Version 2.0, updated May 22nd, 2018
Kupiku and associated entities act as joint data controllers, who are jointly responsible for compliance with data protection legislation. Kupiku B.V. is primarily responsible for exercising of rights of data subjects and providing information about data processing.
Kupiku Website. Any website that is the property of Kupiku B.V., including but not limited to everything hosted under the top-level domain kupiku.com.
Kupiku Account. An account you create and which Kupiku may use in communicating with you or providing Kupiku services to you, which contains your first name, last name, email, address(es), and username. It is accessed via a username and password and can be used to manage your Personal Data.
Kupiku Orders, Kupiku Auctions, Kupiku Gift Certificates, Kupiku Snipe It, Kupiku Wish List, and Kupiku Blog, may be collectively referred to as "Kupiku Services".
Personal Data means any data relating to an identified or identifiable natural person.
Why We Collect Data and What We Collect
We collect data for various reasons, such as:
a) To provide you with our services, or information. We may collect data which are required to provide you with support, and services, including the proper processing of your orders, provision of support, reporting of issues and bugs, and other processing connected with use of Kupiku website, services, or information. You explicitly fill in the data required for you to receive orders you place, support, or services, whether you use Kupiku Services, use our support feature, sign up for a Kupiku Account, participate in a survey, and/or subscribe to receive marketing and/or technical information and content, or these data are collected in the course of use of Kupiku Services. We may use third-party service providers, acting as data processors, to assist us in provisioning Kupiku Services to you or in our operations. For example, we may use third-party service providers to provide data storage and backup services. With your consent, your Personal data may also be transferred to third-party service providers, acting as separate data controllers, who provide products and services complementary to Kupiku Services (further data processing performed by these service providers is governed by their privacy policies). The legal basis for this data processing is performance of contract between you and us.
b) To protect us from fraud and unlawful use of our software or services. We may collect data which are required to protect us from any fraudulent, unlawful, or unauthorized use of our services, or which are necessary to ensure security of our services, including both data provided by you (see above) and data collected in the course of use of Kupiku Services. The legal basis for this data processing is Kupiku's legitimate interest in protection from fraud and unlawful use of Kupiku services.
c) To improve our offerings based on usage. We may collect data based on your use of Kupiku Services, and we do not associate these data with your name. We use these data to better understand usage patterns of our services and behavior of our collective audience. At times we may share this information in aggregated anonymous form with third parties. Collection of data based on your use of Kupiku Services is done only if you permit it. The legal basis for this data processing is our legitimate interest in improving the services we offer you.
f) To fulfil legal duties stipulated by accounting, taxation and other laws. We may use and disclose your personal data where required by law, such as in keeping and disclosing our accounts, in keeping and disclosing our tax records, and in response to a court order, valid subpoena, or other legal process. The legal basis for this data processing is our compliance with our legal obligations.
You may object to the processing of your personal data for the purposes b) to e) at any time.
Categories of data involved in data processing include:
- email address,
- phone number,
- IP address,
- SSH public key,
- physical address,
- order history
- information about subscription and payments
Where appropriate, we will prompt you to give us your consent to the collection and processing of your data as described above. This may happen within Kupiku Services, or in another environment set up by Kupiku, always in a clear and conspicuous manner. You can manage your data and opt-outs as described in the Transparency section below.
Our services are not designed for and are not offered to children under the age of 13. If we discover that a person under the age of 13 has submitted information directly to us, we will endeavor to delete the information from our systems.
We may share your data with certain third parties which help us provide you with Kupiku Services, or to run our business, for example to providers of data storage and backup services. We may also share your data with individual representatives of your company.
Your personal data may also be shared with other organizations or individuals if we have obtained your consent to do so.
We may also share your data with certain third parties if we are obliged to do so under applicable legislation (especially with tax authorities or with other government bodies exercising their statutory powers) or if such sharing is necessary to achieve the purposes defined above (especially with government bodies or with parties harmed by your illegal acts, if applicable).
To secure your personal data, our services are designed with security and privacy in mind.
We encrypt your data in transfer and at rest where it is technically feasible. External web resources are protected by encryption.
We review the processes of personal data usage before implementing them. This is done to minimize data usage and to make sure that you as the data owner is informed about the processing. When the reason for data storage expires, we remove your personal data from our servers or anonymize it for further usage. By the nature of the activity within which your data is collected, it may appear in datasets used for research. Before using the datasets for research or other purposes you are not informed of, we remove or anonymize your personal data in the datasets.
Location of Your Information
Data retention, withdrawal of approval, access to data and your rights
You may manage your Personal Data in your Kupiku Account, including providing us with an opt-out for certain kinds of data collection. You are responsible for the correctness of the Personal Data you provide to us. We expect you to check the Personal Data you provide to us and if any inconsistency takes place, update your Personal Data or report the inconsistency to Kupiku.
As permitted by applicable law, E.U. residents may request a copy of the information that we hold about them. To do so, please go to your Kupiku Account and ask for a copy through the means available there, or contact [email protected]. We may charge a reasonable fee in accordance with applicable law for this service.
Moreover, as set out in locally applicable personal data protection law, you may have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request a restriction on the processing of your personal data; (v) request personal data portability; or (vi) object to the processing of your personal data.
- Right of access. You may have the right to obtain from us a confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, to request access to your personal data. The information about personal data processing includes the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom your personal data have been or will be disclosed, etc. However, this is not an absolute right and the interests of other individuals may restrict your right of access. Further, you may have the right to obtain a copy of your personal data undergoing processing. For additional copies requested, we may charge a reasonable fee based on administrative costs.
- Right to rectification. You may have the right to obtain from us the rectification of inaccurate personal data. Depending on the purposes of the processing, you may have the right to have incomplete personal data made complete, in particular by providing a supplementary statement.
- Right to erasure (right to be forgotten). Under certain circumstances, you may have the right to require us to delete your personal data.
- Right to a restriction on processing. Under certain circumstances, you may have the right to require us to restrict the processing of your personal data. In this case, the respective personal data will be marked and may only be processed by us for certain purposes.
- Right to personal data portability. Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit these personal data to another entity.
- Right to object. Under certain circumstances, you may have the right to object, on grounds relating to their particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data.
These rights can be exercised via the email address [email protected].
You may also contact Kupiku to get up-to-date information about your personal data processing and any personal data recipients.
You may lodge a complaint related to the processing of your personal data with the competent data protection supervisory authority.
Changes to this Policy