This privacy policy (“Privacy Policy”) applies to all Personal Data processed by HARLI + HARPA (“HARLI + HARPA”, “we”, “us”, or “Data Controller”). HARLI + HARPA complies with:

• the Australian Privacy Principles in the Privacy Act 1988 (Cth) (Privacy Act) in relation to Personal Data processed in Australia; and

This privacy policy explains how we collect, hold, use, disclose and otherwise manage:

• personal information in Australia (that is, information or an opinion about you, whether true or not, which identifies you or from which your identity is reasonably identifiable);

At HARLI + HARPA we take our responsibilities under current data protection regulations and laws seriously. We recognise the importance of the Personal Data you have entrusted to us and are committed to properly managing, protecting, and processing Personal Data.

HARLI + HARPA reserves the right to change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date of this Privacy Policy. If we make material changes to this Privacy Policy, we will provide you with additional notice (such as adding a statement to our websites’ homepage).

HARLI + HARPA only collects Personal Data where it is reasonably necessary for our business activities.  Unless it is not reasonable or practicable to do so, and in other cases allowed by law, we will collect Personal Data about you directly from you. For example, we may collect Personal Data you directly give us:

• when you make an online inquiry or place an order in relation our goods or services;
• when you contact us via telephone or email;
• from correspondence (whether in writing or electronically);
• through any mobile applications provided by us;
• while conducting customer satisfaction and market research surveys;
• when administering any of our services; and
• as otherwise required to manage our business.

However, in certain cases we may collect Personal Data from publicly available sources and third parties, such as suppliers, recruitment agencies, contractors, our clients and business partners.

In general, we may use or disclose your Personal Data:

• for the purposes for which we collected it, and for related purposes which would be reasonably expected by you;
• for other purposes to which you have consented; and
• as otherwise authorised or required by law.

The kinds of Personal Data that HARLI + HARPA collects will vary depending on our particular interaction or dealing with you. However, generally speaking, the kinds of Personal Data HARLI + HARPA collects and the purposes for which HARLI + HARPA uses Personal Data are set out in this clause

4.1. SENSITIVE INFORMATION

HARLI + HARPA may collect sensitive information.

4.2. WEBSITE DATA COLLECTION

When accessing our website, your device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

We save this data for the following purposes:

• Load balancing, i.e., to distribute the access to our website across several devices and to be able to offer you the fastest possible loading times.
• Ensuring the security of our IT systems (in accordance with Art 32 of the GDPR, where applicable) and based on our legitimate interest in protecting us from misuse of our service, for example, to prevent specific attacks on our systems and to identify attack patterns.
• Ensuring the proper operation of our IT systems, for example if errors occur that we can only remedy by storing the IP address.
• To enable criminal prosecution, security, or legal prosecution if there are specific indications of criminal offenses or legal liability.

This processing takes place based on our predominant legitimate interests mentioned above in accordance with Sec 25 para 2 no 2 German Telecommunications and Telemedia Data Protection Act (TTDSG) and Art 6 Para 1 lit f) GDPR) (where applicable).  

4.3. REGISTRATION DATA

To be able to use all functions within our website, you have to register. For this, you have to provide the following mandatory information:

• Full Name
• Email Address
• Phone Number
• Password

Your registration data is required to set up and manage a user account for you and so that you can use all the features of our website. In this case, you conclude a (free) usage contract with us on the basis of which we collect this data (Art 6 para 1 lit b) GDPR).

In order to conclude the contract, you have to provide us with this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.

In addition, you can provide further voluntary information as part of the registration, for example, you can provide your birthday date. This information is voluntary and not necessary for your registration. We collect this data in order to be able to provide you with the corresponding functions of our website (Art 6 para 1 lit b) GDPR).

Additionally, we process your Personal Data for the following purposes:

• Complete Transactions. Complete transactions you request and perform our contractual obligations, including sending notifications related to your purchases, exchanges, and returns based on Art 6 para 1 lit b) GDPR.
• Respond to You. To manage your queries, claims and complaints for products in order to identify fraudulent behaviour and technical support matters through email, our chat function, telephone and through social media based upon Art 6 para 1 lit f) GDPR.
• Comply with Legal Obligations. To comply with legal obligations, court findings and decisions from authorities based upon Art 6 para 1 lit c) GDPR.

Registration data only needed for providing your user account will be deleted once your user account is closed. 

4.4. CONTACT VIA EMAIL OR LIVE CHAT

4.5. IN STORE DATA

We offer our customers a choice of either physical or digital receipt when they are shopping in store. When a customer selects to receive a digital receipt, we collect the following information:

• Full Name
• Phone Number
• Email address

The customer’s email address is saved in our CRM System () for the purpose of being able to send a digital receipt to the customer. If the customer has registered on our website using the same details, we will link this information to their registration data. 

 4.6. OUR SOCIAL MEDIA CHANNELS

 4.6.1. SOCIAL MEDIA GENERALLY

If you visit our social media channels (Facebook, Instagram, TikTok, Pinterest) we will process certain data, e.g., when you interact with one of our channels or our social media account, like or comment on a post. The corresponding data processing is carried out based on our legitimate interest (Art 6 para 1 lit. f) GDPR) in providing you with the respective functions or based upon your consent provided to the respective social media provider (e.g., Meta, TikTok Technology Limited, Pinterest Europe Ltd.)

Please note that these areas are publicly accessible and any Personal Data you post or provide when registering or using those areas may be viewed by others. We cannot control how other users use this information. In particular, we cannot prevent unsolicited messages from being sent to you by third parties.

Content posted in community areas may be stored for an unlimited period of time. If you would like us to remove any content you have posted, please send us an e-mail to the address given.  

4.6.2 FACEBOOK

You can find us on our Facebook:

Facebook Services are provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta Ireland”), for users outside the U.S. and Canada, or Meta Platforms Inc., 1601 South California Avenue, Palo Alto, CA 94304, U.S. (“Meta Platforms”) for users in the U.S. and Canada (collectively, “Meta”).

Even if you are not registered with Facebook and visit our Facebook Meta may collect pseudonymous usage data from you. You can find more information in Meta’s data policy at https://www.facebook.com/privacy/policy/ and at https://www.facebook.com/legal/terms/information_about_page_insights_dataIn the data policy, you will also find information on the settings options for your Facebook account.

Meta may share your data within the Meta group companies and with other third parties. This may involve the transfer of Personal Data to the U.S. and other third countries for which there is no EU Commission adequacy decision. In this case, Meta Ireland will use the standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR (where applicable). Further information can also be found in Meta's data policy.

We are also jointly responsible with Meta for the processing of so-called insights data when visiting our Facebook fan page. With the help of this insights data, Meta analyses the behaviour on our Facebook and makes this data available to us in anonymised form. For this purpose, we have concluded an agreement with Meta Ireland on joint responsibility for data processing, which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum In this agreement, Meta Ireland undertakes, among other things, to assume primary responsibility under the GDPR for the processing of insights data and to fulfil all obligations under the GDPR with regard to the processing of insights data. The processing serves our legitimate economic interests in the optimisation and needs-based design of our Facebook fan page, Art 6 para 1 lit f) GDPR.

We would also like to draw your attention to the following: If you visit or like our Facebook fan page as a registered Facebook user, Meta collects Personal Data. If you are not registered with Facebook and visit the Facebook fan page, Meta may collect pseudonymous usage data.

• Specifically, the following information is collected by Meta:
• Accessing a page or a post or a video from a page;
• Subscribe or unsubscribe to a page;
• Tag a page or post with "like" or "no longer like";
• Recommend a Page in a post or comment;
• Comment on, share or respond to a Page post (including how to respond);
• Hide a Page post or report it as spam;
• Click on a link leading to the Page from another page on Facebook or from a website outside Facebook;
• Hover over the name or profile picture of a Page to preview Page content;
• Click on the webpage button, phone number button, "plan a route" button or any other button on a page; and
• Information whether you are logged in via a computer or a mobile device.

For more information, please see Facebook's privacy policy at: https://www.facebook.com/legal/terms/information_about_page_insights_data 

4.7. NEWSLETTERS, NOTIFICATIONS AND SURVEYS (DIRECT MARKETING)

In addition to the other purposes outlined in this clause 4, we may collect, use and disclose Personal Data in order to inform you of events, products or services that may be of interest to you and to conduct surveys regarding our products or services.  This may include HARLI + HARPA disclosing Personal Data to related companies of HARLI + HARPA or other entities with which HARLI + HARPA has a commercial relationship or arrangement for the purpose of the other entity contacting you for such marketing purposes. Details of these marketing purposes are set out in further detail below.  If you do not wish to receive such communications, you can opt-out by contacting HARLI + HARPA via the contact details set out in paragraph 20 of this privacy policy or through the opt-out mechanism contained in a marketing communication to you. 

4.7.1. EMAIL MARKETING

Our customers can sign up to our newsletter list by providing an email address. As a subscriber to our newsletter, they will receive marketing emails including but not limited to: special offers, new products & services, time sensitive email alerts and surveys.

We offer a free newsletter to keep you informed about special offers, product, and styling news and so-called trigger-based communications with time sensitive reminders such as abandoned cart e-mails and post purchase surveys (in order for us to receive feedback on product or website experience, brand and customer satisfaction. If you would like to receive such newsletters, reminders or surveys, we require your e-mail address for registration.

By opting in, you consent to receiving unsolicited electronic commercial messages via email for an indefinite period until you opt out. You may opt out at any time by following the instructions to unsubscribe in any of these messages.

No further Personal Data is collected unless provided by you on a voluntary basis. We use this data exclusively for sending the requested information.

The processing of your Personal Data is based on your consent (Art 6 para 1 lit a) GDPR).

Further storage for the purpose of proving consent is based on our legitimate interest, the proper documentation of our business operations and the assertion, safeguarding or defence of claims (Art 6 para 1 lit f) GDPR).

We operate an e-mail marketing platform on the servers of the service provider.

4.7.2. SMS MARKETING / MOBILE MESSAGE SERVICE

If you provide us with your consent, we will send you text notifications as specified in the Mobile Terms of Service [include link to the Mobile Terms of Service] via SMS in the future.

By opting in, you consent to receiving unsolicited electronic commercial messages via SMS for an indefinite period until you opt out. You may opt out at any time by following the instructions to unsubscribe in any of these messages.

No further Personal Data other than your name, phone number, country, time of consent and consent method is collected unless provided by you on a voluntary basis.  We use this data exclusively for providing you with the Service as specified in the Mobile Terms of Service.

The processing of your Personal Data is based on your consent (Art 6 para 1 lit a) GDPR).

Further storage for the purpose of proving consent is based on our legitimate interest, the proper documentation of our business operations and the assertion, safeguarding or defence of claims (Art 6 para 1 lit f) GDPR).

4.7.3. SURVEYS

We may ask you to complete a survey from time-to-time to receive feedback on our products and services and better tailor our products and services to you. We may ask you questions that relate to your experiences, our brand or your customer satisfaction with our products and services.

Our surveys may be conducted by our third-party providers who handle Personal Data in accordance with their own privacy policy and may disclose the Personal Data to us. If you opt to complete a survey conducted by a third-party provider, we recommend you review their privacy policy.

By providing your feedback via our surveys, you consent to the collection, handling and disclosure of your survey responses and any other information you provide in connection with the survey for purposes necessary or useful in the course of operating our business.

We may use cookies and similar technologies (we will refer to all of these as “Cookies”) to enable you to use certain features on our website, store your preferences, recognise you when you return to our website and maintain information about your use of our website. Cookies are small files that are saved on your device with the help of your internet browser.

Specifically, we use the following Cookies (unless other Cookies are specified elsewhere in this policy or on our website):

• Session Cookies: These Cookies are required to save certain technical data during your visit to our website, e.g., to determine whether you have logged in.
• Login Cookies: These Cookies are required to save your login over a session if you want to.

The following points only apply to users in the EU and the UK:

• The legal basis for the use of these Cookies is Sec 25 para 2 no 2 German Telecommunications and Telemedia Data Protection Act (TTDSG) and Art 6 para 1 lit f) GDPR, insofar as these Cookies are essentially necessary for the us to provide you with our website content.
• For all other (non-essential) Cookies we will only use these Cookies based upon your consent. If we use Cookies based upon your consent, you can withdraw your consent at any time with effect for the future by adjusting your Cookie settings. Alternatively, you can change your settings at any time. You will find the link in the footer of the website. Your withdrawal does not affect the lawfulness of the processing carried out up to the point.

The following Cookies are integrated into our website:

Disclosure of your Personal Data will generally be for the primary purpose of providing products or services to you in accordance with this Privacy Policy. 

In addition, HARLI + HARPA may disclose your Personal Data for purposes related to the above purpose, other purposes which we notify you of when we collect the information and for purposes otherwise permitted or required by law.  This may include HARLI + HARPA disclosing Personal Data to related companies of HARLI + HARPA or other entities with which HARLI + HARPA has a commercial relationship, including to third parties in the following cases:

6.1. LEGAL ENQUIRIES

If it is necessary to clarify an illegal use of our services or for legal prosecution, Personal Data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are concrete indications of unlawful or abusive behaviour. Data may also be passed on if this serves to enforce contracts or other agreements. We are also legally obliged to provide information to certain public authorities upon request. These include law enforcement agencies, authorities that prosecute administrative offences subject to fines and the tax authorities. This data is disclosed on the basis of our legitimate interest in combating abuse, prosecuting criminal offences, and securing, asserting, and enforcing claims (Art 6 para 1 lit f) GDPR) or on the basis of a legal obligation (Art 6 para 1 lit c GDPR).

6.2. PASSING ON DATA

We rely on contractually affiliated third-party companies and external service providers ("processors") to provide services to us. In such cases, we pass on Personal Data to these processors in order to enable them to continue processing. These processors are carefully selected and regularly reviewed by us to ensure that your rights and freedoms are protected. The processors may only use the data for the purposes specified by us and we also contractually oblige these processors to process your Personal Data in accordance with applicable data protection laws.

The transfer of data to processors in the EU and the UK takes place on the basis of Art 28 para 1 GDPR. In addition to the processors already mentioned in this Privacy Policy, we also use the following categories of processors:

• IT service providers
• Cloud service providers
• Hosting service providers
• Software service providers

The use of external service providers to store personal information will not always involve a disclosure of Personal Data, for example, where data is transmitted and stored in an encrypted form.

6.3 TRANSMISSION TO AUTHORITIES

In the context of administrative processes and the organisation of our operations, financial accounting, and compliance with legal obligations, such as archiving, we disclose or transmit the same data that we have received in the context of the provision of our contractual services to tax authorities, consultants, such as tax advisors or auditors, as well as other fee offices and payment service providers.

This data is passed on based upon our legitimate interest in maintaining our business activities, performing our tasks, and providing our services (Art 6 para 1 lit f) GDPR) or on the basis of a legal obligation (Art 6 para 1 lit c) GDPR).

6.4 COMPLIANCE

In the course of the further development of our business, the structure may change by changing its legal form or by founding, buying, or selling subsidiaries, parts of companies or components. In such transactions, Personal Data of our customers and contact persons in particular will be passed on together with the part of the company to be transferred. Whenever Personal Data is passed on to third parties to the extent described above, we ensure that this is done in accordance with this Privacy Policy and the relevant data protection laws.

Any disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form to the economic and legal circumstances as required, Art 6 para 1 lit f) GDPR.

Any Personal Data collected by HARLI + HARPA will be processed fairly, lawfully, and in a transparent manner. “Processing” includes, but is not limited to, collection, storage, transfer, dissemination, or erasure of Personal Data. HARLI + HARPA takes appropriate technical and organisational measures against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to Personal Data.

However, to the extent that the Internet is not completely secure, we cannot guarantee that any of your Personal Data stored or sent to us will be completely safe. We encourage you to use caution when using internet to access our web sites, applications, or social media.

We operate our website on servers of the service provider shopify

If you contact HARLI + HARPA via our website to apply for a job, we will process your e-mail address and the other contact details you provide, as well as your application documents and the information contained therein, in order to process your application or to decide whether to offer you employment.

Your application documents will only be made available to the persons responsible for the application within our company. The data processing is carried out on the legal basis of Sec 26 para 1, 3 German Federal Data Protection Act ("BDSG").

If we are unable to offer you a position, your application documents will generally be retained for up to 6 months after completion of the respective application process in order to be able to answer queries in connection with your application. Further storage may take place if we feel you are a potential candidate for future employment or if this is necessary for the provision of evidence, in particular for the defence, assertion, or enforcement of claims (Art 6 para 1 lit f) GDPR).

Otherwise, we only store your applicant data if you have expressly consented to this (Art 6 para 1 lit a) GDPR). You can withdraw your consent at any time with future effect. You can do this, for example, by contacting the contact details given. Withdrawing your consent does not affect the processing that took place before your withdrawal.

In instances where Personal Data is collected inside the EU or European Economic Area (“EEA”) and transferred to countries without adequacy decisions (see Art 45 GDPR and https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en for further information), transfers within the HARLI + HARPA will only be carried out in accordance with its binding corporate rules relating to data transfers outside the EU / EEA. 

In all other cases, including where Personal Data is collected outside the EU or EEA and transferred to another country, we make use of the standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR when structuring contractual relationships with recipients in third countries. With our service providers who process Personal Data on our behalf ("processors"), we conclude the standard contractual clauses for transfers to processors in third countries. For transfers to third parties who act as controllers in third countries, we use the standard contractual clauses for transfers to third parties as data controllers. You can request a copy of these standard contractual clauses using the contact details set out in section 20 below.

Some of the parties to whom HARLI + HARPA discloses your Personal Data to may be located outside Australia, including in the United States of America, United Kingdom, Canada and the Philippines and related companies of HARLI + HARPA located in countries including the United States of America, Europe, including France, the Netherlands and Switzerland, the United Kingdom, the Philippines, Israel and Bulgaria.  We also take reasonable steps to ensure that any such overseas recipients do not hold, use or disclose your Personal Data in a way that is inconsistent with the obligations imposed under the Privacy Act and the Australian Privacy Principles in the Privacy Act. 

By providing your Personal Data to us, you consent to us disclosing your Personal Data to any such overseas recipients for purposes necessary or useful in the course of operating our business. In the case of Australian residents, you agree that APP 8.1 of the Australian Privacy Principles will not apply to such disclosures and that such overseas recipients will not be bound by, and you will not be able seek redress for any breach by the overseas recipients under, the Privacy Act.

We have an obligation to ensure that your Personal Data is protected from unauthorised processing, accidental disclosure, access, loss, destruction, or alteration. Accordingly, we have a range of technical security measures and procedures in place to ensure that your Personal Data is protected appropriately. These include but are not limited to:

• Restricting access to information systems through access control measures and authentication techniques;
• Encrypting sensitive data while at rest and in transmission;
• Providing information security training to internal employees; and
• Binding employees and contractors to information security policies

Your Personal Data will be kept on databases held on servers kept in a physically and technologically secured environment, accessed only by authorised personnel or contractors. Where Personal Data is held in hard copy, it will be held in controlled, access restricted premises which only authorised personnel or contractors will be permitted to access.

You are neither legally nor contractually obliged to provide your Personal Data (including any sensitive information).

However, the provision of your Personal Data is necessary to a certain extent so that we can provide you with the functions on our website and our services. In particular, the provision of your Personal Data is necessary to enable us to receive and process your enquiries, to enable us to initiate or execute contracts, to allow us to provide piercing services to you, and to enable you to use the community functions in connection with our social media presences.

If it is necessary to provide your Personal Data, we will indicate this by marking the relevant field as mandatory on our forms. The provision of further Personal Data is voluntary. In the case of required Personal Data, failure to provide this Personal Data will result in HARLI + HARPA not being able to provide the corresponding functions and services; in particular, we will not be able to receive and process your enquiries and/or enable the initiation or execution of a contract. Furthermore, you will not be able to use the community functions of our social media sites. If you do not provide us with the required Personal Data in connection with your application, we will not be able to consider your application. Insofar as voluntary information is concerned, the failure to provide it means that we cannot provide the corresponding functions and services or cannot provide them to the usual extent.

Your data will only be processed for purposes other than those described in this Privacy Policy if this is permitted or required by law or if you have consented to the changed purpose of the data processing. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes prior to further processing and provide you with all other relevant information.

Unless otherwise stated within this Privacy Policy, we will delete or anonymise your Personal Data as soon as it is no longer required for HARLI + HARPA to achieve the purpose for which we collected or used your Personal Data.

Insofar as HARLI + HARPA is legally obliged to store your Personal Data, we also store it for the legally required period (Art 6 para 1 lit c) GDPR). Legal storage requirements may arise in particular from the retention periods (e.g. the German Commercial Code (HGB) or the German Fiscal Code (AO)). The retention period according to these regulations is usually between 6 and 10 years from the end of the year in which the corresponding process was completed, e.g., we have finally processed your enquiry, or the contract has ended or your piercing was completed. Your Personal Data will then be archived to be used in the event of a litigation or dispute for the statute of limitation term applicable to the related purpose. If a judicial action is initiated, the Personal Data may be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived as permitted by applicable law. The storage is based on our legitimate interest, the proper documentation of our business operations and the protection of our legal positions (Art 6 para 1 lit f) GDPR). If your Personal Data is relevant to the initiation of a contract or the execution of contracts, it is stored for the initiation and execution of the respective contractual relationship (Art 6 para 1 lit b GDPR).

Your Personal Data will then be anonymized or deleted.

16.1 RIGHT TO ACCESS

You have the right to request information on the Personal Data that HARLI + HARPA holds about you. You are entitled to know what Personal Data we are processing, why we have processed it, and whether we have shared your Personal Data. You may exercise your right to request access and to obtain copies of any Personal Data we have collected from you, and request that your Personal Data be provided to you in a format that can be easily read.

You can contact our Privacy Officer using the contact details in the contact section of this Privacy Policy and we will provide you with your Personal Data via e-mail.

We will respond to all requests for access to Personal Data within a reasonable time. We may require you to verify your identity before we can release your Personal Data. On the rare occasions when we refuse access, we will provide you with a written notice stating our reasons for refusing access. Where permitted by law, we may seek to recover from you reasonable costs incurred for providing you with access to any of the Personal Data we hold about you.

16.2 RIGHT TO RECTIFICATION

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete by contacting our Privacy Officer.

We will respond to all requests for correction of Personal Data within a reasonable time. We are not obliged to correct any Personal Data if we do it does not agree that it requires correction. If we refuse a correction request, we will provide you with a written notice stating our reasons for refusing.

If you are dissatisfied with HARLI + HARPA’s refusal of a correction request, you may make a complaint to the relevant regulatory authority, including the Office of the Australian Information Commissioner.

16.3 RIGHT TO OBJECT

To the extent the GDPR applies, you have the right to object to the processing of your Personal Data that is done based upon Art 6 para 1 lit e) or f) GDPR (Art 6 para 1 lit f) GDPR, being HARLI + HARPA’s legitimate interests. In response to a valid objection, HARLI + HARPA will not continue to process the Personal Data unless we can demonstrate a legitimate ground which overrides your interest and rights, or due to legal claims.

You also have the right to object to direct marketing. You can opt out from HARLI + HARPA direct marketing by following the instructions contained in each marketing e-mail. After your objection, we will stop the processing.

16.4 RIGHT TO RESTRICTION

To the extent the GDPR applies and in limited circumstances, you have the right to request that HARLI + HARPA restricts the processing of your Personal Data. These circumstances include:

• If you object to a processing based on HARLI + HARPA’s legitimate interest, in which case HARLI + HARPA shall restrict all processing the data pending the verification of the legitimate interest;
• If your Personal Data is incorrect, in which case HARLI + HARPA will restrict the processing of your data pending verification of the accuracy of your Personal Data;
• If the processing is unlawful, in which case you can request restriction of your Personal Data as opposed to deletion; and
• If HARLI + HARPA no longer requires your Personal Data but it is required by you to defend legal claims.

We process the Personal Data you provide HARLI + HARPA when making use of your aforementioned rights for the purpose enabling these rights and to be able to provide proof thereof. This processing is based on the legal basis of Art 6 para 1 lit c) GDPR in conjunction with Art 15 - 22 GDPR and Section 34 para 2 German Federal Data Protection Act (“BDSG”).

16.5 RIGHT TO DATA PORTABILITY

To the extent the GDPR applies, you have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies to information you have given us and only applies if we are processing information based on your consent or under or in talks about entering into a contract and the processing is automated

16.6 RIGHT TO LODGE A COMPLAINT

You have a right to make a complaint if you are unhappy with how your Personal Data has been treated under this privacy policy.  Such complaints should be sent to the HARLI + HARPA Privacy Officer at admin@harliandharpa.com. Please provide as much detail as possible about your complaint so we can review and consider it appropriately.  At all times, privacy complaints:

• will be treated seriously;
• will be dealt with promptly;
• will be dealt with in a confidential manner; and
• will not affect your existing obligations or affect the commercial arrangements between you and HARLI + HARPA.

We will seek to resolve your complaint within [30] days of receipt, unless we inform you otherwise and seek your agreement in writing.  We may request additional information so that we can investigate your complaint appropriately.

On receipt of your complaint, our Privacy Officer will commence an investigation, and you will be informed of the outcome following completion of the investigation.  In the event that you are dissatisfied with the outcome of your complaint, or an extension to the time in which HARLI + HARPA will resolve it, you may refer the complaint to the Office of the Australian Information Commissioner (www.oaic.gov.au) or other relevant privacy regulator in your region.

You can manage your consent and take other data-related actions on the Data Privacy Page

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, HARLI + HARPA will assess the risk to your rights and freedoms and if appropriate report this breach to the relevant authorities.

If you have any questions or comments about this Privacy Policy email us at Hello@harliandharpa.com