iFurn.pro Privacy Policy
This Privacy Policy (the “Policy”) describes how the iFurn.pro platform (the “Service”, the “Provider”) processes information in connection with registration for and use of the Service. By using the Service, the User confirms that they have read this Policy.
This Policy applies together with the Public Offer Agreement and the Security Policy. Matters concerning the Provider’s liability are governed by the Public Offer Agreement.
1. What information is processed
The Provider may process:
- registration and contact details (name, email address, telephone number, company name and the like);
- Account data and User settings;
- technical data relating to use of the Service (IP address, browser type and language, cookies, access logs, date and time of requests);
- data required in order to pay for access to the Service, subject to the “Payment” section;
- information that the User enters or uploads to the Service themselves.
2. Purposes and legal bases of processing
Information in respect of which the Provider acts as the controller is processed for the purposes of registering and operating the Account, providing services and operating the functionality of the Service, providing support, ensuring security, complying with statutory requirements and for other lawful purposes. The legal bases may be the performance of a contract with the User, the User’s consent, compliance with the Provider’s legal obligations and its legitimate interests, to the extent provided for by applicable law.
User Data (section 3) is processed solely on the User’s documented instructions and for the purpose of providing the Service.
3. Data entered or uploaded by the User
The User may enter or upload information to the Service, including personal data of third parties (in particular the User’s own customers, employees or counterparties) — hereinafter “User Data”.
In respect of User Data, the User independently determines the purposes and means of its processing and acts as the owner (controller) of such data. The Provider processes User Data on behalf of and on the instructions of the User as a processor, to the extent necessary in order to provide the Service, and solely on the User’s documented instructions, except where otherwise required by law.
The terms of such a processing mandate (subject matter, purpose, categories of data, processing operations, duration, confidentiality, security measures, deletion or return of data, assistance with handling data subject requests and with responding to incidents) are determined by this Policy and by the Public Offer Agreement.
The User warrants that it has all legal grounds and authority to transfer User Data to the Provider and to engage third-party providers (sub-processors) to process it within the Service. The User is solely and fully responsible for the existence of an appropriate legal basis and of the necessary consents for the processing of User Data, for its accuracy and lawfulness, for informing the relevant data subjects and for handling their requests and enquiries. The Provider is not obliged to verify the content of User Data and bears no responsibility for its lawfulness.
The User is responsible for the instructions it provides and shall indemnify the Provider against claims, demands, losses and expenses arising as a result of the User’s breach of this section, to the extent provided for by the Public Offer Agreement and by mandatory provisions of law.
If the Provider receives a request or claim from a third party or from an authority relating to User Data, the Provider is entitled to notify the User thereof and to forward the relevant enquiry to the User for consideration.
4. Cookies, local storage and usage data
The Service uses cookies, browser local storage and similar technologies falling into two categories.
- Necessary — the authorisation session, protection against request forgery, the selected interface language, and storage of the choice made regarding cookies. They are used without separate consent: they are required in order to provide the functions requested by the User, to ensure security and to preserve the User’s own choice. The legal basis is the performance of a contract or the Provider’s legitimate interest in ensuring the operation and security of the Service.
- Analytics — measuring traffic and improving the materials of the Service. They are used solely on the basis of the User’s consent.
The choice regarding cookies is stored in the ifp_consent cookie for 6 months, the selected interface language in the ifp_locale cookie for 1 year, and the authorisation session cookie until the end of the session.
Google Analytics is used for web analytics and Google Tag Manager for tag management; the provider is Google Ireland Limited (see the List of sub-processors). Google may receive the IP address, the address of the page viewed, the referral source, information about the browser and the device, the time and events of use of the Service, as well as the consent status.
No analytics cookies are set before consent has been obtained; Google may nevertheless receive limited cookieless measurement signals — such information should not be regarded as fully anonymous. No advertising permissions are granted: the Service does not display advertising and does not use advertising personalisation by means of Google.
Once consent has been obtained, information about the first referral source (UTM parameters, the advertising click identifier, the source domain) may be stored in the browser’s local storage for up to 90 days. Before consent has been obtained, this information is retained only for the duration of the current session.
The Service also maintains its own statistics on the use of the knowledge base: it counts article views and the frequency of search queries, taking the interface language into account. This information is not linked to an account, an IP address or a device identifier. Please do not enter personal data or confidential information into the search box. The legal basis is the Provider’s legitimate interest in improving the materials of the Service.
Consent may be changed or withdrawn at any time via the “Cookie settings” link at the bottom of the page. Following withdrawal, consent-based analytics processing ceases. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. In addition, the User may restrict or delete cookies in their browser settings; this may affect the availability of certain functions of the Service.
When Google services are used, data may be processed in the European Economic Area, the United States and other countries in which Google group companies operate. Transfers outside the EEA take place on the basis of an applicable adequacy decision of the European Commission or of the European Commission’s standard contractual clauses.
5. Disclosure of information to third parties
The Provider may engage third-party providers (in particular hosting providers, data centres, providers of cloud infrastructure, email, analytics and payment services) which process information on the Provider’s behalf to the extent necessary for the operation of the Service. With regard to User Data, such providers are engaged under the User’s general authorisation and are required to comply with the corresponding confidentiality and information protection requirements.
The Provider may disclose information without the User’s separate consent where this is required by a legally binding requirement of the law or of a competent authority, as well as where this is necessary in order to detect and prevent fraud or violations or in order to ensure security and to protect the rights, property or safety of the Provider, of Users or of third parties, to the extent permitted by law. Where possible and where not prohibited by law, the Provider notifies the User of such a request relating to User Data.
6. International transfers
Information may be processed and stored on servers located in various countries, including outside the User’s country of residence, depending on the location of the Provider’s infrastructure and of the service providers engaged, provided that a legal basis prescribed by law and appropriate safeguards for its protection are in place.
7. Retention period
Information is retained for as long as is necessary for the purposes set out in this Policy, for the operation of the Account and for the provision of the Service, as well as for the periods prescribed by law. Once the need for processing ceases, the information is deleted or anonymised, except where its further retention is required by law or is necessary in order to protect rights and legitimate interests.
8. Rights of the User and of data subjects
To the extent provided for by applicable law, the User has the right to obtain access to their personal data, to request its rectification, erasure or the restriction of its processing, and to withdraw consent. In order to give effect to these rights, the Provider may ask the User to verify their identity. Enquiries are submitted through the “Contact us” section on the website of the Service.
The exercise of data subjects’ rights in respect of User Data (section 3) is ensured by the User itself as the owner of such data.
9. Information security and incidents
The Provider takes reasonable organisational and technical measures to protect information. A description of such measures is set out in the Security Policy. No information system is able to guarantee absolute security, and the Provider does not warrant that information is fully protected against all possible threats.
The Provider notifies the User without undue delay of any security incident known to it that concerns User Data, to the extent and in the manner provided for by applicable law. Subsequent notification of data subjects and of competent authorities in respect of User Data is ensured by the User as the owner of such data.
10. Payment
Where payment is made by bank card, the payment details are processed by the relevant bank, payment system or other payment service provider. If the card details are entered directly on the payment provider’s side, the Service does not receive or store the full details of such a card. The terms of payment and of refunds are determined by the Public Offer Agreement.
11. Changes to the Policy
The Provider is entitled to amend this Policy, including in connection with changes to the functionality of the Service, to the infrastructure, to the technologies used or to statutory requirements. The current version of the Policy is published on the website of the Service.
12. Liability and relationship with other documents
This Policy does not constitute a service level agreement (SLA), a warranty or an independent basis for the Provider’s liability; the scope of the Provider’s liability is determined by the Public Offer Agreement.
In the event of a conflict between this Policy and the Public Offer Agreement, the provisions of the Public Offer Agreement shall apply. The provisions of this Policy and of the Public Offer Agreement apply subject to the mandatory provisions of law which cannot be varied by contract. Limitations and exclusions of the Provider’s liability do not apply to the extent that they are prohibited by mandatory provisions of law.