Privacy policy for loyalty club and digital solutions

Ltd. Runikon Retail   (hereinafter “we”) respects your privacy and is committed to protect it through compliance with this privacy policy (hereinafter the “Privacy policy”). In this Privacy policy, we will inform you about how we process your personal data for loyalty club and digital solutions. We commit ourselves to be transparent with you by providing clear information about what personal data we process, the purpose of processing, the retention period of the personal data as well as the legal basis for the processing and other information that we are required to provide pursuant to applicable legislation.

Topics:
1. What personal data do we process and why?
1.1. E-shop
1.2. IKEA Family loyalty club
1.3. IKEA Application (IKEA App)
1.4. Direct marketing  
1.5. Cookies
1.6. Statistical analysis
2. How do we collect information about you?
3. How long do we keep your personal data?
4. To whom personal data are disclosed?
5. Protection of personal data
6. Your rights 
7. Changes to our Privacy policy
8. Contact information


1. What personal data do we process and why?
When you create an IKEA account, join the IKEA Family club, shop at our e-shop, use the IKEA App services and/or agree to receive direct marketing, you provide personal data that we will process. The categories of your personal data that we process as well as purposes and legal basis for the processing are the following:

1.1 E-Store

Categories of personal data

Legal basis for the processing

Email  Name  Surname  Phone number  Password (hashed)  List of products and/or favourite items Viewed items  Actions within the IKEA account  Preferences (subscriptions, registration in loyalty club, etc.) Details of the IKEA Family loyalty club, as specified in Paragraph 1.2 (if you register as an IKEA Family member)  Information you provide when ordering direct marketing, as specified in Paragraph 1.3 (if you order/subscribe Details of emails, including subject line, sender, recipient and content of the email (e.g., when you create an IKEA account and we send a confirmation email, or when you request to remind the forgotten password)  Details of short messages, including subject line, sender, recipient and content (e.g., when you create an IKEA account and we send a confirmation code)  Shopping cart  Address (es)  Point of collection of goods  Payment data (including bank account number)   Purchase history   Purchase and other related documents (VAT invoice, etc.)  Signatures (e.g., in transfer and acceptance act of the goods)  Information on returns

Conclusion and performance of a contract with you.

You can create your IKEA account and use the e-shop services on our website or IKEA application. In such case, we will process your data to provide you with the opportunity to create the account and be able to use it for taking advantage of services offered to registered users, including e-shop services (to place the order, pay for it, receive VAT invoices, see the order details, to deliver purchased goods etc.). Also, for the purpose of administration and maintenance of e-shop, to recognise you when you lodge inquiries, to notify you of any changes in the terms and conditions (privacy policy, changes in terms and conditions, etc.), or to contact you (in case of any problems with regard to the account or order, in case some items are lost etc.). Your email and phone number shall be processed for the purposes of notifying you of the status of your order, expected date of pick-up or delivery, for sending interim confirmations. We also process your certain data for the statistical purposes, as described in Paragraph 1.6.
In your IKEA account, you can see which of your personal data we process, including IKEA Family details (if you register as an IKEA Family member), edit information about yourself, change your preferences with regard to direct marketing, participation in games and/or contests/competitions and etc.
To create the IKEA account and shop at our e-shop, you have to accept the terms and conditions of the purchase-sale contract and provide your personal data. If you do not accept the terms and conditions and/or refuse to provide your personal data, you will be unable to create the IKEA account and shop at the e-shop. If you order products and/or services at e-shop for or in the name of another person, you must notify the person and obtain the person’s consent to provide his/her personal data to us and ensure that the person has understood and familiarised himself/herself with this Privacy policy. The afore-mentioned information of the other person shall be used as defined in this Paragraph.
By registering to the IKEA account and e-shop, you approve that you are at least 18 years of age and your personal data are accurate and correct. In cases of any inaccuracies, you should immediately correct them.
In case you order the delivery service, we shall process information as indicated in Paragraph 1.2. “Home delivery of goods” of the Services privacy policy. In case of withdrawal from the purchase-sale contract or return of the goods – as indicated in Paragraph 1.5. of Services privacy policy.
In case you send the list of products in your shopping cart by email or we send a notice of your abandoned cart, or notify you of the products that are back in stock, your personal data shall be processed as indicated in Paragraph 1.3. hereof.
For more information on how the third parties (payment service providers that administer payments via the e-shop) process payment data, we advise you to read their privacy policies.

1.2 IKEA Family loyalty club

Management of IKEA Family membership

Categories of personal data	Legal basis for the processing
Email   IKEA Family e-card number  Purchase history with IKEA Family e-card  Start date of the membership Name  Surname  Date of birth  Phone number   Country	Performance of a contract with you.

If you want to become a member of the IKEA Family loyalty club, receive your IKEA Family e-card and its benefits, and you agree with the IKEA Family terms and conditions, then we collect certain information about you. We use this data in order to provide you with the IKEA Family e-card, to identify you in case of queries, to manage the activities necessary for you to use discounts and other IKEA Family benefits, to communicate by email about your membership (e.g., changes of privacy policy, terms and conditions, etc.). We also process your certain personal data for the statistical purposes, as described in Paragraph 1.6.
If you want to join the IKEA Family club, you have to agree with IKEA Family terms and conditions and provide your personal data. If you do not provide it, you cannot join the IKEA Family loyalty club.
By providing personal data, you approve that you are at least 18 years of age and your personal data are accurate and correct. In cases of any inaccuracies, you should immediately correct them. You can correct information about yourself that was provided by registering to the IKEA Family membership, in your IKEA account or by contacting us (contact details are provided below).

Games and/or competitions for IKEA Family members

Categories of personal data	Legal basis for the processing
Name, surname Purchase history with IKEA Family e-card IKEA Family e-card number Email Phone number In case of winning, see Paragraph 1.9 in our General privacy policy	Your consent.  In case of winning, the legal basis for data processing is our legal duty. If any complaint with regard to a game/lottery and/or competition is received, personal data processing is then based on a legitimate interest to protect our rights.

When registering for the IKEA Family e-card or having logged in to your IKEA account, you can decide, whether you want to participate in games and/or competitions for IKEA Family members. Participation is not obligatory, you are free to choose. Having expressed a consent to participate in games and/or competitions, you agree and understand that your details in relation to IKEA Family e-card you provided earlier, once the terms and conditions of a game and/or competition are met, will be automatically included in all IKEA Family games and/or competitions without any additional registration or notification. You also agree that your IKEA Family e-card number will be publicly announced in case of winning.
If you agree to participate in IKEA Family games and/or competitions, we will process your personal data for the purposes of organisation, execution, administration of games and/or competitions, determination of winners, announcement of winners, presentation of prizes and/or other gifts. In case a complaint is received with regard to games and/or competitions, personal data is processed in order to lay claims, satisfy claims or defend legal claims.
You have the right to withdraw your consent to process your personal data for the purpose of IKEA Family games and/or competitions any time, without prejudice to lawfulness of data collection and processing before the withdrawal of the consent. You can do that in your IKEA account or by contacting us (contact details are provided below).
For more details about how we process personal data for the purpose of games and/or competitions, how long we retain such data and whom we transfer it, see Paragraph 1.7 in our General privacy policy

1.3. IKEA Application (IKEA app)

Categories of personal data	Legal basis for the processing
Technical information related to the IKEA Application and device  Information about how you interact with the IKEA Application (e.g., date of latest login) Information about selected language Wish list Inspirations Search history Crash data If you separately give the following permissions: Notifications Camera access Access to files and media	Performance of a contract with you.  Processing is also necessary to ensure our legitimate interest to evaluate and improve the IKEA Application. Your consent for specific permissions.

We process your personal data to provide you with opportunity to use the IKEA Application, to ensure proper administration, functioning of it and operation of all its features. In order to function properly, the IKEA Application needs to have access to certain information on your device, i.e., when you download and install the IKEA Application, it will access device type, operating systems and their versions, etc. 
If you give separate permission (consent), the IKEA Application may have access to your mobile device's camera, files and media etc. You can manage your permissions in your mobile device settings.
If you give a permission to receive notifications, we will provide you with information about the changes to the IKEA Application rules, privacy policy, working hours, status of the order, etc. as well as marketing offers, as indicated in this Privacy policy. In order to provide you with relevant notifications, we may use automated analysis of this information. This analysis does not have any legal or similar significant effect to you.
In addition, to ensure our legitimate interest, we use the afore-mentioned personal data to produce statistics about how the IKEA Application is used and take measures to improve and develop it.
If you use the IKEA application with the IKEA account, your personal data will be processed as described above, and consent to the processing of personal data provided during primary registration (if not changed later) is valid.
Without these processing activities and collecting your personal data, we would not be able to provide you with access to the IKEA Application. If you don‘t agree that your personal data will be processed as described above, do not download or install the IKEA Application, and if you downloaded and installed without reading this Privacy policy, delete the IKEA application from your mobile device immediately.
Please note that deleting or uninstalling the IKEA Application does not delete your IKEA account and/or terminate your IKEA Family membership. So even after deleting the IKEA Application, we will continue to process your information in line with the conditions of this Privacy policy, unless you will delete the IKEA account and/or terminate your IKEA Family membership, or retention period indicated below will expire.


1.4. Direct marketing

Categories of personal data

Legal basis for the processing

Name  Email  List of products (shopping cart)  List of favourite items  Wish list Purchase history (including purchases with the IKEA Family e-card) IKEA Family e-card number Country Date of birth (where such data is collected till 08 July 2019) Preferences  Information related with the TV show “Home idea with IKEA”: phone number, room type for makeover, why makeover is needed, the functionality of the room, what is lacking, information about the person and the family, photos) Inspirations Details of communication, including subject line, sender, recipient, content  Tracking interactions of email (information if it was read, when it was read, how many times it has been read (or opened), if it has been forwarded, what operating system or email server was used, including its location) Information collected via cookies, including online browsing behaviour History of direct marketing Optional:  Gender Living with children under 12 years old City Language

We are processing personal data for direct marketing based on your consent.  Based on our legitimate interest to offer products and/or services that better meet your needs, we are doing limited profiling.

If you give us a consent to receive direct marketing offers, we will provide information about our products, services, offers & promotions, notify you of the products that are back in stock and inform you about the abandoned cart in the e-shop. 
If you email a list of products in your shopping cart or a notice of the products that are back in stock to another person, you must notify the person and obtain the person’s consent to provide his/her personal data to us and ensure that the person has understood and familiarised himself/herself with this Privacy policy. The afore-mentioned information of the other person shall be used as defined in this Paragraph.
Sometimes we can invite you to special events or ask you to participate in activities or surveys (e.g., which items you prefer, why you buy this or that item, or how your dream home looks like). We do that to learn more about your preferences and to better tailor our offerings to your needs. This information is purely voluntary and you are not obliged to answer these surveys or participate in the event or activity.
If you have provided additional data of your choice, we provide you with particular direct marketing offers based on limited profiling (i.e., your gender, city, living with children under 12 years old, list of products, a list of favourite items, purchase history, etc.). These direct marketing offers are not personalised marketing, but they are tailored to the specific group of the customers.
If you agree to receive marketing offers by email, we will track the interaction of email (information if it was read, when it was read, how many times it has been read or opened, if it has been forwarded, what operating system or email server was used, including its location). We do this in order to better understand if information we send is relevant to you. 
You can unsubscribe from direct marketing offers by changing your choices in the IKEA account, by clicking unsubscribe link in each email or by contacting us (contact details are provided below).
By registering for direct marketing offers, you confirm that your personal data is accurate and correct, and you are at least 18 years of age.


1.5 Cookies
When you visit our website www.IKEA.ee  and/or IKEA Application, we want to provide content and features which function properly and are tailored to your needs. This requires cookies. Cookies are small text documents that the website saves on your device when you visit the site or application. The purpose of cookies is to ensure that our site and/or IKEA app function properly, to remember your preferences (such as language, the goods that you viewed, etc.) for a certain period of time, and to collect data on the use of the site and/or IKEA App. We use cookies to distinguish you from other users and to provide you with a unique browsing experience. We also use cookies to collect aggregate statistics about the use and performance of the website and/or IKEA App, to remember what you have done while browsing it, and to collect this information for the purpose of improving our performance and for personalized advertising. 

Legal basis for the use of cookies:
-    our legitimate interest in ensuring technical operation of the website and collecting general anonymised information about the functionality of the website;
-    your consent when cookies are used to store your preferences, also for the purposes of providing customized advertising, or for other purposes when your personal data are collected.

Cookies may be session or persistent. Session cookies are deleted after closing the browser. Persistent cookies are stored until they are deleted or expire. Some cookies are essential and strictly necessary for proper operation of the basic functions and for determining whether you have agreed to the use of cookies on the website and/or IKEA App. Others help to improve the functioning of the website and/or IKEA app and your experience as the user. Some cookies are also used to improve our services and to run customized advertising.

Since we use different types of cookies, below is the information on each cookie category, its purpose and the related information. A specific list of cookies is displayed when you open the website's and/or IKEA App homepage and indicate your choice on the use of cookies (in the cookie information bar).

Necessary cookies.. These cookies are necessary to navigate the site and to use its features. For example, for the right screen view or navigation. Using the site and/or IKEA app would be impossible without these cookies, thus they are essencial for the functionality. We collect statistical information using Google Analytics tools, which allow us capturing and analysing how visitors use our website and/or IKEA App. Cookies enable these tools. This process is anonymous, i.e. when collecting data, visitors are not identified. The Google Analytics automated tool anonymizes visitor IP addresses before saving and processing any data. This way, solely anonymised data are used for the analysis of website use. Google Analytics allows uninstalling Google Analytics from the browsers that you use. For more information, visit: https://tools.google.com/dlpage/gaoptout. 

Preferences cookies. Preference cookies enable the website and/or IKEA app to remember information that changes the way the website and/or IKEA app behaves or looks, like your preferred language or the region that you are in.

Statistical cookies. These cookies provide us with general  information on what visitors do on our website and/or IKEA app. We use them for internal analysis in order to evaluate how our it is used, what its load is, how the specific pages of the website and/or IKEA app and its content are used. 

Marketing cookies. These cookies collect information about your browsing of the website and/or IKEA app, and allow us recording your visit and your individual preferences. This way, we can show you attention, provide you with more useful information that you need, customize the site and/or IKEA app to your individual needs and thus make your visit much more efficient. Also, advertising and targeted marketing cookies help us to show customized advertising. Marketing cookies are also used to see certain advertisements a certain number of times only and to measure the effectiveness of advertisements.

Information about specific cookies, their functions and the time of storing your personal data is available in the Cookiebot tool installed on the website, which is used in the cookie info bar. 

Session cookies are temporary and disappear when you end the session (i.e. when you close your browser). The rest of the cookies used are persistent, so they will be stored on your device (PC or phone) for a certain period of time. You can find more information about the expiry of cookies and their division to session and persistent cookies in Cookiebot, which is used in the cookie info bar. 
Your data are transferred to:
-    IT maintenance service providers;
-    Providers of tools used on the website, e.g. Google LLC, that provide data analytics services (in cases where they receive personal data). Some of the data collected using cookies are transferred to the United States (e.g. through Google Analytics). These entities to whom your personal data are transferred, if any, ensure an adequate level of data protection and data are transferred based on standard contractual clauses.

When you first visit our site, you see a cookie information bar generated by Cookiebot asking you to indicate whether or not you accept cookies. You are given the choice of which specific categories of cookies you accept or reject. When you use a browser to access the content we provide, you can configure your browser to accept all cookies, to reject all cookies, or to notify you when a cookie is downloaded. Each browser is different, so if you don't know how to change your cookie preferences, check out its Help menu. Your device’s operating system may have additional cookie controls. If you do not want cookies to collect information, use a simple procedure in most browsers that allows you to opt out of cookies. To learn more about managing cookies, visit aboutcookies.org or allaboutcookies.org. Deleting cookies that already exist on your device or setting your browser to prevent cookies from being saved to your device may require you to manually change certain options each time you visit our website and/or IKEA app, and some services and features may not work altogether.
Our website may contain links to the websites of other persons, companies or organizations. Please note that we are not responsible for the content of such websites or the privacy practices used by them. Therefore, if having clicked on a link you are redirected to other websites, you should specifically read their privacy policy.

1.6 Statistical analysis

Categories of personal data	Legal basis for the processing
Age Country Gender  The fact of having children under 12 years old  City  Language  Purchase history (including purchases with the IKEA Family e-card)  List of products  List of favourite items  Wish list Data of returns	Our legitimate interest, which means collection of statistical data and preparation of reports required for the purposes specified below.

We also process personal data by automated means for statistical purposes. For instance, we analyse what products you add to the list of your favourite items, since such details help us have a generalized overview of the IKEA customer and determine market strategies and, once we know the needs of the IKEA customers –improve the IKEA products and services. Actions of statistical analysis have no legal or any similar significant effect.

2.    How do we collect information about you?
We obtain information about you when you provide personal data to us by registering for the IKEA Family membership, create or use your IKEA account, use the e-shop services, contact us, use the IKEA Application, the IKEA Family e-card or other services, subscribe for our offers, etc.
When you pay in the e-shop, we receive your payment details from the bank.
We may also receive your data from the user of the e-shop where he/she orders products and/or services in the e-shop for you or in your name, sends a list of products in the shopping cart or a notice of the products that are back in stock by email with your consent.

3.    How long do we keep your personal data?
a)    IKEA Family data will be stored until you terminate your IKEA Family membership or otherwise request us to delete your data, or 61 month from your last action.
b)    IKEA account data will be stored 61 month from the last login or till the date when you decide to delete the account.
c)    Details of emails (e.g., when you create an IKEA account on the website and receive confirmation email, request to remind the forgotten password, send a list of products in the shopping cart to your email, or receive a notice of the abandoned cart) shall be stored for the following period:

• content of the email – for 72 hours,
• subject line, sender, recipient – for 15 days

d)    In case you request to send a notice of the products that are back in stock, your personal data shall be stored: 

• not longer than 3 months, if the products are not back in stock during the afore-mentioned period and no notice was sent,
• if the notice was sent, see the point c).

e)    The details of short messages (e.g., when you create your IKEA account and receive a conformation code) shall be stored for 72 hours. 
f)    The personal data contained in the purchase-sale contract and payment documents (VAT invoice, etc.) shall be stored for 7 years. 
g)    Data for the purposes of statistical analysis will be stored for the same period as the IKEA account, IKEA Family and/or IKEA Application data.
h)    Personal data for direct marketing will be stored as long as you want to receive it from us. If you withdraw the consent, your personal data will be stored for 2 years from the withdrawal date.  
i)    Information related with the IKEA Application and your device as well as information about your use of the IKEA Application will be stored for as long as you use the Application.

4.    To whom personal data are disclosed?
We disclose your personal data to:
a) Companies we work with
The personal data shall be disclosed to companies that provide services to us, i.e., our data processors:
1) IT maintenance companies, IT support companies, companies that provide IT systems and/or solutions. These companies process personal data within the European Union/European Economic Area and USA. Data to USA shall be transmitted based on signed EU Standard Contractual Clauses.
2)  the company that manages our email marketing subscriber list and helps us to send emails to our subscribers established within Lithuania. It is a third-party provider that may collect and process your data using industry standard technologies to help us monitor and improve our newsletter. MailerLite’s privacy policy is available at https://www.mailerlite.com/privacy-policy. The company shall also involve sub-processors that provide data centre services and processes personal data within the European Union/European Economic Area. For other sub-processors that provide data centre, verification, customer support, communication services, data are transferred to the USA. Data to the afore-mentioned sub-processors in USA shall be transmitted on the basis of EU Standard Contractual Clauses;
3) the companies that provide email sending services and are established in the UK and USA. Data shall be transmitted on the basis of EU Standard Contractual Clauses;
4) the company that provides SMS centre services and processes personal data within Lithuania;
5) to UAB „Felit“ (IKEA Lithuania) which provides support, administration services and process personal data within Lithuania;
6) to SIA Paul Mason Properties (IKEA Latvia) which provides support, administration services, also benefits for IKEA FAMILY members in IKEA Latvia store and process personal data within Latvia;
7) companies that provide analytic services. These companies process personal data within the European Union/European Economic Area and USA. Data to USA shall be transmitted on the basis of signed EU Standard Contractual Clauses.
These companies are required to adequately safeguard your personal data, to not use them for any unauthorised purposes and to ensure that their suppliers do the same. More information on personal data protection safeguards in transmission of your data outside the European Union/European Economic Area is available at separate request submitted to us.
b) Other
In case of dispute or insurance case, we transfer your personal data to legal advisers and/or insurance. Furthermore, when you shop at the e-shop and order delivery to the home address, we shall transmit the personal data necessary for delivery to the companies that deliver the online orders. When you settle accounts in the e-shop, we shall transfer your order-related personal data to the payment service provider and the technical service provider of the payment portal chosen by it.
c) State and local government institutions, other persons performing functions assigned to them by law
We transfer your personal data to state and local government institutions and other persons performing functions assigned to them by law upon their request or in order to meet our legitimate interest in establishing, claiming and defending legal claims.

5.    Protection of personal data
We take the following precautions in relation to the personal data you provide us:
a)    Security
We use a variety of technical and organisational security measures to protect your personal data from all kinds of threats: destruction, loss, alteration, unauthorized disclosure or access. Your personal data are stored safely and are only accessible to a limited number of persons.

6.    Your rights 
a)    The right to access. You have the right to obtain our confirmation as to whether or not we process your personal data and, where we do, access to the personal data. That’s why we inform you in advance about our processing activities via this Privacy policy. If you have any questions or would you like to learn more about what information we process, you are always welcome to contact us and we will provide you with further information.
b)    The right to rectification. You have the right to request us to correct any inaccurate personal data. You can also correct your personal data in the IKEA account.
c)    The right to erase. In some circumstances, you have the right to the erasure of your personal data, if you believe there’s no longer any need for us to keep it. If you have previously given your permission, you can just decide to withdraw it. This does not apply if processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
d)    The right to receive yourself or transfer your personal data to another company in certain circumstances (known as the right to data portability). This applies when data processing is based on you consent or on a contract and where processing is carried out by automated means.
e)    The right to restrict. In some circumstances, you have the right to restrict the processing of your personal data. This means we will continue to store your information, but we’ll temporarily stop any other processing. Why would you want to do this? For example, if you’ve asked us to fix incorrect information. In this situation, you may want us to stop processing until the information is correct.
f)    The right to object. You have the right to object to our processing. This applies when data processing is based on legitimate interests pursued by us or by a third party. You can do this when you believe that your personal interest outweighs ours. 
g)    The right to object. You have the right to object to our processing of your personal data for direct marketing purposes, including profiling.
h)    The right to withdraw your consent to the processing at any time.

To carry out the afore-mentioned rights, please provide written request to us or to Data protection officer (contact details are provided below).

You also have the right to make a complaint to the Estonian data protection  inspectorate (https://www.aki.ee), 39 Tatari St., 10134 Tallinn, phone: +372 627 4135, email: info@aki.ee, if you believe that the processing of your personal data does not comply with applicable legislation.

7.    Changes to our privacy policy
We keep our Privacy policy under regular review. This Privacy policy was updated August 24th, 2022.

8.    Contact information
If you have any questions or requests about the processing of your personal data, or if you would like to give us feedback, please contact:
Ltd. Runikon Retail, registration number 14611049, legal address:  Kangrumetsa tee 1, Kurna, 75307 Harju maakond, Republic of Estonia, phone number: +372 330 4000, email address: info@IKEA.ee.

Data protection officer 
You can also contact our Data protection officer by email dpo@IKEA.ee or by sending a letter to us at the afore-mentioned address and addressing it to the Data protection officer.