PRIVACY POLICY

Oru Kayak Privacy Policy

Oru Kayak, Inc. (“Oru Kayak,” “Company,” “we,” “our,” or “us”) is the controller with regards to processing activities described in this Privacy Policy. We hope you find our website, products, and our other services (collectively, the “Services”) helpful and useful. 

This Privacy Policy applies to everybody who interacts with us online or otherwise. Since different portions of the Privacy Policy will apply differently to the various groups who interact with us, we have tried to clearly categorize the types of information we process and how we do so. If you have any questions about this Privacy Policy or how we handle your information, please e-mail us at service@orukayak.com.

1. Data We Collect

In this Privacy Policy, we use the word “personal data” in equivalent to the term “personal data” governed by European data protection legislation to describe all the information we collect that may identify, relate to, describe, or is reasonably capable of being associated with you and your use of our Services. We may refer to the different categories separately, but when we use the word “personal data,” we mean all the different categories described in this Privacy Policy. The term “personal data” does not apply to anonymised and aggregated data that may be derived from personal data, such as traffic patterns, search activity, and other information that cannot be reasonably connected with any individual (“Anonymised Data”). We may use Anonymised Data for our own purposes in any manner and without attribution or compensation to any person.

We collect personal data in the following circumstances:

• Creating an account. You are not required to create an account to purchase our products. If you decide to create an account however, you will provide us with certain personal data, such as your name, email address, username, and password. If your account is created while placing an order, we will also request your shipping address and phone number.
• Purchasing a product from our website. When you make a purchase, you are given the option of logging into an account or checking out as a guest. In either case, when you purchase a product, you will provide us with information, such as your name, email address, phone number, and shipping address. 
• Making a payment. When you make a payment to Oru Kayak in connection with a product purchase, you may need to provide personal data to our third-party payment processors. Such personal data may include your name, address, phone number, and payment information, including your credit card number.
• Information provided to Oru Kayak. We collect personal data you provide to us when you communicate with us via email, call our customer service department, participate in a survey, or join our rewards program. We may also collect your information when you post a product review, refer a friend, or post comments on social media. If you post content on public facing areas of the website or other social media you will not be subject to the privacy protections identified in this Policy.
• Automatic collection. We use (via third parties) automatic data collection technologies to collect certain information about you, your equipment, browsing actions or patterns. This information may include your Internet protocol (IP) address, location data, cookie identifier, browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our website, operating system, date/time stamp, and/or clickstream data. We use this data to analyze trends in the aggregate and to tailor our website to make a better customer experience.
• Technology. Oru Kayak, along with its partners, use cookies, flash cookies, pixels, server logs, web beacons, and other similar technology to administer the website, identify devices, track users’ movements around the website, analyze trends, and to gather information about those visiting our website. Non-personal data that we collect using these technologies may be combined with other information about you.
• Third-party collection. Oru Kayak uses third parties to help administer the website and provide products to you. Oru Kayak may receive information about you from third parties to enhance our ability to serve you and to offer you information that we believe may be of interest to you.

2. Processing Purposes

We collect personal data from you in the variety of ways listed above for processing purposes, primarily to provide you with information related to our products and fulfill our obligations to you upon purchase (Art. 6 para. 1 lit. b) or f) GDPR, as applicable).  We process your personal data to:

• Operate this website, including tailored content to you based upon your interests, purchases, and preferences;
• Analyze functionality of this website;
• Provide you with customer support, respond to your feedback
• Provide you with products and fulfill product orders;
• Protect the safety and interests of us or other visitors to the website;
• Notify you about changes;
• Provide product information, marketing, newsletter and other related advertising;
• Communicate with you via email or SMS (based upon your explicit consent) related to your account, products, and other services to you
• Achieve compliance with applicable laws.

3. How We share Personal Data

We disclose your personal data in the following situations:

• At your instruction. If you request us to make your information available to a third party, and such request furthers the purposes of our Services, we will do so.
• Vendors and Service Providers. In certain cases, we use the services of third-party vendors and service providers to assist us in providing the Services. We may share your personal data with such vendors and service providers solely for that purpose, such as fulfilling orders, processing payments, sending communications, limiting communications, conducting surveys, security reasons, fraud screening, website personalization, auditing, or developing and improving our Services, including this website. These third parties are required to maintain the confidentiality of this information and are prohibited from retaining, sharing, storing or using this information for any other purposes.
• Business transitions. If we go through a business transition, such as a merger, acquisition, liquidation or sale of all or a portion of our assets, the information we have about you will, in most instances, be part of the assets transferred. We reserve the right to transfer that information in connection with such transactions without notice to you. We will, generally, not be required to obtain your consent for such a transfer.
• Affiliates. We may share your information with our parent company, subsidiaries, affiliates, or sister companies as part of our marketing or advertising strategy.
• Legal grounds. We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to conform to applicable law, comply with a judicial proceeding, court order or legal process served on us, protect and defend our rights or property, or investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of our terms of service.
• Consent. We may also share your personal data with your consent.

4. International Transfers

When we share information with our affiliates and certain service providers which are located in a third country outside the European Union /European Economic Area such disclosure is deemed an international transfer under Art. 44 et. seqq. GDPR or other applicable data protection or privacy laws. We may transfer personal data to the following countries outside of the EU: USA, Canada. 

Where we transfer personal data outside the European Union /European Economic Area, and where this is to a recipient in a country that is not subject to an adequacy decision by the EU Commission (Art. 45 GDPR), we and our trusted service providers protect your personal data by EU Commission approved standard contractual clauses (Art. 46 para. 2 GDPR) or a trusted service provider’s binding corporate rules (Art. 47 GDPR) and additional necessary supplementary measures. A copy of the relevant transfer mechanism can be provided for your review on request to service@orukayak.com.

5. Retention and Security

We delete your personal data which we process based on your consent if you withdraw your consent, or when you request us to remove your personal data in accordance with this Notice. We will retain your personal data when we have a legitimate interest to do so. For example, we may retain your personal data to resolve disputes, enforce our terms and conditions or other agreements, or comply with legal requirements, including (tax) retention obligations; in that event, your personal data will be blocked from use for any other purpose. In any case, Oru Kayak (or its vendors) will not retain your personal data longer than necessary for the purposes set out in this Privacy Policy.  

We have taken appropriate technical and organisational measures to protect your information from improper use and unauthorized access. No matter how hard we try, no security measures are perfect or impenetrable. It is important to take personal measures in safeguarding your password and computer.

6. Children or Minors 

Our services are not directed at children under the age of 13 and we do not knowingly collect personal data from children.  We recognize the special obligation to protect personal data obtained from children and request that if you are 16 years old or younger to please not submit any personally identifiable information to us or to our website.

7. Your Rights 

We will at all times honor your right to Access, Correct, Erase, Restrict, Transfer, Object, and Withdraw Consent at any time with respect to your personal data which are as follows: 

• Request access to your personal data and to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you in order to have any incomplete or inaccurate information corrected, though we may need to verify the accuracy of the new information you provide to us.
• Request erasure of your personal data in order to ask us to delete or remove personal data where there is not a good reason or legitimate interest for us to continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. For example, where we have a legal obligation to retain and store your personal data.
• Request restriction of processing of your personal data in order to ask us to suspend the processing of your personal data.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data which you initially provided consent for us to use or where we used the personal data to perform a contract with or provide services to you.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms. You may, in particular, control the extent to which we market to you and you have the right to request that we stop sending you marketing messages at any time.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. In particular, you may opt out of receiving promotional emails from us by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as emails about our ongoing business relations.
• Lodge a complaint with the competent data protection authority. 

To exercise these rights please send an email to service@orukayak.com. Please ensure the request provides sufficient information for us to verify you are the person about whom we collected personal data.

8. Representative, Supervisory Authority and Data Protection Officer

If you are located in the EEA or the United Kingdom and have questions about your personal data or would like to request to access, update, or delete it, you may contact our representative at:

Geyssendorfferweg 15, Unit DC2, 3088GJ, 

Rotterdam, Netherlands

service@orukayak.com

Key Contact:

Danny da Silva

We have appointed a Data Protection Officer, whose contact information is: Chris Blevins; support@islesurfandsup.com. 

As a data subject residing, or located, in an EU Member State, you may also contact your local supervisory authority, the government agency charged with the enforcement of privacy laws, for information about your rights as a data subject and, in certain circumstances, seek redress for violations of your privacy rights.

9. Links

Our website may contain links to other websites. We recommend and encourage that you always review such other websites’ privacy policies before you provide any personal data or complete any transaction with such other parties.

Contacting Us

If you have questions regarding our Privacy Policy, its implementation, and/or our general practices, please contact us at service@orukayak.com, or send your comments to:

Oru Kayak, Inc.

Privacy Questions – Legal Counsel

Geyssendorfferweg 15, Unit DC2

3088GJ, Rotterdam, Netherlands

10. Changes to this Privacy Policy

This Privacy Policy is subject to occasional revision.  Any changes will be effective upon the earlier of thirty (30) calendar days following our dispatch of an email notice to you or thirty (30) calendar days following our posting of notice of the changes on our Website, and will be effective immediately. If we make any material changes in the way we use your personal data, we will notify you by sending you an email to the last email address you provided to us and/or by posting notice of the changes on our Website. These changes will be effective immediately for new users of our Website.

Effective Date: April 1, 2022