0

  2. PRIVACY POLICY

PRIVACY POLICY

Data controller

The controller responsible for personal data collected through https://www.omnicareexpress.co.uk/shop4/ is:

OMNICARE EXPRESS SARL
9 Flugfeld
9676 NOERTRANGE
LUXEMBOURG
Telephone: +352 621 270 832
Email: info@omnicareexpress.com

Personal data we process

Depending on how you use the website, OMNICARE EXPRESS SARL may process the following categories of personal data:

  • identification and contact data, such as title, surname, first name, postal address, telephone number and email address;
  • business information where you act on behalf of a company, such as company name, VAT number or similar information you provide;
  • customer account data, such as technical identifiers, language, delivery addresses, preferences and information required to operate the account;
  • order data, such as products ordered, quantities, prices, discounts, billing and delivery addresses, order history and information required to issue invoices;
  • payment-related data, such as payment status and transaction identifiers required to reconcile the order with the payment service provider;
  • communications with OMNICARE EXPRESS SARL, including requests submitted through forms, emails or other contact channels;
  • technical data required for the operation and security of the website, such as IP address, session information and certain technical logs;
  • commercial communication data, such as email address, records of certain campaigns and opt-out or unsubscribe information.

Purposes and legal bases

Personal data is processed only for specified purposes and on an appropriate legal basis. Depending on the processing activity, this may include:

  • creating and managing your customer account, cart, addresses and orders, and providing delivery, payment, after-sales service and communications required to perform the order: performance of a contract or steps taken before entering into a contract;
  • issuing and retaining invoices, accounting documents and information required by applicable law: compliance with legal obligations;
  • responding to enquiries, ensuring website security, preventing abuse and protecting the rights of OMNICARE EXPRESS SARL: legitimate interests, where applicable;
  • sending commercial communications where permitted by law. Where consent is required, such communications are based on your consent. In an existing customer relationship, contact details collected in connection with a sale may, under the conditions provided by applicable law, be used to offer similar products or services, with the right to object at any time.

Commercial communications and right to object

You may object at any time to the use of your personal data for direct marketing.

Each commercial communication sent by OMNICARE EXPRESS SARL should provide an easy way to unsubscribe. If you have a customer account, you can also manage this preference in the “Communications” section of your account.

Opting out of marketing does not prevent transactional messages required to perform an order, such as order confirmations, payment information, shipping information or invoices.

When an objection is recorded, OMNICARE EXPRESS SARL may retain minimal information necessary to respect that objection and prevent accidental re-enrolment in commercial communications.

Account deletion

You may request the closure and deletion of your customer account. When the request is carried out, active account data that is no longer necessary is deleted and the email address is removed from commercial communications.

Deleting an account does not require the deletion of data that must still be retained to comply with a legal obligation, including orders, invoices and accounting information. Such data is then retained only for the relevant legal purposes and is no longer used for direct marketing.

Retention periods

  • Customer account: for as long as the account is in use, then deleted when the account is closed, except for data that must be retained for another lawful purpose.
  • Orders, invoices and accounting records: for the period required by applicable accounting law. In Luxembourg, accounting documents must in principle be retained for 10 years.
  • Enquiries and correspondence: for the time required to process the request and carry out any useful follow-up, followed by archiving or deletion depending on the nature of the communication and applicable obligations.
  • Commercial communications: until you object, unsubscribe or withdraw consent where consent is the legal basis, followed where appropriate by the retention of minimal opt-out information.
  • Technical and security data: for a period proportionate to the security, diagnostic or evidentiary purpose pursued.

Recipients

Personal data is accessible to authorised members of OMNICARE EXPRESS SARL who need it to perform their duties.

Where necessary, data may also be disclosed to service providers involved in operating the website and fulfilling orders, including hosting, payment, email and delivery providers, as well as professional advisers, public authorities or other bodies where disclosure is required by law.

Recipients must process the data only for authorised purposes and with appropriate safeguards. Where a service provider involves a transfer of personal data outside the European Economic Area, the transfer must be protected in accordance with GDPR requirements.

Security

OMNICARE EXPRESS SARL implements appropriate technical and organisational measures designed to protect personal data against loss, unauthorised access, alteration, disclosure or destruction.

Cookies and similar technologies

The website may use cookies or similar technologies. Some cookies are strictly necessary for the website to operate, for example to maintain a session, remember a technical choice or manage a shopping cart. Such essential cookies do not require prior consent where the conditions provided by applicable law are met.

Non-essential cookies or trackers, including those used for non-exempt audience measurement, personalisation, tracking or advertising, must not be stored or accessed before consent is obtained where consent is required. Users must be able to refuse such cookies as easily as they can accept them and to withdraw consent afterwards.

Your rights

Subject to the conditions set out in the GDPR, you may exercise your rights of access, rectification, erasure, restriction of processing, objection and, where the relevant conditions are met, data portability.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact OMNICARE EXPRESS SARL at info@omnicareexpress.com or by post using the contact details above. Reasonable verification of your identity may be requested where necessary to protect your personal data.

Your request will be handled within the time limits laid down by the GDPR, in principle within one month of receipt.

Complaint to the CNPD

If you believe that the processing of your personal data does not comply with applicable data protection law, you have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), the Luxembourg supervisory authority.

CNPD website: https://cnpd.public.lu/

Updates to this policy

This policy may be updated to reflect legal, regulatory, technical or organisational changes. The version published on https://www.omnicareexpress.co.uk/shop4/ is the version applicable at the time it is consulted.