Introduction
This Policy is intended to help you understand:
● why we collect your personal data;
● how we collect, use and store your personal data;
● which rights relating to your personal data you have;
● how you can exercise the rights relating to your personal data;
● how we use cookies and other tracking technologies;
● how we share and disclose your personal data;
ALIRNA FZCO is located in Dubai, the United Arabian Emirates.
ALIRNA FZCO (“we”, “us”, “our”, “Company”, “ALIRNA“) cares for your privacy and therefore provides you with the information hereunder. On this page, you can learn what information about you we collect while you interact with Madonna, what for and how it is used, stored, disclosed etc., as well as how we process personal data you provide us with.
This Privacy Policy (“Policy”) describes how we handle the data you provide us with through our websites (“Site”), via our Facebook, Instagram, Youtube, WhatsApp, Telegram, Viber accounts (“social media”), telephone, or by interacting with us in other ways. Such treatment may include, but is not limited to, the following:
● collection;
● recording;
● organization;
● storage;
● structuring;
● adaptation;
● alteration;
● retrieval;
● consultation;
● use;
● disclosure by transmission;
● dissemination or otherwise making available;
● alignment or combination;
● restriction; and
● erasure or destruction.
When processing your personal data Madonna can play different roles under the GDPR and other applicable laws and regulations. We act as a data controller under the GDPR and as a business under the CCPA respectively.
When you submit your personal data as a customer through our Site, you may be asked to consent to our processing of the personal data you provide as explained in this Policy to enable us to provide you with the information or service requested, if no other legal ground can be used.
You can be our visitor or customer (collectively “users”):
● You are a visitor when you merely browse this Site and leave your data via cookies and other tracking technologies;
● You are a customer when you submit your personal data via Site, email, social media, phone or in any other way to receive our services.
Definitions
To facilitate your understanding of this Policy, we explain the usage of the definitions listed here in accordance with the GDPR and CCPA.
We use the following definitions in this Policy:
“data controller” means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data is processed.
“data processor” means the natural or legal person who processes personal data on behalf of the data controller.
“data subject” is any living individual whose data we collect.
“personal data” means any information relating to you and helping identify you (directly or indirectly) such as your name, last name, email, location data, etc.
“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“services” means access and/or use the functionalities of the Site described in Terms of Service in order to familiarize yourself with and order our services as provided in Terms of Service.
The definitions of terms used within this Policy are taken from the GDPR in consideration of the definitions established in the CCPA. The pair of definitions “personal data” and “personal information”; “controller” and “business”; “processor” and “service provider”; “data subject” and “consumer” may be used interchangeably unless another meaning is mentioned.
Data Collection
We collect and process the information about you or obtained from you in accordance with this Policy.
We collect the information from you through the forms on the Site, email, social media, telephone number and process it as a data controller.
We collect information about you in connection with our Site and services in two main ways: visitor data and customer data. In particular, we collect:
Visitor data:
(a) Cookies information. On our Site, we may use cookies and other tracking technologies for a variety of purposes: for analytics, marketing activities, remembering your preferences, and other purposes. Such use may involve the transmission of information from us to you and from you to a third party website or us. To learn more regarding our use of cookies please see the ‘Use of Cookies’ section of this Policy and Cookie Policy.
Customer data:
(b) Contact information. If you provide your contact information, namely: email, full name, telephone, gender, age, photo or any other personal information, we may use it to provide you with our services, for communication with you regarding our services and for customer support.
(c) Payment Information. If you make a purchase via Site, you will need to provide certain banking information, so the order can be fulfilled. We may use the email address you provided when you purchased our services to provide you with information regarding your purchase. We may also use payment information (e.g., SWIFT number, IBAN, address) to provide you with a refund for the services.
We use your personal data we collected and the personal data you provided us with only for the purposes listed in this Policy. We may share your personal data with third parties solely for purposes listed herein.
We do not sell your data. We DO NOT use automated decision-making and profiling.
We DO NOT intentionally collect and process any sensitive personal data. Please, refrain from sharing your or third-party sensitive personal data with us.
Use of Your Personal Data
When acting as a data controller, we use your personal data for the purposes listed in the table below where we also detail the type of personal data processed, legal bases we rely on to do so, third parties with whom we may share your personal data and information as to source of such data:
| Purposes | Type of personal data | Legal grounds | Third Parties recipients | Source |
|---|---|---|---|---|
| To enable users to provide their information via forms on Site
To communicate with users regarding the provision of our services For performing customer support and solving users’ issues |
(b) Contact information | Performance of a contract (Article 6(1)(b)) | Service providers, Contractors | Site, email, telephone, social media |
| To receive payments for our services | (c) Payment Information | Performance of a contract (Article 6(1)(b)) | Service providers, Contractors | Site |
| To provide refunds for our services | (c) Payment Information | Performance of a contract (Article 6(1)(b)) | Service providers, Contractors | Site |
|
To ensure the functionality of the Site To prevent fraudulent activities |
(a) Cookies information | Our legitimate interest (Article 6(1)(f)) | Service providers, Contractors | Site |
| For analytics and marketing purposes | (a) Cookies information
|
Your consent (Article 6(1)(a)) | Service providers, Contractors | Site |
Please, note that upon processing of payments using services of a payment processor, such payment provider may collect certain personal data it considers as necessary for provision of services. Such collection of personal data is regulated under the rules and policies of payment processors. We advise you to access the payment processors’ websites carefully and always check their policies and rules regarding the collection of your personal data.
Data Security, Integrity and Retention
We will store and process your personal data for as long as needed to provide you or other customers with the services.
Also, you may request erasing of your personal data by contacting us in any way convenient for you.
We store and process your personal data until we do not need it for any of the purposes defined in this Policy unless longer storage is required or expressly permitted by law.
We may not delete or anonymize your data if we are compelled to keep it under Article 30 of the GDPR and other applicable laws.
Notwithstanding any of the aforementioned periods of data storage, you may request to delete your personal data by sending us an email at admin@alirnafzco.com or contacting us via another way convenient for you.
We have implemented appropriate organizational, technical, administrative, and physical security measures that are designed to protect your personal data from unauthorized access, disclosure, use, and modification. We regularly review our security procedures and policies to consider appropriate new technology and methods.
Data Sharing and Disclosure
We only transfer your personal data to third parties according to the requirements of GDPR.
Where possible, we always enter into data processing agreements (DPAs) and Non-Disclosure Agreements (NDAs) with our third parties.
We may disclose the personal data to third parties, including those located outside the EU and EEA, provided that proper safeguards are put in place and the applicable local laws do not put your rights at risk.
We may share your personal data as a data controller to data processors in accordance with provisions specified hereafter.
Sharing data with data processors
There are many features necessary to provide you with our services that we cannot complete ourselves, thus we seek help from third parties. We may grant some service providers access to your personal data, in whole or in part, to provide the necessary services. We have established Supplier Assessment Procedures to ensure we choose trusted partners who provide appropriate security measures and safeguards.
Therefore, we may share and disclose your personal data to other data processors (“service providers”):
- ActiveCampaign(ActiveCampaign, LLC, USA): to perform email marketing campaigns. You may read its Privacy Policy here;
- Calendly (Calendly, LLC, USA): to perform online calls and create time-tables. You may read its Privacy Policy here;
- Google Forms (Google, LLC, USA): to create forms for online data collection. You may read its Privacy Policy here;
- Google Sheets (Google, LLC, USA): to create online tables. You may read its Privacy Policy here;
- Google Analytics (Google, LLC, USA): for analytics purposes. You may read its Privacy Policy here;
- Mailchimp (Intuit Inc., USA): to perform email marketing campaigns. You may read its Privacy Policy here;
- Salebot (Individual entrepreneur Spirin D.V., Russian Federation): to perform email marketing campaigns. You may read its Privacy Policy here;
- Smart Sender (Global Software Investment OÜ, Estonia): to perform marketing campaigns via chat-bots and messengers. You may read its Privacy Policy here;
- Stripe (Stripe Inc., USA): to receive payments. You may read its Privacy Policy here;
- Thinkific (Thinkific Labs Inc., Canada): to create online courses. You may read its Privacy Policy here;
- Twilio (Twilio Inc., USA): to create sms and calls. You may read its Privacy Policy here;
- EverWebinar (Genesis Digital, LLC, USA): to perform webinars. You may read its Privacy Policy here;
- Zoom (Zoom Video Communications, Inc., USA): to perform video conferences and webinars. You may read its Privacy Policy here;
- Creatio (CREATIO EMEA LTD, Cyprus): to manage our relationships with customers and for marketing purposes. You may read its Privacy Policy here;
- Gravitec (GRAVITEC POLSKA Sp.z O.O., Poland): to use push-notifications. You may read its Privacy Policy here;
- Zapier (Zapier Inc., USA): to manage integrations between other services. You may read its Privacy Policy here;
- Zadarma (Smartvoice LTD., UK): to perform cloud telecommunications and sms sending. You may read its Privacy Policy here;
- Ysell (HotPart GmbH, Germany): to perform logistics for an online shop. You may read its Privacy Policy here;
During our business activities we may engage different specialists which may receive your personal data, including technical, sales and marketing specialists, to provide you with better customer service. Also, we may disclose some of your personal data to our outsource legal professionals to make our business accurate and transparent. The abovementioned specialists are collectively referred to as Contractors.
We may transfer your personal data to countries outside the EU and EEA that are not determined to offer an adequate level of data protection on the basis of article 45 of GDPR (adequacy decision) with appropriate safeguards as determined under the GDPR.
We only transfer your personal data to third parties within requirements under the GDPR. Where possible, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with them and treat personal data transfer seriously. Where the Contractor has an appropriate data processing agreement in place, Madonna may adjoin such data processing agreement. If so, Madonna and the Contractor may regulate the transfer of the personal data to such Contractor by means of this data processing agreement.
Transferring your personal data outside of the European Economic Area
We may transfer your personal data to third countries outside the EU and the EEA under Article 46 of the GDPR on the appropriate safeguards, including the standard contractual clauses (SCC).
For transfers to countries that do not fall under requirements of Article 45 of the GDPR on the adequacy of the level of protection, we may transfer your personal data to the third countries outside the EU and the EEA, including the onward transfers of the personal data from the third countries to another third countries, under Article 46 of the GDPR with the appropriate safeguards, including the SCC.
We put supplementary technical and organizational measures in place when transferring data outside the EU and the EEA. e.g. prior assessment of the service supplier’s reliability and personal data protection practices, encryption of the transferred personal data, prompt reacting to any threats to confidentiality, integrity and availability of the personal data, conducting transfer impact assessments (TIA) when necessary, etc.
Data Subject Age
We undertake best possible efforts to secure the processing of personal data belonging to the underage.
We do not knowingly collect personal data from persons under the age of 13.
By submitting your personal data to us, you acknowledge that you have reached the age of 13 and under the laws of your country of residence you have all rights to provide us with your personal data for processing.
If you have any reason to believe that a child under the age of 13 has provided his/her personal data to us, please contact us at admin@alirnafzco.com
Your Rights under the GDPR
You may exercise the following rights under the GDPR:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object to processing;
- right to data portability;
- right to lodge a complaint;
right to consent withdrawal.
You may exercise the following rights by submitting your request at admin@alirnafzco.com
Rights under the GDPR
- right of access means that you may ask us to send you the copy of your personal data collected together with information regarding the nature, processing and disclosure of that personal data;
- right to rectification means that you may ask us to update and correct the false data, missing or incomplete personal d
- right to erasure (to be “forgotten”) means that you may ask us to delete your personal data collected, except insofar it is prohibited by appropriate laws.
- right to restriction of processing means that you may ask us to restrict processing where:
- your personal datais not correct or outdated;
- the processing is unlawful.
- right to object to the processing means that you may raise objections on grounds relating to your particular situation;
- right to data portability means that you may ask us to transfer a copy of your personal data to another organisation or to you;
- right to withdraw the consent when your personal data processed on a basis of your consent;
- right to lodge a complaint with the supervisory data protection authority pertaining to the processing of your personal data.
You may submit the complaint to the supervisory authority of your place of residence within the EU or to the data protection authority stated in this Policy.
Please, note that we may need to confirm your identity to process your requests to exercise your rights under the GDPR. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.
Data Protection Authority under the GDPR
We kindly ask you to contact us directly so that we can quickly answer your question.
We kindly invite you to share your concerns with us in the first place regarding any issue related to your personal data processing. You may use the following channels to address your inquiries.
In some cases, you have the right to lodge a complaint about our use of your personal data with a data protection authority. For more information, please contact your national data protection authority. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us.
California Residents: Your Rights under the CCPA
This section applies to the processing of the personal information of the California residents
Under the California Consumer Privacy Act (the “CCPA”), California residents have certain rights regarding our collection, use, and sharing of their personal information.
We may collect various categories of personal information when you use and/or access our Site, including information you provide when you want to receive our services, provide us with any additional information, and automatically collected data (regarding your interactions with our Site).
In particular, depending on actual circumstances, we may collect the following categories of personal information specified in the CCPA when you access our Site:
- Category A – Identifiers;
- Category B – Personal information categories listed in the Cal. Civ. Code § 1798.80(e);
- Category C – Protected classification characteristics under California or federal law;
- Category F – Internet or other similar network activity.
You can find a detailed description of the personal information that we may collect from you above in the ‘Use of Your Personal Data’ section of this Policy. Note that in the ‘Data Disclosure and Sharing’ section of this Policy you can review the categories of third parties with whom we may share your personal information. The terms used within those sections of this Policy are taken from the GDPR in consideration of the definitions established in the CCPA.
If you are a California resident, to the extent provided for by the CCPA and subject to applicable exception, you have the following rights in relation to the personal information we have about you:
- Right to obtain information. You can request information about what personal information has been collected about you and how we have used that personal information during the preceding 12 months.
- Right of access. You can request a copy of the personal information that we have collected about you during the preceding 12 months.
- Right to deletion. You can request us to delete the personal information that we have collected from you unless it is necessary for us to maintain your personal information in certain cases under the CCPA, such as protection against malicious, deceptive, fraudulent, or illegal activity.
- Right to be free from discrimination relating to the exercise of any of your privacy rights.
We do not sell your personal information to third parties for monetary or other valuable consideration. Additionally, we do not offer any financial incentives associated with our collection, sharing, or retention of your personal information.
We take the protection of your privacy seriously, so in no way will we discriminate against you for exercising any of your rights granted by the CCPA.
You can exercise your rights under the CCPA by sending us an email by any other means of communications convenient for you, including those listed in the ‘How to Contact Us’ section of this Policy.
Please, note that we may need to confirm your identity to process your requests to exercise your rights under the CCPA. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.
Changes to the Privacy Policy
We may change this policy from time to time due to the different purposes.
We will notify you on such material changes through means available to us.
This Policy may be changed from time to time due to the implementation of new updates, technologies, laws’ requirements or for other purposes. We will send notice to you if these changes are dramatic and where required by applicable laws, we will obtain your consent for the subsequent processing. In any case, we encourage you to regularly review this Policy to check for any changes.
Such notification may be provided via your email address, announcement published on the Site and/or by other means, consistent with applicable law.