PRIVACY POLICY

1: Your Privacy

Your privacy is important to 8848 Altitude BV, and we are committed to protecting and safeguarding the rights relating to the privacy of your data.

2: Our policy

In this privacy policy, we describe how we handle your personal data and how we comply with our legal obligations when you visit our website (website visitor), purchase goods and/or services from us (customer), supply goods and/or services to us (supplier), or apply for a position with us as a candidate (applicant).

Based on the applicable legislation (General Data Protection Regulation, “the GDPR”), we ensure that every processing of your personal data complies with the following principles:

We process your personal data only for legitimate purposes. This means that the processing is necessary to achieve specific purposes named in the GDPR, or that you have given consent for your personal data to be processed. When it is legitimate to process your personal data, we do so properly and responsibly. We clearly explain the purposes for which your personal data is processed and how this is done.

We collect and process your personal data only for specified, explicit, and legitimate purposes. If we later use your data for another purpose, we ensure that this purpose is compatible with the original purpose for which it was collected.

We ensure that the personal data we collect and process from you is adequate for the purpose for which we collect it, relevant, and limited to what is necessary. We take all reasonable measures to ensure that your personal data is accurate and up to date. If your data is no longer accurate or up to date, we delete or correct it.

We do not retain your personal data for longer than necessary for the purpose for which we process it. When the data is no longer necessary, we destroy or delete it.

We ensure that your personal data is properly secured and remains confidential. We protect your personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
We are responsible for complying with all the above principles and can demonstrate that the processing of your personal data complies with these principles.

To ensure fair processing of personal data, the GDPR grants you various rights that you can exercise against us if you disagree with how we implement this privacy policy.

3: When this policy applies to you

This policy applies to you when:

• You visit our website (Website user)
• We provide products and/or services to you as a customer (Customer)
• You provide products and/or services to us as a supplier (Supplier)
• You apply for a position with us as a candidate (Applicant)
• This policy does not apply to our employees

4: How you can contact us, as the controller of your personal data

If you want to know how to contact us, go to Appendix 1 or visit our website. In addition to the Netherlands, this privacy policy also applies in Belgium, Germany, Finland, France, Hungary, Ireland, Italy, Luxembourg, Austria, Poland, Portugal, Spain, Slovenia, the Czech Republic, the United Kingdom (UK) and Sweden. Countries may implement the protection of personal data differently in certain details based on local implementing legislation. That is why this privacy policy also includes country-specific sections. You can find this country-specific information in Appendix 3. To keep this privacy policy up to date, we must amend it from time to time. You can always find the most current version on our website.

5: Which Personal Data do we collect and use?

Website user data
We collect and use basic information about our Website Users, which we primarily use to improve our website. We look at how you use our website, how often you visit our website and when the website is used most frequently. We also use website data to monitor visitor behavior and optimize our campaigns as part of remarketing. View the cookie statement here.

When you subscribe to our newsletter, you can choose to share the following information with us:

• Interests;
• You primarily shop for;
• Which email updates would you like to receive;
• Name and address details;
• Country;
• Date of birth;
• Gender;
• Purchased items;
• Amount paid for purchased items;
• Purchase date.

You can adjust this data yourself on our website if you have an account. You can always unsubscribe from the newsletter.

Customer data
We collect and use information about you to provide our products and/or services. When collecting data, we limit ourselves to the information necessary to achieve our purpose. This generally includes the personal data we may collect and use about you:

• First name;
• Last name;
• Street;
• House number;
• Postal code;
• Province;
• City;
• Country;
• Email address;
  
• Telephone number;
• Fax number;
• Chamber of Commerce number;
• VAT number;
  
• Credit insurer's file number;
  
• Bank details;
  
• Order number;
  
• Shipping method;
  
• Payment method;
  
• Purchased items;
  
• Amount paid for purchased items.

For a Customer, the email address is used for 2 purposes:
1. For sending an order confirmation

2. For information about delivery (such as Track & Trace)

If the ordering process is interrupted, 8848 Altitude BV will send a reminder email containing the contents of the shopping cart (also known as an abandoned shopping cart email).

Supplier data
We collect and use information about you or individuals within your organization in order to communicate with you, receive products and/or services, and pay for them within the context of what we have agreed with you.
These are generally the personal data that we may collect and use about you:

• Email address;
  
• Telephone number;
  
• Fax number;
  
• VAT number;
  
• Bank details;
  
• Shipping method;
  
• Payment method.

Applicant data
When you apply for a vacancy with us on the website, we record the following personal data about you in our records:

All data that you share with us in your CV and cover letter.
If your application does not lead to a job, we will destroy your file after four weeks, unless you have given us permission to retain it for another year.

6: How do we collect your personal data?

Website users
We automatically collect your data using cookies when you visit our website, based on the cookie settings in our cookie bar. When you contact us via the website, we will also collect data from you.

Customer data
We collect Customers' personal data in three ways:

• Personal data that you provide to us as a Customer;
• Personal data that we receive from other sources;
  
• Personal data that we collect automatically.

Supplier data
We collect your personal data during our contractual relationship with your organization.

Applicant data
We collect your personal data in order to be able to offer you a job if you are found to be suitable.

7: How do we use your personal data?

Website users
Website User data helps us improve your user experience with our website.

Customer data
We use Customer data for:

• Delivery of products and/or services;
  
• Marketing activities;
  
• Financial activities;
  
• Customer analysis.

The main reason for using Customer data is to ensure that the contractually agreed arrangements can be fulfilled so that the relationship runs smoothly. In exceptional cases, we use your personal data in criminal proceedings.

Supplier data
The main reason for using Supplier data is to ensure that the contractually agreed arrangements can be fulfilled so that the relationship runs smoothly.

Applicant data
We collect your personal data in order to be able to offer you a job if you are found to be suitable.

8: Who do we share your personal data with?
We may share your personal data in various ways and on different legal grounds with the following categories of persons, where appropriate and in accordance with local laws and regulations:

All business entities falling under 8848 Altitude BV;
Where required by laws and regulations: tax, audit, or other authorities;
Third parties such as service providers that perform functions on our behalf;
Third parties such as outsourced IT providers and file storage providers with whom we have a data processing agreement;
Marketing technology platforms and suppliers.
Regarding marketing technology platforms and suppliers, 8848 Altitude BV has entered into an affiliate marketing advertiser agreement and accompanying data processing agreement with AWIN, in which both parties acknowledge that they are joint Data Controllers with regard to personal consumer data when providing the services. How personal data is processed by or on behalf of AWIN is set out in their Privacy Policy for Data.
This list is not exhaustive.

9: How long do we retain your personal data?

We will delete your personal data from our systems if:

Website users
The retention period at user level and at event level linked to cookies, user IDs and advertising IDs in Google Analytics for Protest Sportswear is 26 months, after which they are automatically deleted.

A customer can unsubscribe from the newsletter. All personal data, both in Emark and Emark Open, will be deleted after unsubscribing.

We will inform financial institutions, freight forwarders and other external platforms to which we have disclosed personal data about its deletion.

Customers
If we have had no meaningful contact with you for a period of 5 years, we will delete your data, unless the law or relevant supervisory authorities require us to retain it for longer.
For consumers:

All personal data relating to placing an order that enters the backend of our website (Shopify) is automatically anonymized after 30 days. This is because shipping a package takes several days; in addition, consumers have the right to return the package within 14 days without giving a reason. As soon as we have received the returned package, the amount will be refunded. We need the personal data in Shopify for the entire process.

Suppliers
If we have had no meaningful contact with you for a period of 5 years, we will delete your data, unless the law or relevant supervisory authorities require us to retain it for longer.

10: Your rights under the GDPR

Under the GDPR, you have the following rights regarding the personal data we hold about you. By contacting us, we can discuss these with you and handle them within the applicable timeframe.

Under the GDPR, you have the following rights:

• The right to information;
  
• The right to access your data;
  
• The right to correction of data if it is inaccurate;
  
• The right to erasure of data and ‘the right to be forgotten’;
  
• The right to restriction of data processing;
  
• The right to object to data processing;
  
• The right to transfer your data (data portability);
  
• The right not to be subject to automated
• decision-making.
  
• Right to information

We have a duty to inform you about the personal data we process about you. More specifically, you have the right to know what happens to your personal data and why. Through this privacy policy, we want to make you aware of the risks of data processing, the applicable rules, our safeguards, and how you can exercise your rights regarding data processing.

Right of access
You have the right to access the personal data we collect about you. You may therefore ask us at reasonable intervals whether, and if so which, personal data we process about you.

We are obliged to respond to such requests and provide the available information within one month. Under certain conditions, this period may be extended to 2 months.

If you request this, we will provide you with a copy of the data or give you remote access to the data in a secure environment (such as a personal account/portal). We will not charge you any costs for the copy of the data. If you want to receive multiple copies, we may charge you a reasonable fee based on administrative costs. We will provide you with the copy in writing (including in electronic form). When we receive a request for access, we will verify that you are the person making the request. To this end, we will establish your identity. This applies in particular to online services.

Right to rectification
When the personal data we process about you is no longer correct, you have the right to instruct us to correct this data. You also have the right to have the data supplemented when it is incomplete. When we have shared your data with other parties, we will inform these parties of the changes, unless this proves impossible or requires disproportionate effort on our part. We determine whether something requires disproportionate effort by weighing your interests against the efforts (costs, time, et cetera) required to inform the recipients.

The right to erasure and the right to be forgotten
You have the right to have us erase your data as soon as possible, but only in one of the following cases:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  
• You withdraw your consent to the processing and there is no other valid reason for us to continue the processing;
  
• You have raised a justified objection to the processing (see the right to object);
  
• Your personal data has been processed unlawfully;
  
• Your personal data must be erased to comply with a legal obligation to which we are subject;
  
• Your personal data was collected in connection with a direct offer of internet services to a child.
  
• In addition to the right to erasure, you have the right to be forgotten.

In situations where we have made your personal data public (for example, by posting it online) and you ask us to erase the data, in addition to erasing the data from our own systems, we will take reasonable technical and organizational measures to inform other data controllers processing your personal data that you wish to be forgotten. This means that every link to and copy or reproduction of the data must be erased.

Under the GDPR, there are several situations in which we do not have to comply with your request for erasure and your request to be forgotten. This is the case, for example, when the processing is necessary to comply with a legal processing obligation imposed on us. When we believe that such a situation applies, we will reject your request with reasons. When we have shared your data with other parties, we will inform those parties that the data must be erased at your request, unless this proves impossible or would require disproportionate effort on our part.

We determine whether something requires disproportionate effort by weighing your interests against the effort (costs, time, etc.) we must expend to inform the recipients.

We may refuse to comply with your request only on the grounds specified in the GDPR.

The right to restriction of processing
You may invoke your right to restriction of processing in the following situations:

• You contest the accuracy of the personal data, for a period allowing the data controller to verify the accuracy of the personal data;
  
• The processing is unlawful and you object to the erasure of the personal data and instead request restriction of its use;
  
• We no longer need the personal data for the processing purposes, but you need it for the establishment, exercise or substantiation of a legal claim;
  
• You have objected to the processing, pending the answer to the question of whether our legitimate grounds outweigh yours.

In the situations mentioned above, we will restrict the processing to such an extent that the personal data can no longer be processed further. When we have shared your personal data with third parties, we will inform them of the restriction on processing, unless this is impossible or would require disproportionate effort. When we lift the restriction, we will inform you in advance.

Right to object
Of the three situations described in the GDPR in which you can exercise your right to object, two apply to you as a Website Visitor, Customer, Supplier, or Applicant:

You may object, on grounds relating to your personal circumstances, to processing based on our legitimate interest. In that case, we will stop the processing unless there are compelling legitimate grounds that outweigh your interest in having the processing stopped;
You can object to the processing of your personal data when we use it for direct marketing. We will always comply with this. We will respond to your request within 30 days (although in certain cases we may be permitted to extend this period).
The right to transfer your data (data portability);
If you wish, you have the right to transfer your personal data to other data controllers. In practice, this means that you can take the data stored about you with you to the provider of another online platform, depending on the nature of the data and the data systems. To enable you to do this, we will provide you with the data in a commonly used, machine-readable format protected by a password. If desired, we can transfer the data directly on your behalf.

The right to data portability applies only to data provided that is processed by automated means on the following legal bases:

• the unambiguous or explicit consent of the data subject;
• the necessity for the performance of the agreement.

The right not to be subject to automated individual decision-making, including profiling.

You have the right not to be subject to a decision based solely on automated processing, including profiling, when this:

• has legal effects on you; or
• otherwise significantly affects you.

In the following situations, we may use automated individual decision-making, including profiling:

• when this is necessary for the conclusion or performance of an agreement between you and us;
  
• when you have given your explicit consent;
  
• when this is permitted under applicable law that also provides for the protection of your legitimate interests.

Right to lodge a complaint with a supervisory authority:
You also have the right to lodge a complaint with your local supervisory authority. You can find details about this in Appendix 2.

11: What are cookies and how do we use them?

A “cookie” is a piece of code stored on your computer's hard drive. Cookies are used by almost all websites and are not harmful to your system. We use cookies to track your activity and provide you with the best possible experience when you visit our website. We may use cookie information to ensure that we show you options tailored to your needs on your next visit. We may also use cookies to analyze traffic to our website and for advertising purposes.

If you want to check which type of cookies you accept when visiting our website, you can do so via the cookie bar. See Appendix 4 to check which cookies belonging to our clients we manage. Appendix 4 shows which cookies we use, why we use them and what type of cookies they are.

How you can delete/change cookies
If you do not wish to receive cookies that are not strictly necessary for carrying out the basic functions of our site (functional and analytical cookies), you can change your other cookie preferences (marketing cookies) on the website via the cookie bar.

For general information about cookies, you can visit aboutcookies.org. You can also find details here about deleting cookies from your computer.

12: Our legal basis for processing your data

Legitimate interests
Under Art. 6(1)(f) GDPR, we may process your data when it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (...).”

However, you have the right to object to our processing of your personal data on this basis. In that case, you can contact us.

Consent
In certain circumstances, we are required to obtain your consent to process your personal data in relation to certain activities. Depending on exactly what we do with your information, this consent will be either opt-in consent or soft opt-in consent.

Art. 4(11) GDPR states that (opt-in) consent means: “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” In plain language, this means that:

• you must give us your consent freely, without us putting you under any form of pressure;
• you must know what you are consenting to - so we ensure that we provide you with sufficient information;
• you should have control over the processing activities to which you give consent and the processing activities to which you do not give consent; and
• you must give your consent through a clear affirmative action - we will probably show you a box that you can tick so that this requirement is clearly and unambiguously met.

We will keep a record of the consents you have given in this way.

We have already mentioned that in some cases we may rely on soft opt-in consent. We are permitted to offer you products or services related to Protest Sportswear as long as you do not actively unsubscribe from these messages.

Right to withdraw consent
When we have obtained your consent to process your personal data for certain activities (for example, for our marketing activities or automated profiling), you may withdraw this consent at any time, at which point we will stop the activity for which you had given consent, unless we believe that there is an alternative legal basis for continuing to process your data for this purpose. In that case, we will inform you of this condition.

The formulation, conduct or defence of criminal proceedings
It may sometimes be necessary for us to process personal data and, where appropriate and in accordance with local laws and regulations, sensitive personal data in connection with conducting or defending criminal proceedings. Article 9(2)(f) of the GDPR permits this where the processing is “necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.”

Glossary:
General Data Protection Regulation (GDPR) - a statutory instrument of the European Union intended to harmonize European data protection laws. The regulation enters into force on 25 May 2018, and any reference to it must be interpreted accordingly as including any national legislation implementing the regulation.
Customers - includes our customers and others to whom we provide products and/or services in the course of our business activities.
Suppliers - refers to partners and companies (including self-employed individuals) and atypical workers such as independent contractors and freelancers who provide products and/or services to us. In certain circumstances, we will outsource this to external suppliers.
Applicants - individuals who apply for a vacancy on our website.
Website User - any individual who visits one of our websites.