1. What information do we collect?

Personal data you provide to us

We may collect personal data that you provide directly to us, including your name, email address, phone number, postal or billing address, the contents of your enquiry, subscription preferences, order or transaction information, recipient details for gifts or certificates, and any other information that you choose to provide.

If you apply for a role with us, whether directly or through a recruitment platform, we may also collect information such as your CV or resume, cover letter, employment history, education, qualifications, portfolio materials, interview notes, references and other information relevant to your application.

We do not ask you to provide special category or other sensitive personal data through our public website unless this is necessary and lawful. If you nevertheless provide such information to us, for example in an enquiry or job application, we may process it where permitted by applicable law.

Personal data we collect automatically

When you visit or use our website, we may automatically collect certain technical and usage data, including your IP address, browser type and version, device type, operating system, language and regional settings, referring source, pages viewed, actions taken on the website, date and time of access, and approximate location derived from your IP address where applicable.

Personal data we receive from other sources

Where relevant, we may also receive personal data from other sources, such as payment or checkout providers, fulfilment or delivery partners, recruitment platforms, publicly available professional profiles, referees, affiliated Oyster Heaven entities, analytics or website service providers, and other third parties where lawful.

2. How do we process your information?

We process personal data only where we have a lawful basis to do so. Depending on how you interact with us, we may use your personal data to:

• Respond to your enquiries, requests and messages;

• Communicate with you about our services, projects, campaigns, events or activities;

• Process and administer purchases, contributions, donations, adoptions, certificates and related support requests;

• Send newsletters and other communications where you have requested them or where we

  are otherwise permitted to do so;

• Administer and improve our recruitment and hiring processes;

• Operate, maintain, secure and improve our website, systems and services;

• Monitor usage, prevent fraud, misuse or unauthorised access, and protect our legal rights

• and business interests;

• Comply with legal, regulatory, tax, accounting and reporting obligations; and

  establish, exercise or defend legal claims.

We will not use personal data for a new purpose that is incompatible with the purpose for which it was originally collected unless we are permitted or required to do so by law. 

3. What legal bases do we rely on to process your personal information?

If you are located in the EEA or the UK, or where equivalent concepts apply under other laws, we may rely on one or more of the following legal bases:

• Consent. We rely on consent where required, for example for marketing communications

  or non-essential cookies and similar technologies. You can withdraw consent at any time,

  although this will not affect the lawfulness of processing before withdrawal.

• Performance of a contract or steps at your request before entering into a contract. We

  may process personal data where this is necessary to manage an order, purchase,

  contribution, adoption, application or other arrangement with you.

• Legitimate interests. We may process personal data where this is necessary for our legitimate interests, such as operating and improving our organisation, website and

  services, responding to communications, managing recruitment, protecting our systems

  and records, and preventing fraud, provided those interests are not overridden by your

  rights and freedoms.

• Legal obligation. We may process personal data where this is necessary to comply with

  applicable laws, regulations, tax obligations, accounting requirements or lawful requests

  from authorities.

• Legal claims. We may process personal data where this is necessary to establish, exercise

  or defend legal claims.

4. When and with whom do we share your personal information?

We do not disclose personal data except where this is necessary for the purposes set out in this Privacy Policy, where another lawful basis applies, or where we are required or permitted to do so by law.

We may share personal data with the following categories of recipients:

• Affiliated Oyster Heaven entities, where relevant to the relationship or service provided;

  website hosting, IT, cloud, maintenance, development, communications and security

  providers;

• Payment, checkout, banking, fulfilment, delivery and customer support providers;

• Newsletter, CRM, analytics and similar service providers;

• Recruitment platforms, recruiters, interviewers and reference-checking providers;

• Professional advisers such as lawyers, accountants, auditors and consultants;

• Courts, regulators, law enforcement, tax authorities and other public authorities; and

• A buyer, investor, successor or transaction counterparty in connection with a merger, investment, financing, restructuring or sale of assets.

Where a third party processes personal data on our behalf, we require that party to do so only on appropriate instructions and subject to suitable confidentiality and security obligations.

5. Do we transfer personal information internationally?

Because Oyster Heaven operates internationally and uses service providers in different countries, personal data may be transferred to or accessed from countries other than the country in which you are located, including countries outside the European Economic Area or the United Kingdom.

Where we transfer personal data internationally, we will use an appropriate lawful transfer mechanism where required, such as an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another recognised safeguard.

6. How long do we keep your information?

We keep personal data for no longer than is necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

We determine retention periods by taking into account the nature of the data, the purpose for which it was collected, the nature and duration of our relationship with you, any applicable limitation periods, legal, tax, accounting or reporting obligations, and whether retention is reasonably necessary to establish, exercise or defend legal claims.

When personal data is no longer required, we will delete it, anonymise it, or securely restrict it, unless we are required or permitted by law to retain it for longer.

7. How do we keep your information safe?

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, misuse or access.

However, no method of transmission over the internet or electronic storage is completely secure. For that reason, we cannot guarantee absolute security.

8. Do we collect information from minors?

Our website and services are not directed to children. We do not knowingly collect personal data from children without an appropriate lawful basis, including consent where required.

If you believe that a child has provided personal data to us inappropriately, please contact us and we will take appropriate steps. 

9. What are your privacy rights?

Depending on your location and the law that applies to the relevant processing, you may have rights in relation to your personal data. These may include rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or to opt out of certain types of processing.

You may also have the right not to be discriminated against for exercising applicable privacy rights. We may need to verify your identity before responding to a request.

The additional sections below describe specific rights and information for individuals in the EEA and UK, Canada, California and Virginia.

10. Controls for cookies and similar technologies

Our website may use cookies and similar technologies for essential website functionality and, where applicable and lawful, for analytics, preferences, security and other operational purposes.

Where the law requires consent for non-essential cookies or similar technologies, we will request that consent through an appropriate mechanism before placing them on your device.

You can also manage cookies through your browser settings. Some browsers provide do-not-track or similar privacy settings. At present there is no universally accepted standard for do-not-track signals. However, where we are legally required to recognise browser-based opt-out preference signals, we will do so.

11. Additional information for individuals in the EEA and UK

If you are located in the EEA or the UK, you may have the right to request access to the personal data we hold about you, to request rectification or erasure, to request restriction of processing, to object to processing based on legitimate interests, to withdraw consent where processing is based on consent, and, where applicable, to request data portability.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

If you believe that we have processed your personal data unlawfully, you may lodge a complaint with the supervisory authority in the country where you live, work or where the alleged infringement took place. If you are in the UK, you may complain to the Information Commissioner’s Office.

12. Additional information for individuals in Canada

If Canadian privacy law applies to our processing of your personal information, we will obtain meaningful consent for the collection, use and disclosure of personal information except where another lawful basis is permitted by law.

Depending on the circumstances and applicable law, you may have the right to request access to the personal information we hold about you, request correction of inaccurate information, and withdraw consent, subject to legal or contractual restrictions and reasonable notice where applicable.

If you have a concern about how we handle your personal information, you may contact us first and you may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator, as applicable.

13. Additional information for California residents

If the California Consumer Privacy Act, as amended, applies to our processing of your personal information, California residents may have the following rights, subject to applicable exceptions and verification requirements: the right to know what categories of personal information we collect, use, disclose and retain; the right to access specific pieces of personal information; the right to request correction of inaccurate personal information; the right to request deletion of personal information; the right to obtain a portable copy of certain personal information; the right to opt out of the sale or sharing of personal information; the right to limit certain uses and disclosures of sensitive personal information; and the right not to receive discriminatory treatment for exercising applicable rights.

Where required by California law, we will provide an appropriate Notice at Collection and a method for submitting requests and, if applicable, a method for exercising opt-out rights, including recognition of valid opt-out preference signals where legally required.

You may exercise applicable California rights by contacting us using the details below. You may also use an authorised agent where California law permits this, although we may require proof of that authority and may need to verify your identity directly with you.

14. Additional information for Virginia residents

If the Virginia Consumer Data Protection Act applies to our processing of your personal data, Virginia residents may have the right, subject to applicable exceptions and authentication requirements, to confirm whether we are processing their personal data and access that data, correct inaccuracies, delete personal data, obtain a copy of personal data previously provided to us in a portable and, to the extent technically feasible, readily usable format, and opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Where the Virginia law applies, we will provide one or more secure and reliable methods for submitting rights requests, as required by law. We will respond within the period required by law, which is generally 45 days, subject to any lawful extension.

If we decline to act on your request, you may have the right to appeal our decision. If your appeal is denied, you may contact the Office of the Virginia Attorney General.

15. Do we make updates to this notice?

Yes. We may update this Privacy Policy from time to time to reflect changes in law, regulation, guidance, our services, or our data processing practices.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy. Where appropriate, we may also take additional steps to notify you.

16. How can you contact us about this notice?

If you have questions, comments or requests about this Privacy Policy or about how we handle personal data, please contact us at:

Oyster Heaven Group B.V.

Aert van Nesstraat 45

3012 CA Rotterdam

The Netherlands

E-mail: info@oysterheaven.com 

If another Oyster Heaven entity is the relevant controller for a particular relationship or service, we may direct your request to that entity or provide you with additional contact details.