounds. We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to conform to applicable law, comply with a judicial proceeding, court order or legal process served on us, protect and defend our rights or property, or investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of our terms of service.
- Consent. We may also share your personal data with your consent.
When we share information with our affiliates and certain service providers which are located in a third country outside the European Union /European Economic Area such disclosure is deemed an international transfer under Art. 44 et. seqq. GDPR or other applicable data protection or privacy laws. We may transfer personal data to the following countries outside of the EU: USA, Canada.
Where we transfer personal data outside the European Union /European Economic Area, and where this is to a recipient in a country that is not subject to an adequacy decision by the EU Commission (Art. 45 GDPR), we and our trusted service providers protect your personal data by EU Commission approved standard contractual clauses (Art. 46 para. 2 GDPR) or a trusted service provider’s binding corporate rules (Art. 47 GDPR) and additional necessary supplementary measures. A copy of the relevant transfer mechanism can be provided for your review on request to email@example.com.
We have taken appropriate technical and organisational measures to protect your information from improper use and unauthorized access. No matter how hard we try, no security measures are perfect or impenetrable. It is important to take personal measures in safeguarding your password and computer.
Our services are not directed at children under the age of 13 and we do not knowingly collect personal data from children. We recognize the special obligation to protect personal data obtained from children and request that if you are 16 years old or younger to please not submit any personally identifiable information to us or to our website.
We will at all times honor your right to Access, Correct, Erase, Restrict, Transfer, Object, and Withdraw Consent at any time with respect to your personal data which are as follows:
- Request access to your personal data and to receive a copy of the personal data we hold about you.
- Request correction of the personal data that we hold about you in order to have any incomplete or inaccurate information corrected, though we may need to verify the accuracy of the new information you provide to us.
- Request erasure of your personal data in order to ask us to delete or remove personal data where there is not a good reason or legitimate interest for us to continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. For example, where we have a legal obligation to retain and store your personal data.
- Request restriction of processing of your personal data in order to ask us to suspend the processing of your personal data.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data which you initially provided consent for us to use or where we used the personal data to perform a contract with or provide services to you.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms. You may, in particular, control the extent to which we market to you and you have the right to request that we stop sending you marketing messages at any time.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. In particular, you may opt out of receiving promotional emails from us by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as emails about our ongoing business relations.
- Lodge a complaint with the competent data protection authority.