PRIVACY POLICY

PRIVACY POLICY

UAB "Kordicepsas" (hereinafter referred to as We or the Company) values and protects the privacy and security of personal data. Therefore, in this Privacy Policy (hereinafter referred to as the Privacy Policy), we explain how we process the personal data of our program participants (hereinafter referred to as Participants), visitors, and other data subjects (collectively referred to as You) when you (a) participate in the Company's loyalty program, (b) visit the Company's online store at www.whieda.eu (hereinafter referred to as the Online Store), and (c) communicate with Us by phone, email, social networks, or other means.

When processing personal data, we comply with the European Parliament and Council Regulation (EU) 2016/679 of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), other applicable legal acts regulating personal data protection, and the provisions of this Privacy Policy. This Privacy Policy provides the most important summarized information about your personal data protection: what personal data we collect, how and why we use it, the legal grounds on which we process it, how long we retain it, to whom we transfer it, as well as our responsibilities in processing your personal data, your rights, and how you can exercise them. The most important information about your personal data processing is presented in the tables in Sections 13 and 14 of this Privacy Policy. Please take the time to review this Privacy Policy, and if you have any questions, do not hesitate to contact Us. If you use the Online Store, we will consider that you have familiarized yourself with this Privacy Policy and the purposes, methods, and procedures of your personal data processing outlined in it. If you do not want your data to be processed as described in this Privacy Policy, please do not use the Online Store or provide us with your personal data in any other way.

The Privacy Policy is a constantly evolving document, and we may improve, change, or update it as necessary. Therefore, we ask you to visit the Online Store from time to time, where you will always find the latest version of the Privacy Policy. You will be additionally informed about the most important changes to the Privacy Policy, and the updated version will always be published in our Online Store.

1. TERMS

1.1. EEA means the European Economic Area, which consists of the European Union member states and Liechtenstein, Iceland, and Norway.

1.2. Online Store means the online store located on the website at www.whieda.eu.

1.3. Visitor means a person who visits the Online Store but has not created an Account.

1.4. We or the Company means UAB "Kordicepsas," a private limited liability company established and operating under the laws of the Republic of Lithuania, legal entity code 304878863, registered address Girulių g. 10-201, 12112 Vilnius, Lithuania, which is your data controller.

1.5. Account means the Participant's personal digital account in the Online Store, allowing participation in the Program.

1.6. Goods means tangible items that Participants can purchase in the Online Store under the conditions set out in the Participants' Terms and Conditions.

1.7. Program means the cooperation program organized by the Company under the Rules for the distribution of Goods through network marketing.

1.8. Conditions means the general conditions for using the Online Store and purchasing Goods in the Online Store, which can be found at https://www.whieda.eu/#/publicofferingagreement.

1.9. Rules means the Company's Online Store Participants' rules, available in the Online Store at https://www.whieda.eu.

1.10. Other terms have the meanings assigned to them and defined in the GDPR and the Rules.

2. ON WHAT LEGAL BASES DO WE PROCESS YOUR PERSONAL DATA?

We process your personal data indicated in this Privacy Policy based on the following legal grounds:

2.1. By concluding, executing, amending, and administering the Rules or Conditions (GDPR Article 6(1)(b));

2.2. By fulfilling legal obligations and requirements imposed on us (GDPR Article 6(1)(c));

2.3. By pursuing our legitimate interests and those of third parties (GDPR Article 6(1)(f));

2.4. By obtaining your consent (GDPR Article 6(1)(a) and GDPR Article 9(2)(a));

2.5. One or more of the above legal grounds may apply to the processing of your personal data to the extent and conditions provided by applicable laws. The purposes and legal grounds for processing your personal data are detailed and presented in Sections 13 and 14 of this Privacy Policy.

3. FOR WHAT PURPOSES AND WHAT PERSONAL DATA DO WE COLLECT?

We collect and process only those of your personal data that are sufficient and necessary to achieve the purposes for which they are processed. The purposes of processing your personal data and the list of collected personal data are detailed and presented in Sections 13 and 14 of this Privacy Policy. We may combine the personal data received from you when you use the Program and/or the Online Store with those collected from other public or available sources.

4. CAN YOU REFUSE TO PROVIDE YOUR PERSONAL DATA AND/OR OBJECT TO ITS PROCESSING?

Your personal data is collected and processed to fulfill the Rules and Conditions with you and/or to enable us to promptly and properly provide services, sell and deliver Goods to Participants, and respond to your queries, requests, and complaints as a Program Participant. If you do not provide your data, provide it incorrectly, or refuse to provide it further, we will not be able to fulfill the provisions of the Rules, sell Goods to you, provide other services, or properly respond to your queries, requests, complaints, and/or other requirements requiring our action. Accordingly, not providing personal data or refusing to provide certain personal data will mean that cooperation under the Rules with you will not be possible or will be terminated. More information about your rights is provided in Section 9 of the Privacy Policy.

5. DO WE SHARE YOUR PERSONAL DATA WITH OTHERS?

Yes, the Company discloses all or part of your personal data to the following data recipients: various service providers, companies belonging to the same group as the Company, competent authorities, and other data controllers entitled to the information under applicable laws and/or our legitimate interests. Additionally, with your consent, your personal data may be disclosed to persons and/or companies specified by you. Details:

5.1. The Company employs various service providers (e.g., server and cloud rental, IT maintenance, identity verification, payment collection, audit, accounting, legal, tax advisory, claims administration, debt collection, analytics, direct marketing, customer service, and other service providers). All service providers have entered into service and data processing agreements with us and are considered your personal data processors, who can process your personal data only following our instructions and strictly adhering to the processing purposes. All processors, like us, must ensure the security of your personal data in accordance with applicable laws and the agreements with us.

5.2. To ensure the smooth sale and delivery of Goods, the operation of the Online Store and the Program, and the quality of other services we provide, it may be necessary to transfer some of your personal data to other companies belonging to the same group as the Company. Group companies, like other service providers, are considered data processors and are subject to all the conditions and procedures applicable to data processors.

5.3. When necessary and legally justified, we provide your personal data to service providers who are separate data controllers, as well as to various institutions, organizations, and other data controllers entitled to receive information under applicable laws and/or our legitimate interests.

6. DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA?

The data processors and independent data controllers with whom we share your personal data are usually located in the European Union member states or store the data entrusted to them by us in the European Union countries. However, there are cases where carefully selected service providers and controllers process personal data outside the EEA. In such cases, we carefully follow the practices and guidelines of supervisory authorities regarding the transfer of personal data outside the EEA and carefully assess the conditions under which data is transferred and may be further processed and stored after transfer outside the EEA. To ensure an appropriate level of data security and guarantee lawful data transfer, we sign the European Commission's approved standard contractual clauses (GDPR Article 46(2)(c)) for data transfers outside the EEA, where possible, or ensure that it is done otherwise in accordance with GDPR provisions. If you wish to obtain more information about how we ensure the security of your personal data when transferring it outside the EEA, please contact us using the contact details provided in Section 12 of the Privacy Policy.

7. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

We process and retain your personal data no longer than necessary to fulfill the purposes for which it is processed or as required by law. Detailed information about possible processing purposes for your personal data and their retention periods is provided in Sections 13 and 14 of this Privacy Policy. After the specified data processing and retention period has expired, we will delete your data or reliably and irreversibly anonymize it as quickly as possible, within a reasonably and justifiably required period.

Longer retention of your personal data than specified in this Privacy Policy may only occur when:

7.1. Your data is necessary for the proper administration of debt, damage (e.g., if you have not fulfilled your financial and/or property obligations or have caused damage to the Company or others), dispute, or complaint resolution to protect our or third parties' legitimate interests;

7.2. It is necessary for the Company to defend against existing or potential claims, complaints, or lawsuits, to exercise its rights;

7.3. There are reasonable suspicions of violations, illegal activities that are or may be subject to investigation;

7.4. The data is necessary to ensure the security, integrity, and resilience of information systems (e.g., when suspicious activities are noticed in the Online Store, Accounts, etc.);

7.5. Other grounds provided by law exist.

8. HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL DATA?

We process your personal data responsibly and securely, following our internal personal data processing rules and appropriate technical and organizational measures to protect against unauthorized data processing, accidental loss, destruction, damage, alteration, disclosure, or any other illegal processing actions. Therefore, we adhere to the following main data processing principles:

8.1. Collect personal data only for defined and legitimate purposes;

8.2. Process personal data fairly and only for its primary purpose;

8.3. Retain personal data no longer than required for the established purposes or by law;

8.4. Assign personal data processing only to employees who have been granted such rights and official access;

8.5. Process personal data only by applying appropriate technical and organizational measures;

8.6. Disclose personal data to third parties only on a legal basis;

8.7. Notify the State Data Protection Inspectorate about recorded or suspected personal data security breaches, if applicable;

8.8. Conduct periodic internal and/or external IT security audits;

8.9. Change, adapt, and continuously improve various processes to ensure the safest possible actions for collecting, receiving, transmitting, using, etc., personal data.

We emphasize that we regularly monitor our systems for potential breaches or attacks, but it is impossible to ensure complete security of information transmitted over the internet or avoid breaches, especially those that may occur due to your carelessness or disclosure of data to others. Considering this, we note that you also bear personal risk associated with providing personal data when using the internet connection through the Online Store, and you bear full risk related to the voluntary disclosure of your data to others and/or careless and negligent processing of your personal data that you receive directly from us.

9. WHAT RIGHTS DO YOU HAVE?

If we process your personal data for the purposes set out in this Privacy Policy or if you have reasons to believe that we process your personal data, then as a data subject you have the following rights as provided for in the GDPR:

9.1. Right to be Informed:

You have the right to know (be informed) about the processing of your personal data.

9.2. Right of Access:

You have the right to obtain confirmation as to whether or not your personal data are being processed, and if so, to access your personal data and obtain copies of them.

9.3. Right to Rectification:

You have the right to request the correction of inaccurate or incomplete personal data.

9.4. Right to Object:

You have the right to object to the processing of your personal data.

9.5. Right to Withdraw Consent:

Where we process data based on your consent, you have the right to withdraw your consent at any time.

9.6. Right to Restriction of Processing:

You have the right to request the restriction of processing of your personal data where there is disagreement about the accuracy or lawfulness of processing.

9.7. Right to Erasure (Right to be Forgotten):

You have the right to request the deletion of unlawfully processed personal data or personal data that are no longer necessary for the purposes for which they were collected or otherwise processed.

9.8. Right to Data Portability:

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller.

9.9. Right to Lodge a Complaint:

You have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, email ada@ada.lt). However, we recommend contacting us first, and we will try to resolve all your requests together.

9.10. Right to Information:

9.10.1. In this Privacy Policy, we strive to provide you with clear and detailed information about the processing of your personal data. The most important information for you can be found in Sections 13 and 14 of the Privacy Policy, which detail the purposes of personal data processing, categories of data, legal bases for processing, and retention periods. Additionally, each time we make changes to the Privacy Policy, we will inform you separately through a notice in the Online Store.

9.11. Right of Access to Processed Data:

9.11.1. If you are a Participant, you can access your data by checking your Account or by contacting us at eu-info@foherb.com, and we will send you an email with information on how to obtain a copy of your personal data or contact us through other contacts specified in Section 12 of the Privacy Policy.

9.12. Right to Rectify Personal Data:

9.12.1. If your data provided to us has changed or if you believe that the information we process about you is inaccurate or incorrect, you have the right to request the correction, clarification, or rectification of this information. To correct your data, please contact us using the contacts specified in Section 12 of the Privacy Policy and request that your data be corrected or clarified.

9.13. Right to Object to Data Processing:

9.13.1. If we process your personal data based on legitimate interests, we have weighed these interests against your rights and freedoms. However, if you believe that your fundamental rights and freedoms are at risk due to our data processing, you can exercise your right as a data subject and restrict the data being processed.

9.13.2. Accordingly, in cases where we process personal data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR), or if we process data for direct marketing purposes, you have the right to object to the data processing.

9.13.3. To exercise this right, please contact us using the contacts specified in Section 12 of the Privacy Policy.

9.14. Right to Withdraw Consent:

9.14.1. In cases where we process your personal data based on your consent, you have the right to withdraw your consent at any time, and processing based on your consent will be discontinued. For example, you can unsubscribe from receiving our newsletters or other marketing offers and information through any of our channels (e.g., newsletters, SMS messages, etc.). However, withdrawing consent does not affect the lawfulness of data processing before consent was withdrawn.

9.14.2. To exercise this right, you can conveniently contact us using the contacts specified in Section 12 of the Privacy Policy.

9.15. Right to Restrict Processing:

9.15.1. You have the right to restrict our ability to process your personal data. Once you restrict the processing of your personal data, we will not perform any actions with your personal data other than storing them. However, restricting personal data may mean that during the restriction period, we may not be able to provide you with goods or services, proper participation in the Program's conditions, and this may result in suspension or termination of cooperation under the Rules.

9.15.2. You may restrict the processing of your personal data in the following circumstances:

- Your personal data are inaccurate (processing of personal data in this case will be restricted until the accuracy of the data is verified);

- Your personal data are processed unlawfully, but you do not agree to have your data deleted;

- We no longer need your personal data for the purposes for which they were collected, but you need them to assert, exercise, or defend legal claims;

- Your personal data are processed based on a legitimate interest, and you object to such processing of personal data by us. In this case, processing will be restricted on this basis until it is verified that the reasons for us processing your personal data outweigh your interests.

9.15.3. You can restrict the processing of your personal data by contacting us using the contacts specified in Section 12 of the Privacy Policy.

9.16. Right to Erasure (Right to be Forgotten):

9.16.1. You have the right to request that we no longer process your personal data and delete them, if at least one of the following circumstances applies:

- Personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

- You withdraw your consent on which the data processing was based, and there is no other legal basis for processing the data;

- Your personal data are processed unlawfully;

- You have objected to the processing of personal data based on our legitimate interest, and it has been proven that your interests outweigh ours in that specific case.

9.16.2. We will consider your request to delete your personal data as a request to terminate cooperation under the Rules, which will be terminated in accordance with the Rules. A request to delete certain personal data may result in the suspension or termination of cooperation under the Rules or may mean that we cannot provide you with all services or purchase goods.

9.16.3. Upon expressing your desire to delete all or part of your data, we will no longer actively process those of your data that are no longer necessary for the purposes for which they were collected or otherwise processed, but personal data will be stored for specified periods for the following reasons:

- Personal data will continue to be processed for accounting, tax purposes following the data controller's legal obligations under Article 6(1)(c) of the GDPR (processing of data is necessary to fulfill a legal obligation applicable to the data controller);

- Personal data will continue to be processed for the purpose of handling complaints from Participants and other applications, based on Article 6(1)(b) of the GDPR (processing of data is necessary to fulfill a contract of which the data subject is a party);

- Personal data will continue to be processed to ensure that the prohibition of creating an Account, purchasing Goods, ordering services and using them in the future is implemented, data (reason for termination of service, date, period, certain identification data of you, etc.) will be stored and processed in accordance with Article 6(1)(f) of the GDPR (processing of data is necessary to pursue legitimate interests of the data controller or a third party);

- In case of disputes, claims, debt management, other enforcement of our legal requirements and protection of rights, data will continue to be processed in accordance with Article 6(1)(f) of the GDPR (processing of data is necessary to pursue legitimate interests of the data controller or a third party).

9.16.4. You can exercise the right to delete your personal data ("right to be forgotten") by contacting us using the contacts specified in Section 12 of the Privacy Policy.

9.17. Right to Data Portability:

9.17.1. You have the right to transfer your personal data to another data controller, which we process based on your consent and which processing is done using automated means. We will provide you with the data you wish to transfer in a format commonly used in our systems and readable by computers, and if desired and technically feasible, we will transmit the data directly to the other data controller specified by you.

9.17.2. You can exercise the right to data portability by contacting us using the contacts specified in Section 12 of the Privacy Policy.

9.18. Right to Lodge a Complaint:

9.18.1. If you believe that we process your data in violation of the requirements of data protection legislation, please first contact us directly. We believe that with goodwill we will be able to dispel all your doubts, answer your questions, and eliminate all your concerns. You can also file a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, email ada@ada.lt).

9.18.2. However, we encourage you to use the opportunity to contact us first, as we believe that by exercising your rights together we can prevent unnecessary bureaucratic burdens, ensure the fastest possible handling of your case, and protect your rights in the most efficient way possible.

10. HOW CAN YOU EXERCISE YOUR RIGHTS?

To exercise your rights, you can contact us in the following ways:

10.1. By email:

You can exercise your rights by contacting us via email at eu-info@foherb.com and submitting a request in free form.

10.2. By phone:

You can contact us by phone at +370 661 37 436. Please note that by phone, we may not be able to fulfill all of your rights. When contacting us by phone, we will first verify your identity by asking you to provide personal information or other information that only you should know. If the identity verification procedure fails, we will be forced to state that you are not the data subject and will have to reject your request.

10.3. In person at our office:

You can also exercise your rights by visiting any of our offices and filling out a request form. In this case, we will ask you to show a personal document (we will not keep a copy of the document). If there are doubts about your identity, before taking action, we may ask you to submit additional documents, evidence, or request that you submit the request in writing and/or signed with a qualified electronic signature or visit our office.

11. HOW DO WE HANDLE YOUR REQUESTS?

To protect the data of our Participants and Visitors from unlawful disclosure, upon receiving your request to exercise your rights, we will need to verify your identity. To confirm your identity, we primarily use the methods specified in Section 11 of the Privacy Policy.

Upon receiving your request and successfully completing the identity verification process, we undertake to provide you with information about the actions we have taken or not taken in response to your request as soon as possible, but no later than 1 (one) month from the date of receipt of your request and completion of the verification process.

Please note that your rights are not absolute, and we reserve the right to refuse to comply with your request with a reasoned written response, under conditions and grounds provided by law. Considering the complexity and number of requests, we may extend the period by 2 (two) months beyond the initial 1 (one) month, informing you of this extension before the end of the first month and specifying the reasons for such extension.

12. HOW TO CONTACT US :

The data controller responsible for processing your personal data as described in this Privacy Policy is UAB "Kordicepsas," legal entity code 304878863, address: Girulių g. 10-201, 12112 Vilnius, Lithuania.

The person responsible for the processing of personal data within the Company, with whom you can contact regarding all matters related to this Privacy Policy and all other matters related to the processing of data by UAB "Kordicepsas," is the designated person, contact email: eu-info@foherb.com.

You can also contact us by calling our general Participant Service phone number: +370 6 30 90818 .

13. DETAILED INFORMATION ABOUT THE PROCESSING OF YOUR PERSONAL DATA:

Below are the tables divided into convenient separate categories according to processing purposes, detailing the data processing processes and providing comprehensive information on how we collect, why we collect, for what purposes we use, and how long we retain your personal data.

13. 1. DETAILED INFORMATION ABOUT THE PROCESSING OF YOUR PERSONAL DATA:

The following tables, categorized conveniently according to processing purposes, provide a detailed description of data processing procedures and detailed information on how we collect, why we collect, the purposes for which we use, and the duration for which we retain your personal data.

By understanding and categorizing the purposes, data collected, reasons for collection, usage, and retention periods, we aim to ensure transparency and adherence to data protection regulations. This approach allows us to manage personal data responsibly and efficiently, providing clarity to our users about their data's journey and lifespan within our systems.

13.2 PURPOSES OF PROCESSING PERSONAL DATA :

Purchase of goods and fulfillment of your orders .

We collect your personal data in order to accept, administer and fulfill your orders for Goods, including (but not limited to) processing payments, delivering the Goods, accepting returns, issuing invoices, communicating with you about your order and its fulfillment, and dealing with and solving them. etc.

14. PURPOSES OF PERSONAL DATA PROCESSING:

Purchase of Goods and Fulfillment of Your Orders:

We collect your personal data to be able to accept, administer, and fulfill your orders of goods, including (but not limited to) processing payments, delivering goods, handling returns, issuing invoices, communicating with you regarding your order and related matters, resolving issues, and more.

Electronic Store Services Provision

By registering for the Program and creating your Account, you will be able to participate in the Program, make purchases, view your purchase history, manage your data and preferences, as well as access services provided exclusively to registered users.

To ensure the proper functioning and security of your Account, and to provide services related to your Account, we process the following data:

Processing Your Requests and Inquiries

When you contact us for assistance, ask questions, submit requests, feedback, complaints, etc., you provide us with your personal data.

We use your data to process and examine your request or other inquiries, provide you with necessary information, respond to your questions, and resolve your requests or demands. We may also use the data from your requests, demands, and other inquiries to defend our rights and legitimate interests.

END OF PRIVACY POLICY.