Privacy Policy
Regarding the processing of personal data
Contents
This Privacy Policy explains what personal data Glasses On The Run Ltd. ("GOTR", "we", "us" or "our") collects and processes when you use the Glasses On The Run platform, why we collect it, how we use it, how long we keep it, and what rights you have under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (shortly the General Data Protection Regulation or the GDPR) and other applicable data protection laws.
This Privacy Policy applies to your Personal Data when you visit and use our Platform (the "GOTR Platform" or the "Platform") or use our services through this Platform, which includes its analytics dashboard, the GOTR Shopify application, and the related functionalities and integrations. The Privacy Policy does not apply to other websites, applications or services that we do not own or control.
If you have any questions or requests, please contact us at: 20 Gurgulyat Str., apt. 12, Sofia 1463, Republic of Bulgaria, email: support@glassesontherun.com
I. Who We Are
The Company providing you services through this Website is Glasses On The Run Ltd., a limited liability company, incorporated and existing under the Laws of the Republic of Bulgaria, registered with the Commercial Register and the Register of Non-Profit Legal Entities at the Registry Agency in the Republic of Bulgaria under Unified Identity Code (UIC) 207759767 with its registered office at 20 Gurgulyat Str., apt. 12, Sofia 1463, Bulgaria, represented by Momchil Marinov, in the capacity as Manager.
Contact person for personal data protection matters:
Momchil Marinov Marinov, e-mail: privacy@glassesontherun.com
We, the Team at Glasses on the Run, respect the right to privacy and continuously work to keep the data we process to a minimum and as protected as possible. Nevertheless, in order for you to be able to use our services, it is necessary for us to process certain personal data. By using any of our services, you acknowledge that you have read and understood this Privacy Policy regarding the processing of personal data by Glasses On The Run Ltd.
What we do? Glasses On The Run Ltd. ("GOTR", "we", "us" or "our") operates a business-to-business (B2B) data and analysis marketplace. Through the Glasses On The Run the Platform and related integrations, we collect and analyse point-of-sale and other business data provided by European running-specialty retailers and generate aggregated market intelligence for brands, manufacturers, distributors, investors, researchers and other running-industry stakeholders.
Depending on the nature and purpose of the relevant processing activity, GOTR may act either as an independent data controller or as a data processor.
GOTR acts as an independent data controller in relation to personal data concerning Merchants, Buyers, Authorised Users, business representatives, website and Platform users, and other individuals who communicate or enter into a commercial relationship with GOTR, including where such data is processed for account administration, service provision, communications, security, legal compliance, billing and product analytics.
Where, through another Integration or functionality, GOTR processes personal data contained in or accessed through a Merchant's point-of-sale system or other connected integration solely on the Merchant's behalf and in accordance with the Merchant's documented instructions, the Merchant shall act as the data Controller and GOTR shall act as its Processor. The terms governing such processing shall be set out in the applicable Data Processing Agreement.
2. Personal Data and Other Information We Process
2.1. Data Accessed Through Point-of-Sale and E-Commerce Integrations
When a Merchant connects its point-of-sale, e-commerce or other supported business system to the GOTR Platform, GOTR is authorised to access and process certain data made available through the relevant integration. The specific categories of data and permissions depend on the third-party platform used and on the technical configuration of the integration.
The majority of the data accessed through these integrations consists of commercial and operational information relating to the Merchant's business, such as product, pricing, inventory and sales information. Such information will not ordinarily constitute personal data unless it relates to an identified or identifiable natural person.
For Merchants using the Shopify Integration, GOTR currently requests the following Shopify API permissions:
| Shopify scope | What we access |
|---|---|
| read_products | Product titles, product types, vendors, variants, prices and related product information |
| read_orders and read_all_orders | Order-level commercial information, including order totals, products, quantities, fulfilment status and financial status. |
| read_inventory | Inventory quantities, stock levels and inventory item information per location. |
| read_locations | Store location names, identifiers and related location information |
Where a Merchant connects the GOTR Platform through another supported integration, information regarding the relevant permissions and categories of data accessed will be made available to the Merchant through the applicable integration documentation, onboarding process or other appropriate notice.
2.2. Personal Data Collected Directly from Merchants, Buyers and Authorised Users
When an individual registers for, accesses or uses the Platform on behalf of a Merchant, Buyer or another organisation, or otherwise communicates with GOTR in a professional capacity, we may collect the following personal data:
A) Identification and professional data: full name, role in relation to the relevant Store (owner or manager) the organisation represented by the individual;
B) Contact and communication data: business email address and any communications, enquiries and support requests submitted to GOTR;
C) Account and authentication data: account details and status, login and authentication information, including password hashes and information concerning the user's most recent login;
D) Platform usage and security data: records relating to the individual's use of the Platform, including the relevant user, the action performed, and the date and time of the change.
2.3. End Customer Data
The third-party platform's (including Shopify's) Integration is technically configured to exclude personal data relating to a Merchant's end customers before order data is transmitted to GOTR. Accordingly, GOTR does not request or receive customer names, email addresses, telephone numbers, billing or delivery addresses, or other direct customer identifiers through the Shopify Integration.
GOTR receives only the non-personal commercial information required to generate aggregated market intelligence, such as order totals, products, quantities, prices, fulfilment status and financial status. GOTR does not collect, store or otherwise process personal data relating to Merchants' end customers through the Shopify Integration.
Where GOTR introduces or supports another integration in the future, the categories of data accessed through that integration will be assessed separately and the relevant information will be provided to the Merchant before or at the time the integration is enabled.
3. How We Use Personal Data and Store Data
We process the personal data and Store Data described above for the following purposes:
A) Provision and operation of the Services
To connect and maintain supported integrations, retrieve and process the relevant Store Data, operate the Platform, provide access to dashboards, analytics, benchmarking and market intelligence functionalities, and deliver the Services requested by Merchants and Buyers.
B) Generation of aggregated market intelligence
To combine and analyse product, pricing, inventory, sales and other Store Data contributed by participating Merchants in order to generate aggregated reports, benchmarks, analyses, visualisations and other market intelligence outputs. Aggregated Data is disclosed only where the applicable participation and aggregation safeguards are satisfied. As a general rule, at least ten participating stores must contribute to a dataset or output before it is made available. GOTR may also apply additional suppression rules, filter restrictions and other safeguards where necessary to reduce the risk that an individual Merchant or store could be identified.
C) Communications and customer support
To send onboarding messages, account and integration notifications, service announcements, security alerts and other operational communications, and to respond to enquiries, support requests and complaints.
D) Platform analytics and service improvement
To understand how the Platform is used, assess feature adoption and onboarding completion, identify technical issues and improve the functionality, performance and usability of the Services. Where applicable, such analytics are carried out using pseudonymous identifiers and configured so as to minimise the personal data processed.
E) Security, fraud prevention and protection of the Platform
To monitor access to and use of the Platform, prevent unauthorised access, misuse, fraud and security incidents, investigate suspected violations, maintain logs and protect the rights, property and security of GOTR, its users and third parties.
F) Management of commercial and contractual relationships
To administer our relationships with Merchants, Buyers, suppliers and other business partners, including contract management, invoicing, payment administration and maintaining business correspondence.
G) Compliance with legal and regulatory obligations
To maintain records and audit trails, respond to lawful requests from competent authorities, establish, exercise or defend legal claims, and comply with applicable legal, regulatory, accounting and platform-related requirements.
H) Marketing Communications
To send marketing communications (including but not limited to newsletters, promotional offers, information) relating to GOTR's services, features, updates, events and other relevant business offerings. Such communications may be sent on the basis of the recipient's consent and recipients may opt out of marketing communications at any time by using the unsubscribe mechanism included in the relevant message or by contacting us at privacy@glassesontherun.com.
4. Legal Bases for Processing
We rely on the following legal bases when processing personal data. The applicable legal basis depends on the nature of the relationship, the relevant processing activity and the purposes for which the personal data is used.
| Processing activity | Legal basis | GDPR article |
|---|---|---|
| Processing the personal data of representatives, employees and Authorised Users of Merchants, Buyers and other business partners | Legitimate interests in establishing, administering and performing commercial and contractual relationships, communicating with business contacts and providing access to the Platform | Art. 6(1)(f) |
| Operating the Platform, managing access permissions and maintaining technical, security and audit records | Legitimate interests in operating, administering and securing the Platform, preventing misuse and protecting GOTR, its users and third parties | Art. 6(1)(f) |
| Sending transactional, operational and service-related communications | Performance of a contract, where the communication is necessary for a contract with the individual; otherwise, legitimate interests in administering the relevant business relationship and providing the Services | Art. 6(1)(b) |
| Collecting Platform usage analytics and improving the functionality, performance and usability of the Services | Legitimate interests in understanding how the Platform is used, identifying technical issues, assessing feature adoption and onboarding completion, and improving the functionality and usability of the Services. | Art. 6(1)(f) |
| Maintaining records required by applicable law and responding to competent authorities | Compliance with legal obligations applicable to GOTR | Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests in protecting GOTR's legal rights and interests | Art. 6(1)(f) |
| Marketing Communications | Consent of the data subject | Art. 6(1)(a) GDPR |
The processing of Store Data that does not constitute personal data, including product, inventory, pricing and non-identifying sales information, is not subject to the GDPR. GOTR nevertheless processes such data in accordance with its contractual obligations and the safeguards described in this Privacy Policy and the applicable Terms of Service.
5. Data Retention
We retain personal data and Store Data only for as long as reasonably necessary for the purposes for which they were collected, including for the provision of the Services, the administration of our commercial relationships, compliance with legal obligations and the establishment, exercise or defence of legal claims.
The applicable retention period depends on the category of data, the purpose of the processing, the status of the relevant Account or Integration and any applicable legal or contractual requirements.
| Data type | Retention period |
|---|---|
| Account and user data relating to Merchants, Buyers, Authorised Users and business representatives | Retained for as long as the relevant GOTR Account remains active or the relevant commercial relationship continues. Disconnection or removal of an Integration does not, by itself, result in termination of the GOTR Account or require deletion of the associated Account and user data, provided that such data remain necessary for the continued administration or use of the GOTR Account. Where a GOTR Account has remained inactive for twenty-four (24) consecutive months and there is no ongoing commercial relationship, GOTR will review whether continued retention of the associated Personal Data remains necessary. Where continued retention is no longer necessary, GOTR will notify the relevant user, where reasonably practicable, and delete or anonymise the Personal Data unless the Account is reactivated or continued retention is required for one of the purposes set out below. Following closure of the GOTR Account or termination of the relevant commercial relationship, Personal Data that is no longer required for the provision of the Services will be deleted or anonymised within thirty (30) days. Personal Data that must be retained to comply with applicable legal, regulatory, accounting or tax obligations, or that is reasonably necessary for the establishment, exercise or defence of legal claims, will be retained only for the applicable statutory or limitation period and will thereafter be deleted or anonymised. |
| Communications, enquiries and support records | Retained for the period necessary to respond to the relevant communication and, where appropriate, for a reasonable period thereafter for the administration of the relationship, dispute resolution and legal claims. |
| Access, authentication, security and audit records | Retained for 12 months from the date of creation of the relevant record, unless longer retention is required in connection with a security incident, legal obligation or the establishment, exercise or defence of legal claims. |
| Store Data retained for the provision of the Services and attributable to an individual Merchant | Deleted within 30 days following termination of the Merchant's participation in the Platform, unless continued retention is required by applicable law or is reasonably necessary for the establishment, exercise or defence of legal claims. |
| Store Data following disconnection of an Integration | GOTR ceases retrieving new Store Data through the disconnected Integration. Previously received Store Data may continue to be retained and processed where the Merchant's participation in the Platform has not been separately terminated. |
| Aggregated Data | May be retained for market-intelligence, analytical and statistical purposes for as long as it can no longer reasonably be attributed to an individual Merchant, Store or natural person. |
| Records required for legal, regulatory, accounting or compliance purposes | Retained for the period required under applicable law or for as long as reasonably necessary to demonstrate compliance and protect GOTR's legal rights. |
| Data contained in backup systems | Deleted in accordance with GOTR's ordinary backup-retention cycle. Such data will not be restored or otherwise processed except where necessary for disaster recovery, security or compliance purposes. |
Disconnecting an Integration or uninstalling an application does not necessarily terminate the Merchant's participation in the Platform or result in the immediate deletion of all previously received data. Where the Merchant wishes to terminate its participation and request deletion of the relevant data, it must use the applicable termination functionality or contact GOTR in accordance with the Terms of Service.
Following termination, GOTR will cease retrieving new Store Data and will initiate deletion of the relevant personal data and attributable Store Data within the periods described above.
Where data is retained after termination because of a legal obligation, a pending dispute, a legal claim or another permitted ground, access to such data will be restricted and it will not be used for incompatible purposes.
6. Data Sharing, Service Providers and Sub-processors
We do not sell personal data. We disclose personal data only where this is necessary for the purposes described in this Privacy Policy, for the provision and security of the Services, for compliance with applicable law, or for the protection of our legal rights.
We use carefully selected third-party service providers to support the operation of the Platform. Where GOTR acts as a data controller, these providers generally process personal data on our behalf as data processors. Where GOTR processes personal data on behalf of a Merchant, the same providers may act as sub-processors. Each such provider is subject to appropriate contractual, confidentiality and data protection obligations.
The principal service providers currently used in connection with the Platform are listed below:
| Sub-processor | Purpose | Data shared | Location |
|---|---|---|---|
| Railway Corporation | Cloud hosting, application infrastructure and database services | Personal data and other information hosted or technically processed through the Platform, depending on the relevant functionality | EU West region; limited processing or access from other locations may occur as described in Section 7 |
| Brevo (Sendinblue SAS) | Transactional and service-related email delivery | Name, business email address and information contained in the relevant operational communication | EEA - France |
| PostHog Ltd | Platform usage analytics and product improvement | Pseudonymous usage and interaction data, such as page views, feature interactions, onboarding events and the relevant store or account identifier; no direct end-customer identifiers | EEA - Frankfurt, Germany |
We may also disclosure personal data to:
- professional advisers, including legal, accounting, audit and insurance advisers, where reasonably necessary for the provision of their professional services;
- competent public authorities, courts and regulatory bodies, where disclosure is required by applicable law, a binding request or a court or regulatory order;
- a prospective purchaser, investor, successor or other relevant party, where this is necessary in connection with a merger, acquisition, financing, restructuring, sale of assets or other corporate transaction, subject to appropriate confidentiality and data protection safeguards; and
- other recipients, where the individual has expressly requested or authorised the disclosure or where another lawful basis applies.
Where a Merchant uses the Platform and GOTR processes personal data on the Merchant's behalf, further information concerning the relevant sub-processors and the applicable terms of processing will be provided in the Data Processing Agreement entered into between the GOTR and the relevant Merchant.
7. International Transfers
We seek to process and store personal data within the European Economic Area ("EEA") wherever reasonably possible. Our primary Platform infrastructure is hosted in Railway's EU West region, and our analytics data is processed through PostHog Cloud EU in Frankfurt, Germany.
However, some of our service providers are established outside the EEA or may access or otherwise process personal data from countries outside the EEA in connection with the provision, support, security or administration of their services. Where personal data is transferred outside the EEA, we ensure that an appropriate transfer mechanism and safeguards are in place in accordance with applicable data protection law.
Railway Corporation is established in the United States and is an active participant in the EU–U.S. Data Privacy Framework. Transfers of personal data to Railway Corporation may therefore be based on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, where the certification applies to the relevant recipient and processing activity. Railway's Data Processing Agreement also incorporates the European Commission's Standard Contractual Clauses as an alternative transfer mechanism where the Data Privacy Framework is not applicable.
Where we use another service provider located outside the EEA, or where a provider engages a recipient outside the EEA, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, as appropriate. We may also implement supplementary contractual, technical and organisational safeguards where required.
Further information regarding the safeguards applicable to a particular transfer may be requested by contacting us at privacy@glassesontherun.com.
8. Your Rights
Under GDPR you have the following rights in relation to your personal data:
a) Right of access:
You have the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, to request access to and a copy of that personal data, together with information concerning its collection, use, disclosure, retention and other processing.
b) You have the right to request the deletion of your personal data where one of the following grounds applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you withdraw your consent, where the processing is based on consent and there is no other legal ground for the processing;
- you object to the processing and there are no overriding legitimate grounds for continuing it;
- the personal data has been processed unlawfully; or
- the personal data must be erased in order to comply with a legal obligation under European Union or Member State law applicable to GOTR.
The right to erasure is not absolute. We may refuse or limit a deletion request where the continued processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation applicable to us;
- for the performance of a task carried out in the public interest or in the exercise of official authority;
- for reasons of public interest in the area of public health;
- for archiving, scientific or historical research or statistical purposes, where applicable; or
- for the establishment, exercise or defence of legal claims.
c) Right to rectification:
You have the right to request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
d) Right to restriction of processing:
You have the right to request that the processing of your personal data be restricted where:
- you contest the accuracy of the personal data, for a period enabling us to verify its accuracy;
- the processing is unlawful, but you oppose the deletion of the personal data and request that its use be restricted instead;
- we no longer require the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
- you have objected to processing based on legitimate interests, pending verification of whether our legitimate grounds override your interests, rights and freedoms.
e) Right to data portability:
Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
Where technically feasible, you may also request that the personal data be transmitted directly to another controller.
f) Right to object:
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where the processing is based on our legitimate interests.
Where you object, we will cease processing the relevant personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
You have the right to object at any time to the processing of your personal data for direct marketing purposes. Where you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.
g) Right to withdraw consent:
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
h) Rights relating to automated decision-making:
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is permitted by applicable law and appropriate safeguards are in place.
GOTR does not currently make decisions concerning individuals based solely on automated processing which produce legal or similarly significant effects.
Exercising Your Rights
You may exercise your rights by contacting us at: privacy@glassesontherun.com.
Please provide sufficient information to enable us to identify you and clearly describe your request. Where reasonably necessary, we may request additional information in order to verify your identity and protect your personal data against unauthorised disclosure.
We will respond to your request without undue delay and, in any event, within one month of receiving it. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. We will inform you of any extension within one month of receiving your request and explain the reasons for the delay.
Requests are generally handled free of charge. However, where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may:
- charge a reasonable fee, taking into account the administrative costs of providing the information, communication or action requested; or
- refuse to act on the request.
Where we refuse to act on a request, we will inform you of the reasons and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
Right to Lodge a Complaint
You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd,
Sofia 1592
Republic of Bulgaria
www.cpdp.bg
For individuals located in the United Kingdom:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane,
Wilmslow, Cheshire SK9 5AF
United Kingdom
https://ico.org.uk/
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our processing activities, the Platform and the Services, our service providers, applicable law or regulatory guidance.
Where the changes are material, we will take reasonable steps to bring them to your attention, for example by email, through an in-app notification where such functionality is available, or by another appropriate means, before or when the updated Privacy Policy takes effect.
The date of the most recent revision will be indicated at the end of this Privacy Policy. We encourage you to review this Privacy Policy periodically to remain informed about how we process personal data.
Where a change requires your consent under applicable law, we will request that consent separately.