LC Waikiki: The Online Shopping Address for Chic in Clothes

Categories

Following the implementation and the obligations arising from Law 124/2024 “On Personal Data Protection” (“Law 124/2024”) we hereby provide you with the information regarding the processing of your personal data:

DATA CONTROLLER

LC Waikiki Retail AL Sh.p.k., is a limited liability company, registered with National Business Center with Unique Identification Number L01508008R, with legal seat located at the address: “Rruga “AbdylFrashëri”, Ndërtesa 8, Hekla Center, Shkalla C, NjësiaBashkiake Nr. 5, Kodipostar 1019, Tiranë, Shqipëri”.

And

LC Waikiki Magazacilik Hizmetleri Ticaret Anonim Sirketi A.S., with legal seat located at the address: “15 TemmuzMah. Gulbahar Cad. No: 41 34212 Bagcilar – Istanbul, Turkey”, with registry number 357092 (hereinafter referred to as the “Joint Controllers” or “Controller” or “LC Waikiki”).

LC Waikiki aims to implement the Website https://www.lcwaikiki.al (“Website”) and the Mobile Applicationhttps://apps.apple.com/us/app/lc-waikiki-online-shopping/id6743737857 and https://play.google.com/store/apps/details?id=com.lcwaikiki.android.global(“Mobile App”) for purpose of exercising e-commerce activity.

LC Waikiki shall collect and process customer’s personal data, who visit, use or access the Website and/or Mobile App, for the purpose and in compliance with the terms and conditions determined herein below in this Privacy Policy (“Privacy Policy”).

The security of your personal data is important to us and we take the utmost care to protect it.

This Privacy Policy aims to inform you, as a data subject, about the personal data we collect and process, the purposes of such processing and you rights in relation to your personal data.

LEGAL BASIS OF PROCESSING

The Joint Controllers shall collect and process your personal data in compliance with the legal grounds stipulated in Article 7 point (a), (b) and (dh) of Law 124/2024.

Legal Grounds	Justification
Consent (Article 7 point (a) of Law 124/2024)	LC Waikiki may process your personal data based on your explicit consent for specific purposes such as subscribing to newsletters, receiving promotional offers, or participating in marketing campaigns. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Performance of a Contract (Article 7 point (b) of Law 124/2024) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract	When you place an order through LC Waikiki’s Website/Mobile App, a distance sales contract is established between you and LC Waikiki. The processing of your personal data is necessary for the conclusion and performance of this contract and for fulfilling our obligations arising from it. Such processing includes but is not limited to: creating and managing your user account, processing orders, issuing invoices, managing payments, arranging delivery, and handling returns, refunds, or warranty claims. Without this processing, LC Waikiki would not be able to conclude or perform the contractual relationship. The functioning of the LC Waikiki Website and Mobile App requires the processing of certain personal data that is strictly necessary for the performance of the contract concluded with user/data subject upon registration and continued use of the digital services. In particular, the processing of identification and authentication data is required to create and manage the user account, verify the user’s identity and enable access to essential Website and Mobile App functionalities. Without such processing, LC Waikiki would not be able to provide the digital services requested by the data subject.
Legitimate interest (Article 7 point (dh) of Law 124/2024 Processing is necessary for the compliance with a legal interest pursued by the Controller 1 or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.	LC Waikiki may process certain personal data when it is necessary for the purpose of legitimate interest pursued by LC Waikiki, provided that such interests are not overridden by your fundamental rights and freedoms. This includes processing activities for preventing and detecting fraud or misuse of service; ensuring the security, integrity availability and the proper functioning of the Website or Mobile App and IT systems; performing internal analytics to improve user experience; maintaining minimal records necessary for legal claims; whenever processing is based on legitimate interest, LC Waikiki conduct a balancing test (legitimate Interest Assessment) to ensure that such processing does not disproportionately affect your privacy.

PERSONAL DATA PROCESSED AND THE PURPOSES FOR PROCESSING

LC Waikikicollects and processes the following categories of personal data within the scope of its e-commerce activities conducted through its Website and/or Mobile App in accordance with the personal data processing conditions provided in Articles 6, 7 and 8 of Law 124/2024 for the following purposes:

Personal data collected	Purpose of processing	Legal Basis
Identification Data: Name, Surname; Contact Details:Email address, Mobile phone number. Account and Authentication Data:Account ID, Username, Password	Website and Mobile App usage – Account creation/registration and management - We need to process your data to identify you as user or as guest; to create, manage and maintain your online customer account, enabling you to view your orders, preferences and purchase history. Synchronize the user profile across devices	Performance of a contract (Article 7, point (b) of Law 124/2024)
Identification Data: Name, Surname; Contact Details:Email address, mobile phone number, billing and delivery address; Shopping and Transaction Data:Purchase and payment history, shopping preferences, shopping cart content, refund and return details;	Order processing and contract performance -To process, confirm and fulfill your online orders/purchases, issue invoices, manage payments, deliver products and handle returns, refunds or warranty claims.	Performance of a contract (Article 7, point (b) of Law 124/2024)
Identification Data:Name, Surname; Contact Details:Email address, mobile phone number, billing and delivery address; Shopping and Transaction Data: interactions with Customer Support Service.	Customer service and communication -To provide assistance and respond to your inquiries, requests, or complaints and provide updates related to your orders, deliveries or returns.	Performance of a contract (Article 7, point (b) of Law 124/2024)and Legitimate interest (Article 7, point dh of Law 124/2024)
Identification Data: Name, Surname; Contact Details:Email address, mobile phone number; Profiling and Website/Mobile App Usage Data: Information collected automatically through cookies and similar technologies, including age, gender, IP address, traffic data, geolocation data, device information (Device ID, software version connection used, operating system, browser used) and keywords searched according to your interests. Shopping and Transaction Data: purchase and payment history;	Marketing and promotional activities -To send newsletters, promotional messages and special offers about LC Waikiki products or services if you have given your consent. Personalize the services we offer you and enable us to give you recommendations based on your interactions with us in the Website/Mobile App and an analysis of your user profile, i.e., based on your purchase and browsing history.	Consent (Article 7, point (a) of Law 124/2024)
Identification Data: Name, Surname; Account and Authentication Data: Login credentials such as account ID, username and password; Profiling and Website Usage Data: IP address, device information, traffic data	Fraud prevention and information security -To prevent fraudulent activities, misuse of services or unauthorized access and to ensure the security of our Website/Mobile App, IT systems and payment operations.	Legitimate interest (Article 7 point (dh) of Law 124/2024)
Profiling and Website Usage Data:Information collected automatically through cookies and similar technologies, including age, gender, IP address, traffic data, geolocation data, device information (Device ID, software version connection used, operating system, browser used) and keywords searched according to your interests.	Improvement of services and user experience -To use behavior analytics tools that help us understand how users interact with our Website/Mobile App, such as how pages are rendered and how users move, click, or scroll. This enables us to make data-driven decisions, identify confusing elements, test new ideas, analyze user behavior, and improve the customer experience. To improve and streamline the services offered to customers, through customer satisfaction surveys.	Legitimate interest (Article 7 point (dh) of Law 124/2024)
Identification Data: Name, Surname; Contact Details: Email address, mobile phone number, billing and delivery address; Shopping and Transaction Data:purchase and payment history, refund and return details;	Legal compliance and protection of rights -To comply with legal obligations arising from tax, accounting and consumer protection laws and to establish, exercise or defend legal claims; To represent Joint Controllers before courts, public institutions, and other competent authorities	Legitimate interest (Article 7 point (dh) of Law 124/2024)
Profiling and Website/Mobile App Usage Data: Information collected automatically through cookies and similar technologies, including age, gender, IP address, traffic data, geolocation data, device information (Device ID, software version connection used, operating system, browser used) and keywords searched according to your interests.	Advertising cookies and online identifiers -To collect data through advertising cookies, advertising technologies, and other online identifiers, including search history and accessed content on our website/Mobile App, to target LC Waikiki advertising banners on social media platforms or other websites you visit.	Consent (Article 7, point (a) of Law 124/2024)
Account and Authentication Data: Login credentials such as account ID, username and password; Profiling and Website/Mobile App Usage Data: Information collected automatically through cookies and similar technologies, including age, gender, IP address, traffic data, geolocation data, device information (Device ID, software version connection used, operating system, browser used) and keywords searched according to your interests.	IT System management and security -to manage communication and IT Systems, conduct audits, ensure database security and maintain the integrity of our IT infrastructure, preventing fraudulent access,	Legitimate interest (Article 7 point (dh) of Law 124/2024)
Technical, infrastructure and Security Data information generated or recorded when you access and use the Website and/or Mobile Application, including technical identifiers (such as IP address and device identifiers), device and software information, access timestamps, system and application logs, performance and stability metrics, server response data, and security-related records (including authentication events and automated protection logs).	Such data is processed for the purposes of maintaining and ensuring the proper functioning, stability and continuity of the digital infrastructure; diagnosing errors, crashes and service disruptions; monitoring and improving the technical performance of the platform; detecting, preventing and responding to cybersecurity incidents; protecting user accounts from unauthorized access; and ensuring the integrity and security of the systems.	Legitimate interest (Article 7 point (dh) of Law 124/2024)

OBLIGATION TO PROVIDE PERSONAL DATA

The processing of your personal data under this Privacy Policy is necessary for the fulfillment of the Joint Controllers purposes clearly specified in Section C, namely for the use of the Website and/or Mobile App and performance and management of e-commerce activities through the Website and Mobile App.

You are not obliged to provide your personal data to LC Waikiki; however, failure to do so may prevent you from using certain functionalities of the Website and/or to not use the Mobile App.

Your explicit consent is required for processing personal data on the consent legal ground, for example, for direct marketing purposes. You may provide your explicit consent to receive marketing communications from LC Waikiki, including newsletters, promotional offers and other commercial messages, by ticking the explicit consent checkbox in the Website/Mobile App.

In any case, you have the right to freely withdraw your consent at any time by contacting LC Waikiki, without affecting the lawfulness of the processing carried out prior to such withdrawal.

METHOD OF COLLECTING AND PROCESSING PERSONAL DATA

Joint Controllers jointly determine the purposes and means of processing in accordance with Law 124/2024.

Joint Controllers have equal access to your personal data and they jointly collect and process your personal data when you interact with the LC Waikiki Website and/or Mobile App.

Your personal data may be collected and processed when you create or manage a user account, log in, place an order, fill in on line forms, subscribe to newsletters, configure country or application settings, enable application permissions, receive notifications, use location-based or personalized features, contact customers support through any available channel, or otherwise use and interact with the Website and/or Mobile App.

RIGHTS OF THE DATA SUBJECT

As a data subject, you are entitled to exercise the following rights against the Joint Controllers, set forth under the Article 13-20 of Law 124/2024:

The right of access – you are entitled to have a free of charge confirmation from the Controller within 30 days as of your request date, consisting of whether the Controller is processing your personal data, the purpose of processing, the existence of the automated decision making including profiling, the envisaged period for which the personal data shall be stored, the processing legal base, personal data category, the receiver and the receiver’s category of the personal data as well as the security measures in case of international transfer, the existence of the rights of the data subject.
The right to rectification – you are entitled to request the correction and/or fulfillment of your personal data from the Controller and the latter should comply within 30 days as of your request date;

The right to delete personal data– you are entitled and the Controller is obliged to delete your processed personal data, within 30 days as of the receipt of your request, in case: (i) the personal data are no longer necessary for the purpose they have been collected and/or processed; (ii) the Data Subject withdraws the consent and there is no other legal ground for processing; (iii) the Data Subject opposes the processing in compliance with Law 124/2024; (iv) the personal data have been unlawfully processed; (v) the personal data should be erased in order for the Controller to comply with a legal obligation.

Controller reserve the right to refuse the deletion of your data when processing is required: (i) for the exercise of the right of freedom of expression and information; (ii) in order to comply with legal obligation that applies to us as a personal data Controller ; (iii) for reasons of public interest in the area of public health; (iv) for archiving purposes in the public interest, scientific or historical research purposes of statistical purposes in so far as the deletion of data is likely to render impossible or seriously impair the achievement of the objectives of processing; (v) to establish, exercise or defend a right in court or public authority.

The right to be forgotten– when exercising your right to delete personal data, you are also entitled to request the Controller to inform other processors which processes your personal data, with regard to your request for deletion of the personal data and such processors should comply with your request; upon your request the Controller shall notify each recipient to whom your personal data has been disclosed for erasure purposes.
The right to restriction of processing – you have the possibility to request the restriction of the processing in compliance with Article 17 of Law 124/2024 in the following cases: (i) Contest the accuracy of the data - in this case, at your request, we will restrict the processing for the period we perform the necessary checks on the accuracy of your data; (ii) Data processing is illegal and you do not want to delete your data; (iii) the Controller no longer needs your data for processing, but processed data about you is necessary to establish, exercise or defend a right in court; (iv) You opposed the processing of your data under our legitimate interest, including the creation of profiles based on this basis - in this case, at your request, we will restrict the processing for the period in which we verify that our legitimate rights do not prevail over your rights.
The right to data portability– your are entitled to receive your personal data in a structured format so that they can be transferred to another operator automatically where (i) the processing is based on consent or performance of a contract and (ii) the processing is carried out by automated means.
The right to object– you are entitled to object at any time the processing of your personal data (i) for reasons relating to your particular circumstances and if the processing of your data is based on our legitimate interest. We will cease processing of your data unless we demonstrate that we have legitimate and compelling reasons that justify processing and those reasons prevail over your interests, rights and freedoms or whether the purpose of processing is to establish, exercise or defend a right in court. (ii) for direct marketing purposes, including the creation of profiles related to that direct marketing.
The right to not be subject to an automated individual decision– you are entitled to not be subject to a decision based solely on automated processing, including profiling, which produces legal effect concerning you or similarly significantly affect you, except (i) the automatic decision is required to conclude or execute a contract between you and the Controller; (ii) the automatic decision is authorized by applicable law to the Controller and also provides for appropriate measures to protect the legitimate rights, freedoms and interests of the data subject; (iii) the automatic decision is based on your explicit consent.

Automated decision-making– means and involves decision made entirely by algorithms or other automated processes without human involvement and such process often incorporate profiling;

Profiling – means any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

The right to withdraw the consent – if the processing is based on the legal ground of consent, you are entitled to freely withdraw your consent at any time by sending us a request.
The right to claim compensation for damages – you are entitled to demand compensation for the damages that you have suffered as a result of an unlawful processing of your personal data;
The right to object direct marketing – you are entitled to request at any time that your personal data to not be used for direct marketing;
The right to complain – you are entitled to submit a complain to the Commissioner for Personal Data Protection and Information Right.

DATA RETENTION

LC Waikiki retains personal data only for as long as necessary to fulfill the purposes for which they are collected, as follows:

Category of Personal Data	Retention Period
Identification Data	For the duration of the contractual relationship plus a maximum of 10 years, during which any related rights may be exercised before the statute limitation expires.
Contact details	For the duration of the contractual relationship plus a maximum of 10 years, during which any related rights may be exercised before the statute limitation expires.
Account and Authentication data	For as long as the account is active; account will be disabled and closed after 2 years of inactivity since last login.
Shopping and Transaction Data	For the duration of the contractual relationship plus a maximum of 10 years, during which any related rights may be exercised before the statute limitation expires.
Marketing	For the duration of your consent or until you unsubscribe or cancel your subscription to the newsletter. Likewise, we will show you personalized ads until you change your device, browser and or cookies settings so that permission to do so is revoked.
Profiling and Website Usage Data	For the duration of the given consent or until the data is no longer necessary; profiling data for legitimate interest is retained for a period of 5 years, then anonymised for statistical purposes.
Technical, infrastructure and Security Data	Technical, infrastructure and security-related data shall be retained only for as long as necessary to ensure operational stability, perform troubleshooting and trend analysis, and detect, investigate and mitigate security incidents, and in any case for no longer than 12 months. Such data shall be securely deleted or anonymized once it is no longer required for these purposes.

DATA SHARING

The Controller may share your personal data if required by law or contracts with:

Government authorities;
IT Service Providers;
Legal & Accounting advisors;
Financial institutions

INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

Joint Controllers may decide to transfer your personal data in case it is necessary for the accomplishment of the purpose of processing, to the following data processors:

International transfer to processors located in countries that provide adequate level of protection under Law 124/2024, namely:

MS Azzure acting as a data processor (Data Center name: Azure West Europe) with legal seat located at the address: “Beekstraat 354, 1118 CZ Luchthaven Schiphol, Noord-Holland, Netherlands”, with servers located in Netherlands, by virtue of the processing agreement dated 31.03.2025 and 31.03.2028, entered into between LC Waikiki MagazacilikHizmetleri Ticaret AnonimSirketi A.S and MS Azzure.

You have the right to request information about the content and key safeguards of the Data Processing Agreement (DPA) governing the processing of your personal data, and to obtain a copy of the DPA, by contacting us at the email address indicated below.

International transfer to processors located in countries that does not provide adequate level of protection under Law 124/2024, based on the approved Standard Contractual Clauses in compliance with Law 124/2024, namely:

PoliTelekominikasyonİletişimBilişimDanişmanlikReklamTurizm Sanayi Ve Ticaret Limited Şirketi acting as a data processor with legal seat located at the address: “Yukari Mah. Yanki Sk. Bayram Apt No: 9 İç Kapi No: 7 Kartal/ İstanbul”, with servers located in Turkey.
Sosyo Plus Bilgi BilişimTeknolojileriDan.Hiz.Tic.A.Ş.acting as a data processor with legal seat located at the address: “Sultan Selim Mh. Libadiye Sk. No:3 34415 Kağıthane/ İstanbul”, with servers located in “Amazon Web Services – 4033 Citywest Avenue, Cooldown Commons, County Dublin, Ireland”;

You have the right to request information about the content and key safeguards of the Standard Contractual Clauses (SCC) used for international data transfers, and to obtain a copy of the SCC, by contacting us at the email address indicated below.

JOINT CONTROLLERS AND ESSENCE OF THE JOINT CONTROLLER AGREEMENT

Identity of the Joint Controllers

Purpose and Basis of Joint Controllership

The Joint Controllers jointly determine the purpose and means of processing personal data through the LC Waikiki Website and Mobile Application, including but not limited to, providing digital services, distance sales, user account management, platform security, and compliance with legal obligations.

Allocation of Responsibilities

In accordance with Article 24 of Law No. 124/2024, the Joint Controllers are jointly responsible for the processing of personal data carried through the LC Waikiki Website and Mobile Application in line with this Privacy Policy, including compliance with the applicable data protection principles, the lawful processing of personal data and the fulfillment of the data subjects’ rights.

Exercise of Rights and Contact point

Data subjects may exercise their rights under this Privacy Policy and Law 124/2024 with respect to each of Joint Controller.

The following contact details apply to both Joint Controllers for any inquiries regarding the processing of your personal data, including but not limited to the exercise of your rights:

Address: “Rruga “AbdylFrashëri”, Ndërtesa 8, Hekla Center, Shkalla C, NjësiaBashkiake Nr. 5, Kodipostar 1019, Tiranë, Shqipëri”
Email: data.protection@lcwaikiki.com

Availability of the Essence of the Joint Controller Agreement

This section represents the essence of the joint controller’s arrangement and is made available to data subject in accordance with Article 24 of Law 124/2024.

PERSONAL DATA SECURITY

LC Waikiki implements appropriate organizational, technical and physical measures to ensure the security and confidentiality of personal data it processes, in compliance with applicable law.

Organizational measures:

All employees and third parties working with LC Waikiki are trained on data security upon hiring and at periodic intervals thereafter to maintain up-to-date knowledge.
Employees accessing personal data are required to provide a signed letter of undertaking regarding their responsibility for data protection.
Non-compliance with policies and procedures results in disciplinary actions.
Personal awareness is reinforced through e-training on privacy and data security and applicable data protection laws.
Data is classified and labeled according to its confidentiality level and internal/external sharing follows protocols on this classification.

Technical measures

IT Systems are protected by firewalls, proxy servers, network segmentation, multi-factor authentication and password-protected protocols.
Access to personal data is strictly controlled, subject to approval and all administrator actions are logged.
Backup procedures and Disaster Recovery Plans are implemented to prevent data loss.
Periodic vulnerability assessments, penetration tests, code scans and corrective actions are performed.
Systems are hardened, malware prevention software is deployed and updated and access rules are regularly reviewed.
Audit trails are maintained for all modifications in IT systems, ensuring traceability.
Personal data is securely destroyed to prevent recovery when no longer necessary.
An ISO/IEC 27001 Information Security Management System certification is held, with regular independent audits to ensure adherence to the highest security standards.

Physical measures

Servers and storage facilities are located in secured areas with strict access controls, including CCTV, ID card management and human security.
Environmental conditions of storage locations are monitored centrally to prevent damage to data storage media.
All digital media containing personal data is protected with password or cryptographic methods to meet data security requirements.

Compliance and Monitoring

IT Risks assessments are conducted as part of the corporate risk management process.
Systems are monitored to detect or prevent unauthorized data transfers.
All changes and backups are logged and periodically reviewed to ensure security compliance.

CHANGES TO THE PRIVACY POLICY

LC Waikiki keeps such Privacy Policy under regular reviews and updates if needed. Any changes to this Privacy Policy shall be indicated through a visible notice in our Website and Mobile App. This Privacy Policy was last updated on 15.02.2026.

Support

HELP

Corporate

POLICIES