Policy Regarding the Processing of Personal Data
We consider ensuring the right to personal data protection as a fundamental commitment of PUFULETE S.R.L.; therefore, we will dedicate all necessary resources and efforts to process your data in full compliance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), as well as any other legislation applicable in Romania.
Since one of the essential principles of this legal framework is transparency, we have prepared this document to inform you about how we collect, use, transfer, and protect your personal data when you interact with Us regarding our services, through the website www.pufuleti.ro, or via e-mail.
We reserve the right to periodically update and modify this Privacy Policy to reflect any changes in the way we process personal data or any updates in legal requirements. In the event of any such modification, we will display the updated version of the Privacy Policy on the Site, which is why we kindly ask you to review this section periodically.
Who We Are and How You Can Contact Us
We are the commercial company PUFULETE S.R.L., a legal entity of Romanian nationality, having its registered office in Bușag, 123 Str., No. 5-10-12, Tăuţii-Măgherăuş city, Maramureș county, Unique Registration Code (CUI) RO 15800214, Trade Register Registration Number: J24/1141/2003, e-mail: office@pufuleti.ro (hereinafter “We”, “Us”, or the “Data Controller”).
Since we are always open to hearing your feedback and providing any additional information you may need regarding data processing, we encourage you to contact our Data Protection Officer by mail or courier at Bușag, 123 Str., No. 5-10-12, Tăuţii-Măgherăuş city, Maramureș county, with the mention: Attention to the PUFULETE S.R.L. Data Protection Officer.
What Categories of Personal Data We Process
In general, we collect your personal data directly from you, giving you control over the type of information you provide to us. By way of example, we receive information from you as a User or Buyer when you place an Order on the Site: you transmit your e-mail address, first and last name, phone number, and delivery address.
We may also collect and subsequently process certain information regarding your behavior during your visit to the pufuleti.ro Site to personalize your online experience and provide offers tailored to your profile. We invite you to learn more details about this by consulting the processing purposes section below.
On our website, we may store and collect information in cookies and similar technologies in accordance with our Cookie Policy.
We do not collect or otherwise process sensitive data included by the General Data Protection Regulation in special categories of personal data. Furthermore, we do not wish to collect or process data belonging to minors under the age of 18.
Purposes and Legal Bases for Processing
We will use your personal data for the following purposes:
- For providing our commercial offer for your benefit. This general purpose may include, as applicable:
- a) Order management;
- b) Order processing, including validation, shipping, and invoicing;
- c) Resolving cancellations or issues of any nature relating to an Order;
- d) Refunding the value of purchased Products, if applicable, in accordance with legal provisions;
- e) Providing transport services, including answering your inquiries regarding Order delivery by Us or our partners (courier companies).
Processing your data for these purposes is, in most cases, necessary for entering into and executing an Order (contract) between you and Us. Furthermore, certain processing activities subsumed under these purposes are mandated by applicable legislation, including tax and accounting laws.
- To improve our services
We constantly strive to offer you the best online product purchasing experience. To achieve this, we may collect and use certain information regarding your Buyer behavior, invite you to complete satisfaction surveys following the completion of an Order, or conduct market research and surveys directly or with the help of partners.
We base these activities on our legitimate interest in conducting commercial activities, always ensuring that your fundamental rights and freedoms are not affected.
- For marketing
We want to keep you informed about the best offers for the Products you care about. In this regard, we may send you any type of message (such as: e-mail/SMS/telephone/WhatsApp, etc.) containing general information, details about products similar or complementary to those you have Ordered, info on offers or promotions, updates regarding new Products you have shown interest in, as well as other commercial communications like market research and opinion polls, and we may display personalized recommendations on the Website.
To provide information of interest to you, we may use certain data regarding your Buyer behavior (e.g., viewed sections, ordered products) to create a profile. We always ensure that such processing is conducted with respect for your rights and freedoms and that decisions based on them have no legal effects on you or significantly affect you.
In most cases, we base our marketing communications on your prior consent. You can change your mind and withdraw your consent at any time by:
– Accessing the unsubscribe link displayed within messages received from us;
or
– Contacting the Data Controller using the contact details on the Site.
In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our commercial business. In any scenario where we use your information for our legitimate interest, we take all necessary measures to ensure your fundamental rights and freedoms are not affected. Nevertheless, you can ask us at any time, via the means described above, to stop processing your personal data for marketing purposes, and we will comply with your request as quickly as possible.
How Long We Retain Personal Data
As a general rule, we will store your personal data for as long as you have an active Order and for an additional 90 days following the delivery date of the Order. You can request the deletion of certain information at any time, and we will honor such requests, subject to retaining certain commercial/fiscal information in cases where applicable legislation or our legitimate interests require it.
To Whom We Disclose Personal Data
As applicable, we may transmit or provide access to certain personal data to the following categories of recipients:
- courier service providers;
- banking service providers;
- marketing service providers;
- IT service providers;
- other partner companies with whom we develop joint programs to improve our services.
If we are under a legal obligation or if necessary to defend a legitimate interest, we may also disclose certain personal data to public authorities.
We ensure that third-party private legal entities access your data in accordance with legal provisions on data protection and confidentiality, based on contracts concluded with them.
To Which Countries We Transfer Personal Data
Currently, we store and process your personal data within the territory of Romania.
We will always take measures to ensure that any international transfer of personal data is carefully managed to protect your rights and interests.
How We Protect the Security of Personal Data
We are committed to ensuring the security of personal data by implementing appropriate technical and organizational measures in line with industry standards. Your personal data is transmitted using encryption algorithms and stored on secure servers while ensuring data redundancy.
Despite the measures taken to safeguard your personal data, please be aware that transmitting information over the Internet in general, or via other public networks or social media platforms, is not completely secure, carrying the risk that data may be viewed and used by unauthorized third parties. We cannot be held responsible for such vulnerabilities in systems that are beyond our control.
What Your Rights Are
The General Data Protection Regulation recognizes a series of rights regarding your personal data. You can request access to your data, correction of any errors in our files, and object to the processing of your personal data. As applicable, you may also exercise the right to request deletion of your personal data, the right to restriction of data processing, and the right to data portability.
To exercise your rights, you can contact us using the provided contact details.
Please note the following points if you wish to exercise these rights:
Identity. We take the confidentiality of all records containing personal data seriously. For this reason, please submit your request regarding such records using the e-mail address with which you placed your online Order. Otherwise, we reserve the right to verify your identity by requesting additional information to confirm your identity.
Fees. We will not charge a fee for exercising any right regarding your personal data, unless your request for access to information is unfounded, repetitive, or excessive, in which case we will charge a reasonable fee given the circumstances.
Response Time. We aim to respond to any valid request within a maximum of 30 days, unless the request is particularly complex or you have submitted multiple requests, in which case we will respond within a maximum of two months. We will notify you if we require more than one month. We may ask if you can specify exactly what you wish to receive or what your concern is. This will help us act faster and shorten the response time to your request.
Third-Party Rights. We are not required to comply with a request if it would adversely affect the rights and freedoms of other data subjects.
Targeted Rights. You May Request Us To:
- confirm whether we are processing your personal data;
- provide you with a copy of such data;
- provide other details about your personal data, such as what data we hold, what we use it for, to whom we disclose it, whether we protect it, how long we keep it, what rights you have, how you can make a complaint, and where we obtained your data from, to the extent that such information has not already been provided to you in this notice;
Rectifications:
- you may ask us to rectify or complete inaccurate or incomplete personal data;
- we may attempt to verify the accuracy of the data before rectifying it.
Data Erasure. You can ask us to erase your personal data, but only if:
- it is no longer necessary for the purposes for which it was collected; or
- you have withdrawn your consent (where processing was based on consent); or
- you exercise a legal right to object; or
- the data has been unlawfully processed; or
- we are under a legal obligation to do so.
We are not obligated to comply with your data erasure request if processing your data is necessary:
- for compliance with a legal obligation; or
- for the establishment, exercise, or defense of legal claims.
There are certain other circumstances where we are not obligated to comply with your request for data erasure.
Objection. You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interest, if you consider that your fundamental rights and freedoms override this interest. You may also object at any time to the processing of your data for direct marketing purposes without giving any reason, in which case we will cease processing as soon as possible.
Complaints. You have the right to lodge a complaint with the supervisory authority regarding the processing of your personal data. In Romania, the contact details for the data protection supervisory authority are:
The National Supervisory Authority for Personal Data Processing (ANSPDCP)
28-30 G-ral. Gheorghe Magheru Blvd., District 1, postal code 010336, Bucharest, Romania
Telephone: +40.318.059.211 or +40.318.059.212;
E-mail: anspdcp@dataprotection.ro
Without affecting your right to contact the supervisory authority at any time, we kindly ask that you contact us first. We will make every effort to resolve any issue amicably.
We remind you that you can contact our Data Protection Officer at any time by sending your request through any of the following methods:
– by e-mail at: office@pufuleti.ro
– by mail or courier at: PUFULETE S.R.L., Bușag, 123 Str., No. 5-10-12, Tăuţii-Măgherăuş city, Maramureș county