Privacy Policy | Little Lenni

Welcome to the Privacy Policy of Little Lenni’s online store!

Within this document, you will find all pertinent information concerning the protection of your personal data. You will learn about your rights and how you can exercise them in situations where Little Lenni collects and processes your data.

SOLE TRADER MILICA GOLUBOVIĆ SELAKOVIĆ ENGAGED IN ARTISTIC CREATION BUSINESS “LITTLE LENNI” TIVAT, Ulica Kamelija 7, Donja Lastva, 85320 Tivat, Montenegro, registration number: 10562160, Tax number: 03564118 (hereinafter: Little Lenni, We, or Little Lenni Company) collects and processes personal data in the conduct of its activities while adhering to all relevant regulations.

This privacy policy (hereinafter: Privacy Policy) explains how Little Lenni collects your personal data, and how it uses them and manages them. Little Lenni commits to protecting and respecting your privacy, making the protection and security of our customers’, clients’, and individuals’ data with our business partners our priority.

Please carefully read this Privacy Policy to understand all important aspects regarding the protection of your privacy. If you disagree with the processing of personal data outlined in this Privacy Policy, we kindly ask you not to access our website and refrain from using our services.

DATA CONTROLLER
DEFINITIONS
TO WHOM DOES THE PRIVACY POLICY APPLY?
HOW AND WHEN DO WE COLLECT YOUR PERSONAL DATA?
PERSONAL DATA WE COLLECT, PURPOSE, AND BASIS
WHERE AND HOW ARE YOUR PERSONAL DATA STORED?
DATA PROCESSORS
HOW LONG DOES LITTLE LENNI RETAIN YOUR PERSONAL DATA?
YOUR RIGHTS
CHANGES TO THE PRIVACY POLICY

1. Data controller

Little Lenni is the data controller, meaning the entity that determines the purpose and manner of processing personal data, in accordance with the Law on Personal Data Protection (“Official Gazette of Montenegro”, No. 079/08 of December 23, 2008, 070/09 of October 21, 2009, 044/12 of August 9, 2012, 022/17 of April 3, 2017).

For more detailed information about specific personal data processed through the website, their purposes, and legal basis, please refer to section 5 (Personal data we collect, purpose, and basis).

Understanding the importance of protecting the privacy of our customers, Little Lenni has a designated individual responsible for the protection of personal data, whom you can contact by sending an email to info@littlelenni.com, or by sending correspondence to the address Palih boraca 15, 85320 Tivat, Montenegro.

Our responsibility does not extend to services provided by third parties through the website. In such cases, their terms of use and privacy policies apply.

2. Definitions

When we say:

Agency, we refer to the Agency for Personal Data Protection and Free Access to Information, located at 11 Revolution Boulevard, 81000 Podgorica, email azlp@t-com.me.

Guest, we mean a customer who places an order for products without registering an account on the Website.

Cookies or other similar technologies (e.g., “pixels” and “web beacons”), we mean text files containing information downloaded to your device when you visit a particular website. These files track your usage of the Website and generate statistical reports on website activities.

Website User, we mean any person who accesses the Website, regardless of whether they have registered or ordered products through the Website as a Guest.

Individual or You, we mean all natural persons who share personal data with us, whether they are Website Users, Guests, or Registered Users.

Processor, we mean any natural or legal person who processes data on behalf of the data controller.

Terms and Conditions, we mean the terms and conditions that form an integral part of the contract you enter into with Little Lenni Company, which are available on the Website.

Data, we mean personal data, i.e., information relating to an identified or identifiable natural person.

Registered User, we mean a person who has a registered account on the Website.

When we refer to consent, we mean a freely given statement in writing or orally recorded, in which a person agrees to the processing of their personal data for a specific purpose after being informed of the processing’s purpose. Parents or legal guardians typically provide consent for the processing of personal data of a minor. However, this is not the case when such consent goes against the minor’s interests. Similarly, heirs are responsible for providing consent for the processing of personal data of a deceased person. This consent is subject to the laws governing inheritance rights. However, processing may occur based on other legal grounds, not just consent.

Website, we mean the website owned by Little Lenni Company, which is accessible at the following link: https://littlelenni.com/.

When we mention the Law, we refer to the Montenegrin Law on Personal Data Protection (“Official Gazette of Montenegro”, No. 079/08 dated December 23, 2008, 070/09 dated October 21, 2009, 044/12 dated August 9, 2012, 022/17 dated April 3, 2017) and to the General Data Protection Regulation 2016/679 of the European Union (GDPR).

Personal data collection, we mean a structured, centralized, decentralized, or categorized set of personal data subject to processing. This data may be accessible according to prescribed criteria based on functional or geographical considerations.

3. To whom does the Privacy Policy apply?

This Privacy Policy applies, as appropriate and in relevant parts, to Individuals who are:

Website Users, regardless of whether they are Guests or Registered Users,
Customers.

Little Lenni is committed to the privacy and security of minors online. While Little Lenni’s online store is intended for the general public, it is not directed at individuals who are minors. Minors must not disclose their personal data to Little Lenni without the prior consent of their parents, legal guardians, or caregivers. If you believe we have collected information about a minor, please notify us by sending an email to info@littlelenni.com without delay.

4. How and when do we collect your personal data?

Little Lenni may collect your data in several different ways.

Most commonly, we collect data from you through various means. These include visiting the Website, making purchases and/or orders from Little Lenni Company, registering an account on our Website, subscribing to our newsletter, or requesting notification when a specific product becomes available for order. Additionally, we gather data when you contact us for customer support. Your data may also be collected if they are otherwise relevant to purchases or our business, and you directly provide them to us.

Little Lenni pays particular attention to the data collected for marketing purposes. We will only process your data for marketing purposes with your explicit consent. We always inform you separately about this. You can decide to withdraw your consent for such processing, at any time. For more information, please read the section “Your Rights”.

We collect certain data automatically when you use our Website:

During login, we store data in local storage, such as user ID, a hashtag we generate ourselves created during login, login date, and the date when you will be automatically logged out. Specifically, we have implemented a feature where every Registered User will be automatically logged out from the Website exactly 8 hours after logging in.
While using the Website, we retain notes on usage details, including date, time, location, frequency, and duration of usage;
Technical information about your computer or mobile device for system administration and analysis, including your IP address, URL clickstreams, unique device identifiers, operating system, network type, and browser;
Other information about your use of the Website, including pages you have viewed, time spent on the Website, and potential user content you have posted on our Website.

We most commonly collect this data through cookies or similar technologies. You can find more detailed information about that in our Cookie Policy.

Most of the data mentioned are necessary for us to provide you with a fully customized user experience on our Website. In this regard, if you choose not to disclose personal data that is necessary for us, we cannot guarantee that the provided information and services will fully meet your needs.

Each method of data collection serves a specific purpose and is based on legal grounds outlined in the Law. Detailed information about this can be found in the following section.

5. Personal data we collect, purpose, and basis

Purpose	Data we collect	Legal basis	Retention period
Account Registration You can register to make a purchase of our products through our e-shop or to use additional features of our Website. Account registration is not mandatory, and you can always delete your account.	– Email address; – Username; – Password.	Processing is necessary to maintain your account and to execute the contract concluded with the individual to whom the data relates or to take actions at the request of the individual before concluding the contract. Without such data, user registration would not be possible, but the contract could be concluded and executed if the customer, who is an individual, purchases a Guest. In other words, registration is not necessary to purchase our products.	Until the registered account is deleted.
Order Processing To process your order and deliver products, it is necessary to share certain personal data with us, essential for the execution of the sales contract. The data is required for contract conclusion and execution, product payment, and delivery, as well as for managing and handling complaints, objections, and claims.	– First and last name; – Email address; – Phone number; – Residential address; – Delivery address; – Credit/debit card number; – IP address.	Processing is necessary to execute the contract we conclude with you or to take action at your request before concluding the contract. Without such data, the contract could not be concluded or executed.	24 months from the date of the last transaction (e.g., delivery transaction, complaints, etc.) or from the expiration of the legal deadline for non-conformity objections, whichever is later.
Customer Support If you need any support regarding ordered products, Website usage, or user account, you can contact us via email (e.g., for additional information, how to exercise your rights, additional inquiries, complaints, the right to withdraw, or exchange products, etc.). In such situations, we will need your data to provide assistance and resolve your request.	– First and last name; – Email address; – Phone number; – Delivery address; Other data related to the issue you contacted us about, which you decide to provide.	Processing is necessary to fulfil the legal obligations of Little Lenni or is based on your consent.	Two years after the submitted inquiry.
Newsletter If you wish to stay informed about the news, offers, and promotions we provide, you can subscribe to our Newsletter on our Site.	Data collected during the account registration on the Site or Guest purchases. Later, data on completed purchases are collected to determine behaviour patterns.	Data is collected based on your consent. If you agree, you can withdraw this consent at any time. You can find more information on withdrawing consent in the “Your Rights” section. Withdrawal of consent will not affect the legality of processing performed while your consent existed.	Processing is carried out until the withdrawal of consent.
Tracking Behavior Patterns, Creating and Sending Personalized Offers During a Site visit, account registration, or Site purchase, you can choose to agree to track your behavior patterns and to receive personalized offers of products and services based on observed behavior patterns. This means that you may agree to us tracking data about your previous purchases and sending you information about other products we believe you might be interested in.	Data collected during the account registration on the Site or Guest purchases. Later, data on completed purchases are collected to determine behavior patterns.	We use your data for this purpose only if, during the account registration on the Site, you have marked your consent for Little Lenni to track your behavior and create and send personalized offers of products and services based on such behavior patterns. You are not obligated to give this consent, in which case we will not track your behavior or create and send personalized offers. You can withdraw this consent at any time, but this will not affect the legality of processing that occurred while consent existed.	Processing is carried out until the withdrawal of consent.
Informing about Product Availability for Order If a specific product is out of stock in our e-store, you can request us via the Site to inform you when that product becomes available for order again.	– Email address.	Data is collected based on your consent. If you agree, you can withdraw this consent at any time. More information on withdrawing consent can be found in the “Your Rights” section. Withdrawal of consent will not affect the legality of processing performed while your consent existed.	Processing is carried out until the withdrawal of consent.
Notification of Changes to General Terms or Privacy Policy If we have your email address, collected for one of the previously mentioned purposes, we may send you a notice about changes to the General Terms or Privacy Policy.	– Email address.	We use your data for this purpose only if you have given your explicit consent. If we do not have your consent for this purpose, we will not directly inform you about changes to these documents, but you will be able to see the notice of changes on the Little Lenni Website. If you agree, you can revoke this consent at any time. More information on withdrawing consent can be found in the “Your Rights” section. Withdrawal of consent will not affect the legality of processing performed while your consent existed.	Processing is carried out until the withdrawal of consent.
Information necessary for identification, time, and date of data subject requests to enable data subjects to exercise their rights in accordance with this Privacy Policy, as defined in Section 9.	– First and last name; – Date and time of the request; – Content of the request.	Processing is necessary to fulfil a legal obligation to which the data controller is subject.	We keep this information for one year from the resolution of the submitted request.

In addition to the aforementioned data, we collect certain personal data through cookies in accordance with the Cookie Policy.

We use Your Data solely for the purposes for which we have collected them when we have a reasonable and lawful legal basis for doing so. None of the Data we have collected are used without Your Consent or other appropriate legal basis, in accordance with this section.

Little Lenni will never:

Sell any personal data.
Disclose this information to third parties not listed in Section 7 of the Privacy Policy.
Process Your personal data in any way not covered by this Privacy Policy.

6. Where and how are your personal data stored?

We are highly committed to safeguarding your data from unauthorized or unlawful processing, accidental or unlawful loss, alteration, or unauthorized access to your personal data. With this aim in mind, we have implemented appropriate technical and organizational measures, such as controlling physical access, password security, and the like. When we deem it necessary, we conduct a review of existing measures and update them in accordance with the level of technological advancements and the costs of their implementation.

Some of the measures we apply include authorization control for access, information classification (and handling thereof), ensuring integrity and confidentiality, data backups, firewalls, encryption, and anonymization of data required for electronic payments, data encryption, and other appropriate measures. We equip our employees with the necessary knowledge and understanding of the importance and confidentiality of the security of your personal data.

However, please note that data security on the internet can never be 100% guaranteed, and thus, we cannot completely eliminate every risk associated with storing your data. Nevertheless, Little Lenni will make every effort and do everything within our capabilities to ensure the security and confidentiality of the data we process.

Each time we store Your personal data, they are stored on servers and in facilities accessible only by selected personnel and our subcontractors. All data you provide via the Website during transmission are encrypted using SSL to prevent unauthorized individuals from viewing such information. Please note that all data you send us via email are not absolutely secure, so do not send sensitive information via email. We will never ask you to provide sensitive or personal information via email; therefore, please report any such requests by sending an email to info@littlelenni.com.

We protect the personal data you provide via the internet in connection with registering a user account on our Website. Access to Your personal data is granted by entering the credentials you have chosen. These credentials are encrypted during transmission from your browser to our servers and during storage on our systems. To protect the security of your personal information, never share your credentials with others. Please notify us immediately if you suspect your registered account is compromised.

7. Data processors

To achieve the highest standard in providing our services, Little Lenni utilizes the services of third parties that assist us in accomplishing this task. At all times, we strive to provide you with fast, convenient, and secure shopping experiences, and the third parties we engage for this purpose act as Data Processors.

Data Processors include service providers we engage to maintain our Website and to deliver ordered products to your address. If you choose to make a purchase through our Website, we transfer your personal data to Data Processors only when necessary to fulfil contractual obligations. For example, we provide necessary data to courier services that deliver ordered products.

All the Data Processors we collaborate with, in accordance with the contracts we sign with them, are obligated to use the data entrusted to them exclusively in accordance with our instructions and strictly for the purpose we have specified. Data Processors are required to ensure the confidentiality of the data we have transmitted to them and are responsible for data security.

In some cases, when necessary for the execution of the contract between you and Little Lenni Company, your data may be transferred outside of Montenegro, to servers located in other countries (Germany). The servers we use to meet an adequate level of personal data protection and apply appropriate measures for personal data protection prescribed by the Law, and consent of the competent authority is not required for such transfer in accordance with Article 42, paragraph 1, points 8 and 9 of the Law on Personal Data Protection.

From the table below, you can find out who our current Data Processors are, what their role is, and where their headquarters are located.

Processor	Role	Location
Montenegro post	Delivery Services	Montenegro
Valve	IT System Maintenance Services	Serbia
	Marketing Services	Norway
Google Inc.	Analytical Services	USA
Automattic Inc.	Technical facilitation of purchases through the Website	USA
CookieYes Limited	Consent Management for the use of cookies on the Website	United Kingdom

In addition to the Data Processors listed in the table above, it is possible that we may also share your personal data with courier service providers operating in the country of your delivery address in order to fulfil our contractual obligations, namely to deliver the product you have ordered through our Website.

8. How long does Little Lenni store your data?

Little Lenni will process personal data collected to fulfil rights and obligations within the business relationship for the duration of the business relationship with the individual to whom the data pertains, except in cases where Little Lenni is obliged to retain the data after the termination of the business cooperation with the individual, based on law, consent of the individual, or on the legal interest of the data controller.

Data collected solely to provide sales transactions or other services will be retained for an additional 24 months from the date of the last transaction (e.g., delivery transaction, complaints, etc.) or from the expiration of the legal deadline for non-conformity complaints, whichever is later.

Personal data processed solely based on consent from the individual will be processed in accordance with the purpose for which they were collected until consent is withdrawn by the individual. For example, if you unsubscribe from the newsletter, we will delete your email data, unless you have provided your email address to us for other purposes. You can withdraw your consent at any time in accordance with the “Your Rights” section.

If the data is no longer needed or if you explicitly request that the collected data about you be deleted, provided that such deletion is permitted by law, we will delete or destroy the collected data in accordance with the relevant law and our internal procedures.

If a judicial, administrative, or extrajudicial proceeding is initiated, personal data may be retained until the end of such proceeding.

Furthermore, if there is a legal obligation defined by imperative regulations to retain certain data for a longer period than stated in Section 5, we are obliged to retain the data within that period.

If not otherwise specified by this Privacy Policy, Little Lenni’s internal regulations, or by law, personal data will be stored for the standard retention period of 6 years plus the current year, in accordance with Little Lenni’s internal regulations.

9. Your rights

As an individual whose personal data is processed, you have rights guaranteed by law regarding your data. Your rights are as follows:

9.1 Right of Access

You have the right to request from Little Lenni information on whether we process your personal data. We will provide the requested information in writing.

If your data is being processed, the information will also include additional details about:

Identity of the data controller,
Content of the processed data,
Purpose and legal basis for processing personal data,
Source of the data, to the extent of available information,
Third-party or user who has the right to process your personal data and the legal basis for providing your data for use,
Method of automatic processing of personal data if such processing is carried out.

Additionally, the right of access includes providing information about the identity of the data processor of personal data, if you have explicitly requested such information.

Before providing the information upon your request, we will verify your identity. We strive to provide the requested information as soon as possible, but no later than within 15 days from the date of submitting the request.

9.2 Right to Amendment and Correction

We review and verify all data we process as accurate and complete whenever possible, updating it regularly. If you believe that the data is incomplete or incorrect, you have the right to request Little Lenni to amend, correct, or delete incomplete or inaccurate personal data.

Upon completion or amendment of personal data, Little Lenni will inform you within eight days.

9.3 Right to Erasure (Right to be Forgotten)

You have the right to request Little Lenni to erase your personal data if you believe that their processing is not in accordance with the law unless there is a legal obligation to retain such data or a legal basis for rejecting the request for data deletion.

Upon completion of the deletion of personal data, Little Lenni will inform you within eight days.

9.4 Right to Object

If the data controller of personal data does not comply with the request of the individual to exercise the rights from this section or rejects such request, the individual has the right to object to Little Lenni in accordance with the special law or to request protection of rights from the supervisory authority.

9.5 Right to Withdraw Consent

If the processing of personal data is based on your prior consent, you have the right to withdraw that consent at any time.

You can withdraw consent by sending an email to info@littlelenni.com, or by sending a letter to the address Ulica Palih boraca 15, 85320 Tivat, Montenegro.

9.6 Right to Restriction of Processing

In certain situations, you have the option to restrict access to your data, both for us and / or third parties, in specific processes or entirely. This option is available to you if you dispute the accuracy of the data during the period allowing us to verify its accuracy, believe that the data are no longer necessary for the processing purpose, or have lodged a complaint with the supervisory authority, during the assessment process of predominant legitimate interests.

9.7 Right to Data Portability

If you have previously provided us with personal data, you have the right to receive back that data in a structured, commonly used, and electronically readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the data was provided, provided that the following conditions are met:

processing is automated,
and processing is based on your consent or on a contract with you.

9.8 Right to Lodge a Complaint

If you have any questions or requests regarding your personal data, please contact us at info@littlelenni.com, and we will respond as soon as possible, but no later than within 30 days.

If you are not satisfied with our response, you can also contact the relevant supervisory authority in the country where you reside or the Agency for Personal Data Protection and Free Access to Information, Boulevard of the Revolution No. 11, 81000 Podgorica, email azlp@t-com.me.

9.9 Contact for Exercising Rights

For all questions, requests, and information regarding the processing of personal data and exercising rights in this area, please contact us at:

Email address: info@littlelenni.com

By post: ENTREPRENEUR MILICA GOLUBOVIĆ SELAKOVIĆ WHO PERFORMS BUSINESS ACTIVITY ARTISTIC CREATION “LITTLE LENNI” TIVAT, Ulica Palih boraca 15, 85320 Tivat, Montenegro.

Each of these communication channels must enable our staff to identify you in accordance with applicable procedures.

If you believe your rights have been violated, you can submit a request for the protection of rights to the Agency for Personal Data Protection and Free Access to Information, Boulevard of the Revolution No. 11, 81000 Podgorica, email azlp@t-com.me

10. Amendments to the Privacy Policy

Little Lenni regularly reviews and updates information on the processing of personal data in accordance with changes in its own business processes or based on obligations arising from relevant regulations. The updated rules will apply from the moment of publication on the Website.

We will always publish the current version of the Privacy Policy on the Website.
If significant changes occur, we’ll promptly update the Website and notify you via email. If you continue to use the Platform after changes to the Privacy Policy, we will deem that you have accepted all such changes.

This Privacy Policy is effective from February 22nd, 2024.