Privacy Policy

This Privacy Policy explains how RUNLAB (CY) LIMITED, registration number HE 425216, VAT/TIC 10425216G, with its registered address at Vasileos Georgiou 20, DRAKOS, Flat SHP06, 4047 Germasogeia, Limassol, Cyprus (hereinafter referred to as “RUNLAB”, “we”, “us” or the “Controller”), collects, uses, stores and otherwise processes personal data through the website https://runlab.shop/ and in connection with the products and services provided by RUNLAB.

Personal data are processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of such Data Law of 2018 (Law 125(I)/2018) of the Republic of Cyprus, and other applicable data protection legislation.

1. Data Controller

The controller responsible for the processing of personal data is:

RUNLAB (CY) LIMITED
Registration No.: HE 425216
VAT/TIC: 10425216G
Vasileos Georgiou 20, DRAKOS, Flat SHP06
4047 Germasogeia, Limassol
Cyprus
Website: https://runlab.shop/

2. Personal Data We May Process

Depending on how you interact with RUNLAB, we may process the following categories of personal data:

first name and surname;
date of birth where required;
telephone number;
email address;
billing and delivery address;
account and authentication information;
order, purchase, return and refund information;
payment-related information received from payment service providers;
communications, enquiries, complaints and customer service correspondence;
information relating to participation in loyalty or bonus programmes, where applicable;
technical information, including IP address, browser type and version, operating system, device type, language settings, referral source and Website activity;
cookie and similar technology data, subject to the Cookie Policy and the user’s preferences;
photographs and video recordings where relevant to services provided by RUNLAB;
information provided in connection with gait analysis, shoe fitting or other testing services.

3. Health and Other Special Category Data

Certain RUNLAB services, including gait analysis, functional testing and shoe fitting, may involve information relating to physical condition, injuries, anthropometric measurements, height, weight, foot characteristics or other information that may constitute data concerning health under Article 9 of the GDPR.

Where RUNLAB processes special category personal data, such processing will only take place where a valid legal basis under Article 6 of the GDPR and an applicable condition under Article 9 of the GDPR are satisfied. Where required, RUNLAB will obtain the data subject’s explicit consent before processing such information.

RUNLAB does not intentionally collect special category personal data that are not necessary for the relevant service.

4. Purposes of Processing

RUNLAB may process personal data for the following purposes:

creating and managing customer accounts;
authenticating users;
processing, confirming, fulfilling and delivering Orders;
processing payments, refunds and returns;
providing customer support and responding to enquiries;
providing gait analysis, shoe fitting, testing and other services requested by customers;
managing appointments where applicable;
maintaining records relating to purchases, returns and customer interactions;
complying with accounting, tax, consumer protection and other legal obligations;
preventing fraud, misuse and security incidents;
maintaining and improving the security and functionality of the Website;
analysing Website usage where permitted by law;
administering loyalty, bonus or promotional programmes where applicable;
sending marketing communications where permitted by law and, where required, with the user’s consent.

5. Legal Bases for Processing

Depending on the relevant processing activity, RUNLAB may rely on one or more of the following legal bases under Article 6 of the GDPR:

Performance of a contract – where processing is necessary to enter into or perform a contract with the customer, including processing Orders and providing requested services;
Legal obligation – where processing is necessary to comply with obligations imposed on RUNLAB by applicable law;
Legitimate interests – where processing is necessary for RUNLAB’s legitimate business interests or those of a third party and such interests are not overridden by the rights and freedoms of the data subject;
Consent – where the data subject has voluntarily given consent for a specific processing purpose.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Orders and Customer Accounts

Personal data necessary to create an Account, authenticate a user, process an Order, arrange delivery, provide a requested service, process payment or refund, or comply with legal obligations do not require consent where another lawful basis under the GDPR applies.

RUNLAB will only request personal data that are reasonably necessary for the relevant purpose.

7. Marketing Communications

RUNLAB may send marketing and promotional communications where permitted by applicable law.

Where marketing is based on consent, such consent is voluntary and separate from the processing required to purchase Goods or receive services.

Users may withdraw their marketing consent at any time by using an unsubscribe option provided in the communication or by contacting RUNLAB.

8. Cookies and Similar Technologies

The Website uses cookies and similar technologies as described in the Cookie Policy.

Strictly necessary cookies may be used without consent where permitted by law. Analytics, advertising and other non-essential cookies will only be used where the required consent has been obtained.

Users may change or withdraw their cookie preferences through the cookie settings available on the Website.

9. Recipients of Personal Data

RUNLAB may disclose personal data where necessary to:

authorised employees and contractors of RUNLAB;
payment service providers;
courier, postal and delivery companies;
IT, hosting, website maintenance and cybersecurity service providers;
communications and authentication service providers;
accounting, tax, legal and other professional advisers;
analytics or advertising providers where permitted by law and subject to applicable consent requirements;
public authorities, courts, regulators or law enforcement authorities where disclosure is required by law.

Service providers processing personal data on behalf of RUNLAB are required to process such data only for authorised purposes and subject to appropriate contractual and confidentiality obligations.

10. International Transfers

Where personal data are transferred outside the European Economic Area (“EEA”), RUNLAB will ensure that an appropriate transfer mechanism and safeguards required by the GDPR are in place.

Such safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another transfer mechanism permitted by applicable data protection law.

11. Data Retention

RUNLAB retains personal data only for as long as necessary for the purposes for which the data were collected and for any additional period required by applicable law.

Retention periods may vary depending on the category of information and may reflect:

the duration of the customer relationship;
the need to fulfil Orders or provide services;
statutory accounting and tax retention requirements;
consumer protection and legal guarantee obligations;
the establishment, exercise or defence of legal claims;
security, fraud prevention and dispute-resolution requirements.

Where personal data are processed solely on the basis of consent, RUNLAB will stop processing them for that purpose after consent is withdrawn, unless another lawful basis for retaining or processing the information applies.

12. Data Security

RUNLAB implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.

Access to personal data is restricted to persons who reasonably require access for authorised business purposes.

RUNLAB reviews and updates security measures where appropriate, taking into account the nature of the processing, available technology and relevant risks.

13. Personal Data Breaches

Where a personal data breach occurs, RUNLAB will assess the incident and take appropriate measures in accordance with the GDPR.

Where required by law, RUNLAB will notify the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus and, where applicable, affected data subjects within the time limits required by the GDPR.

14. Your Rights

Subject to the conditions and limitations provided by the GDPR, data subjects may have the right to:

obtain confirmation as to whether their personal data are being processed;
request access to their personal data;
request correction of inaccurate or incomplete personal data;
request erasure of personal data;
request restriction of processing;
object to processing based on legitimate interests or to direct marketing;
receive certain personal data in a structured, commonly used and machine-readable format;
request transmission of such data to another controller where the right to data portability applies;
withdraw consent at any time where processing is based on consent;
lodge a complaint with the competent supervisory authority.

Requests to exercise data protection rights will be handled without undue delay and generally within one month of receipt, subject to any extensions permitted by the GDPR for complex or numerous requests.

RUNLAB may request reasonable information necessary to verify the identity of the person making the request.

15. Right to Object to Direct Marketing

A data subject has the right to object at any time to the processing of personal data for direct marketing purposes.

Where such an objection is made, RUNLAB will cease processing the relevant personal data for direct marketing purposes.

16. Automated Decision-Making

RUNLAB does not intend to make decisions producing legal effects or similarly significant effects on individuals solely through automated processing unless such processing is permitted by applicable law and appropriate safeguards are in place.

17. Children

RUNLAB does not knowingly process children’s personal data beyond what is reasonably necessary to provide permitted products or services.

Where an information society service is offered directly to a child and processing is based on consent, the age requirements provided by applicable Cyprus law will apply.

18. Third-Party Websites and Services

The Website may contain links to websites or services operated by third parties.

RUNLAB is not responsible for the privacy practices of independent third-party controllers. Users are encouraged to review the privacy information provided by such third parties.

19. Changes to this Privacy Policy

RUNLAB may update this Privacy Policy from time to time to reflect changes in legislation, Website functionality, services or processing activities.

The current version of the Privacy Policy will be published on the Website.

20. Complaints

If you believe that your personal data have been processed in violation of applicable data protection law, you may lodge a complaint with:

Office of the Commissioner for Personal Data Protection
Republic of Cyprus
Website: https://www.dataprotection.gov.cy/

You may also contact RUNLAB first so that we can review and address your request or concern.

21. Contact Details

For questions regarding this Privacy Policy, the processing of personal data, or the exercise of data protection rights, please contact RUNLAB using the contact details published on https://runlab.shop/.

Data Controller:
RUNLAB (CY) LIMITED
Registration No.: HE 425216
VAT/TIC: 10425216G
Vasileos Georgiou 20, DRAKOS, Flat SHP06
4047 Germasogeia, Limassol
Cyprus