PERSONAL DATA Protection Policy

This policy (the “Policy”) describes how ORYSTA SAS (“we”) processes your personal data when you interact with ORYSTA – as defined in paragraph 1 below – our advisors, or when you visit or use our website myorysta.com (the “Website”). It also informs you of your rights regarding the protection of your personal data.

1. Who is responsible for processing your personal data?

ORYSTA SAS, whose registered office is located in Portugal, Setubal, is registered at Portuguese Commercial Chamber (hereinafter “ORYSTA”, “we” or “our”), is the data controller responsible for the processing of your personal data.

2. What personal data do we collect and where does it come from?

We primarily process personal data collected directly from you, such as:

(i) Identifying information (including title, first name, last name, postal address, telephone number, email address, date of birth, marriage, engagement) when you create and manage your account, or when you subscribe to our newsletter or enter our contests;

(ii) Order-related data (including quote number, invoice number, transaction number, purchase details, product returns), event type, engraving information, delivery address, billing address, and payment data (credit card number, expiry date, and security code), when you make purchases in-store and/or on our Website;

(iii) Data contained in any identity document that may be requested from you when required by law or to secure the processing of data by verifying your identity, for example for the following purposes: to exercise your right to VAT exemption, to exercise your rights regarding your personal data (only in case of reasonable doubt about your identity), to conduct a gold buy-back, or to perform an ear piercing on a minor;

(iv) Measurement-related data (such as ring size);

(v) Metadata or technical data (connection time, date and time of access, IP address, logs, etc.) resulting in particular from the use of cookies and your browsing on our Website;

(vi) Conversation data or feedback resulting from the sale of our products or the use of our services, including our real-time online chat service (the “Chat”) when communicating with our advisors.

3. With whom do we share your personal data?

We share your personal data with:

• ORYSTA employees, the employees of the companies listed above, and the employees of our ORYSTA-branded stores who need access to the data as part of their duties and for the performance of their missions (for example, our sales advisors);

• Our service providers (such as transport/delivery services, data hosting, maintenance, payment services, after-sales workshops, etc.) who process your personal data on our behalf and in accordance with our instructions, acting as data processors;

• Public authorities, when we are required to do so under the law or by a decision of a competent authority;

• Our external advisors (lawyers, auditors, etc.), when necessary for the legitimate interests pursued by ORYSTA or to comply with our legal obligations.

In any case, regardless of the processing carried out and the purpose pursued, ORYSTA does not sell the personal data of its customers or prospects, nor any files or databases containing such data.

Where is your data stored?

Your data is generally hosted and processed within the European Economic Area (EEA). Since some of our service providers are located outside the European Economic Area (EEA), your personal data may be transferred outside the EEA to countries considered as not offering a level of protection equivalent to that available within the EEA.
Such transfers are governed by appropriate transfer mechanisms and by all additional measures (including security measures) necessary to ensure an adequate level of protection.

You may obtain a copy of the transfer mechanisms implemented (excluding any confidential provisions, where applicable) by using the contact details.

4. How long do we retain your personal data?

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected and as described in paragraph 3 above.

5. What are your rights?

You have the following rights regarding your personal data:

Access.
You may ask us to confirm whether we process your personal data and, if so, request information about the characteristics of such processing, access your data, and obtain a copy.

Rectification.
You may ask us to rectify or complete your personal data if it is inaccurate or incomplete.

Erasure.
You may ask us to delete your personal data in the following cases: when it is no longer necessary for the purposes for which it was collected; when you have withdrawn your consent; following the exercise of your right to object; when your personal data has been unlawfully processed; or to comply with a legal obligation.
In some cases, we may refuse your request to delete your personal data, in particular if its processing is necessary to comply with a legal obligation or for the establishment, exercise, or defence of legal claims. You will be informed accordingly.

Restriction.
You may ask us to restrict the processing of your personal data (meaning we retain it but do not use it) in the following situations: its accuracy is contested; its processing is unlawful but you do not want it to be deleted; the data is no longer needed by the data controller but is still required by you for the establishment, exercise, or defence of legal claims; or you have objected to the processing and the data controller is assessing whether there are compelling legitimate grounds to override your objection. You will be informed of the outcome.

Portability.
You may ask us to provide you with a copy of your personal data in a structured, commonly used, and machine-readable format, or you may request that it be transferred directly to another data controller. This right may only be exercised when the processing is based on your consent or on the performance of a contract concluded with you, and when the processing is carried out using automated means.

Withdrawal of consent.
You may withdraw your consent at any time for any processing of your personal data that is based on your consent, without affecting the lawfulness of processing carried out prior to the withdrawal.

Digital legacy.
You have the right to define instructions (general or specific) regarding the retention, deletion, or communication of your personal data after your death.

Objection to the processing of personal data based on legitimate interest.
You may object to any processing of your personal data that is based on our legitimate interest (see paragraph 3 above).

If you receive our marketing communications by email or SMS, you may unsubscribe by clicking the dedicated link at the bottom of each message (usually found in the legal notice section). If you do not wish to receive marketing calls, you may register on a telephone marketing opt-out list.

7. Updates to the Personal Data Protection Policy

We reserve the right to amend this Policy, for example to take into account changes in applicable laws and/or regulations, technological developments, or business best practices relevant to our activities. We will inform you directly of any change only if it constitutes a substantial modification that may affect your orders and/or your ongoing contracts with ORYSTA. We encourage you to review our Policy regularly on our Website.

Last updated: 18/11/2024