PRIVACY POLICY

(the “Policy”)

WHO WE ARE

LC Waikiki is a global ready-made clothing retailer based in Turkey, operating in more than 30 countries https://www.lcwaikiki.me  with more than 40,000 employees thus all related data processing activities are jointly operated and carried out by the following entities from the LC Waikiki Group of companies as joint controllers:

1. Mainly by LC WAIKIKI RETAIL MNE PODGORICA, daughter company registered and functioning under Montenegrin laws, with headquarters in Montenegro, Podgorica, Serdara Jola Piletica no number, Business Center Palada, 2nd Floor, duly registered with the Central Register of Business Entity under registration no. 50837108, having tax identification number / statistical number no. 03194817, for all operations related to the retail sale of textiles in specialized stores;
2. In subsidiary by LC WAIKIKI MAĞAZACILIK HIZMETLERI TICARET A.Ş., mother company and sole shareholder of LC WAIKIKI RETAIL RO S.R.L registered and functioning under Turkish laws, with headquarters in Turkey, 15 Temmuz Mahallesi Gülbahar Cad. no: 41 Bağcılar, 34212 İstanbul, Turkey.

LC WAIKIKI RETAIL MNE PODGORICA and LC WAIKIKI MAĞAZACILIK HIZMETLERI TICARET A.Ş. are collectively referred to as “LC WAIKIKI” or “we”.

We respect the privacy of our customers and make every effort to ensure the protection of personal data and information, in compliance with the Personal Data Protection Law (“Official Gazette of Montenegro”, 79/2008, 70/2009, 44/2012, 22/2017 and 77/2024; the “Law”) and other regulations.

To this end, we have implemented the this Policy that outlines the key aspects regarding: the personal data we collect and process during your visit to our stores in Montenegro, on our website https://www.lcwaikiki.me  and online application LC WAIKIKI  for which we collect and process such data and legal basis for that; the recipients of personal data, including third parties, and the legal basis for providing data to them; whether the provision of personal data is mandatory or voluntary and the possible consequences of refusing to provide such data; and your right related to the processing of your personal data.

Our website https://www.lcwaikiki.me and online application https://apps.apple.com/us/app/lc-waikiki-online-shopping/id6743737857 and https://play.google.com/store/apps/details?id=com.lcwaikiki.android.global

are collectively referred to as the “Platforms”.

We comply with all applicable legal requirements, and any personal data we receive and/or collect from you is processed, stored, and retained in accordance with applicable laws and exclusively for the purposes set out in this Policy.

It is important to note that this Policy applies to you regardless of the method by which you access our Platforms, and it covers every device through which our Platforms are made available to you (including via phone, tablet, computer, etc.).

Please note that our Cookie Policy forms an integral part of this Policy.

This Policy, in relation to your data concerning online purchases, applies only to customers physically located in Montenegro.

WHAT PERSONAL DATA DO WE PROCESS

If you visit our Stores

If you visit our store and make a purchase, for the purpose of issuing product invoices, return invoices, and payment orders we will need your name, surname, address (city, district, neighborhood, postal code and street address), and signature. For resolving complaints received from you through the Register of Complaints, you will process your full name, surname, e-mail address, and telephone number (phone area code and phone number).

To ensure store security and monitor access routes and activity in LC WAIKIKI stores through CCTV systems we will process video footage in which you might appear. We also use the images to best organize the store activity for optimal customer satisfaction (making sure all the products are displayed and easy to access, completing empty shelves with new merchandise, clearing the hangers near the exchange cabins, etc.).

If you book a product in the store or a product available in another LC WAIKIKI store, we will need your name, surname, and phone number to inform you when you can pick up your product.

If you visit our Platforms

For the purpose of making online purchases via our Platforms, we will process data related to the profiling of Platforms’ users, in accordance with the Cookies Policy, as follows: age, sex, IP, traffic data, geo-location data, device information (Device ID, software version, connection used, operating system, browser used), keywords searched by the user according to its interests.

For the same purpose, we will also process data regarding your shopping account, as follows: name, surname, billing and delivery address (city, district, neighborhood, postal code and street address), account ID and password, e-mail address, telephone number (phone area code and phone number), date of birth, shopping and payment history and preferences, shopping cart content, and your interactions with our online Customer Support Services.

As part of processing any order, and depending on the payment method you choose when placing your order, you will be required to provide your bank account details and credit card information. These details will be used to process payments to us or refunds to you, as applicable.

Please note that in this case, you will provide your payment information directly to the payment processor, not to us, and you will be subject to the payment processor’s privacy policy. We recommend that you review their terms and conditions before selecting this payment method.

Credit card information used to place your order is never stored or retained in our system.

If you want to be part of the LC WAIKIKI Team

If you apply for employment or any other form of engagement with LC Waikiki, we will process data related to the recruitment process, as follows: name, surname, age, gender, nationality, address, CV data, workbook (if applicable), level and specialization of studies required by a job description, recommendation letter, references from your past jobs (if applicable), specific test and evaluation results  or supporting documents.

If you contact our Call Center

We will process your voice and any information you provide during the call (name, surname, address details) for the purpose of handling your inquiries, providing customer support, and improving our services.

If you access our social media platforms

Within our social media pages such as Facebook and Instagram page, we can process the following categories of personal data as follows:

- if you send a message to our page, we have access to your public profile (which includes your username) as well as the content and date/time of that message. Messages can be used, for example, if you request additional information about an order (delivery date) or you can use our page to apply to a job advertisement, in which case we have access to all the information you have filled in your Personal Profile by Facebook (name/surname, city, phone number, e-mail address, education, experience, etc.) or similar information on Instagram;
- if you comment on a page post, we have access to your public profile (which includes your username) as well as the content and date/time of that comment;
- if you interact with the content of our page (like, share), we can view your public profile (which includes your username) and the type of interaction;
- in case you participate to a contest or campaign we will collect your name and surname, phone number, e-mail address, order number if necessary, cargo tracking number if necessary, invoice of the product purchased when in case you have a query over an order, or we use the indicated information in order to send you the contest’s prize.

When you interact with our page, the social media platforms process certain personal data based on which it provides us with aggregate statistics. This does not include personal data directly, but is limited to:
- the number of clicks on the contact data;
- the number of page views;
- the number of page previews by placing the mouse over the page name (hover);
- the number of page likes;
- the number of people to whom content from the page was displayed;
- the number of page recommendations made by people;
- the number of interactions with the page content (like, share, comment, etc.)
- the number of views of videos on the page for more than 3 seconds;
- the number of fans;
- the number of people viewing our promotional campaigns.

Also, when we customize the audience of our posts or advertising campaigns on Facebook, we set interest categories that may include you (for example male from Podgorica, between 25 and 45 years old, interested in travel). Even if these categories are based on the processing of personal data, we do not have access to them, but only to the statistical results resulting from the analyses, since Facebook makes the results directly available to us.

To learn more about how Facebook processes your personal data to establish categories of interests, you can read the Facebook Data Use Policy at https://www.facebook.com/about/privacy/previous.

To learn more about how Instagram processes your personal data to establish categories of interests, you can read the Instagram privacy policy at https://help.instagram.com/155833707900388.

WHERE DO WE OBTAIN PERSONAL DATA FROM

As a rule, the personal data we process is obtained directly from you.

However, there are situations in which we will also be in possession of your personal data in connection with the execution of a contract to which you are not a party:

• If you are designated as an authorized person or business contact for our partners;
• If you purchase an LC Waikiki product from our partner online shop/marketplace;
• If you use our store’s discounts or any other benefits won in our partner’s campaigns (shopping malls);
• If you allow recruitment platforms to share your resume with us.

PURPOSES OF THE PROCESSING

Your personal data is processed by LC WAIKIKI according to the legal regulations in force, as follows:

• We use a behavior analytics tool that helps us understand how users interact with our Platforms. Supported features capture the user interactions on our Platforms such as, how the page is rendered, and user interactions such as mouse movements, clicks, scrolls, and so on. So, we will be to make data-driven decisions on what works and what does not, understand confusing elements of our Platforms, identify user behavior and add required content to our page, test and publish new ideas on our Platforms, study user clicks, and scrolling behavior, and provide better customer experience on our Platforms.

• Data gathered by Advertising Cookies, advertising technologies and other online identifiers, search history, and access content on our Platforms.

• To target our advertising banners, more precisely to show you LC Waikiki advertising on Social Media platforms as described above or on other websites you use.
  
  

We use for such purpose several digital marketing networks, ad exchanges, and advertising technologies such as advertising cookies, web beacons, pixels, online identifiers, and ad tags, including specific services offered by sites and Social Media, such as Facebook’s Custom Audience service.

The LC Waikiki banners and ads you may see will be based on your activity on our Platforms (search history and accessed content) or on LC Waikiki banners and ads that you have clicked/accessed before.

We will do this only if you have consented, as per Article 10, paragraph 1 of the Law, to the use of advertising cookies on our Platforms. Please see our Cookie Policy for more details. You can withdraw your consent and manage your cookie settings at any time.

• Concluding and executing contracts with our partners.

• To process, confirm, and fulfill your order, including confirming payment, updating you on the status of your order, and shipping the order to you.We process your information to manage payments for products you purchase, regardless of the payment method used. If you choose, when purchasing any of our products through the Platforms, to enable the feature that saves your payment and shipping information for future purchases, we need to process the indicated data to activate and operate this feature. By giving consent to activate this feature, your payment information will be automatically entered for subsequent purchases, so you do not need to provide it each time. The data provided is considered valid and effective for future purchases. You can update or remove your card payment details at any time through the payment information section.

• For Customer Support and general assistance.We only process personal data that is strictly necessary to manage and handle your requests or applications. If you contact us by phone, your call may be recorded for quality assurance purposes and to enable us to respond to your request. [to be completed by the client if applicable: the customer may contact LC Waikiki through the chat service of a social network]

• Managing communications systems and IT systems, conducting audit reports, managing database security and all IT systems.

• Drafting tax documents and collecting payment amounts from individuals, including recovering debts and invoices issued by suppliers.

• To issue product invoices, return invoices, and payment orders.

• To resolve complaints received from you through the Register of Complaints.

• To provide security for goods and people inside LC WAIKIKI’S stores by using the video surveillance system;

• Conducting recruitment/selection activities for filling vacancies and managing recruitment/contest files during the various stages of the procedure.

• Developing campaigns for customers or potential customers through an electronic newsletter or SMS for direct marketing purposes.

• Streamlining the services made available to the clients and constantly improving the quality of the services offered, in particular, the Call Center service through the recording of calls or web services and products by inviting you to complete our surveys.

• To register your user account on our Platforms. If you decide to create an account on our Platforms, we will process your information to verify your identity and provide access to the different features, products, and services available to registered users. You may close your account at any time by contacting our Customer Service. Please be aware that any activity data we collect, including purchases and interactions across the Platforms, will remain associated with your account to allow seamless access to all your information.

• Representation of the company in courts and before public authorities.

NOTE

Please note that when we ask you to provide personal data in order to give you access to any feature or service of the Platform, or when you make a purchase in our physical stores, certain fields will be marked as mandatory because this information is necessary for us to provide the service or enable the relevant feature. If you choose not to provide such data, you may be unable to complete your user registration, finalize your in-store purchase, or use the requested services or features.

If LC WAIKIKI wishes to process your personal data for purposes other than those originally declared, you will be provided with a separate information note detailing the subsequent purpose of the processing, the legal basis of the processing, and the retention period of your personal data, along with any other useful information in relation to further processing to enable you to express your consent freely, knowingly and expressly for each processing operation (if such processing is conditional upon your express consent being obtained).

LEGAL BASIS OF PROCESSING

• Making steps at your request before concluding a contract and for the fulfillment of the contract (Article 10, paragraph 2, item 3 of the Law);
• The fulfillment of legal obligations by LC WAIKIKI (Article 10, paragraph 2, item 1 of the Law);
• Your consent to the processing, when expressly granted, freely and unconditionally, in specific situations such as, for example, marketing processing (Article 10, paragraph 1 of the Law).

FOR HOW LONG DO WE KEEP PERSONAL DATA

• Personal data processed for accounting purposes, especially those related to billing and payments, will be stored for a period of 5 years starting on 31 December of the current year;
• Personal data from the recruitment process will be kept for a period of 6 months from the end of the recruitment/selection process for the vacancy;
• Video footage of store surveillance cameras is kept for a maximum of 30 days;
• Personal data submitted through the Register of Complaints, according to the legislation, shall be kept for 2 year after its completion;
• Product reservation forms will be kept in special compartments at the store where you requested the product until the product arrives;
• Personal data processed for concluding and performing the distances sales contract (online purchases through the Platforms) will be kept for the entire contractual period plus a maximum period of 10 years during which related rights should reach prescription/statute of limitation;
• Personal data processed for user account purposes will be kept for as long as your account is valid. Your account shall be disabled and closed after a period of inactivity of 2 years calculated since the last log-in in that account;
• Data processed under your consent will be processed during the validity period of your consent or until you choose to withdraw your consent or the data is no longer necessary.

When personal data processing conditions set forth in the legislation no longer apply, LC WAIKIKI has to delete, destroy, or anonymize personal data ex-officio, or upon request of the data subject. Personal data, which is processed in compliance with the legislation, is deleted, destroyed, or anonymized by the data controller ex-officio, or upon request of the data subject, when such personal data is no longer necessary for the purposes of processing.

In some circumstances, such as to meet our legal or regulatory obligations, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions, we may hold on to your personal data after we have finished providing services to you, or for longer than our general retention policy.

WHO DO WE SHARE PERSONAL DATA WITH

In accordance with the Law, and only in cases expressly permitted by Law, your personal data may be shared or made available to third parties.

Firstly, your personal data may be processed by LC Waikiki, either directly or through data processors engaged to act exclusively on our behalf and in line with our documented instructions. In certain cases, where LC Waikiki and another entity jointly determine the purposes and means of processing, your personal data may be processed within the framework of joint controllership, in accordance with the requirements of the applicable legislation.

We may share your personal data with various service providers, including but not limited to IT system providers and other contractual partners such as Microsoft Corporation, Iron Mountain and similar entities. Your personal data may also be disclosed to lawyers, accountants, auditors, and other professionals subject to statutory confidentiality obligations.

In order to comply with our legal obligations, we may be required to submit certain personal data to public authorities and other competent institutions.

Personal data obtained through our website is stored at the Microsoft Azure West Europe Data Center in Amsterdam, the Netherlands, which constitutes a transfer of personal data to a country that ensures an adequate level of protection in accordance with the Law.

PERSONAL DATA TRANSFERS TO THIRD COUNTRIES

We may share your personal dates within LC Waikiki group of companies, in particular with LC WAIKIKI MAĞAZACILIK HIZMETLERI TIC. A.Ş., mother company and sole shareholder of LC WAIKIKI RETAIL MNE PODGORICA, registered and functioning under Turkish laws, with headquarters in Turkey, 15 Temmuz Mahallesi Gülbahar Cad. No:41 Bağcılar, 34212 İstanbul, Turkey.

Personal data obtained through our website is stored at the Microsoft Azure West Europe Data Center in Amsterdam, the Netherlands, which constitutes a transfer of personal data to a country that ensures an adequate level of protection in accordance with the Law. Any processing of personal data by Microsoft Azure West Europe will be carried out in full compliance with the Law.

Your personal data may also be transferred to other companies in third countries for the purposes of initiating, concluding, or performing contracts, or implementing projects and services (such as, but not limited to, travel management, order processing, and delivery). Any such transfer will be carried out in accordance with the applicable provisions of the Law and only if appropriate safeguards are in place to ensure the protection of your personal data, in line with the Law and international standards where applicable.

PERSONAL DATA SECURITY

LC Waikiki takes all necessary measures to ensure that its employees, and all companies and organizations it works with, exercise due care and have awareness related to data security. LC Waikiki provides training on data security to its employees when they first start working at the company, and at later stages as well to update their knowledge on this matter. All employees that access personal or sensitive personal data are required to provide a letter of undertaking in relation to the security and privacy of such data.

In case of any non-conformity with policies and procedures, disciplinary action is taken. The security of personal data is provided with password-protected protocols, firewalls, and access control mechanisms. Data is classified and labeled. Physical security measures are taken against external and peripheral threats. Changes made in the information systems are recorded. To avoid data losses, the backup of personal data is taken according to the data backup policy. Information systems are regularly scanned for security vulnerabilities and any detected vulnerability is eliminated. In case of any breach of information security, non-conformities are determined immediately and all necessary measures are taken to eliminate and prevent recurrence of such non-conformities.

We also hold an ISO/IEC 27001- Information Security Management System certificate meaning that we employ the highest standards in protecting all the data we process and we are periodically audited by an independent security auditor.

Technical measures are listed below:

• Internal IT controls are made for the systems operated by the company.
• Our servers are kept in secured locations with strict physical access (CCTV, ID Card Management, human security, secured access ways, etc.);
• We have mirroring solutions, periodical back-ups, and a Disaster Recovery Plan;
• IT risk assessment of the systems operated by the company is conducted as part of the Corporate Risk Management process.
• E-training on privacy and data security is provided to raise awareness of the personnel related to personal data and laws on the protection of data.
• Personnel are required to provide a letter of undertaking related to their responsibilities for data security. In case of any non-conformity with policies and procedures, disciplinary action is taken.
• Data processed by the company is classified based on its level of confidentiality, and information is shared in the company and out of the company using methods chosen according to the classification of data.
• Firewalls, proxy servers, networks, and sub-networks are used for the network and data security of the company.
• Firewall access rules are periodically reviewed to ensure password-protected protocol is used for the security of data at the application and service level.
• Multi-factor authentication is used to access critical systems of the company.
• There are systems to prevent or detect unauthorized transfer of data from the company, technical rules are identified for the operation of these systems, and compliance with these rules is monitored.
• Periodical general infiltration tests, application-based and general vulnerability scans, and code scans are carried out and if needed, corrective actions are taken.
• Access of IT employees to personal data is controlled and subject to approval; also any administrator account action is logged.
• There is an audit trail of any modification to be made on the systems operated by the company, in order to follow up any issue related to data security.
• Personal data is destroyed without leaving an audit trail and making it impossible to recover such data.
• Hardening measures are taken for IT services and systems.
• Central applications are used to prevent malware, and the malware database is updated in all end-users.
• Places where data is stored and backed up are physically secured. Environmental factors are monitored centrally.
• Under the applicable legislation, all kinds of digital medium, where personal data is stored, is protected with password or cryptographic methods to meet data security requirements.
• Backup of personal data is to avoid data losses, under the data backup policy.

YOUR RIGHTS IN RELATION TO THE PERSONAL DATA PROCESSING

We take responsibility for keeping your personal data confidential and for enabling you to exercise your rights regarding its processing. Accordingly, we, as joint controllers, have agreed that you can exercise your rights free of charge by sending us an email at data.protection@lcwaikiki.com ,  indicating your request and the specific right you wish to exercise. If necessary to verify your identity, we may ask you to provide a copy of a document that confirms your identity.

Additionally, some rights can be exercised directly through the privacy settings available in our digital services or via the channels provided on the Platforms.

Regardless of the purpose or legal basis for processing your data, you have the following rights:

-      Access to personal data - You have the right to request information about the personal data we process. Registered users can check this information through their account on the Platforms, while in-store customers can exercise this right by contacting at

data.protection@lcwaikiki.com

If we receive a request from you for a notification on whether your personal data is being processed, after we verify your identity, we are obliged to provide, within 15 days of receiving your request, a notification stating whether we are processing your personal data.

If your personal data is being processed, the notification will also include the following information:

1.      Your personal name, or the name and address of the personal data controller;

2.      The name, or the name and address of the personal data processor, if you explicitly request it;

3.      The content of the personal data being processed;

4.      The purpose and legal basis for processing your personal data;

5.      The source of your data according to available information;

6.      Any third party or recipient of your data;

7.      The manner of automated processing of your personal data, in cases referred to in Article 15a of the Law.

LC Waikiki is obliged, upon your written request, your legal representative or authorized proxy within 15 days from the date of receiving your request, to:

-        Complete incomplete, correct, or delete inaccurate personal data;

-        Delete personal data if its processing is not in accordance with the law.

We will notify you, or your legal representative or authorized proxy, as well as any third party or recipient of your personal data, about any corrections, updates, or deletions made pursuant to the above, within eight days, unless this proves impossible.

If the personal data controller does not act in accordance with the above or refuses your request, you have the right to submit a complaint to the personal data controller in accordance with the applicable law or to request protection of your rights from the supervisory authority – Agencyfor Personal Data Protection and Free Access to Information, address Bulevar revolucije no. 11, Podgorica, email azlp@azlp.me and azlp@t-com.me.

-      Correction of data - You have the right to request the correction of inaccurate or incomplete personal data. Registered users can make corrections through their Platforms accounts.  If you do not want to personally update or you do not have a user account, you can submit a request at data.protection@lcwaikiki.com  and we shall perform the necessary changes. By actively providing your data, you ensure its accuracy and agree to notify us of any changes or updates.

-      Erasure of data - You have the right to request the deletion of your data when it is no longer necessary for the purpose for which it was collected, or when we are no longer legally permitted to process it.

-      Right to withdraw consent - If your personal data is processed based on your consent, you have the right to withdraw that consent at any time.We shall comply with your request unless we have a reason for keeping your personal data.

Please note if you do not want your data to be used for personalized advertising, you can manage this by adjusting your device, browser, and/or cookie settings, reviewing the privacy policies of social networks where you have accounts, or sending a request to the above email address.

The personal data controller shall be liable for any damage you suffer as a result of a breach of the rights prescribed by this law, in accordance with the general rules on compensation for damages.

***

Under certain circumstances, LC WAIKIKI may, as a personal data controller, modify this policy on the processing of personal data to reflect changes in legislation, internal practices, and procedures for processing personal data, or technological advances made over a certain period of time. In the event that we make changes in the way your personal data is processed or used, they will be published in the updated policy and the date of entry into force of the policy so amended will be published at the beginning of the processing note updated personal data. Therefore, this Privacy Policy must be consulted periodically in order to keep up with the latest policies and practices in this field.