Customers’ Rights Policy

We are Lifeplus Europe Ltd. Lifeplus Europe is the data controller and a data processor. Our nominated representative for data protection and the purposes of the General Data Protection Regulation (EU/2016/679) is Sam Arnold. Our registered office is Lifeplus House, Little End Road, Eaton Socon, St. Neots, Cambridgeshire, PE19 8JH, England. We may be reached at T +44 1480 224610; F +44 1480 224611; email to privacy@lifeplus.com. Personal data belonging to our Employees, our Customers and our Business Builders is processed at Lifeplus.

In this policy we explain the data rights of our Customers and our Business Builders (together “Customers”).

The processing we undertake at Lifeplus is done under four lawful bases: Contract, Legitimate Interests, Legal Obligation and Consent. Our Customers have specific rights with respect to their personal data, which vary depending on the lawful basis that justifies the processing. There are six lawful bases for processing, but Lifeplus processes Customers’ personal data using only four of them. The four lawful bases employed by Lifeplus are shown below, together with a summary of the personal data we process:

1. Contract
   • Order fulfilment
   • Third party ordering
   • Commission payment
   • Preparation of commission statements
2. Legitimate Interests
   • Direct marketing sent to Customers by email (in accordance with the Privacy and Electronic Communications Regulation) and by mail, of material relevant to Lifeplus and its products
   • Collection and conversational use of information voluntarily provided to Lifeplus by Customers (birthdays, etc.)
   • Processing for the Lifeplus business opportunity online management reporting system (“Lifeplus Teams”)
   • Transferring Customers’ personal data outside the EEA to the United States for the management purposes fully explained in the Privacy Notice.
3. Legal Obligation
   • Compliance with EU and Member States’ obligations
4. Consent
   • Responsive email direct marketing to recipients of information requested on product micro-sites
   • email or mail contact from the Lifeplus Foundation (a not-for-profit corporation in the Lifeplus group of companies focused on helping people around the world lead better lives by improving access to water, food and education resources).

The seven Rights that all Customers have regarding the processing of their personal data are shown below.

1. Right to be informed
2. Right to object
3. Right to restrict processing
4. Right to erasure (“to be forgotten”)
5. Right to rectification
6. Right of access
7. Right to data portability

Not all of these Rights apply to all lawful bases. The matrix below shows the Rights that are not available for each of the four lawful bases employed by Lifeplus:

	Erasure	Portability	Object
Contract			X
Legitimate Interests		X
Legal Obligation	X	X	X
Consent			X (but customers may withdraw consent)

Each of these Rights is more fully explained in the paragraphs below:

The Right to be Informed

Customers have the Right to be informed about the collection and use of their personal data. Our Privacy Notice explains why and how Lifeplus processes personal data, how long we retain the data for and why we need to share some personal data with external organisations. It also explains the reasons why it is necessary for us to transfer personal data for processing outside the EEA.

The Privacy Notice is published on our website, is sent to our Customers by email immediately upon their initial contact with Lifeplus, and in published form is included the Welcome Pack with their first order.

The Right to Object

Customers may object to processing based on our Legitimate Interests. Immediately upon receiving an objection, we will review the legitimate grounds for the processing we are undertaking and closely consider whether the Customer’s rights and freedoms override those grounds and if legal claims exist or may arise which would allow us to continue using the data. Objections to other Legitimate Interests processing, such as inclusion of personal data in Lifeplus Teams or transfer of personal data to the USA will be dealt with on a case basis.

A Customer who receives direct marketing communications from Lifeplus has the right to object to receiving this information at any time. Customers have been notified of this Right in the Privacy Notice that was sent to them immediately upon their initial contact with Lifeplus.

It is the policy of Lifeplus to acknowledge an objection immediately upon receipt, and to provide information on actions taken without undue delay, but in any case, within one month of receipt.

The Right to Restrict Processing

Customers have the Right to block the processing of their personal data under certain circumstances and for a certain period of time. In those instances, we may store the data, but not further process it.

We will restrict the processing of personal data under the following circumstances:

• A Customer has questioned the lawful processing of their data while the circumstances are investigated.
• The accuracy of personal data has been contested by a Customer, whereupon processing may be restricted while the accuracy of the data is being confirmed.
• A Customer has objected to the processing of personal data, pending verification of whether the legitimate interests of Lifeplus override those of the Customer.

We will inform the Customer when we decide to lift a restriction on processing their personal data.

The Right to Erasure (the right to be forgotten)

Customers have the Right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. Customers have a Right to have personal data erased under the following circumstances:

• The personal data is no longer necessary for the purpose for which it was originally collected.
• The Customer withdraws consent.
• We are processing personal data for direct marketing purposes and the objection relates to that processing.
• The Customer objects to processing and there is no overriding Legitimate Interest for continuing the processing.
• Personal data was unlawfully processed in breach of the GDPR.
• Personal data must be erased to comply with a legal obligation.

Lifeplus will comply with valid requests for erasure unless we must retain the data in defence of legal claims.

While there are extra rights of erasure that apply to children, Lifeplus does not process children’s personal data.

Lifeplus will respond to a request for erasure without delay and within one month of receipt.

If we have disclosed the personal data in question to others, if requested, we will contact each recipient and inform them of the erasure unless this involves disproportionate effort.

The Right to Rectification

Customers have the Right to have personal data rectified if it is inaccurate or incomplete.

Rectification must be accomplished within one month of notification, and if we do not take action in response to a request for rectification, we must inform the Customer that they can complain to the supervisory authority in their country of residence.

Right of Access

Customers have a Right to access their personal data so that they can be aware of and verify the lawfulness of the processing Lifeplus undertakes.

We will provide this information free of charge and without delay, but at the latest within one month of receipt of the request. If we receive numerous requests or if a request is complex, we may extend this period by up to two months but will contact the Customer first and explain why the extension is necessary.

Prior to sending data, we must verify the identity of the person making the request.

Right of Data Portability

The right of data portability is intended to allow Customers to move data easily from one IT environment to another.

This right applies only when Contract or Consent is the lawful basis for the processing, and the processing is carried out by automated means. Lifeplus has no data processes that meet these criteria.

Rights Related to Automated Decision Making and Profiling

Customers have the right to obtain information about these processes.

Automated decision-making is making a decision solely by automated means without human involvement. Profiling is automated processing of personal data to evaluate certain things about an individual. Lifeplus engages in neither of these automated processes.

This Customers’ Rights Policy is published on all Lifeplus websites at lifeplus.com/privacy-rights and is regularly reviewed.

Should you have any concerns or queries regarding this Policy or how personal data is processed at Lifeplus, please contact Sam Arnold at privacy@lifeplus.com.

Lifeplus Europe Limited is Registered in England, Company No. 3231785