PRIVACY POLICY
Last Updated: 08.09.2023
The E.M.P. Merchandising Handelsgesellschaft mbH ("EMP") Group takes your privacy seriously where we deal with your personal data. This means information that identifies you personally such as your name, contact details, order history, marketing preferences or data that can be linked with such information in order to identify you directly or indirectly ("Personal Information"). References to "we" "our" or "us" in this Privacy Policy are to the EMP Group entities listed as controllers in the "Controllers of your Personal Information" section below.
This Privacy Policy describes our practices in connection with Personal Information that we collect from you in person and through certain of our owned or controlled websites, online stores, web properties (e.g., widgets and applications) and mobile applications ("Mobile Apps") in each case, that link to this Privacy Policy (each, a "Platform" or collectively our "Platforms").
This Privacy Policy applies to the EMP Group as a whole and where there are local variations or additions concerning how we use your Personal Information collected from your home country, these are set out clearly in the Country Specific Schedules section of this Privacy Policy. Please treat these schedules as a part of this Privacy Policy.
1. CONTROLLERS OF YOUR PERSONAL INFORMATION
1.1 The EMP Group companies listed below will be responsible as controllers of the Personal Information we collect on our own Plattforms:
1.1.1 E.M.P. Merchandising Handelsgesellschaft mbH
A German corporation with its principal place of business at Darmer Esch 70a, 49811 Lingen, Germany;
1.1.2 EMP Mail Order UK Ltd.
A company incorporated and registered in England and Wales whose registered office is at c/o Francis Clark LLP, Melville Building East, Unit 18, 23 Royal William Yard, Plymouth, Devon, PL1 3GW, UK;
1.1.3 EMP Mailorder Italia S.r.l.
An Italian corporation with its registered office at Via XX Settembre 70/G, 37036 SAN MARTINO B.A. - VR -, Italy;
1.1.4 Large Popmerchandising BVBA
A Belgian corporation with its registered office at Middelmolenlaan 175 postvak 23, 2100 Antwerpen, België;
1.1.5 Large Popmerchandising BV
A Dutch corporation with its registered office at Schenkkade 50 K, 2595 AR Den Haag, the Netherlands.
Please note that the exact controller relationship that will apply to your Personal Information is determined by the activities that apply to you in the "How we use your Personal Information" section, and depending on the relevant activities identified, the companies listed above may either be sole controllers (so one company listed above is solely responsible) or joint-controllers (so two or more companies listed above are jointly responsible) of your Personal Information. We have included a table here setting out the controller relationship for each activity that may apply to you and where there is a joint-controller relationship we have included a summary of the arrangements in place (basically who is responsible for complying with the law with regards to your privacy) here.
1.2 If you have any questions about which of the above companies is the controller of your Personal Information or would like to contact any of the companies listed above, please email us or, if more convenient, write to us. You find our contact details listed in section CONTACTING US.
2. HOW WE USE YOUR PERSONAL INFORMATION
We receive Personal Information about you, either directly from you, from a third-party source (a source other than you, for example, when you use an express purchase) or by automated collection when you use any of our Platforms.
We use your Personal Information for various purposes (reasons) and our lawful bases (justifications) for using your Personal Information is either "to carry out a contract with you"; "where we have a legal obligation"; where you have given us your consent"; or "where it is necessary for our legitimate interests" (this means that we have a business or commercial interest in using your Personal Information).
The tables below set out clearly how we collect and use your Personal Information and the lawful bases (reason) we rely on for using your Personal Information. Where we have said that using or keeping your information is "necessary for our legitimate interests", we have carried out an assessment to ensure this is not unfair to you. Please note that each heading in the "How we use your information and our lawful bases" column of the table below refers to the different lawful basis we rely on for using your Personal Information. The purpose(s) of the processing and, if relevant, the legitimate interests are described under each heading.
Please bear in mind that if you choose not to provide information requested by us, or if you object to our use of your Personal Information where we have made it clear that this information is mandatory, we may not be able to provide you with the services you have requested or otherwise fulfil the purpose(s) for which we have asked for your Personal Information.
2.1 Online Accounts and Purchases
Information we collect | How we use your information and our lawful bases |
---|---|
User Account
You give us Personal Information about you when you register for an online account on any of our Platforms (e.g., our e-commerce stores online). This is generally information including your name and email address. Where we ask for information not required for registering (such as date of birth and telephone number), this information is marked as optional. When you complete your account information after registration and use your account, you give us additional information about you. This is generally Personal Information including your address details (shipping address and billing address), contents of your shopping cart, order history, preferred payment method (e.g., credit card/PayPal). For clarification: We do not process payment details such as your credit card number. |
Carry out a contract with you
With your consent
To store your preferred payment method (credit card/PayPal) to your account for future payments. Necessary for our legitimate interestsTo process optional information in order to specify your account and to improve related customer service. |
Single-Sign-On
You give us Personal Information about you when you register for an online account on our Platforms using single sign-on ("SSO"). Depending on the SSO provider, you provide us with Personal Information from your SSO account during the initial SSO registration process, e.g., the name and the e-mail address of the SSO account. |
Carry out a contract with you
To register your account and provide you with an easy-to-use login functionality. |
Purchases/Orders
You give us Personal Information about you when you place an order on any of our Platforms. This is generally information including the contents of your shopping cart, your name, email address, telephone number, shipping address, delivery preferences, payment methods, payment details (only if you use “payment in advance” or for refunds) and – if you use the size calculators – your height and weight. For clarification: We do not process payment details such as your credit card number. |
Carry out a contract with you
Comply with a legal obligation
To comply with any relevant consumer laws in relation to purchases you make, including regarding giving you certain information and issuing replacements, credits or refunds (if applicable). |
Customer Service Support
You give us Personal Information about you when you contact us in relation to an order or support request you have made on any of our Platforms. This is generally information including your name, address, email address, telephone number, customer number, order details about your order and details of your enquiry or query. |
Carry out a contract with you
To communicate with you regarding purchases you have made on our Platforms and provide you with related customer service. Necessary for our legitimate interests
To communicate with you in case your request does not relate to purchases. |
2.2 Marketing Campaigns and Direct Marketing
Information we collect | How we use your information |
---|---|
Competitions, Sweepstakes and Similar Promotions
You give us Personal Information about you when you participate in any of our competitions, sweepstakes, or similar promotions. This is generally information including your name, telephone number (optional), address, email address, date of birth (optional), country, details of the competition or sweepstake you have participated in and your entry. |
With your consent
To allow you to participate in our competitions, sweepstakes or similar promotions, and to administer these activities. |
Direct Marketing
We collect Personal Information about you when you purchase from us, register an account or sign up for our free magazine. This is generally information including your name, email address, postal address and optionally your telephone number.
|
Necessary for our legitimate interests
With your consent
|
Social Media Audience Advertising
You give us Personal Information about you when you sign up or agree to receive marketing communications from us including social media advertising. This is generally information including your name, email address, social media username or handle, telephone number and marketing preferences. |
With your consent
|
2.3 Social Media, Streaming Services and Third-Party Accounts
Information we collect | How we use your information |
---|---|
Entering Competitions, Sweepstakes and Similar Promotions with a Social Media Account
If you use your social media account (e.g. Facebook) or any other third party user account to enter our competition, sweepstakes or promotions or via an invitation to sign into such account on our Platforms, you will share certain Personal Information from your third party account with us which may include, for example, your name, gender, email address, city, country, details of the promotion you have participated in, your entry and any other Personal Information that you make accessible to us. |
With your consent
To allow you to participate in our competitions, sweepstakes or similar promotions, and to administer these activities. |
2.4 General Enquiries and Engagement
Information we collect | How we use your information |
---|---|
General EnquiriesYou give us Personal Information about you when you contact us or otherwise interact with us generally, including via email, social media, online contact form, telephone call or otherwise. This is generally information including your name, contact information, and details of your communication. |
Necessary for our legitimate interests
To respond to your inquiries and fulfil your requests, for example, when you send us questions, suggestions, compliments or complaints, or when you request information about our Platforms. We may also take such into account when improving our Platforms, products and services. Necessary to comply with a legal obligationTo comply with applicable legislation with regard to right of access and information – for example, when you exercise your right of access under the GDPR. |
Surveys
You give us Personal Information about you when you participate in and complete any of our surveys. This is generally information including your name, contact information, and your survey responses. |
With your consent
To register you for our surveys and to analyse the responses you have provided to our survey questions. |
2.5 Automatically Collected Information
Information we collect | How we use your information |
---|---|
Email Deliverability
We collect certain Personal Information by automated means when |
With your consent
Necessary for our legitimate interests
|
Accessing our online Platform
We collect certain Personal Information by automated means when you visit or interact with any of our online Platforms.
|
It is necessary for our legitimate interests
|
Cookies (and Similar Technologies)
Please see our Cookies Policy for information on what Cookies (and other similar technologies) are and how we use them. You can |
2.6 Internal Business Processes
Information we collect | How we use your information |
---|---|
Aggregating Personal InformationOur aggregating of Personal Information may apply to any of the above Personal Information we collect about you. |
Necessary for our legitimate interestsTo aggregate any Personal Information we collect so that in its final aggregated form, it will no longer directly identify you or any other individual. For example, by using Personal Information collected from website visits to calculate the percentage of our users who like a particular product. We use the aggregated data generated for multiple purposes including:
|
Audits (Internal and External) and ComplianceOur audit and compliance process may apply to any of the above Personal Information we collect about you. |
Necessary for our legitimate interestsTo verify that our internal processes function as intended. Necessary to comply with a legal obligationTo verify that our internal processes are compliant with legal or regulatory requirements. |
Fraud and SecurityOur fraud and security monitoring process may apply to any of the above Personal Information we collect about you. |
Necessary for our legitimate interest
To carry out fraud and security monitoring within our business, for example, to detect and prevent cyberattacks or attempts to commit identity theft. Necessary to comply with a legal obligationTo verify that our internal processes are compliant with legal or regulatory requirements. |
AdministrationOur administrative processes may apply to any of the above Personal Information we collect about you. |
Necessary for our legitimate interests
To operate efficiently within our business model and corporate structure, in a way that effectively services our customers, including by using a range of centralised and localised business functions. |
Legal claims
Our legal claims process may apply to any of the above Personal Information we collect about you. |
Necessary to comply with a legal obligation / Legitimate interests (depending on the situation)
To effectively defend or bring claims to protect our legal rights and interests, and to respond to investigations from regulators or law enforcement. |
3. HOW WE SHARE YOUR PERSONAL INFORMATION
We share your Personal Information for the following purposes:
- We share your Personal Information with other EMP Group companies for the purposes described in this Privacy Policy. You can consult the list and location of the EMP Group companies in section Controllers of your Personal Information.
- We share your Personal Information with companies who perform services on our behalf (and in some cases, EMP Group companies), to enable them to support the services we provide to you including those listed below. These can include consultants, providers of professional advisory services (such as lawyers and accountants), digital marketing agencies (such as for enhanced advertising experiences), service providers involved in hosting (cloud providers such as Salesforce), marketing technology (such as for email campaign creation, email automation, managing opt-outs etc.), data analysis (such as website traffic analytics), payment processing (such as PayPal), order fulfilment (such as shipping/delivery of customer orders), infrastructure provision (such as website and application development), auditing (external auditors), IT services, customer service, email delivery, credit card processing, and other similar services.
- We share your Personal Information (only email address) with third parties (including our marketing partners (e.g. Funko) and artists) to permit them to send you marketing communications, consistent with your marketing preferences. For example, when you register to receive an artist's newsletter.
- We share your Personal Information with our social media partners for the purposes of carrying out social media audience advertising and when we use social media plug-ins on our Platforms.
- We share your Personal Information with third parties that sponsor contests, sweepstakes and similar promotions so that they can offer and administer such contests, sweepstakes and promotions.
- Any Personal Information that you post or disclose on or through public areas of our Platforms (e.g. through message boards, chat, profile pages and blogs) will become public information, and may be available to visitors to our Platforms and to the general public, and may be redistributed through the Internet and other media channels where they will reach an even broader audience.
- We share your Personal Information if we are under a duty to do so, in order to comply with (and/or where we reasonably believe we are under a duty to comply with) any legal or regulatory obligation, such as pursuant to court orders, enforcement action from regulators or law enforcement; or in order to enforce any agreement we have in place with you; or to protect the rights, property, safety, or security of the EMP Group, you, others third parties, users of our Platforms or the general public.
- We share your Personal Information in connection with a sale or business transaction. We have a legitimate interest in disclosing or transferring your Personal Information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings). Such third parties may include, for example, an acquiring entity and its advisors.
- We share your Personal Information to enforce our terms and conditions or any other contracts we have with you and to allow us to pursue available remedies or limit the damages that we may sustain in any action, such as pursuant to court orders and engaging debt collection agencies.
4. DO WE TRANSFER YOUR PERSONAL INFORMATION
Please note that as a result of the global nature of the EMP Group, your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers, and by using our Platforms you understand that your Personal Information may be transferred to countries outside of your country of residence, including countries outside the EEA such as the United States, which may have data protection rules that are different from those of your country.
Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For transfers from the EEA to countries not considered adequate by the European Commission (including the United States), we entered into the standard contractual clauses by the European Commission regarding Personal Information transfers as a safeguard for the transfer of your information. You may obtain a copy of this safeguard by emailing us (see our contact details in section CONTACTING US) or consult the standard terms by following this link.
Please see the "Do we transfer your personal information" section in the Country Specific Schedules of this Privacy Policy for information on how we protect your Personal Information when it is transferred from your country of residence to a location outside your country of residence.
5. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION
We will retain your Personal Information for as long as needed or permitted considering the purpose(s) for which it was obtained and consistent with applicable law.
The criteria we use to determine our retention periods include:
- The length of time we have an ongoing relationship with you and provide our Platforms to you (for example, for as long as you have an account with us or keep using the Platforms);
- Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period before we can delete them);
- Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations); and
- Any guidelines issued by relevant legal and data protection authorities.
6. SENSITIVE PERSONAL INFORMATION
We ask that you not send us, and you not disclose to us, any sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, sexual orientation or sex life, political opinions, religion or philosophical beliefs, health related information, criminal background or trade union membership) on or through our Platforms or otherwise unless we expressly request this information for specified purposes.
7. YOUR PRIVACY RIGHTS
You have a number of rights (subject to certain conditions and exceptions) when it comes to your information. You can exercise any of these rights by contacting us. Please see our contact details in section CONTACTING US.
When contacting us, please make clear what right(s) you wish to exercise, what actions you would like us to take concerning your Personal Information and any specifics on the Personal Information your request relates to. This will allow us deal with your request more efficiently.
For your protection, you may be required to provide additional information to verify your identity before we process your request. We will try to comply with your request as soon as reasonably practicable and within any legally required time limits.
You have the right to object to us using your Personal Information where we rely on "legitimate interests" as a lawful basis for processing your Personal Information or where we use your Personal Information for direct marketing purposes (e. g. if you no longer want to receive direct marketing newsletters, updates and other marketing communications from us).
Rights | What does this mean? |
---|---|
The right to be informed |
You have the right to be provided with clear, transparent and easily understandable information about how we use your Personal Information and your rights. This is why we are providing you with the information in this Privacy Policy. |
The right of access |
You have the right to obtain access to your Personal Information (if we are processing it), and certain other information (like the information provided in this Privacy Policy). |
The right to rectification |
You are entitled to have your Personal Information corrected if it is inaccurate or incomplete. |
The right to erasure |
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your Personal Information where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions. |
The right to restrict processing |
You have rights to ‘block’ or suppress further use of your Personal Information. When processing is restricted, we can still store your Personal information, but may not use it further. We keep lists of people who have asked for further use of their Personal Information to be ‘blocked’ to make sure the restriction is respected in future. |
The right to data portability |
You have the right to receive your Personal Information in a structured, commonly used and machine-readable format and to request that this data is transmitted to another controller where this is technically feasible. This right only applies to Personal Information you have provided to us yourself (not any other information), that we process by automated means. |
The right to object |
You have the right to object to the use of your Personal Information in some circumstances, such as where we don’t have to process your Personal Information to meet a contractual or other legal obligation. For example, you may object to the use of your Personal Information for direct marketing purposes. We can still store your Personal Information, but we can no longer use it in the way that you have asked us not to. |
The right not to be subject to a decision based solely on automated processing, including profiling |
You have the right not to have your Personal Information used to make solely automated decisions about you that you impact you. For example, you have the right not to have your Personal Information used to create a profile of you that automated decisions are later based on without there being any human involvement in that processing. |
The right to lodge a complaint |
You have the right to lodge a complaint about the way we handle or process your Personal Information with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of an alleged infringement. |
|
For Belgium (App shops “Large Popmerchandising België”, “Large Popmerchandising België en français” and www.large.be): |
|
For Italy (App shop “EMP Italia” and www.emp-online.it): |
|
For the Netherlands (App shop “Large Popmerchandising Nederland” and www.large.nl): |
|
For the United Kingdom (App shop “EMP United Kingdom” and www.emp.co.uk): |
The right to withdraw consent |
If you have given your consent to anything we do with your Personal Information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your Personal Information with your consent up to that point is unlawful). This includes the right to withdraw consent to us using your Personal Information for marketing purposes. |
Please see the "Your Privacy Rights" section in the Country Specific Schedules of this Privacy Policy for information on specific data protection rights provided by your jurisdiction.
8. UPDATES TO THIS PRIVACY POLICY
We may change this Privacy Policy at any time. We will notify you of any significant changes where we have a relationship with you and otherwise post updated versions on our website from time to time. Please take a look at the Last updated legend at the top of this page to see when this Privacy Policy was last revised. Any changes to this Privacy Policy will become effective when we make the revised Privacy Policy available on or through our online Platforms.
9. CONTACTING US
If you have any questions or concerns about this Privacy Policy or our data processing practices, please contact us by email at datenschutz@emp.de (applies for Germany, i.e. App shop "EMP Deutschland" and www.emp.de) or at a country-specific email address. We have included a table here setting out the email addresses for each country.
If more convenient, you can also write to us at the following addresses:
Germany |
E.M.P. Merchandising Handelsgesellschaft mbH |
Belgium |
Large Popmerchandising BVBA |
Italy |
EMP Mailorder Italia S.r.l. |
the Netherlands |
Large Popmerchandising BV |
United Kingdom |
EMP Mail Order UK Ltd. |
Data Protection Officer:
You can directly contact our Data Protection Officer at the following address:
Data Protection Officer
André Bosse
Darmer Esch 70a
49811 Lingen
GERMANY
phone: 0049 591 - 914310
e-mail: datenschutz@emp.de or see here for a list of country-specific email addresses.
Please note that email communications are not always secure, so please do not include credit card information or other sensitive information in your email messages to us.
10. COUNTRY SPECIFIC SCHEDULES
10.1 United Kingdom (UK)
DO WE TRANSFER YOUR PERSONAL INFORMATION?
EEA countries are recognised by the UK as providing an adequate level of data protection and as such transfers of your Personal Information from the UK to an EEA country are currently permitted under UK law. In addition, transfers of your Personal Information to some non-EEA countries are currently permitted by the UK provided these countries have been certified by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here).
For transfers from the UK to countries not considered adequate by the European Commission (including the United States), the standard contractual clauses adopted by the European Commission regarding Personal Information transfers are currently certified by the UK as a valid safeguard for the transfer of your information and we have put these standard contractual clauses in place where we transfer your Personal Information to countries not considered by the UK as providing an adequate level of data protection. You may obtain a copy of this safeguard by contacting dataprotection@emp.co.uk or consult the standard terms by following this link.
YOUR PRIVACY RIGHTS
Privacy Rights if you are located in the UK or your Personal Information is held by EMP Mail Order UK Ltd.:
You have a number of rights (subject to certain conditions and exceptions) when it comes to your Personal Information. You can exercise any of these rights by contacting us at dataprotection@emp.co.uk or through our details in section CONTACTING US.
You have the right to object to us using your Personal Information where we rely on "legitimate interests" as a lawful basis for processing your Personal Information or where we use your Personal Information for direct marketing purposes (e. g. if you no longer want to receive direct marketing newsletters, updates and other marketing communications from us).
Rights |
What does this mean? |
The right to be informed |
You have the right to be provided with clear, transparent and easily understandable information about how we use your Personal Information and your rights. This is why we are providing you with the information in this Privacy Policy. |
The right of access |
You have the right to obtain access to your Personal Information (if we are processing it), and certain other information (like the information provided in this Privacy Policy). |
The right to rectification |
You are entitled to have your Personal Information corrected if it is inaccurate or incomplete. |
The right to erasure |
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your Personal Information where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions. |
The right to restrict processing |
You have rights to ‘block’ or suppress further use of your Personal Information. When processing is restricted, we can still store your Personal Information, but may not use it further. We keep lists of people who have asked for further use of their Personal Information to be ‘blocked’ to make sure the restriction is respected in future. |
The right to data portability |
You have the right to receive your Personal Information in a structured, commonly used and machine-readable format and to request that this data is transmitted to another controller where this is technically feasible. This right only applies to Personal information you have provided to us yourself (not any other information), that we process by automated means. |
The right to object |
You have the right to object to the use of your Personal Information in some circumstances, such as where we don’t have to process your Personal Information to meet a contractual or other legal obligation. For example, you may object to the use of your Personal Information for direct marketing purposes. We can still store your Personal Information, but we can no longer use it in the way that you have asked us not to. |
The right not to be subject to a decision based solely on automated processing, including profiling |
You have the right not to have your Personal Information used to make solely automated decisions about you that you impact you. For example, you have the right not to have your Personal Information used to create a profile of you that automated decisions are later based on without there being any human involvement in that processing. |
The right to lodge a complaint |
You have the right to lodge a complaint about the way we handle or process your Personal Information with the UK data protection regulator (ICO). Please see contact details for the ICO below: |
The right to withdraw consent |
If you have given your consent to anything we do with your Personal Information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your Personal Information with your consent up to that point is unlawful). This includes the right to withdraw consent to us using your Personal information for marketing purposes. |