IV. Purposes of Personal Data Processing

Personal data may be processed for the following purposes:

1. Order and delivery management

Personal data are used to process orders, organize deliveries, and ensure an efficient purchasing experience for users.

2. Creation and management of user accounts

Processing personal data for account creation, user authentication, and personalization of the purchasing experience.

3. Payments and financial transaction processing

Data may be processed in order to perform secure payments, issue invoices, and confirm payments made by users.

4. Customer communication

Processing data in order to send notifications regarding order status, special offers, promotions, website updates, or administrative communications.

5. Marketing and advertising

Data may be used to create personalized marketing campaigns, product recommendations, and tailored offers based on purchasing behavior.

6. Improvement of services and user experience

Data analysis in order to understand how services are used, improve website performance, and optimize the purchasing process.

7. Security and fraud prevention

Processing data to prevent online fraud, detect suspicious activities, and ensure a secure environment for user transactions.

8. Compliance with legal obligations

Processing data to comply with legal and fiscal requirements, such as issuing invoices and retaining documents in accordance with applicable regulations.

If it becomes necessary for the Company to further process personal data for a purpose other than those for which you were initially informed, and which is not compatible with the original purposes of collection, we will provide you with information regarding that secondary purpose and any relevant additional information and will continue the processing only with your consent.

V. Legal Grounds for Data Processing

As a rule, we seek to collect personal data directly from you. However, in certain situations we may also receive personal data from other sources, such as our customers and partners, legal entities, public institutions and authorities, third parties, or publicly available sources.

Our policy is to process only the minimum amount of personal data necessary. The legal bases for processing take into account the provisions of Regulation (EU) 2016/679, Romanian legislation regarding personal data processing, as well as other applicable national and European legal acts.

We may process data based on the following legal grounds:

1. Consent of the data subject (Art. 6(1)(a) GDPR)

Consent is required when data processing is based on a clear and informed action by the user. For example, consent may be requested to receive newsletters or to participate in marketing campaigns. Consent will be freely given, specific, informed, and unambiguous.

2. Performance of a contract (Art. 6(1)(b) GDPR)

Data processing is necessary for the conclusion or performance of a contract between the user and the online sales platform. For example, to process orders, deliver products, and manage payments, the platform must collect personal data such as the user’s name, address, and payment information. This legal basis applies when processing is essential for delivering the requested services or products.

3. Compliance with a legal obligation (Art. 6(1)(c) GDPR)

Processing may be necessary in order to comply with legal obligations of the data controller. For example, an online sales platform may be required to retain fiscal data and issue invoices in accordance with tax legislation.

4. Legitimate interests of the controller or a third party (Art. 6(1)(f) GDPR)

Processing may be necessary for the legitimate interests pursued by the data controller or a third party, provided that such interests do not override the fundamental rights and freedoms of the data subject. For example, processing for fraud prevention, improvement of user experience, or website security may be considered a legitimate interest, provided that GDPR principles are respected.

5. Protection of vital interests (Art. 6(1)(d) GDPR)

Processing may be necessary to protect the life or safety of a person. This legal basis is rarely applicable in the context of an online sales platform, except in exceptional circumstances (e.g., emergency situations).

6. Performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1)(e) GDPR)

This legal basis generally does not apply to online sales platforms, as they do not perform public authority functions. However, it may be relevant in special cases, such as processing data for purposes related to public order or national security.

VI. Technical and Organizational Measures

Taking into account the provisions of Regulation (EU) 679/2016, we undertake to implement appropriate and reasonable technical and organizational measures to ensure compliant processing of the personal data entrusted to us:

• storage periods are limited to the fulfillment of the purpose or as required by law (e.g., for a period of 3 years after the termination of contractual relations)
• if the data are no longer necessary, or upon the user’s request, we ensure that they are deleted
• data will not be transferred to entities outside the EEA; transfers outside the EU will occur only after ensuring an adequate level of protection in accordance with European Commission standards
• system protection measures
• updated antivirus and firewall systems
• periodic data backups
• capacity to ensure confidentiality, integrity, and resilience of systems
• internal data processing policies and procedures
• controlled access to users’ personal data based on the “minimum data processing” principle
• ongoing staff training (including training sessions and confidentiality agreements with employees)
• continuous evaluation of the impact of data processing and adoption of new measures to ensure compliance with legal requirements

6. Right to data portability (Art. 20 GDPR)

Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format. These data may also be transferred to another data controller where technically feasible, and where the processing is based on consent or a contract.

7. Right to object (Art. 21 GDPR)

Data subjects may object to the processing of their personal data in certain cases, including the processing of data for direct marketing or where the processing is based on legitimate interests. In such cases, the controller must cease processing unless it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject.

8. Right not to be subject to automated decision-making (Art. 22 GDPR)

Data subjects have the right not to be subject to a decision based solely on automated processing of data, including profiling, which produces legal effects concerning them or similarly significantly affects them. Exceptions are permitted only in certain circumstances, such as where the decision is necessary for entering into a contract or is based on the explicit consent of the data subject.

9. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Data subjects have the right to lodge a complaint with the national data protection authority (usually, the National Supervisory Authority for Personal Data Processing) if they believe that their rights have been violated.

10. Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on consent, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, as well as for any further questions regarding this notice or in connection with the Company’s use of personal data, please contact us using any of the communication methods described in Section I of this notice.

To protect your data and prevent misuse by malicious individuals seeking access to your information, we may require you to complete certain identification steps in advance, to ensure that you are the person exercising the rights outlined below through a request.

If you are not satisfied with the response received, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

We may continue processing your data only if there are compelling legitimate grounds that prevail over your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

This data processing policy was last updated on 07.02.2025.