Privacy Notice
KATYSHOP.RO LTD, a private limited company incorporated in England and Wales under company number 17348937, whose registered office is at 57 Prospect Drive, Shirebrook, Mansfield NG20 8BH, England, registered with the Information Commissioner's Office as a data controller under registration reference ZC213908 (the "Company", "we", "us", "our").
Effective date: 14 November 2026. Version: 2.6 (30 October 2026 — the website katyshop.co.uk and the Katy Shop UK application are brought within this Notice; personalised advertising on the Website and in the App, and the display of advertising within the Katy Shop UK application, each with the consent of the data subject, are described at clauses 12.3A and 12B; version 2.5 of 13 October 2026 remains in force until the effective date).
1. Scope and status of this Notice
1.1 This Privacy Notice ("Notice") is issued pursuant to Articles 13 and 14 of the UK General Data Protection Regulation ("UK GDPR") as incorporated into domestic law by section 3 of the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018 (the "DPA 2018").
1.2 Where the Company offers goods to data subjects located in the European Union, Regulation (EU) 2016/679 ("EU GDPR") applies by virtue of Article 3(2)(a) thereof, and this Notice shall be construed accordingly. References in this Notice to the UK GDPR shall be read as including the EU GDPR where the latter applies.
1.3 This Notice governs the processing of personal data carried out in connection with:
(a) the websites located at katyshop.co.uk and www.katyshop.ro (each and together, the "Website"); and
(b) the mobile applications published under the names Katy Shop Pro and Katy Shop UK for the Android and iOS operating systems (each and together, the "App"),
together the "Services".
1.4 The Company is the controller in respect of all processing described in this Notice, within the meaning of Article 4(7) UK GDPR. Contact particulars are set out at clause 15.
1.5 The Company has not appointed a Data Protection Officer, no such appointment being mandatory under Article 37 UK GDPR having regard to the nature, scope and purposes of the Company's processing activities.
2. Definitions
2.1 Terms defined in Article 4 UK GDPR bear the same meaning in this Notice. In particular, "personal data", "processing", "controller", "processor" and "data subject" are to be construed in accordance with that Article.
2.2 "Live Sale" means a real-time video broadcast conducted through the App during which items are offered at a stated fixed price and allocated to the first user to claim them.
2.3 "Auction" means a real-time bidding process conducted through the App, distinct from a Live Sale, in which items are allocated to the highest bidder at the close of bidding.
3. Categories of personal data processed, purposes and lawful bases
3.1 Website. The Company processes the following categories of personal data in connection with the Website:
| Category of personal data | Purpose of processing | Lawful basis (Art. 6(1) UK GDPR) |
|---|---|---|
| Identity and contact data: full name, delivery address, billing address, email address, telephone number | Conclusion and performance of the contract of sale; despatch of the goods | Art. 6(1)(b) — performance of a contract |
| Transaction data: orders placed, sums paid, refunds issued, correspondence relating thereto | Administration of returns, refunds and statutory guarantees; maintenance of accounting records | Art. 6(1)(b) and Art. 6(1)(c) — legal obligation |
| Communications data: the content of enquiries submitted to the Company | Responding to customer enquiries | Art. 6(1)(f) — legitimate interests (customer service) |
| Technical data: internet protocol address, browser type and version, pages accessed, timestamps | Maintaining the security and availability of the Website; prevention and detection of fraud | Art. 6(1)(f) — legitimate interests (network and information security) |
3.2 App. The Company processes the following categories of personal data in connection with the App:
| Category of personal data | Purpose of processing | Lawful basis (Art. 6(1) UK GDPR) |
|---|---|---|
| Account data: full name and email address, obtained from the authentication provider selected by the data subject (Google, through the Firebase Authentication service of Google LLC, or Apple) | Creation and administration of the user account; issue of invoices | Art. 6(1)(b) |
| Profile image, where voluntarily supplied | Display of the data subject's image alongside messages posted in the live chat | Art. 6(1)(a) — consent, freely given and withdrawable |
| Date of birth | Verification that the data subject has attained the age of eighteen years. The Company does not contract with minors. Once recorded, this datum is immutable, in order that the verification cannot be circumvented | Art. 6(1)(b) and Art. 6(1)(c) |
| Delivery address and telephone number | Despatch of goods by the carrier, which requires both particulars | Art. 6(1)(b) |
| Commercial data: basket contents, items claimed during a Live Sale, bids placed in an Auction, purchase history | Reservation of items, formation and performance of the contract of sale | Art. 6(1)(b) |
| User-generated content: messages posted in the live chat and reports submitted in respect of messages posted by others | Operation of the chat facility; moderation and enforcement of the rules of conduct | Art. 6(1)(f) — legitimate interests (maintenance of a lawful and civil environment) |
| Interaction data: number of taps registered during a broadcast; instances of a broadcast being shared | Operation of the on-screen counters and the leaderboard, being features visible to the data subject | Art. 6(1)(f) — legitimate interests (provision of the requested features) |
| Viewing data: the times at which the data subject joins and leaves a broadcast, the minutes watched in each broadcast, and the presence of the data subject among the viewers connected at a given moment | Display to the host of the viewers currently connected; calculation of the contest score; security of the broadcast | Art. 6(1)(f) — legitimate interests (operation of an interactive live sale and of the contest) |
| Contest data: the score calculated from purchases, participation in Auctions, minutes watched, taps, shares and accepted invitations, less the deductions provided for in the contest rules (including for late payment and for prohibited language); the resulting position in the leaderboard; prizes awarded | Operation of the monthly contest and of the evening prize described in the contest rules; announcement of winners | Art. 6(1)(b) — performance of the contest rules accepted by the data subject |
| Invitation data: the invitation code of the data subject, visits made through that code and accounts created through it | Crediting the inviting user in the contest; prevention of abuse | Art. 6(1)(f) — legitimate interests (operation of the invitation feature) |
| Device notification token | Delivery of push notifications to the device, including information concerning the Services and marketing communications, as described at clause 11 | Art. 6(1)(a) — consent given through the permission of the operating system |
| Restriction data: where an account is deleted while subject to a restriction (including a restriction for non-payment), a keyed one-way hash (HMAC-SHA256) of its email address, of the identifiers assigned by the authentication provider and of its telephone number, together with the number of the deleted account and the date of the restriction. The email address, identifiers and telephone number themselves are not retained and cannot be derived from the hash | Recognition of a new account opened with any of the same particulars, which is opened subject to the same restriction; prevention of the circumvention of a restriction by deletion and re-registration. This processing applies to accounts deleted on or after 13 October 2026 | Art. 6(1)(f) — legitimate interests (prevention of fraud and of non-payment) |
3.3 Where the Company relies upon Article 6(1)(f), it has conducted a balancing exercise and is satisfied that its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject. The data subject's right to object under Article 21 UK GDPR is set out at clause 8.1(f).
3.4 The Company does not process special categories of personal data within the meaning of Article 9(1) UK GDPR, nor does it carry out automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22 UK GDPR. The restrictions applied automatically by the App, namely upon non-payment within the period stated in the Conditions of Purchase and upon the opening of an account bearing the particulars of an account deleted while restricted, do not prevent payment of sums owed, and the data subject may at any time obtain review of such a restriction by a person, by contacting the Company, which may lift it.
3.5 Automatic chat moderation. Before a message is published in the live chat, it is checked automatically against a list of prohibited words. A message containing such a word is not published; the Company records the date, the account and the number of prohibited words, and deducts points from the contest score as stated in the contest rules. This processing does not produce legal effects or similarly significant effects. A data subject who considers that a message was blocked in error may ask for a review by a person at [email protected].
3.6 Public display in the App. In the contest leaderboard, and when a prize is announced on screen during a broadcast (including by the animated character "Gugu"), the data subject is shown to other users by first name and the initial of the surname only. The full name, contact particulars and amounts spent are never shown to other users.
3.7 Orders placed through other channels. Personal data received in connection with orders placed through the Company's shop on eBay is processed in the same manner, and for the same purposes, as orders placed through the Website; eBay acts as an independent controller in respect of its own platform.
4. Categories of personal data expressly not processed
4.1 For the avoidance of doubt, the Company does not process:
(a) payment card data. Payment is effected through Revolut Ltd, or, where the data subject elects to pay by instalments, through Stripe Payments UK Ltd with Klarna or Clearpay, in each case upon a payment page operated by that provider. Card numbers, expiry dates and security codes are transmitted by the data subject directly to the provider and at no point traverse the Company's applications, servers or systems;
(b) geolocation data. The App neither requests nor accesses the location permissions of the device;
(c) contacts, photographs, stored files, calendar entries, microphone or camera input. The App does not declare the corresponding permissions, which the data subject may independently verify in the permissions listing maintained by the operating system;
(d) advertising identifiers, save where the data subject has given consent in accordance with clause 12A and, on devices running iOS, has additionally permitted tracking through the operating system; and
(e) the content of chat messages, delivery addresses, telephone numbers or payment data, which are in no case disclosed to the Measurement Partners referred to at clause 12A.
5. Recipients and categories of recipients
5.1 The Company does not sell personal data, and does not disclose personal data to third parties for the purposes of advertising or profiling, save, in each case with the consent of the data subject, for the measurement of advertising and the presentation of personalised advertising as described at clauses 12.3A, 12A and 12B.
5.2 Personal data is disclosed to the following recipients, each acting as a processor on the Company's documented instructions pursuant to Article 28 UK GDPR save where indicated otherwise, and in each case limited to the data necessary for the stated purpose:
| Recipient | Function | Data disclosed | Place of processing |
|---|---|---|---|
| Shopify Inc. | Hosting of the Website and operation of the checkout | Order and delivery particulars | Canada; United States |
| Cloudflare, Inc. | Network protection and content delivery for the Company's servers | Technical traffic data | Global network |
| Revolut Ltd | Payment services (independent controller in respect of payment data) | Sum payable; name; email address | United Kingdom |
| Stripe Payments UK Ltd | Payment by instalments through Klarna or Clearpay, where the data subject elects it | Sum payable; name; email address; delivery address | United Kingdom; United States |
| Klarna Bank AB; Clearpay Finance Ltd | Provision of instalment credit (independent controllers, including for their own credit checks) | Particulars supplied by the data subject to that provider; sum payable | Sweden; United Kingdom |
| Royal Mail Group Ltd | Carriage and delivery of goods within the United Kingdom | Name; delivery address; telephone number | United Kingdom |
| Pandora's Courier | Carriage and delivery of goods to destinations outside the United Kingdom | Name; delivery address; telephone number | United Kingdom; the destination country |
| Xero Ltd | Issue and retention of invoices; accounting | Name; email address; address; particulars of goods sold | United Kingdom; New Zealand |
| Google Ireland Ltd; Apple Inc. | Authentication, where the data subject elects to use that provider (independent controllers in respect of their own accounts) | Confirmation of identity; name; email address | Ireland; United States |
| Resend, Inc. | Transmission of transactional electronic mail | Email address; content of the message | United States |
| Hetzner Online GmbH | Relay of the live video signal | Audio and video signal of the host; internet protocol address of the viewer's device, needed to deliver the signal; no account data | Germany |
| Google LLC (Firebase) | Sign-in with a Google account; delivery of push notifications to Android devices | Account identifier; name; email address; device notification token | United States |
| Apple Inc. | Delivery of push notifications to iPhone devices | Device notification token | United States |
| DIG WILD LTD (company number 16723627) | Development, hosting and maintenance of the Company's servers and applications, under a written data processing agreement dated 4 October 2026 | The data held on the application server | United Kingdom |
| Backblaze, Inc. (sub-processor of DIG WILD LTD) | Backup copies of the database and of profile images | The data held on the application server | United States |
| Anthropic PBC (sub-processor of DIG WILD LTD) | Artificial-intelligence assistance used in the maintenance and support of the systems | Data contained in the maintenance task concerned | United States |
| WhatsApp Ireland Limited (Meta) | Correspondence with the Company through the WhatsApp Business application, where the data subject elects to contact the Company by that means, including automated replies generated by the business artificial-intelligence features of that application where they are enabled (independent controller in respect of its own service) | Telephone number; WhatsApp profile name; content of the messages exchanged | Ireland; United States |
| Microsoft Ireland Operations Ltd | Electronic mail of the Company | Correspondence with the Company | European Union; United Kingdom |
| Meta Platforms Ireland Limited (independent controller) | Measurement and attribution of advertising and personalised advertising, where consented (clauses 12.3A and 12A) | Website and App events, including products viewed, added to the basket and purchased; device data; advertising identifier where permitted | Ireland; United States |
| TikTok Technology Limited (independent controller) | Measurement and attribution of advertising and personalised advertising, where consented (clauses 12.3A and 12A) | Website and App events, including products viewed, added to the basket and purchased; device data; advertising identifier where permitted | Ireland; United Kingdom; United States; Singapore |
| Google Ireland Limited (Google Analytics; Google Analytics for Firebase; Google Ads; Google AdMob) (independent controller in respect of advertising) | Analytics, measurement of advertising and personalised advertising, where consented (clauses 12.3, 12.3A, 12A and 12B); display of advertising within the Katy Shop UK application (clause 12B) | Website and App events, including products viewed, added to the basket and purchased; device data; advertising identifier where permitted | Ireland; United States |
5.3 The Company's application server, upon which user accounts are held, is situated in the United Kingdom.
5.4 International transfers. Where a recipient identified at clause 5.2 processes personal data outside the United Kingdom, such transfer is effected in reliance upon (a) adequacy regulations made under section 17A DPA 2018, or (b) the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, issued under section 119A DPA 2018, together with such supplementary measures as the Company considers appropriate. A copy of the relevant safeguards may be obtained on written request.
5.5 The Company shall disclose personal data where required to do so by law, including in response to an order of a competent court, a lawful request by a law enforcement authority, or a statutory notice issued by His Majesty's Revenue and Customs.
6. Retention
6.1 Personal data is retained for no longer than is necessary for the purposes for which it is processed, in accordance with the following schedule:
| Category | Retention period | Justification |
|---|---|---|
| Account data | For the duration of the account, and erased upon its deletion | Art. 5(1)(e) — storage limitation |
| Accounting records and invoices | Six years from the end of the financial year to which they relate | Section 388(4) Companies Act 2006; paragraph 21 Schedule 11 Value Added Tax Act 1994 |
| Chat messages | Erased upon deletion of the account | Storage limitation |
| Viewing, contest and invitation data | For the duration of the account; upon deletion, these records cease to be linked to the name or contact particulars of the data subject | Storage limitation |
| Device notification tokens | Erased upon deletion of the account, or when the token ceases to be valid | Storage limitation |
| Moderation reports | Twelve months from submission | Legitimate interest in identifying repeated conduct |
| Technical and security logs | Ninety days | Legitimate interest in network security |
| Restriction data described at clause 3.2 (keyed one-way hash of the particulars of an account deleted while restricted) | Twenty-four months from the deletion of the account, after which it is erased automatically | Art. 6(1)(f) — legitimate interest in preventing the circumvention of a restriction |
| Copies held in email delivery logs (Resend, Inc.) and in database backups | Thirty days, after which they are overwritten or erased in the ordinary cycle | Art. 5(1)(e) — storage limitation; Art. 32 — availability and resilience of processing |
6.2 The retention of accounting records at clause 6.1 is a statutory obligation and is not capable of being waived by the Company, notwithstanding any request for erasure. Such records are not used for any purpose other than the discharge of that obligation.
7. Erasure of the account
7.1 The data subject may procure the deletion of the account at any time and without giving reasons, by either of the following means:
(a) within the App: Settings section ("Setări") → "Șterge contul" ("Delete account"), and confirmation of the prompt displayed; or
(b) without the App: by visiting live.katyshop.cloud/stergere-cont, or by written request sent from the electronic mail address associated with the account.
7.2 Deletion effects the erasure of the data subject's name, electronic mail address, profile image, delivery address, telephone number, date of birth, chat messages and any unpaid basket. Records retained pursuant to clause 6.1 are unaffected. Where the account is subject to a restriction at the time of deletion, the restriction data described at clause 3.2 is retained in accordance with clause 6.1, and a new account bearing any of the same particulars is opened subject to the same restriction. Copies of the erased data held in email delivery logs and in backups are removed within the period stated at clause 6.1.
7.3 A request made under clause 7.1(b) shall be actioned without undue delay and in any event within one month of receipt, in accordance with Article 12(3) UK GDPR.
8. Rights of the data subject
8.1 The data subject enjoys the following rights, exercisable in accordance with Chapter III UK GDPR:
(a) access — Article 15: to obtain confirmation as to whether personal data concerning the data subject is being processed and, where that is the case, access to that data and to the information specified in Article 15(1);
(b) rectification — Article 16: to obtain the rectification of inaccurate personal data and the completion of incomplete personal data;
(c) erasure — Article 17: to obtain the erasure of personal data, save where processing is necessary for compliance with a legal obligation to which the Company is subject (Article 17(3)(b));
(d) restriction — Article 18: to obtain the restriction of processing in the circumstances there specified;
(e) portability — Article 20: to receive personal data provided to the Company in a structured, commonly used and machine-readable format, and to transmit it to another controller;
(f) objection — Article 21: to object, on grounds relating to the data subject's particular situation, to processing based upon Article 6(1)(f); and to object at any time and without qualification to processing for direct marketing purposes; and
(g) withdrawal of consent — Article 7(3): to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8.2 Rights are exercised by written request to [email protected], in order that a clear record of each request may be kept; the public chat within the App is not a channel for such requests. The Company shall respond without undue delay and in any event within one month of receipt, which period may be extended by two further months where necessary, having regard to the complexity and number of the requests, in which case the data subject shall be informed within one month of the reasons for the delay.
8.3 No fee is payable. The Company may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive, in particular because of its repetitive character (Article 12(5) UK GDPR).
8.4 The Company may request such information as is reasonably necessary to confirm the identity of the requester, in order that personal data is not disclosed to a person not entitled to receive it.
9. Complaints
9.1 The data subject is invited to raise any concern with the Company in the first instance, at [email protected].
9.2 The Company is registered with the Information Commissioner's Office as a data controller under registration reference ZC213908, and the entry may be inspected on the public register maintained at ico.org.uk.
9.3 The data subject has in any event the right to lodge a complaint with a supervisory authority, being in the United Kingdom the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk; telephone 0303 123 1113), and, in the case of a data subject resident in the European Union, the supervisory authority of that data subject's Member State of habitual residence, place of work or place of the alleged infringement (Article 77 UK GDPR / EU GDPR).
10. Minors
10.1 The Services are directed exclusively to persons who have attained the age of eighteen years. The Company does not knowingly process the personal data of children, and does not offer information society services directly to children within the meaning of Article 8 UK GDPR.
10.2 The App requires the entry of a date of birth and refuses to conclude any transaction where that date discloses an age below eighteen years.
10.3 Where the Company becomes aware that it holds personal data relating to a child, that data shall be erased without undue delay. Any person having reason to believe that such data has been supplied is requested to notify the Company at [email protected].
11. Notifications and direct marketing
11.1 The App may transmit push notifications concerning the commencement of a broadcast (in the App or on the Company's social media channels), the commencement of Auctions, the payment deadline and the release of Items reserved in the Basket, the status of an order, notices and information concerning the Services, including changes to the Company's policies, and marketing communications concerning the Company's products, offers, broadcasts and events. Such notifications are transmitted only where the data subject has granted the corresponding permission at the level of the operating system, and that permission may be withdrawn at any time through the settings of the device. Push notifications containing marketing communications are sent on the basis of the consent so given (Art. 6(1)(a) UK GDPR). The data subject may at any time, free of charge and without giving reasons, object to the receipt of marketing communications (Art. 21(2) and (3) UK GDPR) by disabling notifications in the settings of the device or by writing to [email protected], whereupon no further marketing communications shall be sent to that data subject.
11.2 Electronic marketing communications are transmitted only in accordance with regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, namely with the prior consent of the recipient or, where applicable, in reliance upon the soft opt-in there provided. Every such communication contains a facility to refuse further communications, which shall be given effect without charge.
11.3 Sender of electronic mail. Electronic mail containing information concerning the Services, notices, order and payment communications and marketing communications is sent from the address [email protected]. That address does not receive replies. Requests, complaints and the exercise of the rights described at clause 8 are to be addressed to [email protected]. Each marketing communication identifies the Company as its sender and contains a facility to refuse further marketing communications.
12. Cookies and similar technologies
12.1 The Website employs two distinct categories of cookie, which are treated differently in law and are treated differently by us.
12.2 Strictly necessary cookies. These are required for the provision of the service the user has requested, namely the maintenance of the session, the persistence of the basket and the completion of the checkout process. They fall within the exemption at regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 and are set without consent, no lawful alternative to their use existing.
12.3 Analytics and advertising cookies. These are used to measure how the Website is used and to present advertising. They are not set unless the user has given consent through the banner displayed upon first visiting the Website. Consent is the lawful basis, within the meaning of Article 6(1)(a) UK GDPR and regulation 6(1) of the 2003 Regulations.
12.3A Personalised advertising (remarketing). Where the data subject consents to the advertising cookies at clause 12.3, the Website records the visit and the products viewed, added to the basket, taken to checkout and purchased (identified by product reference, name, price and quantity, together with the order number and value in the case of a purchase), and discloses that information, with an online identifier, to Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited, in order that advertisements for the Company's products, including the products viewed, may be presented to the data subject on the services and networks of those companies, and that the effectiveness of that advertising may be measured. Google may associate such data with the Google account of a data subject who is signed in and has enabled ads personalisation in that account. Each of those companies acts as an independent controller in respect of its own processing, which is governed by its own privacy policy. No such information is recorded or disclosed unless and until consent is given, and the delivery address, telephone number, email address and payment data of the data subject are in no case disclosed for that purpose.
12.4 Cookies within both categories are set by the Company as operator of the Website and, in the case of the cookies at clause 12.3, by Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited.
12.5 Withdrawal of consent. Consent given under clause 12.3 may be withdrawn at any time, at no disadvantage, through the cookie preferences control on the Website, or by clearing cookies in the browser, whereupon the banner is presented afresh. Withdrawal does not affect the lawfulness of processing carried out before it.
12.6 Declining the cookies at clause 12.3 does not impair the ordinary use of the Website. Refusing all cookies, including those at clause 12.2, will prevent the basket and the checkout from functioning.
12.7 The App employs no cookies. The measurement technologies used within the App are described at clause 12A.
12A. Measurement of advertising and analytics within the App
12A.1 With the consent of the data subject, the App employs software development kits provided by Meta Platforms Ireland Limited, TikTok Technology Limited and Google Ireland Limited (including Google Analytics for Firebase) (together, the "Measurement Partners"), for the purposes of measuring the effectiveness of the Company's advertising, attributing the installation of the App and the opening of an account to the advertising which gave rise to them, and improving the relevance of the Company's communications.
12A.2 Where consent is given, the following data may be disclosed to the Measurement Partners: the occurrence and time of the installation and opening of the App, the opening of an account, the viewing of a product, its addition to the basket, the commencement of checkout and the completion of a payment, together with the product reference, name, price and quantity, and the value and currency of the payment; technical data concerning the device (model, operating system, language, internet protocol address); and, where permitted under clause 4.1(d), the advertising identifier of the device. Each Measurement Partner acts as an independent controller in respect of its own processing, which is governed by its own privacy policy.
12A.3 The lawful basis is consent, within the meaning of Article 6(1)(a) UK GDPR and regulation 6(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003. Consent is requested by means of the notice headed "Confidențialitatea ta", presented upon the first opening of the App following its installation, and may otherwise be given in the App under "Setări" → "Confidențialitate". In the Katy Shop UK application, consent is requested by means of the consent message provided by Google (the Google User Messaging Platform, which implements the IAB Transparency and Consent Framework), presented upon the first opening of the App, in which each purpose may be accepted or refused separately; that consent may be reviewed at any time in the App under "Profile" → "Settings" → "Privacy choices". No data is disclosed to the Measurement Partners unless and until consent is given. On devices running iOS, the advertising identifier is accessed only where the data subject has additionally permitted tracking through the App Tracking Transparency control of the operating system; otherwise measurement is confined to the aggregated and anonymised attribution frameworks provided by Apple.
12A.4 Consent may be withdrawn at any time, at no disadvantage, in the App under "Setări" → "Confidențialitate" (in the Katy Shop UK application, "Profile" → "Settings" → "Privacy choices"), and on iOS additionally in the settings of the device. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before it. Declining or withdrawing consent does not impair the use of the App.
12A.5 Data disclosed to the Measurement Partners may be processed outside the United Kingdom, including in the United States; such transfers are effected under the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable to the partner concerned.
12B. Advertising displayed within the Katy Shop UK application
12B.1 The Katy Shop UK application displays a limited number of advertisements for the goods and services of third parties, served by Google Ireland Limited through its Google AdMob service: a single advertising banner on the home screen. No advertisement is displayed in the basket, at checkout or on the page of a product. The Katy Shop UK application installed on devices which do not provide Google services displays no advertisements.
12B.2 Where the data subject consents through the consent message described at clause 12A.3, advertisements may be personalised, and Google Ireland Limited may to that end collect the advertising identifier of the device, the internet protocol address, technical data concerning the device and information concerning the interaction with advertisements. To assist the relevance of advertisements, the App communicates to Google the categories of products offered in the Company's shop and the address of the Website; it does not communicate the identity, the account or the purchases of the data subject for that purpose.
12B.3 Where the data subject refuses consent to personalised advertising, only non-personalised advertisements are displayed, selected by reference to context, in respect of which Google may process limited data, such as the internet protocol address and the approximate location derived from it, for the purposes of delivering the advertisement, limiting its frequency, preventing fraud and aggregated reporting, as described in Google's own policies.
12B.4 Google Ireland Limited acts as an independent controller in respect of its processing for the purposes of this clause, which is governed by its own privacy policy (policies.google.com/privacy). The lawful basis for personalised advertising is consent, within the meaning of Article 6(1)(a) UK GDPR and regulation 6(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003. Consent may be reviewed or withdrawn at any time, at no disadvantage, in the App under "Profile" → "Settings" → "Privacy choices", and the advertising identifier may be reset or deleted in the settings of the device. Data may be processed outside the United Kingdom on the terms set out at clause 12A.5.
13. Security of processing
13.1 The Company implements appropriate technical and organisational measures pursuant to Article 32 UK GDPR, including: transmission of all data over encrypted channels (TLS); restriction of access to the customer database to those personnel whose duties require it; and access to the application server restricted to authorised persons and to approved devices; daily backups; the delegation of authentication to Google and Apple, with the consequence that the Company neither holds nor is capable of holding user passwords.
13.2 In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the Company shall notify the Information Commissioner without undue delay and, where feasible, not later than 72 hours after having become aware of it (Article 33 UK GDPR), and shall notify affected data subjects where the breach is likely to result in a high risk to their rights and freedoms (Article 34 UK GDPR).
14. Amendment of this Notice
14.1 The Company may amend this Notice from time to time. The effective date and version number appear at the head of this document.
14.2 Where an amendment materially affects the processing of personal data — including the introduction of a new purpose, a new category of recipient, or an extended retention period — the Company shall notify data subjects through the App or by electronic mail before the amendment takes effect. Where the data subject has not supplied an email address at which the Company can reach them, notification is given through the App and by publication of the amended Notice on the Website, and the data subject is responsible for consulting the current version.
15. Identity and contact details of the controller
KATYSHOP.RO LTD
Registered office: 57 Prospect Drive, Shirebrook, Mansfield NG20 8BH, England
Registered in England and Wales, company number 17348937
Data protection registration (ICO): ZC213908
Electronic mail: [email protected]
Telephone and WhatsApp: +44 7990 059672
For the purposes of the UK GDPR and the DPA 2018, KATYSHOP.RO LTD is the controller of the personal data described in this Notice.