Privacy Policy
Thank you for your interest in this Privacy Policy and our website and shop. At Habea (“we”, “us”, “our”) we want you to feel comfortable in our online shop and not have to worry about the security of your data. That is why data protection is an important part of our philosophy.
In this Privacy Policy you will find all the information about which personal data we collect and process and for what purpose. You will also find out what rights you have and how you can assert them.
The Data Controller
Responsible for the collection and processing of your personal data is EM Retail Group Ltd t/a Habea of 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“we”, “our” or “us”). For more information about how we protect your Personal Information, or if you feel that your interests were not accurately represented, please contact us using the details below.
Call us on: 020 8050 4330
Email us at: support@habea.co.uk
The Supervisory Authority
The competent data protection authority in the UK is: The Information Commissioner's Office (ICO) located at Wycliffe House, Water Ln, Wilmslow SK9 5AF, UK www.ico.org.uk
What is personal data?
According to the UK`s Data Protection Act (“DPA”) and the EU's General Data Protection Regulation (GDPR), personal data is "any information relating to an identified or identifiable natural person. This is, for example, name or address data, telephone number, mobile number, bank details or insurance number. However, personal data also includes online identifiers such as your device identifier and IP address.
General information on data processing
All personal data that we obtain from you via the website will be processed for the purposes described in more detail below. This is done within the framework of the DPA and GDPR or with your consent. And of course, only when data processing is permitted and if:
What data does Habea process?
Habea offers you a wide range of products and services and in the process, various data are always collected. Most of the data we process is provided by you when you use our services or contact us. As soon as you register, you provide us with your name and email address or your postal address.
Further, we also automatically collect technical device and access data that occur during your interaction with our website. And we collect further data through website analyses in order, for example, to optimise our offers for you personally (e.g., to optimise our offers for you).
a) Log files, Cookies and Analytical data
Even if you do not log in or register on our website, but simply browse our website, data is collected and stored and processed by us. Specifically, this requires the IP address of your computer, Date and time of access, Name and URL of the accessed file, Browser used, Number of bytes transferred, Status of the page retrieval, Session ID, Referrer URL.
In addition, we use cookies and analysis services when you visit www.habea.co.uk. You can find more information in our Cookie Policy. The legal bases for processing are contract and our legitimate interest. The collection and processing of this data is necessary from a technical point of view so that you can use our website.
b) Contacting us
You can easily contact us via our contact form, e-mail, live chat or social media. In this case, we store and process the following data from you: Name, e-mail address, telephone number as well as other personal data that you provide when contacting us.
For the Chat, we use shopify inbox Live Chat of the company shopify- Their live Chat uses cookies to enable you to personalise your online experience. We have no knowledge of the storage period at shopify inbox and no possibility to influence it. The legal bases for processing are contract and our legitimate interest.
This data is collected and processed exclusively for the purpose of contacting you and processing your request and then deleted, provided there is no legal obligation to retain it. The legal bases for processing are contract and our legitimate interest.
c) User account
To use our services, you can register and log in to Habea. Here, too, we store data in order to create a User account for you: Name, E-mail address, chosen password.
We store this data as long as you are registered with us. If you delete your account, we will delete your data unless there is a legal retention period on our part. In this case, we must store your data for longer.
The data that you provide to us via your account will be stored until you delete the data from your account. In addition, we process data that is required for the services we offer or your membership. The legal bases for processing are contract and our legitimate interest.
d) Use of the online shop
You can order our offers via the online shop. In doing so, we process your personal data that is required for processing your order and for customer care, as well as the data that you also provide to us voluntarily. When you order via the online shop, for example, we have to ask for your name, e-mail address and shipping address. We will process this data for order processing: Name, Address(es), E-mail address, Order data, Payment data, Telephone number, IP address
The processing of this personal data is necessary for the ordering process. We process this data insofar as this is necessary for the processing of the contract, and for the assertion of possible claims on our part. The legal bases for processing are contract and our legitimate interest.
The provision of bank details is subject to our payment processors Shopify , Amazon and PayPal. We do not collect or store payment information or bank details ourselves but receive payment confirmation statements. For further information, please refer to Shopify`s, Amazon`s or PayPal`s Privacy Policy by clicking on the above links. The legal basis for the data processing is the fulfilment of our contractual obligations and the fulfilment of our legal obligations.
To ensure that you receive your ordered products, we pass on the necessary data to the selected service provider for order and order processing. In this case, we transmit your email address and in some cases also your telephone number to the logistics service provider. In this way, they can inform you that your parcel is being sent. With the parcel notification, you can influence the parcel delivery if necessary and change the delivery day or delivery location.
e) Shopify
We use the store system Shopify of the service provider Shopify International Limited, for the purpose of hosting and displaying the shop on the basis of processing on our behalf. All data collected on our website is processed on Shopify's servers. As part of Shopify's services, data may also be transferred to Shopify Inc, (USA) as part of further processing on our behalf. The legal basis for the data processing is our legitimate interest in providing an appealing website and shop.
f) Trusted Site
Trusted Site widgets are integrated on this website to display Trusted Site services and accreditation. This serves to protect our legitimate interest. The Trust badge and the services advertised with it are an offer of TrustedSite LLC. When the Trust badge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, the date and time of the call-up, the amount of data transferred and the requesting provider (access data) and documents the call-up. The IP address is anonymised immediately after collection so that the stored data cannot be assigned to you personally.
g) Judge.me
We use the rating functions of Judge.me to constantly improve our products, we offer our customers the opportunity to rate us via an independent portal, without us being able to influence this in any way. For this purpose, some data is transmitted to Judge.me. The integration is based on our legitimate interest, and we have no influence or control over the data collected and processed by Judge.me.
h) Klaviyo
We use the services of Klaviyo, Inc to analyse user behaviour on our website for our own advertising and market research purposes. Klaviyo also uses cookies and can link your behaviour on our website with your data if you have registered for our newsletter or SMS marketing, or gone through an order process on our website. The legal bases are to provide you with our services and your consent.
Analytics and Advertising
We would like to show you interesting advertising outside of our website and use various third-party tools and cookies for this purpose. These collect and process information about your activities on our website - for example, which products you are interested in or which Habea pages you visit. By knowing what you are looking for and how you use our website, we can adapt our advertising to your needs. And thus increase the likelihood that you will also be shown suitable and interesting advertising outside our website.
We also analyse this data to evaluate the relevance of the advertisements and to optimise the advertisements for you. Through the tools, your browser regularly establishes a connection to the server of the tool provider when you visit our website. For some tools, we have no direct influence on what data is processed by the providers. The following personal data may be processed by third-party providers:
Authorities and other third parties
In the event of certain legal incidents, we are obliged to pass on our customers' data to law enforcement authorities or other third parties. This may be the case, for example, for official and court decisions or for legal and criminal prosecution.
How is my data protected?
We want you to feel and be safe on our website. Therefore, we take various measures to meet both the legal requirements and our own very high standards of data protection and data security.
Habea takes the protection of your personal data seriously. All data is handled and processed in accordance with the DPA and GDPR, which ensures the highest standards of data protection.
Our data processing is subject to the principle that we only process the personal data that is necessary for the sensible and economic use of our offer. In doing so, we take great care to ensure that your privacy and the confidentiality of all personal data are always guaranteed.
All transmitted data is protected by TLS encryption. Transport Layer Security (TLS) is a protocol used to ensure secure data transmission on the Internet. The public-private key procedure is used here. This means that data encrypted with a publicly accessible key can only be decrypted again with a separate private key.
We stand for high security when shopping online. Habea uses technical and organisational security measures (TOMs) throughout the company to protect the data we manage from you against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons.
Duration of data storage
We store personal data on our secure server and only for as long as it is necessary for the purposes for which it is processed or for as long as any consent you have given us has been revoked by you. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 6 years, irrespective of the processing purposes.
Marketing
Insofar as you have also given us your separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to.
You may give us your consent in a number of ways including by selecting a box on a form where we seek your permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. Where your consent is implied, it is on the basis that you would have a reasonable expectation of receiving a marketing communication based on your interactions or contractual relationship with us.
Direct Marketing generally takes the form of e-mail but may also include other less traditional or emerging channels. These forms of contact will be managed by us, or by our contracted service providers. Every directly addressed marketing sent or made by us or on our behalf will include a means by which you may unsubscribe or opt out.
Your data subject rights
These rights are standardised in the DPA and GDPR. These include:
We encourage you to contact us if you have any information requests, requests for information or objections about data processing or concerns. However, you also have the right to file a complaint with your local supervisory authority. However, we would appreciate it if you would contact us with your concern before turning to a supervisory authority.
Online presence in social media
Based on our legitimate interests, we maintain online presences within social networks and platforms in order to communicate with the active, interested parties and users there and to inform them about our services there. When calling up the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.
Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within the social networks and platforms, e.g., write posts on our online presences or send us messages.
Updating your information
If you believe that the information we hold about you is inaccurate or that we are no longer entitled to use it and want to request its rectification, deletion, or object to its processing, please do so by contacting us. For your protection and the protection of all of our users, we may ask you to provide proof of identity before we can answer the above requests.
Keep in mind, we may reject requests for certain reasons, including if the request is unlawful or if it may infringe on trade secrets or intellectual property or the privacy of another user. Also, we may not be able to accommodate certain requests to object to the processing of Personal Data, notably where such requests would not allow us to provide our service to you anymore.
Withdraw your consent
You may withdraw your consent and request us to stop using and/or disclosing your Personal Data for any or all of the Purposes by submitting your request to us. Should you withdraw your consent to the collection, use or disclosure of your Personal Data, it may impact our ability to proceed with your transactions, agreements, or interactions with us. Prior to you exercising your choice to withdraw your consent, we will inform you of the consequences of the withdrawal of your consent. Please note that your withdrawal of consent will not prevent us from exercising our legal rights (including any remedies) or undertaking any steps as we may be entitled to at law.
Personal Data and children
Our services are aimed at people aged 18 and over. We will not knowingly collect, use or disclose Personal Data from minors under the age of 18 without first obtaining consent from a legal guardian through direct offline contact.
Changes
We are constantly developing and improving our website - and as a result, some of the information in this Privacy Policy is likely to change. We therefore recommend that you read this Privacy Policy again from time to time so that you are informed about the current status.
Do you have any questions?
Please contact us if you have any comments or questions about this policy and/or our use of your Personal Data.
Effective Date
Wednesday, 28th of February 2024.
In this Privacy Policy you will find all the information about which personal data we collect and process and for what purpose. You will also find out what rights you have and how you can assert them.
The Data Controller
Responsible for the collection and processing of your personal data is EM Retail Group Ltd t/a Habea of 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“we”, “our” or “us”). For more information about how we protect your Personal Information, or if you feel that your interests were not accurately represented, please contact us using the details below.
Call us on: 020 8050 4330
Email us at: support@habea.co.uk
The Supervisory Authority
The competent data protection authority in the UK is: The Information Commissioner's Office (ICO) located at Wycliffe House, Water Ln, Wilmslow SK9 5AF, UK www.ico.org.uk
What is personal data?
According to the UK`s Data Protection Act (“DPA”) and the EU's General Data Protection Regulation (GDPR), personal data is "any information relating to an identified or identifiable natural person. This is, for example, name or address data, telephone number, mobile number, bank details or insurance number. However, personal data also includes online identifiers such as your device identifier and IP address.
General information on data processing
All personal data that we obtain from you via the website will be processed for the purposes described in more detail below. This is done within the framework of the DPA and GDPR or with your consent. And of course, only when data processing is permitted and if:
- you have given your consent,
- the data is necessary for the fulfilment of a contract / pre-contractual measures,
- the data is necessary for the fulfilment of a legal obligation or
- the data is necessary to protect the legitimate interests of our company, provided that your interests are not overridden.
What data does Habea process?
Habea offers you a wide range of products and services and in the process, various data are always collected. Most of the data we process is provided by you when you use our services or contact us. As soon as you register, you provide us with your name and email address or your postal address.
Further, we also automatically collect technical device and access data that occur during your interaction with our website. And we collect further data through website analyses in order, for example, to optimise our offers for you personally (e.g., to optimise our offers for you).
a) Log files, Cookies and Analytical data
Even if you do not log in or register on our website, but simply browse our website, data is collected and stored and processed by us. Specifically, this requires the IP address of your computer, Date and time of access, Name and URL of the accessed file, Browser used, Number of bytes transferred, Status of the page retrieval, Session ID, Referrer URL.
In addition, we use cookies and analysis services when you visit www.habea.co.uk. You can find more information in our Cookie Policy. The legal bases for processing are contract and our legitimate interest. The collection and processing of this data is necessary from a technical point of view so that you can use our website.
b) Contacting us
You can easily contact us via our contact form, e-mail, live chat or social media. In this case, we store and process the following data from you: Name, e-mail address, telephone number as well as other personal data that you provide when contacting us.
For the Chat, we use shopify inbox Live Chat of the company shopify- Their live Chat uses cookies to enable you to personalise your online experience. We have no knowledge of the storage period at shopify inbox and no possibility to influence it. The legal bases for processing are contract and our legitimate interest.
This data is collected and processed exclusively for the purpose of contacting you and processing your request and then deleted, provided there is no legal obligation to retain it. The legal bases for processing are contract and our legitimate interest.
c) User account
To use our services, you can register and log in to Habea. Here, too, we store data in order to create a User account for you: Name, E-mail address, chosen password.
We store this data as long as you are registered with us. If you delete your account, we will delete your data unless there is a legal retention period on our part. In this case, we must store your data for longer.
The data that you provide to us via your account will be stored until you delete the data from your account. In addition, we process data that is required for the services we offer or your membership. The legal bases for processing are contract and our legitimate interest.
d) Use of the online shop
You can order our offers via the online shop. In doing so, we process your personal data that is required for processing your order and for customer care, as well as the data that you also provide to us voluntarily. When you order via the online shop, for example, we have to ask for your name, e-mail address and shipping address. We will process this data for order processing: Name, Address(es), E-mail address, Order data, Payment data, Telephone number, IP address
The processing of this personal data is necessary for the ordering process. We process this data insofar as this is necessary for the processing of the contract, and for the assertion of possible claims on our part. The legal bases for processing are contract and our legitimate interest.
The provision of bank details is subject to our payment processors Shopify , Amazon and PayPal. We do not collect or store payment information or bank details ourselves but receive payment confirmation statements. For further information, please refer to Shopify`s, Amazon`s or PayPal`s Privacy Policy by clicking on the above links. The legal basis for the data processing is the fulfilment of our contractual obligations and the fulfilment of our legal obligations.
To ensure that you receive your ordered products, we pass on the necessary data to the selected service provider for order and order processing. In this case, we transmit your email address and in some cases also your telephone number to the logistics service provider. In this way, they can inform you that your parcel is being sent. With the parcel notification, you can influence the parcel delivery if necessary and change the delivery day or delivery location.
e) Shopify
We use the store system Shopify of the service provider Shopify International Limited, for the purpose of hosting and displaying the shop on the basis of processing on our behalf. All data collected on our website is processed on Shopify's servers. As part of Shopify's services, data may also be transferred to Shopify Inc, (USA) as part of further processing on our behalf. The legal basis for the data processing is our legitimate interest in providing an appealing website and shop.
f) Trusted Site
Trusted Site widgets are integrated on this website to display Trusted Site services and accreditation. This serves to protect our legitimate interest. The Trust badge and the services advertised with it are an offer of TrustedSite LLC. When the Trust badge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, the date and time of the call-up, the amount of data transferred and the requesting provider (access data) and documents the call-up. The IP address is anonymised immediately after collection so that the stored data cannot be assigned to you personally.
g) Judge.me
We use the rating functions of Judge.me to constantly improve our products, we offer our customers the opportunity to rate us via an independent portal, without us being able to influence this in any way. For this purpose, some data is transmitted to Judge.me. The integration is based on our legitimate interest, and we have no influence or control over the data collected and processed by Judge.me.
h) Klaviyo
We use the services of Klaviyo, Inc to analyse user behaviour on our website for our own advertising and market research purposes. Klaviyo also uses cookies and can link your behaviour on our website with your data if you have registered for our newsletter or SMS marketing, or gone through an order process on our website. The legal bases are to provide you with our services and your consent.
Analytics and Advertising
We would like to show you interesting advertising outside of our website and use various third-party tools and cookies for this purpose. These collect and process information about your activities on our website - for example, which products you are interested in or which Habea pages you visit. By knowing what you are looking for and how you use our website, we can adapt our advertising to your needs. And thus increase the likelihood that you will also be shown suitable and interesting advertising outside our website.
We also analyse this data to evaluate the relevance of the advertisements and to optimise the advertisements for you. Through the tools, your browser regularly establishes a connection to the server of the tool provider when you visit our website. For some tools, we have no direct influence on what data is processed by the providers. The following personal data may be processed by third-party providers:
- HTTP header information (e.g., IP address, web browser, website URL, date and time).
- measuring pixel-specific data (e.g., pixel ID and cookie ID)
- additional information about visits to our website (e.g., orders placed, products clicked on).
Authorities and other third parties
In the event of certain legal incidents, we are obliged to pass on our customers' data to law enforcement authorities or other third parties. This may be the case, for example, for official and court decisions or for legal and criminal prosecution.
How is my data protected?
We want you to feel and be safe on our website. Therefore, we take various measures to meet both the legal requirements and our own very high standards of data protection and data security.
Habea takes the protection of your personal data seriously. All data is handled and processed in accordance with the DPA and GDPR, which ensures the highest standards of data protection.
Our data processing is subject to the principle that we only process the personal data that is necessary for the sensible and economic use of our offer. In doing so, we take great care to ensure that your privacy and the confidentiality of all personal data are always guaranteed.
All transmitted data is protected by TLS encryption. Transport Layer Security (TLS) is a protocol used to ensure secure data transmission on the Internet. The public-private key procedure is used here. This means that data encrypted with a publicly accessible key can only be decrypted again with a separate private key.
We stand for high security when shopping online. Habea uses technical and organisational security measures (TOMs) throughout the company to protect the data we manage from you against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons.
Duration of data storage
We store personal data on our secure server and only for as long as it is necessary for the purposes for which it is processed or for as long as any consent you have given us has been revoked by you. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 6 years, irrespective of the processing purposes.
Marketing
Insofar as you have also given us your separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to.
You may give us your consent in a number of ways including by selecting a box on a form where we seek your permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. Where your consent is implied, it is on the basis that you would have a reasonable expectation of receiving a marketing communication based on your interactions or contractual relationship with us.
Direct Marketing generally takes the form of e-mail but may also include other less traditional or emerging channels. These forms of contact will be managed by us, or by our contracted service providers. Every directly addressed marketing sent or made by us or on our behalf will include a means by which you may unsubscribe or opt out.
Your data subject rights
These rights are standardised in the DPA and GDPR. These include:
- the right to information,
- the right to rectification,
- the right to erasure,
- the right to restriction of data processing,
- the right to data portability,
- the right to object to data processing,
- the right to revoke any consent you have given, and
- the right to lodge a complaint with the competent supervisory authority.
We encourage you to contact us if you have any information requests, requests for information or objections about data processing or concerns. However, you also have the right to file a complaint with your local supervisory authority. However, we would appreciate it if you would contact us with your concern before turning to a supervisory authority.
Online presence in social media
Based on our legitimate interests, we maintain online presences within social networks and platforms in order to communicate with the active, interested parties and users there and to inform them about our services there. When calling up the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.
Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within the social networks and platforms, e.g., write posts on our online presences or send us messages.
Updating your information
If you believe that the information we hold about you is inaccurate or that we are no longer entitled to use it and want to request its rectification, deletion, or object to its processing, please do so by contacting us. For your protection and the protection of all of our users, we may ask you to provide proof of identity before we can answer the above requests.
Keep in mind, we may reject requests for certain reasons, including if the request is unlawful or if it may infringe on trade secrets or intellectual property or the privacy of another user. Also, we may not be able to accommodate certain requests to object to the processing of Personal Data, notably where such requests would not allow us to provide our service to you anymore.
Withdraw your consent
You may withdraw your consent and request us to stop using and/or disclosing your Personal Data for any or all of the Purposes by submitting your request to us. Should you withdraw your consent to the collection, use or disclosure of your Personal Data, it may impact our ability to proceed with your transactions, agreements, or interactions with us. Prior to you exercising your choice to withdraw your consent, we will inform you of the consequences of the withdrawal of your consent. Please note that your withdrawal of consent will not prevent us from exercising our legal rights (including any remedies) or undertaking any steps as we may be entitled to at law.
Personal Data and children
Our services are aimed at people aged 18 and over. We will not knowingly collect, use or disclose Personal Data from minors under the age of 18 without first obtaining consent from a legal guardian through direct offline contact.
Changes
We are constantly developing and improving our website - and as a result, some of the information in this Privacy Policy is likely to change. We therefore recommend that you read this Privacy Policy again from time to time so that you are informed about the current status.
Do you have any questions?
Please contact us if you have any comments or questions about this policy and/or our use of your Personal Data.
Effective Date
Wednesday, 28th of February 2024.