1. Identification of Data Controller and Overview of the Policy

Data Controller: SOURCEZ LIMITED, a Cyprus-based limited liability company, registered under the number ΗΕ 450745, with its principal office located at Ezekias Papaioannou, 9, EXECUTIVE HOUSE, Floor 2, Flat/Office 201, 1075, Nicosia, Cyprus, (hereafter referred to as "SOURCEZ" or "us”, “we”, or “our”.).

At SOURCEZ, via our website https://sourcez.co/ (hereafter referred to as "Platform"), we gather and process certain personal data about our users (hereafter referred to as "you" or "User"). Personal data is defined as any information about a natural person that can be identified directly or indirectly, especially by an identifier like a name, ID number, location data, an online identifier, or by unique aspects of their physical, economic, cultural, or social identity (hereafter referred to as "personal data'').

This Privacy Policy (hereafter referred to as "Policy"), in compliance with the General Regulation on Data Protection No. 2016/679 of the European Parliament and of the Council dated April 27, 2016 ("GDPR"), and The Cypriot Law 125 (I) of July 31, 2018, in its latest version, aims to inform you about the kinds of data we collect, how we process them, their retention duration, who has access to your data, and your rights as a data subject.

This Policy supplements the contractual terms governing the Platform, which you agree to by using the Platform (this includes the general terms of use referred to as "Terms").

Policy Updates: We reserve the right to update this Policy at any time. The version available on the Platform is the current one. Should there be a significant modification to the Policy, we will notify you within a reasonable timeframe (via email).

We may request, at any time and through any recordable means, your confirmation that you have read and understood the Policy.

2. Collection of Personal Data on the Platform

We primarily obtain your data directly from you.

On our Platform, we clearly indicate the mandatory data required during collection (for instance, through an asterisk). Without these essential details, some of our services may be unavailable to you.

Below is an extensive list of data we may collect and process, depending on how you use the Platform and the permissions you grant:

Identity and Account Creation Data: Includes your full name, username, email address, phone number, password, date of birth or age confirmation, and gender.

Device, Account, and Usage Information: This covers your IP address, session details, cookies and tracking technologies, consent status including date and time of consent, User profile, language preferences, your device\'s browser, content and URLs accessed, timestamps of your access, device model and manufacturer, and operating system (iOS, Android).

Payment Data: Consists of customs (if applicable) and shipping fees, applicable withholding tax rates based on the buyer\'s location, and payment method details.

Shipping Data: This includes chosen delivery options, addresses of shipping and delivery points, package tracking numbers, delivery confirmations, delivery timestamps, package location, and other necessary details as required by the transportation service provider.

Communication and Dispute Management Data: Encompasses messages to Customer Support (queries, complaints), and User complaints (content, reason, timestamp).

Sensitive Data: We do not collect sensitive personal data as a standard practice. Should any sensitive data be collected or processed, it will only be with your explicit consent and full awareness. We advise sharing only the most necessary information.

3. Personal Data Processing for Pre-Contractual Measures and Compliance with Our General Conditions

We utilise your personal data for the following purposes:

To facilitate the creation of your account on the Platform.
To assist in managing your account effectively.
To engage in contractual agreements with you.
To deliver our services, including direct shipping.
To enable transaction and payment processing on the Platform.
To inform you about any activities related to your account, from its inception to termination.
To update you on any changes to our General Conditions, this Policy, and our services and features.
To keep you informed about the status of your transactions, including purchase status, payment status, shipping label status, and overall shipping progress.
To notify you about any issues that could or are hindering your usage of the Platform.
To send you promotional coupons and extend offers tailored to you.
To respond to your inquiries, requests, or complaints submitted to our Customer Support Team.

4. Data Processing Based on Our Legitimate Interests

This section pertains to data processing activities that are grounded in our legitimate interests. To lawfully execute such processing, three key conditions must be satisfied:

the interest pursued should be legitimate, meaning it must be lawful, clearly defined, real, and current;
the processing should be necessary; and
it should not negatively impact the rights and interests of the data subjects.

To ensure full transparency, we outline below the specific processing activities and their corresponding legitimate interests, while also confirming that these activities do not violate your fundamental rights and freedoms.

We process your personal data for the following purposes based on our legitimate interests:

To present content, products, and information that might interest you (like emails based on the content you interact with), as we strive to optimise User experience and enhance our Platform, services, and features. This includes personalising User experiences and offering special promotions.

To address issues and disputes, send warnings, or temporarily/permanently suspend User accounts. This is because we have a legitimate interest in combating inappropriate behaviour, ensuring adherence to our Terms, preventing fraud and counterfeit activities, maintaining Platform security, resolving User disputes, and safeguarding our rights and interests.

To conduct marketing statistics and analyses with the aim of understanding how you use the Platform and our Services, and to enhance both. This is because we have a legitimate interest in continually improving User experiences, our Platform, Services, and features, and in personalising these for each User.

5. Data Processing Requiring Your Consent

We engage in the following data processing activities, which are contingent on your explicit consent:

Subscribing you to our newsletters. Should you wish to opt-out, you can easily unsubscribe at any time using the provided link in the newsletters or directly from your account.
Tailoring advertisements displayed on third-party sites to ensure they are relevant to your interests. You have the option to opt-out by adjusting your cookie preferences.
Collecting your phone number exclusively for specific purposes, such as enhancing our customer care services.

Your consent is fundamental for these processing activities, and you have full control to withdraw it at any time.

6. Data Processing for Compliance with Legal Obligations

We engage in processing your personal data for the following reasons, in order to fulfil our legal and regulatory responsibilities:

Adhering to legal and regulatory requirements, such as collaborating with judicial authorities, especially during their investigations. This includes retaining certain documents, like invoices, even after your account closure.
Handling your requests related to exercising your rights under the General Data Protection Regulation (GDPR) (for more details, refer to the "Your Rights" section below).

These processing activities are essential for compliance with our legal obligations and are carried out in accordance with applicable laws and regulations.

7. Retention Period of Personal Data

We retain your personal data only for the period necessary to achieve the specific processing purposes for which they were collected. The retention period may vary based on the nature and purpose of the data:

Data used for account creation and management are retained throughout the duration of our commercial relationship and until your account is deleted.
Data for sending newsletters are kept until you withdraw your consent by unsubscribing.
Data related to the fulfilment of specific contracts are retained for the duration of the contract and archived as per legal requirements.
Data necessary for legal, fiscal, and accounting purposes are kept as per the applicable retention laws and regulations.
Data associated with the handling of complaints, disputes, and litigations are retained as necessary to resolve the issue and in accordance with legal limitation periods.
Data may be anonymized for analytical and statistical purposes and retained indefinitely in this form.

In certain instances, we may need to retain some of your data even after account deletion, due to legal obligations, or if there is a legitimate overriding interest (like unresolved claims or disputes, or for the defence and exercise of our rights). In such cases, the necessary data will be retained for the duration of the dispute, within the bounds of applicable legal limitation periods.

This approach ensures data are kept for the period they are required for their collected purpose, unless a longer retention is mandated by law.

8. Disclosure of Your Data to Recipients

In processing your personal data, we may share it with specific personnel within our company ensuring access is limited to those with a legitimate need based on their roles or duties. The categories of internal recipients include:

Our internal departments: Transport and Logistics, Product Control, Customer Support, Legal, and Data Protection Officer.

Furthermore, your data may be shared with external service providers and third parties, as outlined below:

Transportation and logistics service providers;
Customer relations management service providers;
Moderation service providers;
Communication service providers;
IT, technical, and hosting service providers;
External legal advisors;
Advertising platforms and business partners (with your consent);
Banking and payment service providers;
Authorised third parties for legal investigations;
Potential buyers or investors in the event of a restructuring, sale of assets, mergers, acquisitions, divestitures, or other corporate actions;
Public bodies in compliance with legal obligations (both in Cyprus and internationally);

We assure you that your data will not be sold to any third party.

Some of these recipients act as independent data processors and handle the personal data we provide in accordance with our agreements and their own data protection policies. This is particularly relevant for:

Service providers facilitating banking transactions on the Platform (such as JCC, Paypal, among others).

Our Policy ensures that your data is only shared with entities that adhere to appropriate data protection standards and is never sold for commercial purposes.

9. Cookies and Tracking Technologies

We employ technologies like cookies to gather information and remember your online preferences. Cookies are small data files sent from a web server to your browser, enabling the server to recognize your browser on subsequent website visits.

Cookie Consent Management

We respect your privacy choices and provide granular control over cookie usage through our cookie consent banner. When you first visit our Platform, you will be presented with options to accept all cookies, reject non-essential cookies, or customize your preferences by category. Your consent choices are stored securely and can be updated at any time through the Cookie Settings option in our website footer.

Cookie Categories

Our Platform uses different types of cookies, categorized as follows:

1. Essential Cookies (Always Active): These cookies are necessary for website navigation and functionality. They remember your login details, shopping cart contents, and cookie consent preferences. Essential cookies also help us understand User behaviour, assess potential business relations, and guard against fraud. You cannot opt out of essential cookies as they are required for the Platform to function properly.

2. Functional Cookies (Requires Consent): These cookies remember your preferences like country, language, and search filters (e.g. size, colour) to enhance your experience by personalising website interactions. They do not track your browsing activities on other sites.

3. Analytics Cookies (Requires Consent): These cookies anonymously track your usage of our Platform (for instance, we use analytics services for insights on site visits and User behaviour) to enhance navigation and the overall User experience. They do not store identifiable personal information.

4. Marketing Cookies (Requires Consent): Used to tailor advertising to your interests and track campaign effectiveness, these cookies track your browsing habits and demographic information in an aggregated form. They help limit repetitive ad exposure and are typically set by third-party networks, sharing data with advertisers to provide personalised ads on other sites.

Campaign Tracking and Attribution

When you visit our Platform through a marketing campaign (such as from an email, advertisement, or social media post), we may capture campaign parameters (known as UTM parameters) to understand how you discovered us. This information helps us measure campaign effectiveness and improve our marketing efforts.

Campaign tracking only occurs with your consent:

With Marketing Consent: If you accept marketing cookies, we store campaign information for up to 30 days to attribute your activities to the correct marketing source.
Without Marketing Consent: If you haven\'t granted marketing consent, campaign parameters are temporarily stored in a pending state for up to 30 minutes. If you later grant marketing consent during this period, the campaign information is processed. Otherwise, it is automatically deleted.

The following campaign information may be collected: source (utm_source), medium (utm_medium), campaign name (utm_campaign), content variation (utm_content), search terms (utm_term), landing page URL, and referrer URL.

Managing Cookie Preferences

You have full control over your cookie preferences and can withdraw your consent at any time via these methods:

Click the "Cookie Settings" link in our website footer to update your preferences.
Clear cookies through your browser\'s settings to reset all preferences.
To opt-out of Google Analytics cookies on all sites, visit the Google Analytics Opt-out Browser Add-on.
For opting out of third-party behavioural advertising cookies, visit www.youronlinechoices.eu.

When you update your cookie preferences, your choice is immediately applied. Note that withdrawing consent for certain cookie categories may affect Platform functionality and your user experience.

Keep in mind, opting out of marketing cookies does not stop online advertising entirely. It simply means that companies will not tailor ads based on your web preferences and browsing habits. As a result, you might see more generic ads that do not align with your interests.

10. iOS App Tracking Transparency (ATT)

If you use our iOS mobile application, Apple requires us to request your permission before tracking your activity across other companies\' apps and websites. This is governed by Apple\'s App Tracking Transparency (ATT) framework, introduced in iOS 14.

What iOS Tracking Permission Controls

The iOS tracking permission specifically controls:

Tracking your activity across other companies\' apps and websites for advertising purposes
Sharing your device\'s advertising identifier (IDFA) with third parties
Combining your activity in our app with information from other companies for targeted advertising

How We Use Tracking Permission

We use tracking permission to understand how you discover our app through marketing campaigns, which helps us provide you with personalized offers and a better shopping experience. When you grant tracking permission:

We can measure the effectiveness of our advertising campaigns
We can show you more relevant advertisements on other apps and websites
We can better understand which marketing channels bring you to our Platform

Dual Consent System

Our iOS app implements a dual consent system to respect both Apple\'s requirements and GDPR compliance:

iOS System-Level Permission: When you first launch the app, iOS will display Apple\'s standard tracking permission dialog. This is a system-level permission that cannot be bypassed.
Web-Level Cookie Consent: Within the app, you will also see our cookie consent banner, allowing you to manage web-based tracking preferences.

For marketing tracking to occur in the iOS app, you must grant permission at both levels. If you deny iOS tracking permission, marketing cookies will be automatically disabled in the app, even if you later accept them in the web-based cookie consent banner.

Managing iOS Tracking Permission

You can change your iOS tracking permission at any time:

Open your device Settings app
Scroll down and select "Sourcez" or find it in the apps list
Toggle "Allow Apps to Request to Track" on or off

When you change this setting, the new permission status is immediately communicated to our app and your marketing cookie preferences are automatically updated to respect your choice.

Impact of Denying Tracking Permission

If you choose to deny tracking permission, it does not affect the core functionality of our app. You can still:

Browse and purchase products
Manage your account and orders
Use all essential features of the Platform

However, denying tracking permission means:

Advertisements you see may be less relevant to your interests
We cannot measure which marketing campaigns led you to discover our app
You may not receive personalized offers based on your browsing behavior across other apps

Your privacy is important to us, and we respect your choice to limit tracking. All core Platform features remain fully functional regardless of your tracking permission choice.

11. Personal Data Protection Measures

We are dedicated to upholding the highest standards of technical and organisational security for personal data processing, in line with Articles 32 to 34 of the GDPR. This commitment involves safeguarding your data against accidental or illegal destruction, loss, modification, unauthorised disclosure, or access. We extend these security obligations to our service providers and subcontractors.

12. International Transfer of Personal Data

We transfer certain personal data to recipients, service providers, or group entities. These transfers may occur within the European Union (EU) or to third-party countries.

Before transferring data outside the EU, we ensure that:

the recipient countries are recognized by the European Commission as having adequate data protection levels; or
we have implemented appropriate safeguards, such as signing standard contractual clauses adopted or authorised by a supervisory authority with the recipient.

13. Your Rights Under GDPR

As per the GDPR, you have several rights regarding your personal data:

Right to Access and Rectify: You can modify, complete, or update your personal data.
Right to Deletion: Erase data that is inaccurate, incomplete, ambiguous, outdated, or collected or processed in violation of the law.
Right to Object: Oppose data processing for legitimate reasons, and to the use of your data for marketing purposes without providing a reason.
Right to Data Portability: Transfer your data in a structured, commonly used, and machine-readable format. This right is limited to the data you provided and only for automated processing.
Right to Limit Processing: As detailed in Article 18 of the European Regulation No. 2016/679 of April 27, 2016, you can request a limitation on the processing of your data.
Right to Lodge a Complaint: File complaints with the competent authority, the Office of the Commissioner for Personal Data Protection.

To exercise these rights (except for lodging complaints), contact our Data Protection Officer via email at info@sourcez.co. We aim to respond within one month, adhering to the GDPR\'s stipulated response timeframes.

Please use the email associated with your Platform account to facilitate identity verification and ensure the processing of your request.

Contact Us

For questions about our data collection and processing methods, please reach out to us at info@sourcez.co. Our Customer Support Team is also available for other inquiries at customersupport@sourcez.co.