This privacy policy (“Policy”) describes how the personally identifiable information (“Personal Information”) you may provide on the vp-concept.com website (“Website” or “Service”) and any of its related products and services (collectively, “Services”) is collected, protected and used. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update this information. This Policy is a legally binding agreement between you (“User”, “you” or “your”) and this Website operator, vp-concept (“Operator”, “we”, “us” or “our”). By accessing and using the Website and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

Collection of personal information

You can access and use the Website without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features on the Website, you will be asked to provide certain Personal Information. We receive and store any information you knowingly provide to us when you create an account, place an order, make a purchase, fill any online forms on the Website or contact us. When required, this information may include the following:

• Personal details such as name, country of residence, date of birth, gender etc.

• Contact information such as email address, postal address, telephone number etc.

• Account details such as user name, unique user ID, password, etc.

• Payment information such as credit card details, bank account details, etc.

Some of the information we collect originates from you via the Website and Services. However, we may also collect Personal Information about you, which is relative to your browsing on the website as well as your interaction with us.  Users who are uncertain about what information is mandatory are welcome to contact us.

Use and processing of collected information

In order to make the Website and Services available to you, or to meet a legal obligation or to execute your orders, we need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes, whichever apply:

• Manage your registration as a User in the website.

• Fulfil and manage orders

• Deliver products or services

• Management and issuing of proof of purchase documents: e-receipts, invoices etc.

• Improve products and services

• Send administrative information

• Send marketing and promotional communications

• Respond to inquiries, requests, potential complaints and offer support

• Request user feedback

• Improve user experience

• Post customer testimonials

• Deliver targeted advertising

• Administer prize draws and competitions

• Enforce terms and conditions and policies

• Protect from abuse and malicious users

• Respond to legal requests and prevent harm

• Run and operate the Website and Services

Legal bases for processing your personal data:

We have the following legal bases to process your personal data, which are in conformity with the European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which applies to the processing of personal data in the Republic of Cyprus:

Execution of the contract 

With regard to the following purposes, the lawful basis of the processing of the necessary personal data is for us to be able to execute the contract between us:

• Manage your registration as a User in the website.

• Fulfil and manage orders

• Deliver products or services

• Send administrative information

• Management and issuing of proof of purchase documents: e-receipts, invoices etc.

Fulfilment of legal obligation

With regard to the following purposes, the legal basis of the processing of your personal data is the fulfilment of a legal obligation:

• Management and issuing of proof of purchase documents: e-receipts, invoices etc.

• Response to the exercise of your privacy rights, and respond to inquiries, requests, potential complaints and offer support

Consent

With regard to the following purposes, the lawful basis of the processing of your personal data is consent, in cases where it has been given: 

• Manage your registration as a User in the website.

• Send administrative information

• Send marketing and promotional communications

• Respond to inquiries, requests, potential complaints and offer support

• Administer prize draws and competitions

• Enforce terms and conditions and policies

• Respond to legal requests and prevent harm

• Deliver targeted advertising

The withdrawal of consent for such processing on your part will not affect the execution of the sale and purchase agreement between us.

Legitimate interest

With regard to the following purposes, the lawful basis of the processing of your personal data is legitimate interest:

• Protect from abuse and malicious users

• Post customer testimonials

• Run and operate the Website and Services

• Request user feedback

• Improve products and services and user experience upon customers’ feedback and testimonials.

Billing and payments

In case of services requiring payment, we request credit card or other payment account information, which will be used solely for processing payments. Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted. Where necessary for processing future payments and subject to your prior consent, your financial information will be stored in encrypted form on secure servers of our reputed payment gateway service provider who is beholden to treating your Personal Information in accordance with this Policy. All direct payment gateways adhere to the latest security standards as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. Sensitive and private data exchange happens over a SSL secured communication channel and is encrypted and protected with digital signatures, and the Website and Services are also in compliance with PCI vulnerability standards in order to create as secure of an environment as possible for Users. Scans for malware are performed on a regular basis for additional security and protection.

Managing information

You are able to delete certain Personal Information we have about you. The Personal Information you can delete may change as the Website and Services change. If you would like to delete your Personal Information or permanently delete your account, you can do so on the settings page of your account on the Website.

Disclosure of information

Depending on the requested Services or as necessary to complete any transaction or provide any service you have requested, we may share your information with your consent with our trusted third parties that work with us, any other affiliates and subsidiaries we rely upon to assist in the operation of the Website and Services available to you. We do not share Personal Information with unaffiliated third parties. These service providers are not authorized to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements.

We will disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Retention of information

We will retain and use your Personal Information for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements unless a longer retention period is required or permitted by law, in relation to, among others, audit and tax purposes, bookkeeping rules or the applicable limitation period to bring a legal claim against us based on the sale and purchase contract. This means that we may keep your personal data for a reasonable time, including after you have stopped using the Services or the website or you have deleted your account. Once the retention period expires, Personal Information shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after the expiration of the retention period.

Transfer of information

The data that we collect from you is stored in Cyprus or in a country within the European Economic Area (“EEA”). If there is a need to be transferred to and processed in a country outside of the EEA for carrying out certain tasks, achieve certain goals etc, any cross-border transfer of your personal data will be carried out in compliance with applicable laws. Whenever applicable, for transfers of personal data from a country within the EEA to a country outside of the EEA which has not been qualified for an adequacy decision by the European commission, we use Standard Contractual Clauses as well as other permitted safeguard measures to protect your privacy and other rights during and after the cross-border transfer.

Data protection rights under GDPR

You have certain data protection rights and the Operator aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights:

• Right to access: You have the right to request information about your Personal Information that we store at any time and have the ability to access your Personal Information. We will provide you with your requested information via appropriate means of communication.

• Right to rectification: You have the right to request that we correct any Personal Information you believe is inaccurate. You also have the right to request us to complete the Personal Information you believe is incomplete.

• Right to erasure: You have the right to request the erase of your Personal Information under certain conditions of this Policy and when, among other reasons, the data is no longer necessary for the purposes for which they were collected. Your erasure request may be hindered if any of the following situations apply: (a) the legal ground for the process is fulfilment of contract and your personal data is still necessary for the purpose set for the process; (b) the legal ground for the process is legitimate interest and the Operator has overriding interests to continue to use your personal data; (c)the legal ground for the process is a legal obligation and the Operator is by law or statute obliged to continue to use and/or store your personal data for the given purpose and time; (d)for the establishment, exercise or defence of legal claims.

• Right to object: You have the right to object to our processing of your Personal Information that is based on our legitimate interest We will stop processing your personal data and immediately erase it, unless we can demonstrate a legitimate reason for the processing which overrides your interest and rights or due to legal claims.

• Right to restriction: You have the right to seek restrictions on the processing of your Personal Information. When you restrict the processing of your Personal Information, we may store it but will not process it further, unless this is necessary for the exercise or defence of legal claims

• Right to data portability: You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.

How to exercise these rights

We take data protection very seriously and therefore we have a dedicated process to handle your requests or complaints in relation to your rights stated above. You can send in your request in the following email: info@vp-concept.com

Please note that we may ask you to verify your identity before responding to such requests. Your request must provide sufficient information that allows us to verify that you are the person you are claiming to be or that you are the authorized representative of such person. You must include sufficient details to allow us to properly understand the request and respond to it. We cannot respond to your request or provide you with Personal Information unless we first verify your identity or authority to make such a request and confirm that the Personal Information relates to you.

If you consider that we process your personal data in an incorrect way, we expect you to contact us immediately in the aforementioned email. You also have the right to turn in a complaint to the competent supervisory authority: the Commissioner for the Personal Data Protection (commissioner@dataprotection.gov.cy)

Cookies

The Website and Services use “cookies” to help personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

We may use cookies to collect, store, and track information for statistical purposes to operate the Website and Services. You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. You may learn more about cookies and how they work here.

Email marketing

We offer electronic newsletters to which you may voluntarily subscribe at any time. We are committed to keeping your e-mail address confidential and will not disclose your email address to any third parties except as allowed in the information use and processing section. We will maintain the information sent via email in accordance with applicable laws and regulations.

All e-mails sent from us will clearly state who the e-mail is from and provide clear information on how to contact the sender. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or by contacting us. However, you will continue to receive essential transactional emails which are necessary for the execution of our contract.

Information security

We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorised access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorised access, use, modification, and disclosure of Personal Information in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed. Therefore, while we strive to protect your Personal Information, you acknowledge that (i) there are security and privacy limitations of the Internet which are beyond our control; (ii) the security, integrity, and privacy of any and all information and data exchanged between you and the Website and Services cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third party, despite best efforts.

Data breach

In the event we become aware that the security of the Website and Services has been compromised or users Personal Information has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the user as a result of the breach or if notice is otherwise required by law. When we do, we will send you an email.

Changes and amendments

We reserve the right to modify this Policy or its terms relating to the Website and Services from time to time in our discretion and will notify you of any material changes to the way in which we treat Personal Information. When we do, we will revise the updated date at the bottom of this page. We may also provide notice to you in other ways in our discretion, such as through contact information you have provided. Any updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Your continued use of the Website and Services after the effective date of the revised Policy (or such other act specified at that time) will constitute your consent to those changes. However, we will not, without your consent, use your Personal Information in a manner materially different than what was stated at the time your Personal Information was collected.

Acceptance of this policy

You acknowledge that you have read this Policy and agree to all its terms and conditions. By using the Website and Services and/or by creating an account with us you agree to be bound by this Policy. If you do not agree to abide by the terms of this Policy, you are not authorized to access or use the Website and Services.