This Privacy Policy details the policies and procedures on how your personal information is collected, used, and shared when you visit, interact or make a purchase of products listed at the URL https://shop.applegreencottage.com (the “Shop”, “We”, “Us”), existing on and operating by the Payhip platform. 

By using the Shop, you hereby warrant that you have read, understand, and agree to the Privacy Policy. Please read it carefully to understand how your personal data will be treated.

This Privacy Policy does not apply to the practices of third parties that We do not own or control, including PayHip or any third party services you access through Payhip. See here to learn more about Payhip’s privacy practices.

The controller of personal data within the meaning of the General Data Protection Regulation Protection (GDPR) and the applicable Slovenian legislation on personal data protection is Damjana Jakoš s.p., Ulica Zore Majcnove 38, Ljubljana, Slovenia (hereinafter: “controller”).

Below you will find information on how the Shop uses your personal information, for what purposes your personal information is used, with whom we share it, and what control and information rights you have.

PERSONAL INFORMATION WE COLLECT

When we talk about “Personal Information” in this Privacy Policy, we are talking about both “Device Information” and “Order Information”.

Device Information - When you visit the Shop, we will automatically collect certain information about your device. This includes information about your IP address, web browser, time zone, and some of the cookies that are installed on your device. While you continue to browse the Shop, we will collect information about the individual web pages and/or products you choose to view, what websites or search terms referred you to the Shop, and information about how you interact and use the Shop. We collect Device Information using the following technologies: 

- “Cookies” are data files that are placed on your device or computer and will often include an anonymous unique identifier. For more information about cookies, and how you can disable them, visit http://www.allaboutcookies.org. 

- “Log files” track actions that occur on the Shop, and collect data including your IP address, Internet service provider, browser type, referring pages, exit pages, and date/time stamps. 

- “Web beacons”, “tags”, and “pixels” are electronic files which are used to record information about how you browse the Shop.

Order Information - In addition to this when you make a purchase or attempt to make a purchase through the Shop, information is collected from you to enable processing and fulfilment of your order, including your name, billing address, shipping address, payment information (PayPal), email address, and phone number. We refer to this information as “Order Information”.

Your payment card details are never collected by the Shop. Payment is handled separately, and securely, through the payment processor you have selected during checkout (currently, Paypal). You can read more about how PayPal uses your Personal Information here. 

HOW YOUR PERSONAL INFORMATION IS USED

The collected Order Information is used generally to fulfill orders placed through the Shop (including processing of your payment information, arranging for shipping/electronic delivery, and providing you with invoices and/or order confirmations). Additionally, this Order Information is used to: 

- Communicate with you; 

- Screen orders for potential risk or fraud; and 

- When in line with the preferences you have shared with Us, provide you with information or advertising relating to Our products or services.

We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Shop (for example, by generating analytics about how our customers browse and interact with the Shop, and to assess the success of our marketing and advertising campaigns). We may also use the device information collected for retargeting and advertising campaigns via carefully selected third parties.

When you sign up for the AppleGreen Cottage newsletter from within the Shop, we use the Personal Information that you voluntarily provide - name and email address, in order to send you our newsletter, while assuring full GDPR compliance. You may revoke your consent at any time.

SHARING YOUR PERSONAL INFORMATION

We share your Personal Information with third parties to help us use your Personal Information, as described above. For example, we use Payhip services to power our online store-you can read more about how Payhip uses your Personal Information here.

The Shop also uses Google Analytics to help us understand how our customers use the Shop -- you can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/. You can also opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

Finally, the Shop may also share your Personal Information to comply with applicable laws and regulations, to respond to a lawful request for information, or to otherwise protect the Shop's rights.

BEHAVIOURAL ADVERTISING - As described above, the Shop may use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work. You can opt out of targeted advertising by using the links below: 

- Facebook: https://www.facebook.com/settings/?tab=ads 

- Google: https://www.google.com/settings/ads/anonymous 

- Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: http://optout.aboutads.info/.

COMPLAINTS

The Shop operates a complaints handling procedure in an attempt to resolve any disputes when they first arise. If you have questions, or if you would like to make a complaint, please contact the Shop by using this contact form. No dispute resolution body has been appointed by the Shop as an alternative, out-of-court dispute resolution option for consumers located in the EU area. Pursuant to the Out-of-Court Resolution of Consumer Disputes Act, we are providing the link to the European Online Dispute Resolution platform for EU-based consumers, which is here.

YOUR RIGHTS - If you are a European resident, you have the right to access the personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below. Additionally, if you are a European resident we note that we are processing your information in order to fulfill, or otherwise to pursue our legitimate business interests listed above.

What rights you have regarding your personal data

If you have any questions regarding our Privacy Policy or the processing of your personal information, you may contact us without hesitation. Write to us at damjana (at) applegreencottage (dot) com. Upon your request, we will inform you – in writing and in accordance with the applicable law.

In accordance with the provisions of the EU General Data Protection Regulation, you have the following rights as an individual:

Right to withdraw consent: If you, as an individual, have consented to the processing of your personal data (for one or more specific purposes), you have the right to revoke your consent at any time, without prejudice to the lawfulness of the data processing carried out up to your revocation. Consent may be revoked by a written statement sent to the controller using the contact form in the Shop. Withdrawal of consent to our processing of personal data does not have any negative consequences or sanctions for the individual. However, after revoking the consent to our processing of personal data, the controller may no longer be able to provide one or more of its services to the concerned individual if the services cannot be provided without personal data.

Right of access: As an individual, you have the right to obtain a confirmation from the provider (personal data controller) whether personal data is processed in relation to you and, where applicable, access to personal data and certain information (on the purposes of processing, on the types of personal data, about the users, on retention periods or criteria for determining periods, on the existence of the right to rectify or delete data, the right to limit and object to processing and the right to appeal to the supervisory authority, the source of data if the data have not been collected from you, the existence of automated decision making, including the creation of profiles, the reasons for it and the meaning and consequences of such processing for you, and other information in accordance with Article 15 of the EU General Data Protection Regulation).

Right to correct personal information: As an individual, you have the right to have the controller correct inaccurate personal data about you without undue delay. As an individual, you have the right to supplement incomplete data, including the submission of a supplementary statement, taking into account the purposes of the processing.

Data deletion (“the right to forget”): As an individual, you have the right to request deletion of the personal information that the controller holds about you. The controller must delete the data without undue delay when there is one of the following reasons:

·        data are no longer needed for the purposes for which they were collected or otherwise processed;

·        if you revoke the consent and there is no other legal basis for the processing;

·        if you object to the processing and there are no overriding legitimate reasons for the processing;

·        the data were processed illegally;

·        the data must be deleted in order to fulfill legal obligations under EU law or the law of the Member State applicable to the controller;

·        data were collected in connection with the provision of information society services.

However, as an individual, in certain cases described in Article 17 (3) of the EU General Data Protection Regulation, you do not have the right to have the data deleted.

Restriction of processing: You have the right to request the controller to restrict the processing of your personal data where:

·        you contest the accuracy of the personal data until the controller has taken sufficient steps to correct or verify its accuracy;

·        the processing is unlawful but you do not want the controller to erase the data;

·        the controller no longer needs your personal data for the purposes of the processing, but you require such data for the establishment, exercise or defence of legal claims; or

·        you have objected to processing justified on legitimate interest grounds (see above) pending verification as to whether the controller has overriding compelling legitimate grounds to continue processing.

Data portability: You, as an individual, have the right to receive personal data about you that you have provided to the controller in a structured, commonly used and machine-readable format, and also to require the controller to transmit it to another controller where this is technically feasible. Namely when:

·        processing is based on consent or a contract, and

·        processing is carried out by automated means.

Right to object: On grounds relating to your specific situation, you have the right to object at any time to the processing of personal data that is necessary to perform tasks in the public interest or exercise public authority conferred on the controller (point (e) of Article 6 (1) of the EU General Data Protection Regulation) or is necessary for legitimate interests pursued by the controller or a third party (point (f) of Article 6 (1) of the EU General Data Protection Regulation), including profiling on the basis of those treatments. The controller ceases to process personal data unless it proves urgent legitimate reasons for the processing that outweigh your interests, rights and freedoms, or for asserting, enforcing or defending legal claims.

Where personal data are processed for marketing purposes, the individual has the right to object at any time to the processing of data relating to him/her for the purposes of such marketing, including the creation of profiles, insofar as it relates to such direct marketing. Where an individual objects to processing for direct marketing purposes, the data shall no longer be processed for those purposes.

Where data is processed for scientific or historical research purposes or for statistical purposes, the individual has the right to object to the processing of data relating to him/her for reasons related to his/hers particular situation, unless the processing is necessary for the performance of a task carried out by reasons of public interest.

Right to lodge a complaint with a supervisory authority: Without prejudice to any other (administrative or other) remedy, you, as an individual, have the right to lodge a complaint with the supervisory authority, in particular in the country where you have your habitual residence, where you work or where the infringement allegedly took place, if you believe that the processing of your personal data violates the regulations on the protection of personal data. Iin Slovenia, the tasks of the supervisory authority are performed by the Information Commissioner.

Without prejudice to any other (administrative or extrajudicial) remedy, you as an individual have the right to an effective remedy against a legally binding decision of the supervisory authority, as well as in the event that the supervisory authority does not consider your complaint or does not inform you about the situation or the decision on the appeal within three months. Proceedings against the supervisory authority shall be subject to the jurisdiction of the courts of the Member State in which the supervisory authority is established.

The individual may address all requests concerning the exercise of rights in relation to personal data in writing to the controller, via one of the contacts listed on the privacy policy.

The controller may, for the purposes of identification of the individual in case of exercising his/her rights in relation to personal data, request additional data from the individual and may refuse to act, if the individual cannot be reliably identified. 

The controller must respond to the request of the individual by which he/she exercises his/her rights in relation to personal data without undue delay and no later than one month from the receipt of the request.

As a data subject, you have the right to lodge a complaint at the following address: Republic of Slovenia, Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, telephone: 01 230 97 30, e-mail: gp.ip@ip-rs.si.

DATA RETENTION

The information you share with the Shop will be maintained for our records unless and until you ask us to delete this information.

MINORS

The Shop is not intended for individuals under the age of 14.

CHANGES

This privacy policy may be updated from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.