Welcome to Vestico’s privacy policy.
Vestico Ltd. (collectively referred to as “we”, “us” or “our”) is committed to protecting and respecting your privacy. This policy will inform you as to how we look after your personal data when you visit our website, use our services or applications (apps). This policy also tells you about your privacy rights and how the law protects you.
So, if you’re looking for more information on how we keep your information safe and how we collect, store, use and share your personal data, this is the right place for you!
This privacy policy is provided in a layered format so you can click through to the specific areas set out below.
This privacy policy aims to give you information on how Vestico Ltd. collects and processes your personal data through your use of our website and applications or when you interact with us by any other means, including (without limitation) any data you may provide through the website when you book a demo or make an online enquiry.
It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.
The Service is not directed to children under the age of 13
This website is not intended for children and we do not knowingly attempt to solicit or receive data relating to children. Users declare themselves to be adult according to their applicable legislation. Children may use Vestico Ltd.’s services only with the consent of their parent or legal guardian. Under no circumstances persons under the age of 13 may use Vestico Ltd.’s services.
Vestico Ltd. is the “data controller” for the purposes of data protection legislation. We are responsible for your personal information and, by law, we are required to provide you with information about us, how and why we use your data and the rights you have over it.
This privacy notice does not apply to personal data we process on behalf of third parties i.e. where we are acting as a data processor or service provider.
We are not required by law to appoint a data protection officer (DPO), so any questions about this policy or our privacy practices, including any requests to exercise “your legal rights”, shall be addressed to our data privacy manager using the details set out in paragraph 10 below.
We may review this privacy policy from time to time when necessary to reflect customer feedback and changes in our products and services. We will notify you of any changes by uploading the new version of it on our website and applications and the “Last updated” date at the top of this policy will also be adjusted accordingly.
You are advised to review this privacy policy periodically for any changes. Changes to this policy are effective when they are posted on our website and applications.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you depending on the type of purchase made from our retail partners (fashion item vs. beauty item), which we have grouped together as follows:
We also collect, use and share Aggregated Data such as statistical or demographic data for industry and market analysis and for our marketing and advertising strategy. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate Usage Data to calculate the percentage of users accessing a specific feature on our application, or disclose Aggregated Data to external third-parties, such as sponsors, advertisers, social media network or other third-parties in connection with marketing and product information. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information concerning your health, or genetic and biometric data). Nor do we collect any information about criminal convictions and offences. If we wish to obtain this type of information about you, we will request your consent prior to any collection/ processing.
Unless specified otherwise, all personal data requested by Vestico Ltd. is mandatory and failure to provide such data may make it impossible for Vestico Ltd. to provide its services. In cases where Vestico Ltd. specifically states that some personal data is not mandatory, you are free not to communicate the data without consequences to the availability or the functioning of the service.
If you are uncertain about which personal data is mandatory, please get in touch with us.
We use different methods to collect data from and about you including through:
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
We have set out below, in a table format, a description of the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
|---|---|---|
| To provide you with our products and services (including the application) | (a) Identity (b) Contact (c) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us) |
| To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey |
(a) Identity (b) Contact (c) Profile (d) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services) |
| To enable you to partake in a prize draw, competition or complete a survey | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business) |
| To perform and maintain various activities supporting the offering and provision of our products and services, (including back office functions, business development activities, technical functionality and security, troubleshooting, data analysis, strategic decision making, oversight mechanisms, etc) | (a) Identity (b) Contact (c) Technical |
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services and for network security) (b) Necessary to comply with a legal obligation |
| To use data analytics to improve our website and application, products and services, marketing, customer relationships and experiences | (a) Technical (b) Usage |
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website/ application updated and relevant, to develop our business and to inform our marketing strategy) |
| To make suggestions and recommendations goods or services that may be of interest to you about to you | (a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications |
Necessary for our legitimate interests (to develop our products and services and grow our business) |
| To protect our and third parties’ interests, rights and assets, including initiation or exercise or defense of legal claims | (a) Identity (b) Contact (c) Usage (d) |
Profile Necessary for out legitimate interests |
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
We may send you marketing communications from time to time about our new products and offers, provided that we obtain your consent to do so. If you no longer wish to receive marketing messages from us, you have the right to opt-out at any time by following the instructions in the “Opting-out” section below.
If you have already purchased goods or services from us, we may send you electronic marketing communications about products we feel may interest you (based on your previous experience with us) if you have not opted out from that marketing messages.
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
You can ask us or third parties to stop sending you marketing messages at any time [by logging into the application and checking or unchecking relevant boxes to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product or service experience or other transactions you have had with Vestico Ltd.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the website or application may become inaccessible or not function properly. For more information about the cookies we use, please see our cookie policy here.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We may share your personal data with third-parties for the purposes set out in the table ‘Purposes for which we will use your personal data’ above in the following circumstances:
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may share personal data with third-party service providers outside the UK (or if you are providing data in a jurisdiction other than UK, to a country not of your own) for purposes described in this privacy policy.
We will only send personal data collected within the UK to foreign countries in circumstances such as:
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. Therefore:
We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please see below to find out more about these rights:
If you wish to exercise any of the rights set out above, please contact us on the contact details set out below.
If you are a Californian or Brazilian resident using our services, please refer to the “Additional Information for Californian Residents” or “Additional Information for Brazilian Residents” at the bottom of this policy for further information about your rights as data subject.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you have any questions about this privacy policy or Vestico Ltd’s privacy practices, please contact our data privacy manager in the following ways:
Full name of legal entity: Vestico Ltd.
Email address: dpo@vestico.co
Postal address: Venture X White City, One Ariel Way, London W12 7SL, United Kingdom
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the business running Vestico Ltd. and, if the case may be, its parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as “we”, “us”, “our”).
The provisions contained in this section apply to all users who are consumers residing in the state of California, United States of America, according to “The California Consumer Privacy Act of 2018” (Users are referred to below, simply as “you”, “your”, “yours”), and, for such consumers, these provisions supersede any other possibly divergent or conflicting provisions contained in the privacy policy.
This part of the document uses the term “personal information“ as it is defined in The California Consumer Privacy Act (CCPA).
In this section we summarize the categories of personal information that we’ve collected, disclosed or sold and the purposes thereof. You can read about these activities in detail in the section titled “The data we collect about you” within this document.
We have collected the following categories of personal information about you: identifiers, california Consumer Records Statute information, biometric information and internet information.
We will not collect additional categories of personal information without notifying you.
We collect the above mentioned categories of personal information, either directly or indirectly, from you when you use vestico Ltd.
For example, you directly provide your personal information when you submit requests via any forms on Vestico Ltd. You also provide personal information indirectly when you navigate Vestico Ltd, as personal information about you is automatically observed and collected. Finally, we may collect your personal information from third parties that work with us in connection with the service or with the functioning of Vestico Ltd. and features thereof.
We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.
We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so, in order to provide you with our service.
To find out more about the purposes of processing, please refer to the relevant section of this document.
For our purposes, the word “sale” means any “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic means, a consumer’s personal information by the business to another business or a third party, for monetary or other valuable consideration”.
This means that, for example, a sale can happen whenever an application runs ads, or makes statistical analyses on the traffic or views, or simply because it uses tools such as social network plugins and the like.
You have the right to opt out of the sale of your personal information. This means that whenever you request us to stop selling your data, we will abide by your request.
Such requests can be made freely, at any time, without submitting any verifiable request, simply by following the instructions below.
If you’d like to know more, or exercise your right to opt out in regard to all the sales carried out by Vestico Ltd, both online and offline, you can contact us for further information using the contact details provided in this document.
We may use your personal information to allow the operational functioning of Vestico Ltd. and features thereof (“business purposes”). In such cases, your personal information will be processed in a fashion necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.
We may also use your personal information for other reasons such as for commercial purposes (as indicated within the section “Purposes for which we will use your personal data” within this document), as well as for complying with the law and defending our rights before the competent authorities where our rights and interests are threatened or we suffer an actual damage.
We will not use your personal information for different, unrelated, or incompatible purposes without notifying you.
The right to know and to portability
You have the right to request that we disclose to you:
The disclosure described above will be limited to the personal information collected or used over the past 12 months.
If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance – provided that this is technically feasible.
You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on Vestico Ltd, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights etc.).
If no legal exception applies, as a result of exercising your right, we will delete your personal information and direct any of our service providers to do so.
How to exercise your rights
To exercise the rights described above, you need to submit your verifiable request to us by contacting us via the details provided in this document.
For us to respond to your request, it’s necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:
We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession actually relates to you.
If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf.
If you are an adult, you can make a verifiable request on behalf of a minor under your parental authority.
You can submit a maximum number of 2 requests over a period of 12 months.
We will confirm receipt of your verifiable request within 10 days and provide information about how we will process your request.
We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.
Our disclosure(s) will cover the preceding 12 month period.
Should we deny your request, we will explain you the reasons behind our denial.
We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.
This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the entity running Vestico Ltd. and, if the case may be, its parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as “we”, “us”, “our”).
The provisions contained in this section apply to all Users who reside in Brazil, according to the “Lei Geral de Proteção de Dados” (Users are referred to below, simply as “you”, “your”, “yours”). For such Users, these provisions supersede any other possibly divergent or conflicting provisions contained in the privacy policy. This part of the document uses the term “personal information“ as it is defined in the Lei Geral de Proteção de Dados (LGPD).
We can process your personal information solely if we have a legal basis for such processing. Legal bases are as follows:
To find out more about the legal bases, you can contact us at any time using the contact details provided in this document.
To find out what categories of your personal information are processed, you can read the section titled “The data we collect about you” within this document.
To find out why we process your personal information, you can read the section titled “The purposes of which we will process your personal data” within this document.
Your Brazilian privacy rights
You have the right to:
You will never be discriminated against, or otherwise suffer any sort of detriment, if you exercise your rights.
How to file your request
You can file your express request to exercise your rights free from any charge, at any time, by using the contact details provided in this document, or via your legal representative.
How and when we will respond to your request
We will strive to promptly respond to your requests. In any case, should it be impossible for us to do so, we’ll make sure to communicate to you the factual or legal reasons that prevent us from immediately, or otherwise ever, complying with your requests. In cases where we are not processing your personal information, we will indicate to you the physical or legal person to whom you should address your requests, if we are in the position to do so.
In the event that you file an access or personal information processing confirmation request, please make sure that you specify whether you’d like your personal information to be delivered in electronic or printed form. You will also need to let us know whether you want us to answer your request immediately, in which case we will answer in a simplified fashion, or if you need a complete disclosure instead. In the latter case, we’ll respond within 15 days from the time of your request, providing you with all the information on the origin of your personal information, confirmation on whether or not records exist, any criteria used for the processing and the purposes of the processing, while safeguarding our commercial and industrial secrets.
In the event that you file a rectification, deletion, anonymization or personal information blocking request, we will make sure to immediately communicate your request to other parties with whom we have shared your personal information in order to enable such third parties to also comply with your request – except in cases where such communication is proven impossible or involves disproportionate effort on our side.
Transfer of personal information outside of Brazil permitted by the law
We are allowed to transfer your personal information outside of the Brazilian territory in the following cases:
Transfer of personal information outside of Brazil based on your consent
We can transfer your personal information outside of the Brazilian territory if you consent to such transfer. When we ask for your consent, we’ll make sure to provide all the information that you need to make an educated decision and to understand the implications and consequences of providing or denying your consent. Such information will be given in clear and plain language and in such a way that you’ll be able to clearly distinguish these requests from other consent requests that we may possibly ask.
You may withdraw your consent at any time.
Transfer of personal information outside of Brazil based on contracts and other legal means
We can transfer your personal information outside of the Brazilian territory provided that we are able to ensure that any further processing of your personal information will be in compliance with the principles and the rules established by the LGPD, and your rights are safeguarded.
To do so, we may use one of the following legal means:
Transfer of personal information outside of Brazil to countries that guarantee the same protection standards as LGPD
We can transfer your personal information outside of the Brazilian territory, if the destination country, or the international organization which receives the personal information, provides an adequate level of protection of the personal information according to the ANPD.
The ANPD authorizes such transfers whenever it considers that country to possess and provide personal information protection standards comparable to those set forth by the LGPD, having taken into account the following: