REGISTER DESCRIPTION

CUSTOMER REGISTER PRIVACY POLICY -
WoolPop

REGISTRAR
WoolPop
Company ID: ESY5360652X
Calle Niagara 50, IRIA IV
03189 Orihuela Costa
Alicante, Spain
info (at) woolpop.com

REGISTER NAME
The name of the register is WoolPop customer, order, billing, and marketing data register.

PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
We comply with the following requirements regarding personal data:

(a) they must be processed lawfully, fairly and transparently for the data subject (“lawfulness, fairness and transparency”);

(b) they must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest or for scientific or historical research purposes or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) (‘purpose limitation’);

(c) personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

(d) personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate or incomplete, having regard to the purposes of the processing, are erased or rectified without delay (“accuracy”);

(e) they shall be kept in a form which permits identification of the data subject only for as long as is necessary for the purposes of the processing; personal data may be stored for longer periods where the personal data are processed solely for archiving purposes in the public interest or for scientific or historical research purposes or statistical purposes in accordance with Article 89(1), provided that appropriate technical and organisational measures required by this Regulation are implemented to safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) they must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').

The customer has the right to know what personal data is stored in the system, the right to correct it, and the right and conditions for having it deleted. The data is not processed outside the EEA except for anonymous web analytics (Google Analytics, Facebook, etc.). The data is stored until the customer requests its deletion. Storage is done, for example, for web analytics (statistical reasons) and, for example, to facilitate the placement of a new order (customer's interest).

PURPOSE OF THE REGISTER
The purpose of the register is to maintain customer contact, maintain and develop customer and business relationships, and use it for reporting and statistical purposes. Lankapuoti / Pielisen Kaluste Oy uses this and other information generated during the customer relationship to plan and target product and service offerings.

Personal data is used within the framework permitted and required by the Personal Data Act. The register is not disclosed to external parties.

The email address of those who subscribe to the newsletter is used to send the newsletter. The information of those who fill out the contact form is used to respond to the contact.

INFORMATION CONTAINED IN THE REGISTER
The customer register consists of several separate registers compiled according to their main purpose. Together, these customer data form the data sets stored about the customer as follows:

- Customer contact information and information enabling ordering: first and last name, street address, postal code, city, country, language, telephone number, email address and personal identification number. For corporate, association and community customers, also the company name and business ID.

- Customer group information, discount category and other additional customer-specific information.
- Billing address and other billing information
- Possible consent to send direct marketing.
- Information about customer orders, deliveries and returns.
- Identifiers required to log in to the service.
- IP address information or other identifier
- Other textual information related to the customer relationship, such as the purpose of the contact request or the desired delivery time of the order

The registered person's personal data will be deleted at the user's request.

DATA PROVISION AND TRANSFER
The information will not be disclosed, except when required by authorities. Due to the processing of the information, some of the information may be held by the company's subcontractors.

REGULAR INFORMATION SOURCES
The contact and customer information in the register is obtained from the notifications made by the customer to the controller at the time of and during the creation of a customer relationship. A customer relationship is created when the customer registers for a service, places an order, subscribes to direct marketing or makes a purchase. A customer relationship can also be started at the customer's request, for example, based on a telephone conversation.

For electronic direct marketing (email and text message marketing), the customer is asked for separate consent in accordance with the Personal Data Act.

ANONYMOUS WEB ANALYTICS
We may use the following tools and services to collect anonymous, roaming information:

Google uses the information it collects to personalize online content, improve its services, and measure their effectiveness: https://business.safety.google/privacy/
Google Analytics: https://analytics.google.com/analytics/web/
Facebook Pixel: https://www.facebook.com/business/a/facebook-pixel
Microsoft Bing Adds: https://advertise.bingads.microsoft.com/en-us/resources/policies

LEGAL BASIS FOR PROCESSING PERSONAL DATA
There must be a legal basis for processing personal data. We process personal data on the basis of consent (e.g. subscribing to a newsletter), a contract (e.g. placing an order), a legal obligation of the controller (e.g. products that require a legal permit to possess or use), the protection of vital interests (e.g. training or a course that requires participants to provide personal health information), or the legitimate interest of the controller or a third party (e.g. web analytics).

COOKIES
Our website uses cookies, which help us develop our website for you. The purpose of cookies is to improve and speed up the shopping experience. Cookies can also be used to provide better offers and more personalized product recommendations to the customer. A cookie is a small text file that a web server stores on the user's hard drive. Some of the content on the website may require that cookies be accepted in order to function. The user's web browser will likely accept cookies with default settings, but the user can also prevent the use of cookies in the browser settings or by deleting cookies from the browser after the service has been used. For more information on browser-specific instructions, see the browser manufacturer's instructions.

REGISTER PROTECTION
Access to the register requires special access rights. Access is limited only to the information necessary for the person's work tasks and requires the use of personal user IDs. The customer register and the information system equipment that processes it are located in closed data centers. Hardware and software updates are handled regularly and appropriately, and potential threats are responded to immediately. In case of disruptions, the data is regularly backed up by copying. The system is protected by a firewall against external contacts.

Employees who process customer register data are bound by a duty of confidentiality. Information is only disclosed or disclosed to third parties in accordance with a statutory duty to disclose, such as at the customer's own request or at the statutory request of an authority.

CUSTOMER DATA RETENTION
We retain customer data for 20 years. The retention period is based on recommendations issued by authorities, the interests of customers, the average duration of customer relationships and the seller's responsibilities to ensure compliance with legislation (including the Product Liability Directive). The need to retain data has been discussed with representatives of the trade sector. We will delete personal data upon request without undue delay or at the latest when it is no longer necessary for its intended purpose.