1. Scope and Applicability
The General Data Protection Regulation (GDPR) is a European Union data protection law that may apply to businesses outside the EU in certain circumstances. Its applicability depends on factors such as the business’s activities, the individuals concerned, and the nature of the personal data processing.
The GDPR may apply when a business processes personal data in connection with an establishment in the EU, offers goods or services to individuals who are in the EU, or monitors their behavior there, as defined by applicable law.
Orelliseel currently states that its shipping coverage is limited to the United States. However, shipping coverage alone does not determine whether the GDPR applies. Where the GDPR applies, we will address the obligations relevant to our processing activities. Other applicable privacy laws may also apply.
2. Data Protection Principles
Where required by the GDPR, personal data must be processed lawfully, fairly, and transparently. It must be collected for specified purposes, limited to what is necessary, kept accurate and only for as long as needed, and protected by appropriate security measures.
Controllers must also be able to demonstrate compliance with applicable data protection requirements.
3. Lawful Bases for Processing
Where the GDPR applies, personal data must be processed under an applicable lawful basis. Depending on the circumstances, these may include:
- Consent: The individual has provided valid consent for a specified purpose.
- Contract: Processing is necessary to perform a contract or take steps requested before entering into one.
- Legal Obligation: Processing is necessary to comply with a legal requirement.
- Vital Interests: Processing is necessary to protect someone’s vital interests.
- Public Interest or Official Authority: Processing is necessary for a qualifying public-interest task or the exercise of official authority.
- Legitimate Interests: Processing is necessary for legitimate interests that are not overridden by the individual’s rights and freedoms, subject to applicable legal restrictions.
The appropriate lawful basis depends on the purpose and circumstances of each processing activity. Consent is not required for every type of processing.
4. Your Data Protection Rights
Where the GDPR applies, you may have the following rights, subject to applicable conditions and exceptions:
- Access: Request access to your personal data and information about how it is processed.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of personal data where the legal requirements are met.
- Restriction: Request restriction of processing in certain circumstances.
- Data Portability: Receive certain personal data in a structured, commonly used, machine-readable format and, where applicable, transmit it to another controller.
- Objection: Object to certain processing based on public interest or legitimate interests.
- Direct Marketing: Object at any time to processing of personal data for direct marketing, including related profiling, as provided by the GDPR.
- Automated Decision-Making: Benefit from applicable safeguards concerning decisions based solely on automated processing that produce legal or similarly significant effects.
- Withdrawal of Consent: Withdraw consent at any time when processing relies on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Complaints: Lodge a complaint with a competent data protection supervisory authority.
These rights are subject to the GDPR’s conditions, limitations, and exceptions and may not apply to every request or processing activity.
5. How to Submit a Privacy Request
If you believe the GDPR applies to your personal data and wish to exercise a right, contact us using the details in the Contact Us section.
Please describe your request and provide only the information reasonably necessary for us to identify the relevant records and, where appropriate, verify your identity. Do not send passwords, full payment card numbers, security codes, or other unnecessary sensitive credentials by ordinary email.
Where applicable, we generally must respond without undue delay and within one month of receiving a request. This period may be extended by up to two additional months when permitted by the GDPR, taking into account the complexity and number of requests. If an extension is necessary, we will provide the required notice within the initial one-month period.
If we cannot fulfill a request, we will provide an explanation where required by law and inform you of applicable complaint or judicial remedies.
6. Consent and Withdrawal
Where consent is the lawful basis for processing, it must meet the GDPR’s requirements, including being freely given, specific, informed, and unambiguous where applicable. Visiting or continuing to browse a website does not, by itself, establish valid consent.
Where processing relies on consent, you may withdraw it at any time, and withdrawal must be as easy as giving consent. Withdrawal affects future processing based on that consent and does not invalidate processing lawfully carried out before withdrawal.
If consent is withdrawn, any continued processing must be supported by another independently applicable lawful basis. A different basis cannot be applied retrospectively to justify processing that was originally based on consent.
7. Data Security and Compliance Obligations
Where the GDPR applies, controllers and processors may be required to implement appropriate technical and organizational security measures, apply data protection by design and by default, and maintain records or other documentation as required by law.
Additional obligations may apply depending on the circumstances, including:
- Conducting a data protection impact assessment when processing is likely to result in a high risk to individuals’ rights and freedoms.
- Notifying the competent supervisory authority of certain personal data breaches, generally within 72 hours of becoming aware of the breach where required and feasible.
- Informing affected individuals of a breach where the GDPR requires it.
- Entering into appropriate agreements with data processors.
- Appointing a Data Protection Officer (DPO) or an EU representative when the relevant legal criteria are met.
Whether these obligations apply depends on our actual activities and legal circumstances. This policy does not, by itself, certify or guarantee compliance with the GDPR.
8. International Data Transfers
Where the GDPR applies, transferring personal data outside the European Economic Area may require an appropriate legal transfer mechanism or safeguard.
Depending on the circumstances, this may include an applicable adequacy decision, approved standard contractual clauses, or another mechanism permitted by the GDPR. The appropriate mechanism depends on the destination, parties, data involved, and circumstances of the transfer.
This policy does not claim that a specific transfer mechanism or certification has been adopted. Any applicable transfer arrangements must be assessed against the actual data flows and legal requirements.
9. Supervisory Authorities
Where the GDPR applies, you may have the right to lodge a complaint with a competent data protection supervisory authority. The appropriate authority may depend on your location, the circumstances of the alleged infringement, and the nature of the processing.
You may also have access to judicial remedies where provided by applicable law.
10. Contact Us
If you have questions about this policy or wish to submit a privacy request, please contact us:
Address: 5223 SE 113th St, Belleview, FL 34420, USA
Phone: +1 (352) 245-8081
Email: support@orelliseel.com
Business Hours: Monday–Friday, 9:00 AM–6:00 PM (Central Time, CT)