SCOPE OF THIS STATEMENT
Please read this privacy statement ("statement") thoroughly to understand our policies and practice concerning your personal data and our processing thereof. This statement applies to persons interacting with OSCAR A/S's services as consumers ("you"). This statement explains how your personal data is collected, used and disclosed by OSCAR A/S ("OSCAR"), "we", "us"). It also contains information about how you access and update your personal data and make certain choices about the use thereof.
This privacy policy covers both our electronic data collection and data collection in other ways, and it includes information that we collect from our various channels, such as websites, applications, third-party networks, customer service, stores and events. Please note that we may collect personal data from various sources (websites, off-line events). As part thereof, we combine personal data initially collected by different OSCAR A/S entities or OSCAR A/S partners. In section 9, you can read more about how to object to this.
If you do not give us the required personal data (we will inform you when this is the case, for example by stating it clearly in our registration forms), we may not be able to deliver our products and/or services to you. This statement may be changed from time to time (see section 11).
This statement contains important information within the following areas:
1. SOURCES OF PERSONAL DATA
2. PERSONAL DATA WHICH WE COLLECT ABOUT YOU, AND HOW WE USE IT
3. PERSONAL DATA OF CHILDREN
4. COOKIES/SIMILAR TECHNOLOGIES, LOG FILES AND WEB BEACONS
5. USE OF YOUR PERSONAL DATA
6. DISCLOSURE OF YOUR PERSONAL DATA
7. STORAGE OF YOUR PERSONAL DATA
8. STORAGE AND/OR TRANSFER OF YOUR PERSONAL DATA
9. ACCESS TO YOUR PERSONAL DATA
10. YOUR CHOICES REGARDING OUR USE AND DISCLOSURE OF YOUR PERSONAL DATA
11. CHANGES TO OUR STATEMENT
12. DATA CONTROLLERS AND CONTACT INFORMATION
1. SOURCES OF PERSONAL DATA
This statement applies to personal data that we collect about you by means of the methods described below (see section 2) from the following sources:
OSCAR A/S Websites:
Consumer-targeted websites run by or for OSCAR A/S, including websites that we run under our own domains/URL's and mini sites which we run on third-party social networks, for example Facebook ("websites").
OSCAR A/S mobile sites/apps:
Consumer-targeted mobile sites or applications operated by or for OSCAR A/S, such as smartphone apps.
Email, SMS and other electronic messages Interactions via electronic communication channels between you and OSCAR A/S.
OSCAR A/S CES:
Communication with our Consumer Engagement Centre ("CES").
Off-line registration forms:
Printed or digital registration and similar forms that we collect through e.g. the mail, demos in the shops, competitions and other campaigns or events.
Advertising interaction:
Interactions with our advertisements (if for example you interact with one of our advertisements on a third-party website, we may receive information about this interaction).
Data that we create:
During our interactions with you, we may create personal data about you (for example registration of your purchases from our websites).
Data from other sources:
Social networks belonging to third parties (e.g. Facebook), marketing networks (e.g. Google), communication applications (e.g. WhatsApp), market surveys (where feedback has not been given on an anonymous basis), third-party data collectors, OSCAR A/S campaign partners, public sources and data collected when we acquire other businesses.
2. PERSONAL DATA WHICH WE COLLECT ABOUT YOU, AND HOW WE USE IT
Depending on how you interact with OSCAR A/S (online, off-line, over the telephone, etc.), we collect various types of information from you as described below.
Personal contact information:
It includes information that you give us, and which enables us to contact you, i.e. name, postal address, email address, information about social networks or telephone number.
Information about account login:
Information required to give you access to your specific account profile. Examples are login ID/email address, screen name, access code in a non-restorable form and/or security questions and answers.
Demographic information and interests:
Information that describes your demographic and behavioural characteristics. Examples are your birthday, age or age group, gender, geographic location (for example postal code), favourite products, hobbies and interests and information about household and lifestyle.
Information from computers/mobile devices:
Information about the computer system or other technological devise that you use to access one of our websites or apps, e.g. the internet protocol address (IP address) used to connect your computer or device to the internet, type of operating system and type and version of web browser. If you access OSCAR A/S website or apps via a mobile device such as a smartphone, the collected information will, if permitted, also include the unique device ID of your phone, advertisement ID, geographic location and other similar data about the mobile device.
Information about the use of websites/communication: When you move about and interact with our websites or newsletters, we use automatic data collection technologies to collect certain information about your actions. This information may e.g. be which links you click on, which pages or which contents you look at and for how long, and similar information and statistics about your interaction, for example contents response times, download errors and the duration of visits to certain sites. This information is registered by means of automated technologies, such as cookies and web beacons and is also collected by means of third-party tracking for analysis and advertisement purposes. You are entitled to object to the use of such technologies. For further information, reference is made to section 4.
Market surveys and consumer feedback:
Information that you share voluntarily with us about your experience in using our products and services.
Consumer-generated contents:
Contents that you create and subsequently share with us on third-party social networks or by uploading them to one of our websites or apps, including the use of third-party social network apps, e.g. Facebook. Examples are photos, videos, personal stories or similar media or contents. To the extent permitted, we collect and publish consumer-generated contents in connection with a number of activities, including competitions and other campaigns, characteristics of website communities, consumer commitment and third-party social networks.
Information about third-party social networks:
Information that you share publicly on third-party social networks, or information that forms part of your profile on a third-party social network (e.g. Facebook) and which you permit that social network to share with us. Examples are, among other things, your general account information (such as name, email address, gender, birthday, current town/city, user ID, list of friends, etc.) and any other information or activities that you permit the said third-party social network to share. We receive your profile information (or some of this) from the social network of this third party every time you download or interact with an OSCAR A/S web application on a third-party social network, e.g. Facebook, every time you use a social network function embedded in an OSCAR A/S (e.g. Facebook Connect) or every time you interact with us via a third-party social network. To learn more about how your information from a third-party network is obtained by OSCAR A/S, or to opt out of sharing of such information from a social network, you must go to the website of the relevant third-party social network.
Communication with a CES can be recorded or listened to under applicable laws to comply with local operational needs (e.g. for quality or training purposes). Payment card information is not registered. When required by law, you will be informed that the call is recorded, at the beginning of the call.
We strive not to collect or process sensitive personal data as part of our ordinary business activities. If it becomes necessary to process your sensitive personal data irrespective or reason, we refer to your previous, express consent for processing, which is voluntary (e.g. for marketing purposes)(. If we process your sensitive personal data for other purposes, we rely on the following legal basis: (i) detection and prevention of crime (including prevention of fraud), and (ii) compliance with applicable legislation (e.g. to comply with our reporting of diversity).
3. PERSONAL DATA OF CHILDREN
We neither request nor collect intentionally personal data from children under 13 years of age. If we detect that we have unintentionally collected personal data from a child under 13 years of age, we will immediately removed the child's personal data from our registrations. However, OSCAR A/S may collect personal data about children under 13 years of age directly from the parent or guardian with the child's express consent.
Nor do we intentionally request or collect personal data from children under 18 years of age for the purpose of marketing communication.
4. COOKIES/SIMILAR TECHNOLOGIES, LOG FILES AND WEB BEACONS
Cookies/similar technologies:
See our cookie statement to read more about how you can administer your cookie settings and for detailed information about the cookies we use and for which purposes we use it.
Log files:
We collect information in the form of log files that register website activity and collect statistical material about your search habits. These registrations are generated automatically and help us identify errors, improve the function and maintain security for our websites.
Web beacons:
Web beacons (also known as "web bugs") are small strings of code sending a graphic picture on a website or in an email message for the purpose of returning data to us. Information collected via web beacons include i.a. IP addresses and information about how you react to an email campaign (e.g. when the email was opened, which links you click on in the email, etc.). We will use web beacons on our websites or include them in email messages that we send to you. We use web beacon information for a number of purposes, i.a. reporting on site traffic, counting of unique visitors, advertising, email control and reporting and individual adaptation.
5. USE OF YOUR PERSONAL DATA
The following sections describe the various purposes for which we collect and use your personal data, and the different types of personal data collected for each purpose. Please note that all information below will not be relevant to all persons.
We use your personal data for:
Consumer service:
We use your personal data for consumer service purposes, including answering your inquiries. This most often requires the use of certain personal contact information and information about the reason for your inquiry (e.g. order status, technical problems, product questions/complaints, general questions, etc.).
- Performance of contractual obligations
- Legal obligations
- Our legitimate interests
- Improvement and development of new products and services
- Improved efficiency
Competitions, marketing and other campaigns:
With your consent (where required), we use your personal data to inform you about products and services (for example marketing messages or campaigns). This may be done via email, advertisements, SMS, telephone calls, message apps and postal deliveries to the extent permitted by law. Some of our campaigns are run on third-party websites and/or social networks. This use of your personal data is voluntary, which means that you can object to (or withdraw your consent in certain countries) the processing of your personal data for this purpose. For further information on how you change your preferences concerning marketing communication, reference is made to sections 9 and 10 below. To get more information about our competitions and other campaigns, please see the official rules or detailed information specified in connection with each competition/campaign.
- With your consent (where required)
- Performance of contractual obligations
- Our legitimate interests
- Find out which of our products and services that may be of interest to you and tell you about them
- Define types of consumer for new products and services
Third-party social networks:
We use your personal data when you interact with functions on third-party social networks, e.g. "like"-functions, to provide you with advertisements and interact with you on third-party social networks. You can obtain more knowledge about how these functions work and the profile data that we obtain about you, and find out how you opt out, by reading the privacy statements on relevant third-party social networks.
We use your personal data to tailor and deliver communication to you, including via social media, based on your interests and your interaction with our products and services.
- With your consent (where required)
- Our legitimate interests
- Find out which of our products and services that may be of interest to you and tell you about them
- Define types of consumer for new products and services
Individual adaptation (offline and online):
With your consent (where required), we use your personal data (i) to analyse your preferences and habits, (ii) to predict your needs based on our analysis of your profile, (iii) to improve and adjust your experience on our websites and apps, (iv) to ensure that contents from our websites/apps are optimised for you and your computer or device: (v) to provide you with targeted advertisements and contents, and (vi) to enable you to participate in interactive functions when you choose to do so. For example, we remember your login ID/email address or screen name, so that you can quickly log on the next time you visit our site, or so that you can quickly pick up the articles which you previously placed in your shopping basket. Based on this type of information and with your consent (where required), we also show you specific OSCAR A/S contents or campaigns especially adjusted to your interests. The use of your personal data is voluntary which means that you may object to the processing of your personal data for this purpose. For detailed information about opting out, reference is made to section 10 below.
- With your consent (where required)
- Our legitimate interests
- Find out which of our products and services that may be of interest to you and tell you about them
- Define types of consumer for new products and services
Performance of orders:
We use your personal data to process and ship your orders, inform you of the status of your orders, to correct addresses and make identify verification and other activities to demonstrate fraud. That includes the use of certain personal data and payment information.
- Performance of contractual obligations
- With your consent (where required)
- Legal obligations
- Our legitimate interests
- Improvement and development of new products and services
- Improved efficiency
- Protect our systems, networks and employees
Compliance with legal obligations
Other general purposes (e.g. internal investigation or market surveys, analysis, safety: Under applicable law, we use your personal data for other general business purposes such as maintenance of your account, performance of internal investigations or market surveys and measuring the efficiency of advertisement campaigns. If you have more OSCAR A/S accounts, we reserve the right to combine them into one account. We also use your personal data to administer and operate our communication, IT and security systems.
- Performance of contractual obligations
- With your consent (where required)
- Legal obligations
- Our legitimate interests
- Improvement and development of new products and services
- Improved efficiency
- Protect our systems, networks and employees
- Compliance with legal obligations
Legal reason or merger/acquisition:
If OSCAR A/S or its activities are acquired by or merged with another enterprise, including in connection with bankruptcy, we will share your personal data with any successors in interest. We will also disclose your personal data to third parties, (i) when required by law, (ii) in connection with legal proceedings, (iii) at the request of a competent law enforcement authority, (iv) to protect our rights, confidentiality, safety or property, or the public, or (v) to enforce the provisions in an agreement or the provisions for our website.
- Legal obligations
- Our legitimate interests
- Compliance with legal obligations
- Protect our assets and employees
6. DISCLOSURE OF YOUR PERSONAL DATA
In addition to the OSCAR A/S entities mentioned in the section Data Controllers and Contact Information (see section 12), we share your personal data with the following types of third-party organisations:
Service providers:
They are external enterprises that we use to help us operate our business (e.g. performance of orders, payment processing, detection of fraud and identity verification, operating websites, marked analysis enterprises, support services, campaigns, development of website, data analysis, CRC, etc.). Service providers and their appointed employees may only access and use your personal data on behalf of us for the specific assignments that they have been asked to perform under our directions, and they are under an obligation to keep secret and protect your personal data. When required according to applicable law, you may obtain a list of the providers who process your personal data (see section 12 on how to contact us).
Credit agencies/debt-collecting offices:
To the extent permitted by applicable law, credit agencies and debt-collecting offices are external businesses which we use to help us verify your creditworthiness (in particular regarding orders with an invoice) or collect invoices outstanding.
Third-party enterprises that use personal data for own marketing purposes:
Unless you have given consent, we neither licence nor sell your personal data to third-party businesses for their own marketing purposes. Their identity will be divulged when your consent is requested.
We can for example share certain information about the actions that you perform on our websites, such as your visits to our websites, your interaction on our websites, your use of Facebook Connect and information collected from cookies or similar technologies, including Facebook pixels, with Meta Platforms Ireland Limited ("Meta"), Google Ireland Limited ("Google") and other partners. This gives us the possibility of measuring the efficiency of our advertisements, improving our marketing practice and helping us deliver more relevant advertisements to you and others like you (including on social media such as Facebook, etc.). We are joint data controllers with Meta and some other partners for this processing. That agreement implies that we must give you this message, but if you want to exercise your data protection rights, you must contact Meta. Further information, including about how Meta ensures that you can exercise your data protection rights, and whether how they subsequently process your information as an independent data controller, is found in Meta's data policy, which can be accessed here https://facebook.com/om/privatliv. Similar terms may apply to other third-party providers, for example Google tags or other technologies. If you want to know more about personal data processed by Google, you may access Google's website, Privacy and Terms.
Third-party recipients that use personal data for legal purposes or due to merger/acquisition:
We will disclose your personal data to third parties for legal purposes or in connection with acquisition or merger (see section 5 for more information).
7. STORAGE OF YOUR PERSONAL DATA
OSCAR A/S takes all reasonable steps to ensure that your personal data is processed only during the period when it is necessary for the purposed specified in this privacy statement. The criteria for determining the storage period for your personal data are as follows:
(a) OSCAR A/S stores copies of your personal data in a form that only makes identification possible for as long as:
(i) We have an ongoing business relationship with you (e.g. when you are on our mailing list and have not opted out)
(ii) Your personal data is necessary in connection with the purposes specified in this privacy statement and we have a valid legal basis.
And
(b) The duration of: (i) any applicable limitation period (meaning a period during which a person may initiate legal proceedings against us), and (ii) another two months after expiry of the applicable limitation period (so that we can identify any personal data for a person who may make a claim on expiry of the applicable period),
And
(c) Further, if a relevant legal claim is made, we can continue to process your personal data in the period that may be necessary in connection with the claim.
In the periods specified in sections b (i) and b (ii) above, we will limit our processing of your personal data to storage and maintenance of security of certain information unless the information must be reviewed in connection with a claim or an obligation under applicable law.
When the periods in sections (a), (b) and (c) above, to the extent relevant, have expired, we will either (i) permanently delete or destruct the relevant personal data or (ii) anonymise the relevant personal data.
8. DISCLOSURE, STORAGE AND/OR TRANSFER OF YOUR PERSONAL DATA
We take relevant measures (described below) to keep secret and protect your personal data. However, it is noted that this protection does not apply to information that you choose to share in public places such as third-party social networks.
Persons who can access your personal data:
Your personal data will be processed by our authorised employees or representatives to the extent necessary depending on the specific purposes for which your personal data is collected (e.g. our employees within consumer care will have access to your consumer list).
Measures in an operational environment:
We keep your personal data in operational environments that use reasonable security measures to prevent unauthorised access. We adhere to reasonable standards to protect personal data. Unfortunately, transfer of information via the internet is not entirely safe, and even if we will do our utmost to protect your personal data, we cannot guarantee the data security during transfer via our websites/apps.
Measures that you are expected to take:
It is important that you also strive to protect your personal data. When you create an online account, you must be certain that you have chosen a password for it which will be difficult to guess for others, and you should never disclose it to anybody. You are responsible for keeping this password secret and for any use of your account. If you use a common or public computer, you should never choose it to remember your login ID/email address or password, and you must remember to log off your account each time you leave the computer. You must also use any privacy settings or controls that we provide you with on our website/app.
Transfer of your personal data:
Storage and processing of your personal data as described above may require that your personal data is ultimately transferred/submitted to and/or stored in a place outside your country of residence, in particular Norway, Sweden and Finland.
We will also transfer your personal data to countries outside the European Economic Area ("EEA") (e.g. other OSCAR A/S entities), including to countries which have other data protection standards than those applicable in the EEA. We (i) have established standard contract clauses approved by the European Commission to protect your personal data (and you are entitled to ask us for a copy of these clauses by contacting us as specified below), and/or (ii) we will refer to your consent (if permitted by law).
9. YOUR RIGHTS
Access to personal data. You are entitled to access, review and request a physical or electronic copy of information about you that is being stored. You are also entitled to request information about the source of your personal data.
These rights can be exercised by sending us an email: Oscar@oscar.dk, please attach a copy of your ID or similar information (at our request or if permitted by law). If the request is sent by a person other than yourself without documentation that the request is made lawfully on your behalf, the request will be rejected. Please note that identification information which we receive will only be processed in compliance with, and to the extent permitted by applicable law.
Further rights:
(for example corrections to or deletion of personal data). When required by law, you can (i) request deletion, portability, rectification or change of your personal data; (ii) limit the use and disclosure of your personal data, and (iii) withdraw consent to one or more of our data processing activities.
In compliance with applicable law you may also have the following, further rights concerning the use of your relevant personal data:
right to object for reasons relating precisely to your situation against our use or use on our behalf, of your relevant personal data; and right to object to our processing or processing on our behalf, of your relevant personal data for direct marketing purposes.
It should be noted that in certain circumstances we cannot delete your personal data without also deleting your user account. We may be obliged to keep some of your personal data after your request for deletion to meet our legal or contractual obligations. We may, also under applicable laws, perhaps be able to keep some of your personal data in order to meet our business needs.
When it is available, our websites will have a dedicated function through which you may review and edit the personal data that you have given. It should be noted that we demand that our registered consumers must verify their identity (e.g. login ID/email address, password), before they can access or make changes to their account information. This contributes to prevent unauthorised access to your account.
We hope that we can answer any questions you may have about the manner in which we process your personal data. If you have any unresolved concerns, you are also entitled to file a complaint with competent data protection authorities.
10. YOUR CHOICES REGARDING OUR USE AND DISCLOSURE OF YOUR PERSONAL DATA
We strive to give you more options concerning the personal data that you give us. The following mechanisms give you the following control over your personal data:
Cookies/similar technologies: You administer your consent through (i) our consent administration solution or (ii) your browser to reject all or some cookies/similar technologies or to warn you when they are used. See section 4 above.
Advertisements, marketing and campaigns:
You may give your consent that your personal data is used by OSCAR A/S to promote the company's products or services through check box(es) on the registration forms or by answering questions from our CES representatives. If you decide that you no longer want to receive such notifications, you may always subsequently opt out of marketing-related messages by following the instructions in these messages. You can unsubscribe to marketing messages from any medium, including third-party social networks, via links in our messages, by logging on to websites/apps or third-party social networks and adjust your user preferences in your account profile by removing the marking from the relevant fields or by calling our CES. It should be noted that even if you opt out of marketing messages, you will still receive administrative notifications from us, such as order or other transaction confirmations, notifications about your account activities (e.g. account confirmations, changes of password, etc.) and other important non-marketing-related messages.
Individual adaptation (offline and online):
When required by law, and if you want that OSCAR A/S should use your personal data to give you a personal experience/targeted advertisement and contents, you can state this via the relevant check box(es) on the registration form or by answering the question(s) asked by our CES representatives. If you decide that you no longer wish this individual adaptation, you can always opt out of it by logging on to websites/apps and adjust your user preferences in your account profile by removing the marking in the relevant fields or by calling our CES.
Targeted advertisement:
We cooperate with advertising networks and other advertising providers ("advertising providers") delivering advertisements on our behalf and on behalf of other non-attached enterprises on the internet. Some of these advertisements are adapted to your interests based on information collected on OSCAR A/S websites or on non-attached websites over time. You can visit www.aboutads.info/choices to learn more about this type of advertisement and on how to opt out of interest-based advertisements from enterprises that participate in Digital Advertising Alliance's ("DAA") self-regulatory programme. In addition, you can opt out of this type of advertisement in mobile applications from enterprises that participate in DAA's AppChoices app by downloading the app from iOS or Android app store. You can also stop the collection of precise location data from a mobile device by accessing the location service of your device.
11. CHANGES TO THIS STATEMENT
If we change the way in which we handle your personal data, we will update this statement. We reserve the right to make changes to our practice and this statement from time to time. Please read it regularly to see any updates or changes.
12. DATA CONTROLLERS AND CONTACT INFORMATION
You may also contact our data protection officer via email at: oscar@oscar.dk or telephone: +45 5679 2222.