PRIVACY POLICY

Mallouppas & Papacostas Ladies & School Bags (KIPLING) is operated by y Malloupas & Papacostas Group (The Group), representing international fashion franchises.

As a Group, we have a commitment to safeguard your privacy and to handle your data in an open and transparent manner. We respect your right to privacy and are committed to maintaining it. We only collect, store and process your personal information in accordance with all applicable laws and regulations.

This Privacy Policy explains how we use any personal information you provide to the companies of the Group when you use our services in our Stores, our Website and any contact you may have with our Customer Contact Centre.

Group Privacy Policy. What this covers

The Group Privacy Policy, (“Policy”) explains what categories of personal information is collected and for what purpose it is processed as well as when and why personal data may be shared within the Group and with third parties. Finally, the Policy outlines your rights and options available to you when it comes to your personal data.

This Policy applies to you with regards to your interactions with our Group and/or our communications with you about our products and services.

What types of personal data do we collect and for what purpose?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Such personal data, collected by us within the context of our business relationship may include:

• First & Last Name
• City of Residence
• Full postal address is only required in the case of delivery of items purchased
• Email address
• Mobile phone data
• Birthday (optional)

The Group collects the minimum required personal data that would allow the Group to perform the service for which the customer has signed up.

Customer Personal Data is collected solely for marketing purposes and may be used (in accordance with any preferences you have expressed and/or instructions given) to send you marketing messages by email, post, phone and social media to keep you updated in relation to the brands you have signed up for.

Anytime you contact us about our services either by phone, email or post or when you contact us via social media, we may also collect personal data you provide us.

We may also contact you in order to manage promotions and competitions you participate in.

Personal Data is collected primarily when customers visit the stores of the Group brands and complete a customer registration from. Personal data may also be collected online and/or via the participation in any one of our event and/or competitions.

We process the aforementioned personal data in compliance with the provisions of GDPR and the applicable local legislation as amended from time to time.

• For compliance with a legal obligation
• For the performance of contractual obligations
• For the purposes of safeguarding legitimate interests

As part of running our business, we have a legitimate interest to promote our brands using marketing messages to existing customers of the Group unless you have asked us not to. This includes the management and dispatch of information on exclusive promotions, latest news and events in store via email, SMS or ordinary mail.

• On the basis of your consent

In so far as you have granted us consent to the processing of personal data for marketing purposes, the lawfulness of such processing is based on your consent. Any such consent granted, may be revoked at any time by contacting us. Please note that revocation of such consent does not affect the legality of any processing that has been performed prior to the revocation.

This also applies to the revocation of declarations of consent that were granted to us prior to the entry into force of the GDPR, i.e. prior to 25 May 2018.

When we collect your personal data, we will always give you the opportunity to revoke your consent and/or instruct us to stop sending marketing messages at any time.

• For email marketing, the best way to do this is to click on the ‘unsubscribe’ link in any email you receive.
• For SMS marketing, you may call the number provided on the SMS and your number will automatically be added to an opt-out list.

We do what is possible to process customer requests within 48 hours of receiving them.  We continuously work on improving our customer experience to allow you to opt-out easily of our communications.

When and why our Group may share personal data within the Mallouppas & Papacostas Group and with other organizations.

The personal data collected may be transferred/communicated to third party data processing companies that carry out certain functions on our behalf. Our Group works with carefully selected Service Providers that help us with technology services. We assure you that we only share personal data that are absolutely necessary to enable our Service Providers to provide their services. Where the party to whom we share your personal information is a legal entity, we hereby affirm that we will take all reasonable steps and/or actions to confirm that the employees and/or representatives of such a third party will execute their duties in accordance with the highest industry standards and will comply with all provisions and requirements of the provisions of this Privacy Notice and the local laws and regulations on the protection of personal data (as amended from time to time) and GDPR and any legislation to success it or complement it.

Some of the Service Providers we work with operate online media channels, and they place relevant online advertising for our products and services on those online media channels on our behalf. For example, you may see an advert for our products and services as you use particular social media sites.

The personal data may be transferred/communicated to our franchise partners or may be processed by third parties who work for our franchise partners. We would like to reassure you that we have in place appropriate protection measures to make sure that your personal data remains adequately protected and is treated in line with this Policy.

Other than the disclosures referred to in this policy, we will not disclose any personal information without your consent unless we are legally entitled or obliged to do so (for example, if required to do so by Court Order or for the purposes of prevention of fraud or other crime or as a result of any legal obligations) and/or if necessary to defend our legal rights.

Our Group does not, under any circumstances, sell customer data to third parties.

How we protect your personal data

The Management of Mallouppas & Papacostas Group are committed to respect, protect and maintain your privacy. We have put in place a number of measures to ensure this is implemented.

Indicatively, we use computer safeguards such as firewalls and data encryption. Authorized access is only granted to the employees who need it to carry out their job responsibilities.

As part of our policies, we enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal data.

You should be aware that the internet is an insecure environment. Whilst we take appropriate technical and organizational measures to safeguard your personal data, please note that we cannot guarantee the security of any personal data that you transfer over the internet to us. However, we will continue to update these measures, as appropriate, when new technology becomes available.

How long we keep your personal information for

We will keep your personal data for as long as you would like us to do so and for as long as you remain a customer to our shops.

Our Group general retention policy is to retain personal data for 6 years following termination of our business relationship.

In some circumstances, such as to meet our legal or regulatory obligations, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions, we may hold on to your personal information after we’ve finished providing services to you, or for longer than our general retention policy.

Your rights over your information

Under the General Data Protection Regulation (EU) 2018/679 which is applicable from 25 May 2018 you have various rights with regards to the personal data we hold about you and how it is used.

These are:

• Right to be informed about what we do with your information
• Right to receive access to your personal data. This enables you to e.g. receive a copy of the personal data we hold about you.
• Right to request correction (rectification) of the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Right to request erasure of your personal information.
  This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. In such a case, your data will be stored but not processed until expiration of the retention obligation.
• Right to withdraw consent
  This enables you to withdraw your consent regarding the processing of your personal data for marketing purposes at any time. You may withdraw your consent given to us either by opting out of SMS messages, unsubscribing to email newsletters or changing preferences via a link in the footer of all non-transactional email messages. These options are made available when you sign-up for our email lists and in email messages delivered from us.  Note that any withdrawal of consent shall not affect the lawfulness of processing based on consent before it was withdrawn or revoked by you.
• Right to object to or restrict the processing of your personal data
  This enables you to ask us to stop processing your information or to ask us to limit the ways in which we process the information.  If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
• Right to portability of your information
  Request to receive a copy of the personal data concerning you in a format that is structured and commonly used and transmit such data to other organizations. You also have the right to have your personal data transmitted directly by ourselves to other organizations you will name.
• Right to lodge a complaint
  If you have exercised any or all of your data protection rights and still feel that your concerns about how we use your personal data have not been adequately addressed by us, you have the right to file a complaint with the Commissioner for the Protection of.

Data transferred to a country outside the European Union

GDRP and the applicable local legislation as amended from time to time prohibits the transfer of personal information outside the European Economic Area (“EEA”) unless specific requirements are met for the protection of that personal information.

Data will only be transferred to countries outside the EU or the EEA (i) it is required by law (e.g. reporting obligations under tax law); or (ii) if you have granted us your consent. If service providers in a third country are used, all reasonable and practicable measures will be taken to ensure that they will comply with the data protection level in Europe in accordance with the GDPR.

Any transfers to parties located outside the European Union will be in line with the legal and regulatory provisions of the GDPR and applicable local legislation as amended from time to time.

To what extent we carry automated decision-making and profiling.

In establishing and carrying out a business relationship, we generally do not use automated decision-making. If we use this procedure in individual cases, we will inform you of this separately.

Changes to our privacy policy

We are committed to offer you with the best possible shopping experience; consequently, additional functions and features may in the future be incorporated into our website.

This may result in periodic changes to this Privacy Policy to reflect how we are processing your personal information.  We do encourage you to review our Privacy Policy periodically so as to be always informed about how we are processing and protecting your personal information.

This Privacy Policy was last updated on 17^th August 2020.

Contacting us

Your concerns are very important to us and we endeavor to address all of your requests promptly.

If, at any time, you believe that you have received an unsolicited commercial email from Mallouppas & Papacostas Group, on behalf of somebody else, you may report it to us.

To exercise any of your rights, or if you have any other questions about our use of your personal data, please contact us by sending an email to: gdpr@mp-group.com with regards to Kipling.