Privacy notice

APB Apranga
PRIVACY NOTICE
for the www.soulz.lt / www.soulz.lv / www.soulz.ee websites
and the SOULZ mobile application

Last updated 13 February 2024.

We understand the importance of personal data protection, so we respect and protect your privacy and personal data. APB Apranga (hereinafter referred to as the Company or us/we) protects information about you and processes data in accordance with the European Union General Data Protection Regulation (hereinafter referred to as the GDPR)¹ and other data protection legislation. In this privacy notice (hereinafter referred to as the Privacy Notice), we will answer the most important questions – how we collect, use and store information about you. You will also be able to familiarise yourself with your rights as a data subject, cookie information and the processing of personal data when you use the www.soulz.lt / www.soulz.lv / www.soulz.ee websites (hereinafter referred to as the Website) and the SOULZ mobile application (hereinafter referred to as the Mobile Application).

If you use the Website and/or the Mobile Application, we will assume that you are familiar with the information provided in this Privacy Notice and give the Company the right to process your personal data under the terms and conditions set out in the Privacy Notice. Please read this important information carefully and visit our Website and/or Mobile Application from time to time to read the latest version of the Privacy Notice posted there.

1. WHO IS RESPONSIBLE FOR PROTECTING INFORMATION ABOUT YOU?

The controller of the personal data that are processed in administering the Website and Mobile Application is APB Apranga, legal entity code: 121933274, office address: Ukmergės g. 362, Vilnius.

2. WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY?

Why do we collect information about you?	What information do we collect about you?	Why do we have the right to collect the information you provide?	How long do we use or store information about you?
We conclude and execute purchase and sale contracts with you, fulfil related tax obligations, and provide information related to performance of the contract, ordering goods, returns, payments and administration. Pursuant to the terms of purchase, minors aged 14-18 have the right to make purchases in the online store with the consent of their parents or guardians, except in cases where they are independently disposing of their income.	Name, surname, telephone number, e-mail address, method of delivery of goods, delivery address, date and time of purchase and delivery, product names, quantities, purchase prices and discounts given, method of payment for purchases and payment information, optional information – self-employment number, VAT identification number.	We conclude and perform a contract with you (GDPR Article 6(1)(b)) and must collect information in accordance with the law (GDPR Article 6(1)(c)).	During the validity of the contract and for five (5) years after the termination of the contract.
We provide an account on the Website and in the Mobile Application and ensure their uninterrupted operation. An account can be created for a person who is at least 14 years old.	Name, surname, gender, telephone number, e-mail address, method of delivery of goods, delivery address, account login details, actions in the account, including customer preferences, saved shopping list and technical browsing data (IP address, login and browsing technical information), date and time of purchase and delivery, product names, quantities, purchase prices and discounts given, method of payment for purchases and payment information, optional – location information (e.g., country, GPS coordinates, geographically restricted area, etc.). Loyalty card details, date of birth, bank account for refunds, payment card information.	We have your consent (GDPR Article 6(1)(a)).	Personal data required for account registration and administration are processed as long as the account is used. If a customer does not log into his or her account on the Website and Mobile Application for two (2) years in a row, the account is deleted. Consent regarding account registration is stored for one (1) year after the expiration of the consent period.
You request an invoice.	Legal entity representative’s name, surname, position, e-mail address, telephone number, address, postcode.	We conclude a contract with you and fulfil contractual obligations (GDPR Article 6(1)(b)) and must collect information in accordance with the law (GDPR Article 6(1)(c)).	10 (ten) years after the invoice is issued.
We inform you about the products sold by the Company that are relevant to you by sending newsletters through the channel of your choice (e-mail, SMS, InApp and Mobile Application notifications). Only persons over the age of 14 can subscribe to newsletters.	Name, surname, telephone number, e-mail address, consent receipt or withdrawal data, communication information sent to the customer, choice in the account for method of receiving newsletters. You can opt-out of receiving newsletters at any time by clicking to unsubscribe link in the e-mail you receive. Consent can only be given by persons over the age of 14.	You consent to us using information about you (GDPR Article 6(1)(a) and Article 81(1) of the Republic of Lithuania Law on Electronic Communications) However, in accordance with the terms and conditions established in Article 81(2) of the Republic of Lithuania Law on Electronic Communications and without your consent, we can process your personal data for direct marketing purposes pursuant to GDPR Article 6(1)(f) in pursuit of our legitimate interests as a data controller.	Three (3) years after consent being given, unless you withdraw your consent within this period. The communication sent is stored for two (2) years from the date of sending.
We invite you to participate in surveys about our products and the quality of the services provided. Only persons over 14 years of age can participate in surveys.	In order to contact you and find out your opinion and assessments, we collect the following data from you: e-mail address, assessment of the products sold or services provided, and your name and/or surname, which are optional.	We have a legitimate interest in asking about the quality of goods and services after the conclusion of a purchase and sale contract (GDPR Article 6(1)(f)) or we have your consent (GDPR Article 6(1)(a)).	We will store the data for two (2) years after the survey invitation is sent out; once this storage period expires, the data will be anonymised to make it impossible to link it to a specific person.
You send us a request, suggestion or complaint using a generic e-mail address, or submit it through social media accounts or other electronic communication channels.	Name, surname, e-mail address, country, telephone number, subject of the enquiry, time of receipt of the enquiry, content of the enquiry, attachments to the enquiry, correspondence history, other information provided related to the enquiry submitted, response to the enquiry.	We have a legitimate interest (to examine your enquiries, requests or complaints) (GDPR Article 6(1)(f)).	One (1) year from the date of submission of the request, suggestion or complaint.
We record telephone conversations in order to ensure the quality of the services provided, provide accurate information about the services provided, provide consultations, and examine enquiries, complaints and requests.	Telephone number, telephone conversation recordings and data provided during conversations. We only provide telephone consultations to persons who are at least 14 years old.	We have your consent as per GDPR Article 6(1)(a) (you agree to continue the conversation) and we have a legitimate interest (to ensure the quality of customer service, provide accurate information about the services provided, provide consultation, and examine requests, enquiries or complaints GDPR Article 6(1)(f)).	Six (6) months after the conversation with you.
You would like to purchase a gift card.	The type and design of the gift card, the value of the gift card, the way you would like to receive the gift card and the gift message. In cases where the customer wants the gift card to be sent to another e-mail address, data on the gift card recipient, the e-mail address and the date on which the customer wishes to send the gift card are also processed.	We conclude and perform a contract with you (GDPR Article 6(1)(b)) and must collect information in accordance with the law (GDPR Article 6(1)(c)).	During the validity of the contract and for five (5) years after the termination of the contract.
In order to compensate for any damage suffered or under other terms and conditions, we send you gifts.	The total amount for which the online store’s customers purchased goods, and the name, surname and delivery address of the customers who purchased goods in the online store for the highest amounts.	We have a legitimate interest GDPR Article 6(1)(f) (to treat customers to gifts).	30 (thirty) calendar days after sending the gift.
We have a goal of properly identifying you so that your goods are delivered to the correct addressees.	Name, surname of the customer or other person collecting the goods, customer’s telephone number, e-mail address, shipment order number, purchase data.	We have a legitimate interest GDPR Article 6(1)(f). Properly verify the identity of the customer so that the goods are handed over to the right person.	During handover.
Conducting statistical and market research and data analysis.	Year of birth, gender, city, information about the goods purchased online. We use automated data analysis for statistical and market research. We do not process information that personalises you for analysis purposes. This data analysis has no legal or similarly significant effect on you.	We have a legitimate interest in improving and expanding the provision of services (GDPR Article 6(1)(f)).	Three (3) years from the product purchased.
In order to help the customer choose the right size products, we provide the opportunity to use a third-party tool (cookie plug-in) named PRIME AI, which only provides us with statistical, depersonalised information on how many customers have used this tool and purchased products using the tool’s size recommendations.	Transaction ID, garment size, purchased product category, garment size recommended by PRIME AI.	We have a legitimate interest in improving and expanding the provision of services (GDPR Article 6(1)(f)). Use of the PRIME AI tool (GDPR Article 6(1)(a)).	The data that you provide when performing certain actions using the PRIME AI tool are not processed by the Company. More information about the tool used can be found in the PRIME AI privacy notice: Privacy Policy – PRIME AI
When communicating with you and organising contests and games on our social media: Facebook account Apranga Group \| Vilnius \| Facebook Instagram account Apranga Group (@aprangagroup) • Instagram photos and videos LinkedIn account Apranga Group: My Company \| LinkedIn YouTube channel APRANGA Group - YouTube TikTok channel Apranga group (@aprangagroup) \| TikTok	We will process your social media account data that you provide in our accounts: account name, account profile picture, your reactions (“likes”) to the information posted, comments you have left, content you have posted to our account (e.g. if you share photos or videos in the comments). For the purpose of organising games and contests, we will process your personal data as described in this Privacy Notice. You can exercise the right to object to the processing of personal data on social media sites in accordance with the procedure established by the managers of the social media sites.	We will process the personal data you provide on the basis of a legitimate interest (GDPR Article 6(1)(f)). - provide information about news, communicate with our social media followers and visitors, customise the information we provide and other activities performed on the accounts to the needs of the account visitors based on statistical information.	The personal data that you provide when performing certain actions on social media sites are processed and stored in accordance with the procedure and terms set by the managers of the social media sites, and we cannot influence this in any way.
We ensure the efficient and secure functioning of our website and seek to understand how individuals use the services offered on our website so that we can improve them and create new ones.	IP address, operating system version, parameters of the device you use, session start time and duration, query terms you enter on our website, other statistical data and any information stored using cookies applicable on your device (more information about the cookies used can be found in our Cookie Notice).	We have a legitimate interest (to monitor the quality of our services, improve existing services and create new ones, ensure that the Company’s website functions in a high-quality and safe manner and that persons who visit it find relevant information) (GDPR Article 6(1)(f)).	Up to two years (for more on the storage periods for cookies, see our Cookie Notice).
Fraud prevention and legal compliance.	All categories of personal data specified in this Privacy Notice.	We have a legitimate interest in defending, asserting and enforcing legal claims, preventing fraudulent and/or criminal activity, collecting evidence of detected violations and preventing abuse of our services (GDPR Article 6(1)(f)).	While the claim is being investigated, processed and enforced. If no violation is established during the investigation, the data are stored for one (1) year from the date of the decision to terminate the investigation. If a violation is established, the data are stored for three years from the date of the decision to terminate the investigation or until the final execution of the court decision.
You submit a request to implement the rights of data subjects provided for in the GDPR and we ensure the implementation of the request.	Depending on what personal data you provide: name, surname, telephone number, address, date of birth, e-mail address, register number, legal partner code, identity document copy, request for the exercise of the rights of the data subject, date of the request, place of the request, method specified for providing a response to the request, content of the request and other information provided in the request of the data subject, response to the data subject, other information related to the exercise of the rights of data subject.	We have a legal obligation (to ensure the exercise of the rights of data subjects (GDPR Chapter III)).	Requests are stored for five (5) years from the date of the response

¹Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation).

3. WHERE DO WE GET INFORMATION ABOUT YOU AND WHAT INFORMATION DO YOU HAVE TO PROVIDE US?

Please see the answer to item 2 above – you must provide the information about yourself that is necessary:

for us to conclude contracts with you and fulfil our contractual obligations;
if you do not provide the specified information, we will not be able to conclude contracts and fulfil our contractual obligations with you and/or the persons you represent.

You provide most of the information yourself, but we may receive some information about your personal data from other customers, for example, if they buy you a gift card.

4. WHO DO WE TRANSFER YOUR INFORMATION TO?

We provide your personal data to third parties who assist us in performing and administering the provision of services to you:

companies providing software maintenance and support services, including companies providing call recording services;
companies providing delivery services in order to deliver the goods to you at the addresses you specify;
payment service providers;
marketing companies;
companies belonging to the Apranga Group when said are responsible for the execution of certain specific functions assigned to them;
companies which provide advertising, media planning, public relations and event organisation services;
companies which provide SMS services;
we can only transfer statistical information to the company providing the AI size recommendation tool services if it does not identify the buyer.

Your personal data may also be provided to:

law enforcement authorities in accordance with the procedure established by legislation of the Republic of Lithuania;
state institutions and courts, where such an obligation is provided for by applicable legislation.

5. WILL YOUR DATA BE TRANSFERRED OUTSIDE THE EUROPEAN ECONOMIC AREA?²

In most cases, personal data are processed and transferred within the territory of the European Union and the European Economic Area, but if necessary for the provision of certain services, data may be transferred and processed outside the aforementioned territories, when an adequate level of personal data protection is observed. When permitted by legislation and required for the reasons specified in item 4 of this Privacy Notice, we disclose information about you:

based on the European Commission’s adequacy decision, meaning that the European Commission has recognised the country in which the third party is established and/or operates as ensuring an adequate level of personal data protection;
when we have signed a contract with the third party based on the Standard Contractual Clauses approved by the European Commission;
when we have received permission from the State Data Protection Inspectorate;
by using, if possible, other possible measures of personal data protection and derogations.

²The European Economic Area consists of all the Member States of the European Union as well as Iceland, Liechtenstein and Norway.

6. WHAT RIGHTS DO YOU HAVE?

The right to access the personal data that are being processed

You have the right to receive our confirmation as to whether we process your personal data, as well as the right of access to your personal data that are being processed by us and information about the purposes of data processing, the categories of processed data, the categories of data recipients, the data processing period, the sources of data acquisition, automated decision-making, including profiling, and its meaning and consequences for you.

The right to rectification

If the data provided to us in your registration form has changed or you believe that the information we process about you is inaccurate or incorrect, you have the right to request that this information be changed by logging in to your account; if this cannot be done, you have the right to correct the data by notifying us by e-mail at [email protected], or by sending the data subject’s request by e-mail to [email protected] in Lithuania, [email protected] or [email protected] in Latvia, or [email protected] or [email protected] in Estonia.

The right to withdraw consent

In cases where we process your data based on your consent, you have the right to withdraw your consent at any time and the data processing based on your consent will be terminated. In some cases, this may mean that we will no longer be able to provide you with the opportunity to continue using our services. You can adjust (withdraw or re-give) your consent to receive offers and information about goods in your account, in the Newsletters section. By sending direct marketing content information to the data subject by e-mail or in other form, we provide the customer with a convenient, free and simple (easy) option to discontinue receipt of this information. All the customer needs to do is click on the unsubscribe link in the information notice or newsletter. After unsubscribing from information notices or newsletters, the data subject’s consent (to receive newsletters in the future) regarding the processing of personal data for the purpose of direct marketing is also revoked.

The right to lodge a complaint

If you believe that we are processing your data in violation of the requirements of data protection legislation, we always ask you to start by contacting us directly. We believe that through good faith efforts, we will be able to dispel all of your doubts, satisfy your requests and rectify any mistakes we have made. If you are not satisfied with our proposed solution to the problem or if you feel that we will not take the necessary actions according to your request, you have the right to lodge a complaint with the supervisory authority (in Lithuania – State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, Lithuania; e-mail address: [email protected]), in Latvia – Republic of Latvia Data State Inspectorate (Elijas iela 17, Riga, e-mail address: [email protected]), in Estonia – Republic of Estonia Data Protection Inspectorate (Tatari 39, 10134 Tallinn; e-mail address: [email protected]).

The right to object to processing where processing is based on legitimate interests

You have the right to object to the processing of personal data when personal data are processed based on our legitimate interests. However, taking into account the objectives of service provision and the balance of the legitimate interests of both parties (both you as the data subject and us as the data controller), your objection may mean that, upon termination of the processing of your data based on our legitimate interest, we will no longer be able to provide you with the opportunity to continue using our services.

The right to erasure (right to be forgotten)

Under certain circumstances specified in data processing legislation (when personal data are unlawfully processed, the basis for data processing has ceased to exist, etc.), you have the right to request that we delete your personal data.

The right to restriction of processing

In certain circumstances specified in data processing legislation (when personal data are unlawfully processed, you dispute the accuracy of the data, you have objected to data processing on the basis of our legitimate interest, etc.), you also have the right to restrict the processing of your data. However, we must note that due to the restriction of data processing and during the period of this restriction, we may not be able to ensure the provision of services to you.

The right to data portability

You have the right to receive or transfer your personal data to another data controller (right to data portability). This right only covers data that have been provided to us based on your consent or in accordance with a contract, and if the data are processed by automated means.

The right to object to the fully automated processing of personal data

You have the right to object to a fully automated decision being used, including profiling, if said decision-making has legal effects or a similarly significant effect on you.

7. HOW CAN YOU EXERCISE YOUR RIGHTS?

In order to exercise your rights specified in item 6 of this Privacy Notice, you can:

deliver the Request to Exercise the Rights of Data Subjects (hereinafter referred to as the Request)³ in person to the Company’s registered office or to the data protection officer at the addresses specified in item 10 of this Privacy Notice (when you deliver the request, we will ask you to provide an identity document);
send the Request to the Company or the data protection officer using the postal addresses specified in item 10 of this Privacy Notice (if you are not our customer, please include a copy of your identity document with the Request);
e-mail the Request to the Company or the data protection officer at the addresses specified in item 10 of this Privacy Notice (a Request submitted by e-mail must be signed with a secure, qualified electronic signature);
when submitting a request through a representative, the request must be accompanied by a document confirming the representation or a copy thereof, approved in the procedure established by legislation, as well as details on how you would like to receive the response regarding the implementation of the Data Subject’s rights;
the data controller, after receiving the request and assessing the specifics of its activities, the content of the request and the information available about the Data Subject, may ask for additional verification of the Data Subject’s identity if there are doubts about the identification of the Data Subject;
in the Company, in certain cases, Data Subjects may be given the opportunity to manage their rights as a Data Subject themselves, for example, in their accounts on the www.soulz.lt / www.soulz.lv / www.soulz.ee websites or in the Mobile Application, Data Subjects can change their account data or delete their account.

³Using the Request to Exercise the Rights of Data Subjects form available here is recommended.

8. DO WE PROFILE YOU AND MAKE AUTOMATED DECISIONS?

The Company may profile you for statistical purposes, or to prevent the sending of unsolicited marketing offers.

9. ARE COOKIES USED ON THE WEBSITE AND THE MOBILE APPLICATION?

Yes, we use cookies on the Website – you can find more about the cookies we use in the Cookie Notice. However, no cookies are collected on the Mobile Application.

Cookies are small text files stored in the browser of your device (e.g. computer, mobile phone, tablet) when you browse websites. Other technologies, including the data that we store on your web browser or device, identifiers associated with your device, and other software, are used for similar purposes. Cookies are widely used so that websites can function or function better and more efficiently.

In accordance with the purpose, cookies may be categorised as Essential, Functional, Statistics, Marketing or other. Cookies are only saved if you confirm your consent in the message on the home page of the website, with the exception of essential cookies, for which consent is not necessary.

For analysis and other purposes, we use the services of third parties (e.g. Google Analytics, Facebook). In this case, we only have access to aggregated data and do not use cookies to identify a specific individual, but the service provider and other third parties may have access to your personal data. More information about how Google and other third parties process your personal data can be found in their privacy policies (you can find Google’s privacy policy here: https://policies.google.com/privacy?hl=en-US; you can find information on personal data processing when you use Facebook here: https://www.facebook.com/policies/cookies).

You can find more information on how you can manage cookies or remove them from your device in the Cookie Notice.

10. HOW CAN I CONTACT THE COMPANY OR THE DATA PROTECTION OFFICER?

If you have questions, comments or complaints about how we collect, use and store information about you, or if you want to exercise your rights as a data subject, you can contact:

the Company in Lithuania at Ukmergės g. 362, LT-14311, Vilnius; in Latvia at Elizabetes 51, LV-1010, Riga; in Estonia at Rotermanni 18/1, 10111,Tallinn; tel +370 5 207 8801, e-mail [email protected];

the data protection officer at Ukmergės g. 362, LT-14311, Vilnius, tel. +370 5 232 1015, e-mail address [email protected] (Lithuania), [email protected] (Latvia), [email protected] (Estonia).

11. PRIVACY NOTICE: CHANGES AND VALIDITY

We reserve the right to change the Privacy Notice by informing about changes or additions on the Website and the Mobile Application.

You can find the previous Privacy Notice here.