Privacy Policy

Generalities

Regulation 2016/679 regarding the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as GDPR or Regulation) was adopted by the European Parliament and the Council of the European Union on April 27, 2016, its provisions being directly applicable from May 25, 2018. This Regulation expressly repeals Directive 95/46/EC, thus replacing the provisions of Law no. 677/2001 (currently repealed).

The Regulation is directly applicable in all Member States, protecting the rights of all individuals located within the European Union. Materially, the Regulation applies to all controllers processing personal data. The Regulation does not apply to the processing of personal data relating to legal persons and, in particular, legal entities, including the name and type of legal entity and the contact details of the legal entity.

Personal data are defined as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors specific to his physical, physiological, genetic, mental, economic, cultural, or social identity.

Processing of personal data involves any operation or set of operations performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction.

Identity of the Controller

Considering Article 4(7) of the Regulation, which defines the notion of “controller” as a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, the controller processing personal data through this website is Cool Web Design Srl, located at 41 1 Mai Street, Bl M1, Ap 6, Dej, registered at the Trade Registry Office under no. J12/610/2022, having VAT number 45593498, legally represented by Pop Andrei Catalin, with contact details [email protected], 0746062250.

Collection of Personal Data

What Personal Data Is Collected

The controller of this website collects, stores, and processes the following personal data about you:

  • Name, Surname
  • Contact details (such as email, phone, fax)
  • IP

Obtaining Consent

Generalities

For the processing of personal data to be legal, the GDPR stipulates that it should be based on a legitimate reason, such as the execution or conclusion of a contract, fulfilling a legal obligation, or based on valid consent previously expressed by the data subject. In the latter case, the controller is obliged to be able to demonstrate that the person in question has given their consent for that processing. Consent given under the scope of Directive 95/46/EC remains valid if it meets the conditions set by the GDPR.

Granting consent must be made through an unequivocal statement or action that constitutes a freely given, specific, informed, and clear indication of the data subject’s agreement to the processing of their personal data. If the consent of the data subject is given in the context of a declaration, whether in electronic or written form, which also concerns other matters, the request for consent must be presented in a way that distinguishes it clearly from the other matters, even by ticking a box. For the processing of personal data to be legal, the GDPR stipulates that it should be based on a legitimate reason, such as the execution or conclusion of a contract, fulfilling a legal obligation, or based on valid consent previously expressed by the data subject. In the latter case, the controller is obliged to be able to demonstrate that the person in question has given their consent for that processing. Consent given under the scope of Directive 95/46/EC remains valid if it meets the conditions set by the GDPR.

Cookies

This site uses cookies. They do not harm your computer and do not contain viruses but contribute to an easier, more efficient, and secure use of the site. They are small text files that are stored on your computer and saved by the browser used.

Many of the cookies used are called “session cookies,” which are automatically deleted after your visit to this site. Others remain stored on your computer’s memory until you delete them, enabling the recognition of the browser on a subsequent visit.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be configured to automatically accept cookies under certain conditions or to always reject them, or to automatically delete cookies when closing the browser. Disabling cookie modules may limit the functionality of this website.

Cookies that are necessary to enable electronic communications or to provide certain functions you wish to use (such as the shopping cart) are stored in accordance with the provisions of art. 6 para. 1 lit. f) of the GDPR, according to which processing is lawful only if and to the extent necessary for the legitimate interests pursued by the controller or by a third party. Therefore, the operator of this website has a legitimate interest in storing certain cookies to ensure error-free optimization. Other cookies (such as those used to analyze your browsing behavior) are also stored and will be treated separately in this document.

Contact Form

If you send us inquiries through the contact form, we will collect the data entered in the form, including the contact details you provide, to respond to your inquiries and any subsequent ones. We do not transmit this information without your permission. Therefore, we will process all data you enter into the contact form only with your consent [in accordance with the provisions of art. 6 para. 1 lit. a) GDPR1]. You can revoke your consent at any time, an informal email to this effect being sufficient. Data processed before receiving your request may be processed legally. We will retain the data you provide on the contact form until:

  • you request deletion of the data;
  • you revoke consent for storage or if
  • the purpose for storage is no longer valid.

Any mandatory legal provisions, especially those regarding mandatory data retention periods, are not affected by the above.

Contact via Email, Telephone, or Fax

If you contact us via email, telephone, or fax, your request, including all personal data you provide, will be stored and processed by us for the purpose of resolving your request, based on your expressed consent.

Therefore, we will process all data you provide under the following provisions of the GDPR:

  • only with your consent – in accordance with the provisions of art. 6 para. 1 lit. a) GDPR
  • for the performance of a contract or in the pre-contractual stage – in accordance with the provisions of art. 6 para. 1 lit. b) GDPR
  • for fulfilling the purpose and legitimate interest pursued by us, namely the efficient processing of requests sent by you – in accordance with the provisions of art. 6 para. 1 lit. f) GDPR.

We will retain the data you provide in this way until:

  • you request deletion of the data;
  • you revoke consent for storage or if
  • the purpose for storage is no longer valid, in all situations except for mandatory data retention periods.

Registration on the Site

You can register on this website to access additional functions and services offered by our company. In this regard, the data entered by you will be used and processed for using the respective service or function for which you registered. The mandatory data requested during registration must be provided by you in full, otherwise, the registration process will be rejected.

To inform you about important changes, such as those in the scope of our website or technical changes, we will use the email address specified by you at the time of registration.

The processing of personal data provided in the registration procedure is done only with your consent and in accordance with the provisions of art. 6 para. 1 lit. a) GDPR. You can revoke your consent at any time, an informal email to this effect being sufficient. We will continue to store the data collected during registration as long as you remain registered on this website, but mandatory storage periods remain valid and will be adhered to.

Comments Section

By accessing the Comments section, certain personal data (such as, but not limited to, email address, username, IP address) will be processed and stored, some of which are necessary from the perspective of preventing illegal actions or defamatory content.

There is also the possibility to subscribe to this site to receive comments through the provided email, so:

  • Your email address may be verified through a confirmation email;
  • You can unsubscribe at any time by accessing the link in the email content, and the data provided by you will be immediately deleted, except for data provided through access to other sections (for example, when subscribing to a newsletter), which will remain stored;

Purpose of Processing Collected Data

Some of the data collected on this site is used for:

  • Providing services we offer for your benefit (for example, resolving issues of any kind related to our products and services, providing support services, etc.)
  • Optimal functioning and optimization of this site (statistical and analytical) – We constantly aim to provide you with the best experience on our site, which is why we may collect and use certain information regarding your satisfaction level during site navigation, invite you to complete suggestion questionnaires, and the like.
  • Periodic information to users – We want to keep you informed about our offers. In this regard, we may send you various types of messages containing general and thematic information, information about offers or promotions, as well as other commercial communications such as market research and opinion surveys. For communications of this kind, we rely on the prior consent obtained from you. You can change your mind and withdraw your consent at any time.

The processing of personal data is carried out in accordance with the provisions of the General Data Protection Regulation, based on both the consent of the data subject and the reasons for the compliant execution of contracts or the realization of the legitimate interests of the controller (except where the fundamental interests or rights and freedoms of the data subject prevail, requiring the protection of personal data, especially when the data subject is a child).

User Rights

Your rights regarding personal data and the means of exercising them are: Right to Information, Right of Access, Right to Rectification, Right to Erasure, Right to Restriction of Processing, Right to Data Portability, Right to Object, Right Not to be Subject to Automated Decision-Making, Right to Lodge a Complaint and Appeal to Courts, Right to Withdraw Consent.

  • Right to Information – you can request information about the processing activities of your personal data, the identity of the controller and its representative, or about the recipients of your data;
  • Right of Access – you can obtain confirmation from the controller whether personal data concerning you is being processed and, if so, access to that data and the following information: processing purposes; categories of personal data concerned; recipients or categories of recipients to whom the personal data has been or will be disclosed, especially recipients in third countries or international organizations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the right to request from the controller rectification or erasure of personal data or restriction of processing or to object to processing, etc;
  • Right to Rectification – you can rectify inaccurate personal data or complete it;
  • Right to Erasure – you can obtain the erasure of data if the processing was not legal or in other cases provided by law;
  • Right to Restriction of Processing – you can request restriction of processing in cases where you contest the accuracy of the data, as well as in other cases provided by law;
  • Right to Data Portability – you can receive, under certain conditions, the personal data you provided to us in a format that can be automatically read, or you can request that such data be transmitted to another operator;
  • Right to Object – you can object, in particular, to processing based on the legitimate interest of the controller;
  • Right Not to be Subject to Automated Decision-Making – you can request and obtain human intervention with regard to that processing or express your own point of view on such processing;
  • Right to Lodge a Complaint and Appeal to Courts – you can file a complaint regarding the processing of personal data with the National Supervisory Authority for Personal Data Processing and/or you can address the courts to enforce your rights;
  • Right to Withdraw Consent – in cases where processing is based on your consent, you can withdraw it at any time. The withdrawal of consent will only have effects for the future, and the processing carried out before the withdrawal will remain valid.

Obligations of the Data Controller

Hosting

Personal data registered on this website is stored on our own servers. The processing of the provided and stored data complies with the following legal provisions:

  • Art. 6(1)(a) GDPR – processing of personal data is based on your consent, obtained after correct and complete information;
  • Art. 6(1)(f) GDPR – data processing is carried out for the purpose of our legitimate interests.

Data Encryption

This site uses SSL encryption for security and the protection of the transmission of confidential information. You can recognize this encryption by the lock icon in the browser’s address bar and the change from “http://” to “https://” in the browser’s address. Once this type of encryption is activated, transmitted or transferred data cannot be viewed by third parties.

According to GDPR, in case a personal data breach is likely to result in a high risk to your rights and freedoms, the operator of this website will inform you without undue delay, unless supplementary provisions of the same Regulation apply (Art. 34(3)).

Data Protection Officer

Given that GDPR provisions (Art. 37(1)) regarding the appointment of a Data Protection Officer do not apply:

  1. when processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
  2. when the core activities of the operator or the person empowered by the operator involve processing operations that, by their nature, scope, and/or purposes, require regular and systematic monitoring of data subjects on a large scale; or
  3. when the core activities of the operator or the person empowered by the operator consist of large-scale processing of special categories of data under Article 9 or personal data relating to criminal convictions and offenses, as referred to in Article 10.

Regarding the obligation to appoint a Data Protection Officer, for any information or clarifications regarding the functioning of this website, please contact us using the provided details:

  • Name: Andrei Catalin Pop
  • Email: [email protected]
  • Phone: 0746062250
  • Fax:
  • Correspondence Address: Strada 1 Mai, Nr 41, Bl M1 Ap 6

Records of Processing Activities

According to GDPR, the data controller or the person empowered by the data controller should keep records of processing activities under its responsibility for a reasonable period. These records should contain all the following information:

  • name and contact details of the data controller
  • purposes of the processing;
  • description of the categories of data subjects and categories of personal data;
  • categories of recipients to whom the personal data have been or will be disclosed;
  • if applicable/possible:
    • transfers of personal data;
    • anticipated time limits for erasure of different categories of data;
    • a general description of the technical and organizational security measures.

Obligations for Small Enterprises: The detailed obligation mentioned earlier does not apply to an enterprise or organization with fewer than 250 employees unless the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects, is not occasional, or involves special categories of data or personal data related to criminal convictions and offenses.

Technical and Organizational Measures:

Considering the current state of technology, the context, and purposes of processing, as well as the risks to the rights and freedoms of individuals, the operator implements appropriate technical and organizational measures to ensure that, by default, only personal data necessary for each specific processing purpose is processed.

Notification to Supervisory Authority in Case of Personal Data Breach:

According to Article 33(1) of the GDPR, in the event of a personal data breach, the supervisory authority (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) will be notified without undue delay and, where feasible, within 72 hours from the time the breach was discovered, unless it is unlikely to result in a risk to the rights and freedoms of individuals.

Informing the Data Subject About Personal Data Breach:

As per Article 34 of the GDPR, if a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the data subject will be informed without undue delay, unless certain conditions are met, such as implementing adequate technical and organizational protection measures, taking subsequent measures to mitigate the high risk, or if it would involve a disproportionate effort.

Newsletter:

To receive a newsletter, providing a valid email address and specific identifying information is necessary. Your consent is required for receiving the newsletter, and any other personal data will be collected and stored only with your agreement. The collected data is processed solely for the purpose of sending the newsletter and will not be transmitted to third parties. The processing of any data you enter into the contact form will be done only with your consent, in accordance with Article 6(1)(a) of the GDPR.

Plugins and Tools

Google Web Fonts

This site uses Web Fonts provided by Google to ensure the uniform use of fonts on this site.

When you access a page on this website, your browser will load the necessary web fonts for the correct display of text and fonts by establishing a connection with Google’s servers.

The use of Google Web Fonts is based on Article 6(1)(f) of the GDPR, with a legitimate interest in the uniform presentation of the font on this website. If there is express consent in this regard (for example, consent to storing cookies), the data will be processed exclusively based on Article 6(1)(a) of the GDPR.

For more information on how Google Web Fonts handles user data, please refer to the Privacy Policy available at: https://policies.google.com/privacy?hl=en.

Google Maps

This site uses Google Maps, a mapping and location service, through an API. The provider is Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, United States.

To ensure data protection on our site, you will find that Google Maps has been deactivated when you visit our site for the first time. A direct connection to Google’s servers will not be established until Google Maps is activated autonomously, i.e., with your consent in accordance with Article 6(1)(a) of the GDPR. This prevents the transfer of data to Google during your first visit to our site. After activating the service, Google Maps will store the IP address. Usually, it is subsequently transferred to a Google server in the United States, where it is stored. The provider of this website has no control over this data transfer once Google Maps has been activated.

Considering the decision of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has stated that the protection provided by the EU-US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for transfers of data from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for transfers of data from EU data controllers to processors established outside the EU or EEA. For more information on these Clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Google Maps uses Standard Contractual Clauses as a suitable guarantee for data protection, in accordance with the level of protection guaranteed by GDPR. For more information, please consult Google’s Data Privacy Statement at the following address: https://policies.google.com/privacy

Google reCaptcha

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our site. The provider is Google Inc., headquartered at 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). The purpose of reCAPTCHA is to determine whether the data entered on our site (e.g., information entered in a contact form) is provided by a human user or by an automated program.

To determine this, reCAPTCHA analyzes the behavior of site visitors based on various parameters. This analysis is triggered automatically as soon as the site visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g., IP address, time the site visitor spent on the site, or cursor movements initiated by the user). The data tracked during such analyses is forwarded to Google. The reCAPTCHA analyses run entirely in the background. Site visitors are not alerted that an analysis is underway. The data is processed based on Article 6(1)(f) of the GDPR. The website operators have a legitimate interest in protecting their web content from misuse by automated industrial espionage systems and against SPAM.

Considering the decision of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has stated that the protection provided by the EU-US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for transfers of data from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for transfers of data from EU data controllers to processors established outside the EU or EEA. For more information on these Clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Google reCaptcha uses Standard Contractual Clauses as a suitable guarantee for data protection, in accordance with the level of protection guaranteed by GDPR. For more information, please consult Google’s Data Privacy Statement available here: https://policies.google.com/privacy and here: https://policies.google.com/terms?hl=en

Online Chat

Online Chat Platforms

Facebook Messenger

On this website, we utilize Facebook Messenger, a free instant messaging application that enables instant text messaging exchange with one or more individuals or computers simultaneously. It’s an American messaging application and platform developed by Facebook, Inc. Initially developed as Facebook Chat in 2008, the company revamped its messaging service in 2010.

Through Facebook Messenger, we can provide swift assistance, allowing interaction with us, including tracking purchases, receiving notifications, and initiating personal conversations with the company’s customer service representatives.

The legal basis for processing personal data through Facebook Messenger is represented by Article 6(1)(f) of the Regulation, relying on our legitimate interest in the legality of processing. Regarding the processing of personal data, Facebook Ireland can be contacted online or by mail at the following address: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The data collected through Facebook Messenger is used, among other purposes, for providing, customizing, and enhancing the chat functionality, enabling analytics services, and communicating with you.

Considering the ruling of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has stated that the protection provided by the EU-US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for transfers of data from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for transfers of data from EU data controllers to processors established outside the EU or EEA. For more information on these Clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Facebook Messenger complies with the GDPR provisions and the Standard Contractual Clauses approved by the European Commission, continually considering its decisions regarding data transfers to the United States and other countries. The European Commission has recognized countries such as Andorra, Argentina, Canada (commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Switzerland, and Uruguay as providing adequate protection.

More information is available here https://www.facebook.com/privacy/explanation and here https://www.facebook.com/legal/EU_data_transfer_addendum.

WhatsApp

Through WhatsApp, we ensure efficient communication with our customers. For those residing in a country within the European Economic Area (which includes the European Union) and any other country or territory included (collectively referred to as the “European Region”), Whatsapp is operated by WhatsApp Ireland Limited, headquartered at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

According to WhatsApp’s policy, which can be reviewed here: https://www.whatsapp.com/legal/#privacy-policy, Whatsapp Ltd., being part of the Facebook Companies, collects and processes personal data while adhering to the security and confidentiality principles applicable at the European (especially GDPR) or international level (when it comes to services provided by WhatsApp Inc. – EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework).

Through WhatsApp, the following data is processed:

  • Data provided directly by users (such as those related to the user account – phone number, profile name, photograph – user connections). Regarding transmitted messages, they are not stored on WhatsApp servers, except those that could not be delivered (for example, for an offline user), which are stored for a period of 30 days before deletion.
  • Data automatically collected (information about the user’s “last seen status,” user preferences stored through cookies, IP address, browser-related information, some transaction and payment information – for terms and conditions regarding payments, we recommend referring to https://www.whatsapp.com/legal/?eea=0#payments-in).

The legal basis for processing personal data through WhatsApp is represented by Article 6(f) of the Regulation, relying on our legitimate interest in the legality of processing.

Considering the ruling of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has stated that the protection provided by the EU-US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for transfers of data from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for transfers of data from EU data controllers to processors established outside the EU or EEA. For more information on these Clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

WhatsApp uses Standard Contractual Clauses as a suitable guarantee for data protection, in accordance with the level of protection guaranteed by GDPR, as per the information available here: https://www.whatsapp.com/legal/#privacy-policy-our-global-operations

Audio-Video Communications

Audio-Video Communication Services

We use specific tools for online conferences to communicate with our clients. If you choose to communicate with us through any of these tools, your personal data will be collected and processed by both us and the respective provider.

These tools collect all the information you provide (for example, email address or phone number). They process other information such as conference duration, time spent in the conference, number of participants, specific information about the functioning of these tools, and technical data (such as IP addresses, types of devices used, operating system type and version, details about the camera and microphone used, as well as content data – text messages, voice messages, uploaded photos and files, etc.).

The legal bases for processing personal data through these tools are:

Article 6(b) of the Regulation, for efficient communication with our contractual partners and current or potential clients;

Article 6(f) of the Regulation, relying on our legitimate interest in the legality of processing, aiming to simplify and accelerate communication with us.

However, please note that we do not have complete control over all procedural and legal aspects regarding the processing of personal data. Therefore, we kindly ask you to refer to the privacy policies of the providers of such audio-video communication tools. If your consent has been requested, the use of the respective tool will be based on this consent until its withdrawal.

Regarding the duration of storing data processed due to the use of these tools, outside legal storage periods, upon your request or if storage is no longer necessary, personal data will be deleted by us. However, for more details about data storage by providers of audio-video communication tools for their own purposes, please contact them and study their privacy policies.

Zoom

We use Zoom to facilitate communication with you. The provider of this service is Zoom Communications Inc, San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For details about data processing, please refer to Zoom’s privacy policy: https://zoom.us/en-us/privacy.html.

Considering the ruling of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has stated that the protection offered by the EU-US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for transfers of data from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for transfers of data from EU data controllers to processors established outside the EU or EEA. For more information on these Clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

The transmission of data to the United States of America through Zoom is based on the European Commission’s Standard Contractual Clauses (SCC). Details can be found here: https://zoom.us/de-de/privacy.html.

E-Commerce and Payment Methods

Online Payments

According to the Regulation, “to maintain security and prevent processing that violates this regulation, the data controller or person authorized by the data controller should assess the inherent risks in processing and implement measures to mitigate these risks, such as encryption” – considerandum 83. Therefore, the availability of strong and efficient encryption is necessary to ensure the protection, confidentiality, and integrity of personal data.

During the purchase process of products sold through this website, your banking data is secure!

We use secure encryption methods, transmitting data through highly secure connections to financial units. Therefore, the data provided by you for making payments is not transmitted to third parties and is not stored in databases.

EuPlătesc

EuroPayment Services S.R.L. (based in Bucharest, Str. Mizil 2C, Bl. Socum, 1st Floor, Sector 3, 032265, Romania) respects the confidentiality of any data, information related to the registered user on the site, as well as the transactions made by them, within the conditions and limitations imposed by law. According to the information available at https://www.euplatesc.ro/politica-de-confidentialitate.php, the information system provides adequate methods for the protection of users’ personal data, as well as the operations, transactions they carry out through: www.euplatesc.ro, hd1.euplatesc.ro, manager.euplatesc.ro, secure.euplatesc.ro, and other subdomains of euplatesc.ro, euplătesc.ro. In this regard, EuroPayment Services S.R.L. has appointed a Data Protection Officer (DPO) certified by TÜV Austria Romania.

EuroPayment Services S.R.L. uses the collected personal data, including the IP address from which the Site is visited, browser configuration, and location, for the following purposes: dispatch and billing of ordered products/services; online payment execution, processing, and monitoring; delivery of ordered products/services; resolution of cancellations or complaints regarding the ordered services or products; ensuring e-Commerce transaction/payment security through anti-fraud filters; sending periodic informative newsletters (with the consent of the data subject).

According to the information in the Privacy Policy – processing of personal data (https://www.euplatesc.ro/politica-de-confidentialitate):

  • The data processed by EuPlătesc (provided by both the merchant and the buyer) are: name, surname, email address, phone number, delivery address, order details, payment card data, phone number, IP address, details about the device used, and location.
  • EuPlătesc does not send personal data to other entities except those involved in the authorization process or authorized control bodies by law.
  • The archiving of communications and activities undertaken by and through EuPlătesc takes place for a minimum of one year.
  • There is the possibility of sharing personal data internally (for example, the customer support department has access to transaction history to respond to requests).
  • Data is processed within the European Union, and EuPlătesc’s archives are encrypted using its encryption keys on servers located in Elevația.
  • The legal basis for data processing is primarily Art. 6(1)(a) GDPR, but also Art. 6(1)(b) or (f) GDPR.

Conclusion

This policy concerns the processing of personal data.