Privacy Policy
1. General information
In implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation”), we provide you with a clear, transparent and fair processing of your personal data, as well as care for your privacy and the security of your personal data.
In this Policy you will find all the information about what personal data we collect about you and how we process it. We encourage you to read the terms of this Policy carefully before you provide us with any of your personal data.
In order to receive the services offered by www.ummlyfood.com, you must register on the website www.ummlyfood.com (“Ummly”) and provide your personal data.
By registering on www.ummlyfood.com, you entrust us, Ummly Ltd (registered office: S. Edžus iela 2-53, Jelgava, reg. no. 42103090960) as the Controller of your personal data (hereinafter referred to as “we” or “Controller”) with your personal data and grant us the right to process them in accordance with this Policy (hereinafter referred to as “Policy”) and the terms of sale of goods or distance contract (hereinafter referred to as “Distance Contract”) of www.ummlyfood.com.
By registering, you confirm that the personal data you have provided is accurate and true. We accept no liability for inaccurate, incomplete or erroneous personal data provided by you. If the personal data you have provided is found to be inaccurate, you must correct it immediately. In the event that you have provided other personal data, we reserve the right to seek recourse against you in the event of a claim.
The provision of your personal data to us is voluntary, however, we inform you that if you do not accept all or part of the terms of the Distance Agreement or this Policy, we regret that we will not be able to provide you with the opportunity to use all or any of the services offered by Ummly (the “Services”).
2. Collection of personal data
We obtain almost all of your personal data directly from you. You provide us with your personal data directly by registering with Ummly, by submitting a request, complaint or feedback in any way (by sending us an email, by submitting a paper or oral submission to us, by calling customer service).
We collect the personal data you provide when you register and create your buyer profile on Ummly, when you provide information about your purchases when you place orders, or when you take action on your Ummly profile, when you order goods and when you contact us to resolve any issues.
If we need to obtain additional information or investigate the circumstances in order to deal with your request in a qualitative and objective manner, we may link the data contained in your request with data already available to us or lawfully collected at the time of your request (e.g. your payment transaction data, your profile usage history, etc.).
3. Legal basis for processing personal data
Your Personal Data is processed on the basis of the General Data Protection Regulation:
- Article 2(1)(a) (your agreement);
- Article 1(1)(b) (for the performance of a contract to which you are a party or for pre-contractual measures);
- Article 2(1)(f) (pursuit of our legitimate interests).
Our legitimate interests include ensuring the development and quality of our products and services, ensuring compliance with our internal rules, and protecting our legitimate interests in the event of disputes (resolving claims against us or defending our interests in court).
4. Types of processing, categories of data and duration of processing
Type of data processing | Categories and types of data | Duration of data processing |
Register with Ummly and create a profile | Name, surname, telephone number, email address, delivery address. Your profile will also store information about your order history, previously viewed products and your marked favourites with each subsequent order. | As long as the Distance Contract is valid (until your profile is deleted). If the customer does not log in for more than 1 year, the profile will be deleted. |
Order creation and delivery | Name, email address, telephone number, delivery address, signature (on the delivery note when accepting the goods), date and time of order and delivery, details of the goods ordered, payment details. | Five years after the order was placed. |
Making payments | Name, payment description, amount, payment reference number (for returnable goods), transaction reference ID, payer account number. | Five years (or other period as required by accounting laws and regulations). |
Exercising the right of withdrawal | Name, email address, telephone number, date and time of order and delivery, signature (on the return document), details of the goods to be returned, payment details and payment account details (in the case of returns). | Five years after exercising the right of withdrawal. |
Claims handling | Name, surname, telephone number, e-mail address, delivery address, date of birth and any other details you provide. The content of your claim or request, which records a description of the claim, your request or your opinion. Other documents or information (e.g. photographs, delivery note details) that you have provided relating to the claim or request. A recording of the telephone conversation if you contact customer service. | For as long as the claim exists and for 12 months after its resolution. |
Direct marketing | Name, email address and/or telephone number, order and purchase details, history of your individual offers and information about their use | As long as your consent is valid. |
Market research and statistics | Address, district or city, order details (e.g. date of purchase, category and names of goods, quantities, total purchases) – in encrypted form (anonymised data). | Anonymised data may be stored for an unlimited period of time. |
Information security | Your profile information and data about your access to and activity in your profile – if necessary to carry out a check to obtain evidence relating to a threat to the security of an information system. | Until the security threat is addressed and the problem is solved. |
Protection of the legitimate interests of the controller | Data that may be or are necessary for this purpose (respecting the basic principles of data protection, in particular the principle of data minimisation). | For as long as the dispute or proceedings are pending, and for the purposes of a possible appeal, for the duration of the appeal. |
5. Purposes of the processing of personal data
We process your personal data so that you can create your personal profile on Ummly, use the information provided in your profile to place orders, receive information about Ummly news and promotions, view your order history, save your shopping baskets, mark your favourite and most frequently purchased items.
We process your personal data to administer your registration with Ummly.
Your personal data will be used to prepare and deliver your orders, contact you, respond to your messages and ensure that your personal information is accurate and up to date.
We need your name to identify and confirm you during delivery/collection of your order, to locate your order in case you contact customer service and report problems with your order, and to make returns if necessary.
We need your telephone number to inform you of the status of your order, to contact you when your order is delivered to your address, to contact you in the event of problems with your order, to inform you of offers, news and promotions if you have accepted them, to locate your order or identify you as a customer in our customer database and to reset your profile password in the event that you have lost it.
We need your email address to keep you informed of the status of your order, to contact you if there are any problems with your order, to inform you of offers, news and promotions if you have agreed to them and to locate your order or your profile in our customer database.
Order creation and delivery:
The order information you provide to us through the Ummly Services is used to fulfil the Distance Contract, i.e. to enable us to process and deliver your order to the address you have provided.
Ummly creates the order from the goods you have purchased online. The content of your order is processed by both electronic systems and our staff.
In order for us to deliver to your address, you must enter the delivery address and other information that may be relevant for the delivery (such as the door code) when you place your order. We will process this data to ensure the fulfilment of your order and delivery.
If you are a registered user and have entered your delivery address in your profile, the address will be saved automatically in your profile for future orders. If you wish to delete or add a new address, you can do so in your Ummly profile or by contacting customer service.
Your order history will be retained to ensure that our legitimate interests are protected in the event that we have to deal with a problem or dispute, so that we can defend our legitimate interests against any claims, demands or claims made against us.
Payment:
We process your purchase data by collecting details of the method of payment and payment information to enable us to proceed with the fulfilment of your order.
The payment processing is provided by the payment platform makecommerce.lv, therefore our company transfers the personal data necessary for payment processing to the owner of the platform Maksekeskus AS.
In order to place an order, you must make a payment on the Ummly website. To make the payment, you use the payment method of your choice from those offered on the Ummly website.
We will process your payment data as set out in this Policy and the Distance Agreement.
Exercise of the right of withdrawal:
We process your data to enable you to exercise your statutory right of withdrawal. For this purpose, we process the details of your order as well as your personal data provided at the time of placing your order and the details you provide when informing us of your wish to exercise your right of withdrawal.
Handling of claims:
We process your personal data in the event that we need to deal with a claim or dispute arising out of the services we provide or an order you have placed, as well as other activities related to your order and our performance of the order.
We will process your personal data to protect our rights in the event of a dispute, to assess the situation in dispute, to obtain evidence, to bring legal claims, to defend ourselves in court, and to pursue our other legitimate interests in relation to the above.
In order to process claims that you have submitted to Ummly via a form or customer service email or telephone contact, we need to process certain of your personal data.
We may also process your personal data to prevent fraud, defamation or other unlawful activity, misuse of our products or services which may harm us or damage our reputation.
Direct marketing:
If you have provided your consent in your Ummly customer profile, we will process your personal data to send you marketing related information and newsletters. For example, to inform you about new products, special offers or discounts. Such notifications will be sent to your email address or by text message if you have consented to this.
We process such data to keep you informed and to promote our goods and services.
Market research and statistics:
We process data about your orders for reporting and statistics in order to monitor, evaluate, improve and expand our online services. We analyse data such as how many deliveries have been made to you, how many complaints have been received from you in customer service, etc. However, we will not process your name, contact details or any other directly identifiable information that can directly point to you as a specific person. Such processing will be carried out on an anonymous basis.
6. Recipients of personal data
In order to fulfil our obligations to you, we transfer your personal data to companies that provide services to us, such as data centre services, system development and maintenance services, email maintenance services.
These companies may only process your personal data in accordance with our instructions and in accordance with a cooperation agreement between us.
In order to comply with our legal obligation, as well as to pursue our legal interests and defend our rights, we may provide your personal data to law enforcement authorities and other state or local authorities at their request or as necessary. In order to protect our legitimate interests, your personal data may be transferred to legal service providers such as lawyers.
Your personal data may be transferred to manufacturers of products offered by Ummly in the event of a dispute or claim relating to that manufacturer’s products that you have purchased. Such processing will be based on your consent.
Your personal data will not be transferred to or processed in a country outside the EU/EEA.
7. Storage of personal data
Your Personal Data will be kept only for as long as necessary for the purposes and in accordance with the criteria set out above (see paragraph 4).
We will store the Distance Contract concluded with you and evidence of its conclusion within the period prescribed by law and may also store it for a longer period of time, until the limitation of liability claims that may arise from the contractual obligations, as well as if necessary to enable us to defend our legitimate interests against claims or claims made against us or asserted against us in court.
In the event of legal action, your personal data may be retained until the end of the legal proceedings, including any appeal periods.
Proof of payment documents, including delivery notes, which are considered as supporting documents, will be kept for as long as required by the laws and regulations governing accounting.
8. Your rights as a data subject
You can exercise your data subject rights, for example to request access to your personal data, to request rectification of your personal data, to request erasure of your personal data or, where applicable, to withdraw consent to the processing of your personal data. In certain cases, you may have the right to request the restriction of the processing of your personal data or to object to the processing of your personal data.
Access to personal data:
You have the right to obtain our confirmation as to whether we are processing your personal data, as well as the right to see the personal data we are processing about you and information about the purposes of the processing, the categories of data processed, the categories of recipients, the period of processing, the sources of the data, automated decision-making, including profiling, as well as its meaning and consequences for you.
Rectification of personal data:
If the data you provided at the time of registration has changed or you see that the information we are processing about you is inaccurate or incorrect, you have the right to request that this information be changed, updated or corrected by contacting our customer service or by independently correcting (updating) your data in your Ummly profile.
Withdrawal of consent:
If we process your personal data on the basis of your consent, you have the right to withdraw your consent to the processing of your personal data at any time.
For example, you can withdraw your consent to receive offers and newsletters at any time. Withdrawal of this consent will not restrict you from continuing to use the Services and from fulfilling your obligations under the Distance Contract, but it will mean that we will not be able to provide and you will not be able to receive up-to-date offers and newsletters.
You may adjust (withdraw or re-grant) your consents by submitting your duly updated registration information for the consents you have given, by changing the terms of the consents in your Ummly profile or by contacting us through customer service.
Once your consent is withdrawn, we will stop processing data on the basis of consent and, in the cases specified in the Policy, delete or anonymise the data. However, in any event, we may retain evidence of your consent for a longer period if this is necessary to enable us to defend our legitimate interests against claims, demands or claims made against us.
Right to object:
You have the right to object to the processing of your personal data where the processing of your personal data is based on our legitimate interests. However, taking into account the purposes of providing the Services and the balance of legitimate interests of both parties (you as the data subject and us as the data controller), your objection may mean that if we stop processing your data for our legitimate interests, we will not be able to enable you to continue using the Services and the Distance Contract will be suspended and terminated.
Data Erasure:
In certain circumstances (e.g. where personal data is processed unlawfully, the lawful basis for processing ceases to exist, personal data is no longer necessary in relation to the purposes for which it was collected) You have the right to ask us to erase your personal data. However, this does not apply where we are required by law to retain the data.
Restriction of processing:
In certain circumstances (e.g. where personal data is being processed unlawfully, you contest the accuracy of the data, you object to the processing for the purposes of our legitimate interests) You have the right to restrict the processing of your personal data. However, we should note that due to the restriction of processing and for the period of such restriction, we may not be able to provide you with the Services and fulfil our obligations under the Distance Contract.
Data Portability:
You have the right to receive or transfer your personal data to another data controller. This right applies only to data that you have provided to us on the basis of consent or contract and where processing is carried out automatically.
To exercise the above rights, you may make a request to the Customer Service.
- Cookies
We use cookies, which are small files of information that are sent to your computer or other device (such as a mobile phone) when you visit a particular website and stored in your browser. The cookie is sent to your computer or other device for the purpose of storing data so that we can recognise you as a user of our services when you visit our website. Cookies allow us to link your purchase history, other data collected during your use of our services, to your browsing on the Internet. The information we collect through cookies enables us to provide you with a more user-friendly browsing experience, attractive offers, and to learn more about website user behaviour, analyse trends and improve both the website and our service to you.
The Ummly website also uses third party cookies. These are used to create a browsing history of each visitor in order to show you targeted advertising and provide you with the best experience when visiting our website. If your browser allows third-party cookies to be recorded, our chosen partner will be able to record their own cookies in your browser.
For more information on cookies, their use and opt-out, please see our Cookie Policy.
10. Requests, questions and complaints
To exercise your rights as a data subject as described in this Policy, as well as to make other requests in relation to the processing of your personal data, you may submit a request by sending an e-mail to the following e-mail address: saldejums@Ummly.lv. The request must specify that the request relates to the processing of your personal data by Ummly and must be as specific and clear as possible in the wording of your request or request.
You may submit any questions about Ummly’s activities, your order, your Ummly profile, as well as requests, feedback, complaints (including questions about the processing of your personal data) to the customer service:
Phone number: +371 28295192
e-mail: info@ummlyfood.com
If you believe that your privacy has been violated, you can file a complaint with the data protection supervisory authority – the Data State Inspectorate in Riga, Blaumaņa iela 11/13-11, tel. 67223131, e-mail: info@dvi.gov.lv.
11. Additional information
Please note that both the Policy and the Distance Contract are subject to change, amendment or renewal, so we encourage you to review these terms each time you use Ummly’s services.
