I. GENERAL PROVISIONS

1. When you visit our internet website, order our newsletter or purchase products without registration, you entrust to us your data which we process for the purposes established in this Privacy Policy.

2. Personal data – any information concerning an identifiable or identified person.

3. Data controller: Rasa Glasaitė, individual activity code 674778
4. CreatedEmotionally respects your privacy and protects your personal data provided by you to us and collected by us in the manner specified in this Privacy Policy.
5. CreatedEmotionally implements appropriate organisational and technical measures to ensure that your personal data are always secure and data processing actions meet the requirements of legal acts on data protection and our internal policies.

II. PERSONAL DATA PROCESSING PURPOSES, COLLECTED PERSONAL DATA, THEIR STORAGE PERIOD AND PRO/CESSING BASIS

6. Data processing purpose: direct marketing (sending of newsletters)
a) Personal data: e-mail address
b) Basis: consent.
c) Data processing (sending of notifications) period – 2 (two) years. If you do not renew your subscription, upon expiry of this period the sending of newsletters to you will stop.
d) You are free to refuse a newsletter informing about the refusal by e-mail: info@createdemotionally.com or clicking to the link provided at the bottom of the newsletter.
e) We will store your data passively for another 1 (one) year after withdrawal of your consent (basis: the data is necessary for the purposes of the legitimate interests pursued by the controller).
f) persons under 16 years of age shall not be allowed to provide any personal data for marketing activities. If you are a person under 16 years of age, prior to the provision of personal information for marketing purposes you must obtain consent of your parents or other statutory legal representative.

7. Data processing purpose: Product sales / order execution (unregistered users)

a) Personal data: forename, surname, e-mail address, phone number, correspondence address, phone number; signature (where products are collected personally by you), date and time of purchase and delivery, names and quantities of products, purchase prices and applicable discounts, method of payment for purchases and payment details;
b) Basis: 1) Data processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. 2) Data processing is necessary for compliance with a legal obligation to which the controller is subject. 3) Data processing is necessary for the purposes of the legitimate interests pursued by the controller.
c) Data processing time limit: purchase details (including the buyer’s details indicated in the invoice) shall be retained in the seller’s accounting records for 5 (five) years.
d) Depending on the method of delivery of products chosen by you, the details relating to the delivery (requested delivery time, address and other information relevant for the courier) shall be transferred to the partner who performs the delivery.
e) Depending on the payment method, the payment details shall be transferred to the partner administrating the payment service (e.g., paypal, stripe).

8. Data processing purpose: games and lotteries

a) If you decide to participate in lotteries and games, we will process your data for the purpose of administration of the games, campaigns and/or competitions organised by us, our suppliers and partners.

b) Data usually processed for this purpose include: forename, surname, city, e-mail address, phone number, link to Facebook account where the game is organised in Facebook social network. Depending on specifics of the game or lottery, the submission of more data may be requested.

c) We process your personal data in order to select and announce the winner and identify you when handing in prizes, winnings. If you don’t provide the data, you will not be able to participate in the game and/or competition. If you win, we will not be able to hand in the prise to you. When handing in the prise your personal identity will be verified.

d) Participants who choose to participate in the game also give their consent that in the case of winning their, as the winner’s, data (forename, surname, city, the prize won) will be published. Information about winners shall be published in the accounts of social networks administrated by the Organiser. In the cases established by legal acts, we will be bound by the obligation to inform competent authorities (e.g., the Tax Inspectorate) about the prize.

e)  Personal data collected during the campaign/lottery will be used only for the lottery organisation purposes of and retained for not more than 3 (three) months of the announcement of the campaign winners. Later the data shall not be retained and shall be deleted.

9. Data processing purpose: organisation of events

a) CreatedEmiotionally may organise both public and private product presentation and other events for its customers.

b) For representational – self-promotion purposes we seek to make video records of the moments of each event, therefore, by giving consent to participate in the events of CreatedEmiotionally, you also agree that your image might be recorded among the event participants and published on the Company’s internet website and in the accounts in social networks.

c) Depending on the nature of the event, it may also be attended by media representatives recording the moments of the events and their participants. Therefore, when deciding to participate in our events you express your consent to have your image recorded and published in press and portals.

d) Each time when inviting you to the effect we will try to remind you about taking photos or filming of the event;

e) If for some reasons you want to have a certain picture of yours removed from galleries of publicly announced events of CreatedEmotionally (in the internet website or social networks), please contact CreatedEmotionally.

10. Business partners, suppliers and other persons

a) CreatedEmotionally also processes personal data of data subjects of different categories (customers, business partners, suppliers, other counterparties in the case of natural persons, as well as of representatives of legal persons (employees, agents, other representatives).

b) Personal data: forename, surname, Personal identification code, date of birth, contact details (place or residence or workplace, phone, e-mail), workplace, position, details about terms and conditions of the concluded contract, contract performance information.

c) Data shall be collected and processed when establishing, maintaining and developing  business, professional or other legal relationships with CreatedEmotionally; concluding, executing, administrating transactions, contracts and agreements; developing and ensuring legitimate interests of the Company and companies of the group related to it; for legal defence of requirements, claims or actions brought against Company; compliance by the Company with the obligations and liabilities to which the Company is subject under applicable legal acts.

e) Data processing basis: Data processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; Data processing is necessary for compliance with a legal obligation to which the controller is subject; Data processing is necessary for the purposes of the legitimate interests pursued by the controller.

f) Data shall be processed only to the extent strictly necessary for achieving the data processing purposes. Information concerning concluded transactions shall be retained throughout validity of the contract and 5 (five) years after expiry of the transaction.

11. Data processing purpose: handling of customer enquiries, complaints, requests and feedback

a) Personal data: identification and contact details specified by the customer: forename, surname, phone number, e-mail address, residence address, date of birth; content of the enquiry: event  regarding which the enquiry was submitted, its circumstances, date, place, the customer’s request, claim or feedback, the product, other information provided in the enquiry; other documents and/or details submitted together with the enquiry: e.g., purchase receipt details, photos.
b) An enquiry may be submitted via the internet website: www.createdemotionally.com, by e-mail, post, by sending a message, by posting a comment in social networks, leaving feedbacks on internet websites.
c) Data storage time limit: 12 (twelve) months. Where as a result of the enquiry a legal dispute is initiated or there is a possibility of such dispute, we may retain your data longer, until expiry of limitation periods of submission of a complaint or action provided for by legal acts and/or until enforcement of the final decision.
d) We use your data only in order to make an appropriate and objective analysis of your enquiry, to provide to you the required information, to answer your questions, settle your requirements or requests. In addition, we can analyse your enquiry details for the purpose of improving the quality of our activities and of the services provided to you, taking account of your opinion and proposals.
e) CreatedEmotionally does not make public the information about its correspondence with customers. However, where the customer’s enquiry or claim is received in public comments formats of internet websites or in social network comments, CreatedEmotionally retains the right to make public the answer / comment, in the same format in which the enquiry was received.
f) On expiry of the time limit of processing and retention of our data established in this Policy, we will destroy your data or reliably and irrecoverably depersonalise them as soon as possible, within the reasonable and justified period necessary for the performance of such action. CreatedEmotionally shall not be able to fulfil this requirement if the enquiry is submitted through internet websites/accounts of social networks which are not administrated by CreatedEmotionally.

12. Personal data processing on the internet website. If you visit the data controller’s internet websites, as well as the accounts of social networks, we would like to provide such content and functions that are specifically adapted to your needs. The Company may process the visitor’s IP address, network and local data.

a) To this end we use cookies in our E-shop. They are small elements of information stored in your internet browser. They help the data controller to recognise you as the former visitor of a certain internet website, save your website visit history and adapt the content according to that. Cookies also help ensure smooth operation of websites, allow monitoring the website’s visit duration, frequency and collect statistics on the number of website visitors. By analysing these data, we can improve our websites and make them more convenient for your use.
b) Cookies are used in order to:
Make it more convenient for you to remember your settings;
Find Products you have added to your cart when you return back;
Improve the content of our website.
c) We hope that you will find this acceptable. If you change your mind in future, you will be able to change the settings of your internet browser and delete the installed cookies.

13. Data processing on Facebook/Instagram followers’ site

a) By writing comments, messages or communicate otherwise with us on Facebook or Instagram platforms (www.facebook.com/www.instagram.com), you personally ensure that you use all safeguards of the confidentiality and integrity of your posting. 

b) We would like to note that personal data and/or any other information which you publish on public access sites (e.g., on the wall of our Facebook page, etc.) is visible to other visitors; therefore, before publishing a message you should assess whether you want to make public your personal data/account link; in addition, you should make sure that it is free from any insulting, discriminating or other content infringing legal acts and/or other visitors’ rights.

c) CreatedEmotionally shall have the right to remove any information posted by visitors on Facebook page, if such information breaches legal acts or rights of other visitors.

d) We use all data voluntarily transferred by you only for the purpose for which you have transferred such data (e.g., for the purposes of communication with you, participation in the game organised on Facebook page, etc.). We don’t accumulate any additional data about you and do not transfer them to third parties, unless this is required by applicable legal acts.

e) Persons under 16 years of age shall be prohibited from sharing their personal data on Facebook page without a prior consent of their parents. Comments, responses, information sharing or other actions carried out by a minor in a social network shall be considered to be made with consent of parents.

f) Your data processing basis – your consent expressed by your active actions: e.g., by preparing to follow the news of our account, when applying to us by submitting personal data, commenting on, editing and sharing notifications posted by us, etc. We also process the data for the purposes of the legitimate interests pursued by us (e.g., administration and ensuring the proper functioning of the account page and for ensuring your personal data security).

g) Please note that when you visit Facebook page your browser and/or mobile device establishes a direct connection with Facebook server which installs cookies and plug-ins for you. Facebook, in its turn, collects information about your actions on the page: what notifications attract your attention, what sections you visit most frequently, what you are searching for, etc. CreatedEmotionally does not influence the extent of collected data and informs you according to the level of its knowledge.

Detailed information about the data processing carried out by Facebook, the purposes for which data are used and the extent related to the data provided by you is available in Facebook Privacy Policy: https://www.facebook.com/privacy/explanation.

III. PROVISION OF DATA TO THIRD PARTIES

14. Processing of your data may be transferred to third parties who assist in implementing and administrating the provision of services. Such persons may be suppliers of software of databases, database administration service providers, data centre, hosting and cloud service providers, direct marketing service providers, market research or business analytics, accounting service providers, auditors, legal and financial consultancy service providers, etc., partners involved for the purpose of execution of the particular order (courier service, payment administration service provider, etc.). 

15. In each case, the data processor shall be provided only with such amount of data which is necessary for the fulfilment of a particular assignment or for the provision of a particular service.

16. Data processors involved by us may process personal data only according to our instructions and may not use them for other purposes or transfer to other persons without our consent. Furthermore, they must ensure the security of your data according to applicable legal acts and written agreements concluded with us.

17. In addition, data may be provided to competent public authorities and law enforcement bodies or persons performing functions assigned to them by virtue of laws, e.g., the police or supervisory authorities; however, only upon their request and only where so required under applicable legal acts or in the cases and according to the procedure provided for by legal acts for guaranteeing our rights, security of our buyers, employees and resources, and for the establishment, exercise or defence of legal claims.

18. Where CreatedEmotionally uses a website analysis service (e.g., Google Analytics), which is applied when determining how you use the information posted on the internet website: www.createdemotionally.com we can share your depersonalised data with third parties who rely on this information when assessing how the internet website is used, when preparing reports for the website operator about the operation of the internet website and providing other services connected with the use of the internet website, internet and mobile application.

IV. PROVISION OF DATA TO THIRD COUNTRIES

19. As a rule, data shall be processed in the territory of the European Union / European economic Area, however, in certain cases they may be transferred and processed outside the EU / EEA.

20. Personal data may be transferred and processed outside the EU / EEA where such transfer is necessary for the conclusion and performance of a contract or with the customer’s consent, and also where the appropriate safeguards are implemented. Such appropriate safeguards may consist of:

a) a concluded contract including standard data protection clauses adopted by the EU Commission and other approved clauses, codes of conduct, certificates, etc. approved according to the General Data Protection Regulation;
b) the country outside the EU or EEA in which the recipient of personal data is located, by decision of the EU Commission, offers the adequate level of personal data protection;
c) The recipient is certified according to requirements of the data protection agreement of the EU and the United States of America (USA) (the so-called ‘Privacy Shield’) (applicable to recipients located in the USA).

V. DATA SUBJECT’S RIGHTS

21. The data subject whose data are processed in the data controller’s activities shall have the right to:
• know (be informed) about processing of his data (the right to be informed);
• access his data and know how they are processed (the right of access);
• request to rectify or, according to the processing purposes, supplement incomplete personal data (right to rectification);
• destroy his personal data or stop the actions of processing of his personal data (except for storage) (right to erasure and right to be forgotten);
• obtain from the data controller a restriction of personal data processing on the basis of one of the existing legitimate grounds (right to restriction);
• transmit data (right to portability);
• object to processing of his personal data or withdraw his consent to personal data processing at any time, to processing of personal data for one or more specific purposes, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint regarding personal data processing with the State Data Protection Inspectorate (www.ada.lt), if you consider that processing of your personal data infringes requirements of legal acts.

22. All matters concerning data processing and implementation of the data subject’s rights should be referred to CreatedEmotionally.

23. In order to protect the data of other persons from unlawful disclosure, upon receiving a request for the provision of data or for the implementation of other rights, the data controller shall have the right to take additional actions to establish personal identity, e.g., ask to indicate other relevant questionnaire data specified in the questionnaire or send a control message using the contact details and ask to perform an authorisation action. If the verification procedure is unsuccessful, the data controller shall reject the request.

24. Upon receipt of a request for the implementation of any right and having successfully completed the above referred control procedure, your request will be examined within one month of its receipt and completion of the verification procedure. Considering the complexity of the request and the number of requests, the data controller shall have the right to extend the period of one month for another two months notifying the data subject by the end of the first month and specifying the reasons for the extension.

25. Where a request is submitted by electronic means, a response shall also be provided by electronic means, unless this is impossible (e.g., because the amount of information is too large) or where a different method of response is indicated in the request.

26. Having identified any circumstances and reasons specified in legal acts which constitute the grounds for refusal to satisfy the request, the relevant reasoned answer shall be provided.

VI. VALIDITY AND AMENDMENTS

This version of the Privacy Policy shall enter into force on November 12, 2018. If we amend this Privacy Policy, its updated version will be published on our website: www.createdemotionally.com