**1. Introduction**
Online Star Save (also referred to as “we”, “our”, and “us”) will process personal data in accordance with GDPR. We aim to provide you with information regarding this matter. We consider it our responsibility to protect your privacy as much as possible and we want to explain how we do this to you. This document will explain how we process the personal data you provide to us.
**2. Definitions**
Online Star Save: Online Star Save B.V., registered with the Netherlands Chamber of Commerce under registration number 60333553.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Data Subject: The data subject as defined in GDPR Article 4(1).
Cookies: Cookie information and script files.
Personal Data: Personal data as defined in GDPR Article 4(1).
Data Processor: The data processor as defined in GDPR Article 4(8).
Processing: Processing activity as defined in GDPR Article 4(2).
Data Controller: The data controller as defined in GDPR Article 4(7).
Website: The web page accessible via the link www.onlinestarsave.com and subpages.
**3. Processing of Your Personal Data by Online Star Save**
**3.1. Performance of the Contract**
Firstly, your personal data is processed for the purpose of delivering our products and services. For this purpose, we process the following Personal Data:
1. Name and address information (including company name if selected);
2. Email address;
3. Financial information such as bank account number;
4. Other personal information provided for inclusion in the gift card message;
5. Phone number;
6. Other personal data, including text, photos, and videos shared in your “Your Own Star Page”.
The legal basis for this type of processing is the Contract we enter into with you.
**3.2. Communication**
Secondly, your personal data is processed when you contact us via the contact form on our website or by emailing info@onlinestarsave.com. This allows us to respond to any questions you may have. For this purpose, the following Personal Data may be processed:
1. Name;
2. Email address;
3. Other personal data mentioned in your messages.
The legal basis for this processing is our legitimate interest in being able to respond to your inquiries. Therefore, we only process the personal data necessary to answer your questions and communicate with you.
**3.3. Newsletter**
Thirdly, if you subscribe to our newsletter (either separately or during the order process), your personal data may be processed to deliver the newsletter to you. For this purpose, the following personal data may be processed:
1. Name;
2. Email address.
The legal basis for this type of processing is our legitimate interest in informing you about news, discount codes, and new products and services.
**3.4. Information Regarding Business Gifts**
Fourthly, personal data may be processed (upon your request) to inform you about business gifts. For this purpose, the following Personal Data may be processed:
1. Name;
2. Email address;
3. Company name;
4. Other personal data you provide in your request.
The legal basis for this processing is our legitimate interest in informing you about business gifts.
**4. Retention Period**
We do not keep your personal data longer than necessary for the purpose of processing unless required by law. Specific retention periods for the data are as follows:
1. For processing related to the “Performance of the Contract”, your name and address information, financial information, and phone number will be kept for 20 years from your last order. There is no specific retention period for email addresses and personal data shared in gift cards or “Your Own Star Page”.
2. For processing related to “Communication”, your data will be kept for 5 years from the date of our last communication.
3. For processing related to “Sending Newsletters”, your data will be kept for 1 year from the date you subscribe to the newsletter.
4. For processing related to “Information Regarding Business Gifts”, your data will be kept for 5 years from the date we inform you about business gifts.
5. We keep your invoice address and bank details for 10 years to comply with legal obligations regarding VAT refunds.
If multiple personal data are processed by us, the retention period is the longest retention period for the personal data that can be stored.
**5. Cookies**
We use cookie data on the website. This use is fully compliant with GDPR. We must inform you about certain cookies and request your consent to use them. We achieve this goal by using cookie bots.
**6. Sharing Your Personal Data with Third Parties**
In some cases,
we need to share your personal data with third parties. This applies to the following situations:
1. When delivering our products and services, for example, when you want a third party recipient to know who the product is from or when you want to use your “Your Own Star Page” publicly;
2. When fulfilling our legal obligations, such as notifying the Dutch Data Protection Authority [Autoriteit Persoonsgegevens];
3. When communicating with third parties such as our IT support provider or hosting provider.
In cases where such external suppliers are used and these parties process personal data on our behalf, we enter into contracts with them in accordance with GDPR. If these parties process data on their own behalf, they will be responsible under GDPR.
**7. Security of Your Personal Data**
We take all necessary technical and administrative measures to prevent the misuse, loss, and unauthorized disclosure of your personal data or unauthorized access by unauthorized persons to your data.
If you have any questions about the security of your personal data or if you believe that your personal data is being used for purposes other than processing, please contact us under KVKK Art. 11. info@onlinestarsave.com.
**8. Rights of the Data Subject**
Right of Access
You have the right to know whether your personal data are being processed and, if so, to request a copy of the processed data. In this case, a copy of the processed data will be sent to you. Requesting additional copies may incur a fee.
Right to Rectification
You have the right to request correction of inaccurately held personal data. Similarly, you can complete any missing personal data by providing an additional statement within the scope of processing purposes.
Right to Erasure
Upon your request, your Personal Data will be promptly deleted under the following circumstances:
1. The purpose of storing personal data or otherwise processing them ceases to exist;
2. Objection is made to the processing of personal data under GDPR Article 21(1) and there is no legal basis for processing, or objection to processing under GDPR Article 21(2);
3. Personal data is processed unlawfully;
4. It is required to delete personal data according to EU or Dutch legislation to which we are subject;
5. Personal data is stored for the purpose of information society services under GDPR Article 8(1).
Right to Restriction of Processing
We restrict the processing of your personal data in the following cases and upon your request:
1. You object to the accuracy of personal data (during the valid period for confirming data accuracy);
2. Processing is unlawful, and you request the restriction of data deletion instead;
3. Although the purpose of processing personal data has ceased, your data is necessary for establishing, defending, or proving a legal claim;
4. You object to the processing of your data under GDPR Article 21(1), and an examination is made as to whether the processing is legitimate.
Right to Data Portability
You have the right to request your personal data processed under the “Performance of the Contract” or “Legitimate Interest” bases and processed in a structured, commonly used, and machine-readable format. Additionally, you have the right to transfer your data to a data controller outside our organization.
Right to Object
If your personal data is processed for the legitimate interest purpose, you can object at any time by specifying your specific situation. We will cease processing your personal data unless we have a legitimate interest that overrides your personal rights and freedoms, or we do not establish or defend a legal claim.
However, you should understand that objecting to the processing or requesting deletion of data means that we may no longer be able to fulfill our obligations towards you as stated in this document.
**9. Complaints**
You can file a complaint with the Dutch Data Protection Authority at any time. Please note that you must first contact us under KVKK Art. 11 before complaining to the Turkish Data Protection Authority.
**10. Final Remarks**
We will periodically review this document due to the possibility of changes in the rules regarding personal data and/or cookie rules on the website. We reserve the right to unilaterally change the Terms and Conditions without prior notice. Please check our website for the most current version of this document.
**11. Contact Information of the Data Controller**
If you have any questions or suggestions, please contact Online Star Save.
**12. Regarding Turkish Legislation**
Although Online Star Save is a company based in the Netherlands and is subject to GDPR regulations, we have prepared a separate information document for you as a data controller in Turkey, as we are qualified as a data controller in Turkey and therefore have an obligation to inform you under the KVKK regulations.
-Online Star Save processes your personal data, including name and address information, email address, financial information such as bank account number, other personal information provided for inclusion in the gift card message, phone number, and other personal data, for the purposes of performing the contract, communication, sending newsletters, and informing you about business gifts.
-Your personal data may be transferred to third parties such as suppliers and carriers when necessary for the delivery of products and services, due to our legal obligation to the Dutch Data Protection Authority, and to our IT support provider and hosting provider.
-These personal data are processed online in accordance with the legal basis of “necessary for the legitimate interests pursued by the data controller” under Article 5 of the Law.
-You can submit your requests within the scope of Article 11 of the Law to Laan van de Maagd 83 – NL-7324 BT Apeldoorn – The Netherlands or to our email address in writing.