Privacy policy

Main information

The purpose of this Privacy Policy is to inform you about how your personal data is collected and processed, explain how long it is stored, to whom it is provided, what rights you have and where to apply for its implementation or other issues related to the processing of personal data.

Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 of the European Union (hereinafter referred to as the Regulation), the Law on the Legal Protection of Personal Data of the Republic of Estonia and other legal acts regulating the protection of personal data.

The controller of your personal data who determines the purposes and means of processing your personal data, is Lemona Eesti JSC (hereinafter referred to as the Company) (entity code: 11611793, registered office address: Tulika 19c, Tallinn, 10613, telephone +372 640 7513, email: [email protected]).

It is important that you read the Privacy Policy carefully, as the terms and conditions set out in it apply every time you purchase goods on our website and/or in any of the Company’s physical shops by visiting our website (https://www.lemona.ee). Please read the current version of this Privacy Policy on a regular basis since its content may change in the future.

Persons under the age of 14 cannot provide any personal data on our website. If you are a person under the age of 14, you must obtain the written consent of your parents or other legal representatives (guardians) to the processing of your personal data before submitting your personal data on our website.
The terms used in the Privacy Policy are construed in the way they are defined in the Regulation.

The information below includes the following data processing purposes: (i) e-commerce; (ii) sending newsletters and other direct marketing activities; (iii) the processing of personal data of job applicants and the administration of the applicants’ databases; (iv) administration of complaints or inquiries; (v) email communication; (vi) the use of cookies; (vii) the use of social networks; (viii) video surveillance.

E-commerce

For the purpose of e-commerce, we shall process the data that you submit at the time of registration, as well as the data that we shall receive from you in the course of the purchase of the goods, including information on the goods you have purchased and the payment details. If you do not provide your personal data at the time of registration, we will not be able to identify you and sell goods to you.

After creating your account on our website, please provide the following personal data: full name, email, password, and telephone number. If you purchase Goods after creating an account on our website, please provide the billing address and delivery information: preferred delivery time, other information relevant to the courier, personal data of the person authorised to collect the goods that we need to fulfil your order and deliver the goods or indicate the place of collection.

In addition to the information you provide, we process information on the products you purchased on our website. Information on using our website is collected by using cookies and it is further described in this Privacy Policy. After making a payment for the goods being purchased on our website, we also receive personal payment details, including the account number and payment amount.

For this purpose, we shall store your personal data for not more than 10 years from the date of your purchase, except for the cases where, in accordance with legal obligations, e.g. you will need to process your personal data for longer than the specified time period, following the instructions of state institutions or participating in legal disputes.

The basis for processing your personal data for this purpose is the performance of the contract or, at your request, the actions taken prior to the conclusion of the contract. The basis for the actions for the processing of certain personal data may also be based on the fulfilment of statutory obligations, e. g. in order to comply with the obligations laid down in the legislation on tax payments. (Article 6(1) (a) (b) of the Regulation). 

Sending newsletters and other direct marketing activities

If you are our client, you have subscribed to a newsletter on our website or otherwise expressed your will to receive direct marketing materials, personal data voluntarily submitted by you, including your email address and telephone, shall be used to provide you with the information on the products and services, news, promotions, events or other direct marketing by the contact details above, as well as social networks, media channels, and other similar e-communication channels.

If you are our customer but have not objected to the processing of your data for direct marketing purposes, we will only process them for the marketing of similar goods and services.  

The processing of your personal data for this purpose is based on your consent to the processing of your personal data and the processing of your personal data for the purpose of direct marketing, or our legitimate interest in promoting our products and services (Article 6(1) (a) (f) of the Regulation).

Your personal data will be processed for direct marketing purposes for 5 years from the last day of communication with you. Your personal data will be destroyed immediately after the specified deadline. After your consent to the cancellation of the processing of personal data, we will destroy them automatically.

Any email sent to you will allow you to opt-out direct marketing communications. You may also unsubscribe or withdraw consent by contacting the Company using the contact details provided in this Privacy Policy.

The Processing of Personal Data of the Job Applicants and the Administration of the Applicant Database

If, according to the notice published on our website for the job selection to a particular job position, you sent your CV (resume), cover letter, references and/or other documents or data on our website, the data that you voluntarily submitted and other personal data below shall be processed for the purpose of conducting a selection for a vacancy in the Company and evaluating your candidacy.

Your personal data shall be processed until the selection ends, i.e. it is decided to employ a particular applicant or it shall be decided to complete the selection process without selecting any applicant. After the end of the selection, your personal data will be destroyed, unless you consent to the continued storage of data for future selections but not later than 3 (three) calendar years after the end of the selection for which you provided your personal data with your consent. Your personal data shall be destroyed within 3 (three) calendar years unless there is a different basis for processing them.

If your personal data is submitted voluntarily to us without the publication of a selection by us, we shall keep this data for the purpose of administering the database of applicants for 3 (three) calendar years after the receipt of data.

We would like to inform you that after informing you, the Company may contact your previous employers and ask for their opinion on your qualifications, professional abilities and job characteristics. However, your current employer shall not be contacted without your explicit prior consent.

Applicants’ data shall be processed by means of consent expressed during the submission of their data and based on the intention to act by the applicant by implied action and/or request before the conclusion of the agreement (Article 6(1) (a) (b) of the Regulation).

Handling complaints, claims, and inquiries

If you have submitted a complaint, claim or inquiry through the contacts provided by our Company (e.g. by email, registered mail, etc.), the personal data provided voluntarily by you will be processed for the purpose of handling this complaint, claim or inquiry. In order to evaluate and handle a complaint, claim or inquiry, we shall process the following personal data of you: name, surname, contact details (email address, telephone), description of the circumstances of the complaint, claim, inquiry, as well as documents confirming the complaint, claim or inquiry.  

If a complaint, claim or enquiry submitted by you is related to a potential dispute, possible damage, etc., as well as if contractual relations arise during the execution of the order, your personal data may be stored for a maximum period of 10 (ten) years. If the personal data related to the complaint or claim is not related to a possible dispute, they shall be destroyed within 1 (one) calendar year from the date of handling the complaint, claim or inquiry when these data will not be necessary to achieve the purpose.

The processing of your personal data shall be based on your free will, i. e. with your consent (Article 6(1) (a) (b) of the Regulation).

The Company does not use the contact information provided by the Customer in complaint, claim or inquiry forms for marketing purposes.

Communication by Email

According to the Regulation, personal data is considered to be the content of correspondence by email, even if the correspondents are the employees of legal entities. In view of this, the content of e-communication and email addresses are subject to the mandatory rules for the processing of personal data in accordance with the Regulation.

The basis for the processing of your personal data is the expression of your free will to perform the communication by email and provide certain data therein, i. e. consent. (Paragraph 6(1)a)). In addition, the basis for data processing may also be based on the performance of a contract and statutory obligations. (Paragraph 6(1)b)).

Your email address, correspondence content and related data shall be processed in accordance with the principle of proportionality. This data shall primarily be visible to the person with whom you shall directly communicate by email. However, in certain cases, your communication may also be read by other employees, e.g. in the cases of internal administration, investigations of violation of possible legal acts or internal rules, substitutions and related purposes, as well as similar situations.

Cookie Usage

Cookie is a small file consisting of letters and digits that is stored in your browser or on your hard disk of your computer. Different cookies are used for different purposes. Cookies also help to differentiate you from other website users, thus providing a better website use experience and allowing us to improve the website.

Most browsers allow to reject all cookies, while some browsers enable rejecting only third-party cookies. Hence you can take advantage of these possibilities. However, please note that blocking all cookies shall adversely affect the use of the website, and without cookies you shall not be able to use all the services provided on the website.

• Our website uses the following cookies:
• Performance cookies (session). They improve the functioning of the website and collect general (anonymous) information on the use of the website;
• Analytical cookies (tracking cookies from Google Analytics). These cookies allow us to identify and count visitors to our website and track how visitors move on the website and use it. This helps us to improve the functioning of the website, e. g. to ensure that users can easily find what they are searching for. The basis for the processing of these cookies is consent;
• Functional cookies. These cookies are used to identify website visitors when they return to the website. It allows us to customise the social networks content designed for the needs of the website and remember the information that is relevant to clients. The basis for the processing of these cookies is the client consent.

The list of cookies used on our website is available below:

How to Manage and Delete Cookies

Most browsers are set to accept cookies automatically. By having information as to what they are used to, you can decide whether to leave the cookies or turn them off in the browser. Most browsers allow you to manage cookies through their settings preferences. If you do not want to accept cookies, you can choose not to accept all cookies in your browser or send an alert when a cookie is being created.

To learn more about how to manage cookies, click on: http://www.allaboutcookies.org/manage-cookies/.

Please be informed that rejecting some of your cookies may result in the removal of certain functionalities. If you do not want to receive cookies, you can set your browser to reject all cookies or send an alert when a cookie is being created.

In addition to the cookies used by the Data Manager, our websites can allow certain third parties to set up and access cookies on your computer. In this case, third-party privacy policy applies to the use of cookies.

Using Social Networks

All information submitted by you on the social media (including notifications, use of Like and Follow, and other communications) is controlled by the social network manager.

Currently, our website has an account on the Facebook, the privacy notice of which is posted at https://www.facebook.com/privacy/explanation;

We recommend you to read third-party privacy notices and contact your service providers directly, if you have any questions about how they use your personal information.

Video Surveillance

The company carries out video surveillance in order to ensure the security of property and persons. Video surveillance is based on the legitimate interest (Article 6) (1) (f)). Video data collected during video surveillance shall be stored from 7 (seven) to 14 (fourteen) calendar days. We inform you about the video surveillance performed by the Company with information signs before entering the monitored area and/or premises. The surveillance field of the cameras does not include the premises where you expect absolute protection of personal data.

Provision of Personal Data to Data Recipients

• Your personal data may be provided to the following persons:
• IT, server, archiving, marketing, bookkeeping, postal and courier service providers.
• Notaries, bailiffs, lawyers, consultants, auditors, and debt collection companies.
• Law enforcement and supervisory authorities, courts and other dispute resolution bodies.
• Potential or existing successors of our business or a part thereof or their authorised advisors or individuals.

What are the Principles of Personal Data Protection that We Follow?

When collecting and using your personal data provided by you, as well as from other sources, we follow the following basic principles of data processing:

• Your personal data is processed in a lawful, fair and transparent manner (the principle of legality, integrity and transparency).
• Your personal data is collected for specified, clearly defined and legitimate purposes and is not further processed in ways incompatible with those purposes (the principle of purpose limitation).
• Your personal data must be adequate, appropriate and only necessary for the purposes for which they are processed (data minimization principle).
• The processed personal data shall be accurate and, if necessary, updated (the principle of accuracy).
• Your personal data shall be securely stored in such a form that data subjects can be identified for no longer than it is necessary for the purposes for which your personal data is processed (the principle of limitation of the length of the storage).
• Your personal data shall be stored in such a form as to ensure the proper security of personal data, including protection against processing without a permit or unauthorised data processing, and against accidental loss, destruction or damage by using appropriate technical or organisational measures. Your personal data shall be processed only by those employees of the Company who are granted such a right according to their work functions or data processors who provide services to the Company and process personal data on behalf of the Company and for the benefit of the Company or you (principle of integrity and confidentiality).

The company shall be responsible for compliance with the principles (principle of accountability).

The Rights of Data Subject and the Procedure for their Implementation

We inform you that you have the following rights to the data subject: the right to access to your data and how it is processed; the right to request correction or, in the context of the purposes of processing personal data, to supplement incomplete personal data of a person; the right to request to destroy your data or suspend processing of your data (except for storage); the right to request the processing of personal data be restricted; the right to transfer the data; the right to submit a complaint to the State Data Protection Inspectorate; the right to withdraw the consent and not to disagree with the processing of personal data.

In order to enforce the rights of your data subject, it is necessary to identify your identity. If we do not identify you, we shall not be able to make sure that the person whose personal data is being processed is actually contacting us. Therefore, it shall be impossible to exercise your rights. The request for access to the video data must indicate which specific premises (shops) or territory of the Company and at what time you have visited. The right to access the video data is exercised upon arrival to view the video at the Company’s registered office address.

It may be refused to investigate the request for enforcement received from you or it may be relevantly charged, if the request is manifestly unfounded or excessive, as well as in other cases provided by law.

The Company’s response will be provided to you not later than one month from the date of receipt of your request, depending on the specific circumstances of the processing of personal data. This period can, if necessary, be extended for two months more depending on the complexity and the number of requests.

If you wish to exercise your data subject’s rights or have other questions regarding the processing of your personal data, please contact the Company in writing in person, by post, through the representative at the address provided at the beginning of this Privacy Policy, or by electronic means of communication: [email protected] .

Privacy Policy last updated on: 23 July 2020