1. WHO WE ARE
The data controller is VOYATZOGLOU ROMANIA S.R.L., a limited liability company, with its registered office in Bucharest, 151 Vasile Lascar St., District 2, Romania, registered with the Trade Register Bucharest under no. J40/1439/1999, having sole registration code RO11447595, email [email protected]. Please use this e-mail address exclusively for matters related to the protection of personal data. Other requests will not be taken into consideration.
2. WHAT TYPE OF PERSONAL DATA DO WE PROCESS, FOR WHAT PURPOSES AND ON WHAT LEGAL GROUNDS?
In the process of managing this website, the Company will collect certain information (“personal data”) related to identified physical persons or which can lead to the identification of physical persons, which are provided by the users of this website directly (for example, first name, last name, postal address, e-mail address, telephone number, date of birth, etc.) or indirectly (for example, IP address).
We will process personal data for the following purposes, based on the legal grounds indicated for each of them:
2.1. Website browsing. Use of cookies
When you visit our website, we use cookies to automatically collect technical information that can identify the user, such as the IP address, the type of internet browser used to navigate our website, your operating system, the domain name or the domain host through which the user navigates the website.
The main purpose of using cookies is to help you have an improved browsing experience and also for advertising purposes, to be able to offer you individualised content adapted to your interests and preferences.
Consequently, to the extent that you have expressed your consent regarding the use of cookies, we will use them to provide you with a personalised and relevant browsing experience on our website and to understand how you interact with our advertising content.
For more information about the use of cookies on this website and the purposes for which they are used, as well as the possibilities to control and/or disable cookies, please consult our Cookie Policy, available here.
2.2. Answering your questions, requests, or complaints
We will process your personal data, such as first name, last name, e-mail address, telephone number and any other information or details that you may provide to us within the correspondence, to communicate with you regarding the processing of orders and purchased products (possible order modifications, delivery terms or other purchased services, handling complaints and processing compensations in exceptional situations), depending on the communication channel through which you contact us, according to the description below.
| Purpose | Legal basis | Duration |
| Providing answers to your questions, complaints or requests through electronic correspondence (e-mail) or telephone | The processing is based on a legitimate interest, allowing us to provide answers to your questions, complaints or requests. Legal obligation, based on consumer protection legislation. Contractual obligation, based on the sales contract. | 3 years |
2.3. Promotional campaigns
We will process personal data collected from you by filling out participation forms on our website or other similar forms to organize promotional campaigns and/or contests, or to award prizes to the winners of promotional campaigns, as well as to analyze the effectiveness of our promotional campaigns.
In the event that we collect data such as the series and number of the identity card or the personal numerical code (CNP), these will be collected and used for the above purpose only to comply with fiscal obligations related to the prizes awarded to the winners of campaigns and/or contests. Your participation in such promotional campaigns and/or contests is voluntary. Consequently, you decide whether to provide us with your personal data by filling out the participation forms on our website or other similar forms provided by the regulations of the promotional campaigns or contests.
| Purpose | Legal basis | Duration |
| Organizing promotional campaigns and/or contests | Contractual obligation (company/contest regulations) | 6 years, which include the longest limitation period in the applicable legal systems |
| Processing the data of the winners of promotional campaigns for the purpose of awarding the prize and also for the purpose of complying with legal tax requirements. | Contractual obligation; Legal obligation | 10 years, under the provisions of the tax law |
| Marketing communications regarding the services/products of contractual partners | First and last name, E-mail address, Phone number | 2 years or until consent withdrawal |
We will not publish on our website the first name, last name, photograph or other personal data of the winners of the promotional campaign and/or contest, unless the data subject has provided us with their consent to this effect.
2.4. Direct marketing communications
We may process personal data to inform you about our products and services, promotional offers and for subscription to newsletters. As a general rule, these personal data will be processed for direct marketing purposes only with your consent and through the use of communication channels (e.g. e-mail, SMS, etc.) that you agreed to when expressing your consent. However, to the extent that you provided us with your e-mail address on the occasion of purchasing a product or service from us, we may use the e-mail address, in accordance with the legal provisions in force that allow us to send you commercial communications regarding similar products or services, based on our legitimate interest in this regard; in this case, upon obtaining the e-mail address from you and subsequently, with each marketing message we may send you, we will offer you the opportunity to object to this use of the e-mail address (unsubscribing).
| Purpose | Categories of processed data | Legal basis | Duration |
| Commercial communications regarding similar products or services | E-mail address provided on the occasion of purchasing a product or service from the Company | Legitimate interest | 2 years |
| Other direct marketing communications | As provided by the data subject when expressing their consent, e.g. first and last name, e-mail address, phone number. | Consent | 2 years or until consent withdrawal |
| Marketing communications regarding the services/products of contractual partners | First and last name, E-mail address, Phone number | Consent | 2 years or until consent withdrawal |
2.5. Surveys, customer satisfaction studies, and customer feedback
We will process your personal data when you decide to participate in our surveys or market studies, in customer satisfaction surveys or when you provide us with feedback regarding our products and services. Such personal data will be processed for the above purpose only based on your consent, also taking into account our legitimate interest in helping us understand customer needs and expectations regarding our products and services.
Your participation in such surveys or market studies is voluntary. Consequently, it is your choice whether or not to provide us with personal data (such as first and last name, information regarding preferences and purchasing habits or other personal data), by filling out the participation forms on our website or other similar forms provided within the respective surveys or studies.
| Purpose | Legal basis | Duration |
| Surveys or market studies, customer satisfaction surveys or when you provide us with feedback regarding our products and services | Consent; Legitimate interest, for surveying satisfaction and improving customer experience, for improving services and the portfolio of services. | 2 years or until consent withdrawal |
2.6. Automated decision-making and automated profiling
The personal data referred to herein are subject to automated decision-making processes, including profiling.
The logic involved in the processing is to improve the experience of purchasing the Company’s services and to develop the Company’s portfolio of services.
The purpose of this type of processing is:
| Purpose | Legal basis | Duration |
| We will retain and evaluate information regarding the most recent visits to our website and how you navigate through different sections of the website for analytical purposes, to understand how people use our website in order to make it more intuitive | Legitimate interest | 2 years |
| We will maintain a record of the items and pages on our website that you have accessed and we will use that information to address advertising to you on this site that is relevant to your interests, which we identified based on the articles you read | Legitimate interest | 2 years |
2.7. Sale of products and/or associated services
For the purchase of products and services, both our own and those of our contractual partners, offered by us, we inform you that we process the following personal data: first name, last name, address, e-mail address, telephone number, IP address, ID card/passport series and number or other numbers and details of the recognized identity document, card type, card number, cardholder name, card security number or other payment details, shipping and delivery address (for customers requesting transport and installation services), as follows:
| Purpose | Legal basis | Duration |
| Sale of products and/or associated services | Contractual obligation | 3 years, which include the longest limitation period in the applicable legal systems |
| Registration of requests to modify orders and their operation | Contractual obligation | 3 years, which include the longest limitation period in the applicable legal systems |
| Purchase of products and services from third parties, through our website | Contractual obligation | 3 years |
2.8. Invoicing and payment management
In the context of purchasing products and services, we process personal data in order to fulfill the following purposes: issuing invoices (including electronic ones), making payments, including but not limited to refunds and compensation, as well as managing cash transactions and we collect personal data in this regard, such as: first name, last name, national identification number, identity document series and number, date of issue and expiration date of the identity document, date and place of birth, address, telephone number, e-mail address, banking data, citizenship.
| Purpose | Legal basis | Duration |
| Issuing invoices (including electronic ones), making payments, including but not limited to refunds and compensation, as well as managing cash transactions | Contractual obligation; Legal obligation | 10 years |
2.9. Processing the data of contractual partners’ representatives involved in the execution of contracts with the Company and/or representatives of public authorities
If you are the contact person of partners, potential partners or public authorities with which the Company interacts in the execution of contracts, the Company processes your personal data as follows:
- For the initiation or execution of the contractual relationship between the Company and partners or potential partners;
- For the initiation or execution of relations between the Company and representatives of public authorities with which it interacts in the course of current activity.
The processing of your data for this purpose is based on the legitimate interest of the Company to initiate and conduct contractual relations and/or with public authorities in conducting the Company’s activity in the context of offering the Company’s products and services. Refusal to provide data for this purpose may result in the impossibility of the Company to conduct its activity.
| Purpose | Categories of processed data | Legal basis | Duration |
| Initiation or execution of the contractual relationship between the Company and partners or potential partners | First name, last name, address, e-mail address, telephone number, position, signature | Legitimate interest | For the duration of contractual relationships, but no more than 3 years from the termination of contractual relationships |
| Initiation or execution of relations between the Company and representatives of public authorities with which it interacts in the course of current activity | First name, last name, address, e-mail address, telephone number, position, signature | Legitimate interest; Legal obligation | For the duration provided by the provisions of the archives law |
2.10. Account creation
We will process your personal data, such as first name and last name, e-mail address, date of birth, nationality, customer type (title), home address, telephone number and any other information or details that you may provide to us during registration formalities for creating an account on our site. The decision to create a personal account is voluntary. Therefore, it is your choice to decide whether to provide us with personal data, by completing the registration formalities on our site.
| Purpose | Legal basis | Duration |
| Creating an account | The processing is based on the subject’s agreement for account creation. | 2 years or until consent withdrawal |
3. TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?
To achieve the purposes described above, the Company uses the services of several contractual partners. Some of them act as data processors, such as banking institutions and payment processors, transporters, courier companies, providers of IT services, software and maintenance, which operate their business activities within the European Union, as well as outside the European Union, and your personal data may be provided to them to be used within the limits of the obligations they have undertaken towards the Company. The personal data we disclose to our processors are limited to the minimum personal information necessary for the provision of those services, and we require them not to use personal data for any other purpose. We make every effort to ensure that all entities we work with store your personal data under safe and secure conditions.
Some of them are, in turn, data controllers, such as other related service providers (courier companies), which operate their business activities both within the European Union and outside the European Union.
Some of them are third parties who do not intend to process the data, but may have access to them in the performance of tasks or in their interactions with the Company, such as companies providing technical maintenance, financial or legal auditors.
The personal data indicated above may be made available or transmitted to third parties also in the following situations:
(i) public authorities, auditors or institutions with competencies in carrying out inspections and controls over the activity and assets of the Company, which request the Company to provide information, by virtue of its legal obligations. These public authorities or institutions may be the police and regulatory authorities, the National Authority for Consumer Protection, the National Supervisory Authority for Personal Data Processing, the National Agency for Fiscal Administration;
(ii) to comply with a legal requirement or to protect the rights and assets of our Company or other entities or persons, such as courts of law;
(iii) third-party buyers, to the extent that the Company’s activity would be transferred (in whole or in part), and the data of the subjects involved would be part of the assets subject to such a transaction.
Also, for the purposes of the processing above, we may share your personal data with the parent company operating in Greece, Cyprus, companies that will respect the instructions of the Company regarding the processing of your personal data.
The persons and entities with whom we may share personal data are the following:
a) For the purpose of browsing the website and for purposes related to the use of cookies, we may transmit personal data to analytics and search engine service providers for them to provide maintenance services for our website;
b) To answer your questions, requests or complaints, we may share your personal data with our specialized legal service providers;
c) For organizing and managing promotional campaigns, as well as for analyzing their effectiveness, we may share your personal data with advertising and marketing agencies or digital media agencies or social media networks;
d) For direct marketing communications, we may transmit personal data to the advertising and marketing agencies that carry out communication on our behalf;
e) For conducting surveys or market studies, customer satisfaction surveys or to obtain feedback from our customers regarding our products and services, we may share personal data with survey or market study/customer survey service providers.
4. TRANSFER OF PERSONAL DATA ABROAD
In the context of the operations described above, your personal data may be transferred abroad to states within the European Union (“EU”) or the European Economic Area (“EEA”).
We hereby inform you that any transfer made by the Company to an EU or EEA member state will comply with the legal requirements provided in the GDPR.
5. HOW LONG DO WE STORE YOUR PERSONAL DATA
We will store your personal data only for the period of time necessary to achieve the processing purposes set forth above, while also complying with the legal requirements in force. In the event that the Company determines that it has a legitimate interest or a legal obligation to further process your personal data for other purposes, you will be informed accordingly in this regard.
Once the processing period indicated above expires, and the Company no longer has legal or legitimate reasons to process your personal data, the data will be deleted in accordance with its procedures, which may involve archiving, anonymization, or destruction thereof.
Consent Management (Cookies): To fully comply with European GDPR legislation and Google Consent Mode v2 requirements, our website uses a native (proprietary) consent management solution. Your choices regarding cookies are stored securely and directly within your browser. You can consult the complete list of cookies used, their purpose, and modify or withdraw your consent at any time by directly accessing our Cookie Policy.
6. SECURITY OF DATA PROCESSING
The Company hereby informs you that it constantly evaluates and updates the security measures implemented to ensure secure and safe processing of personal data.
7. REFUSAL OF PROCESSING AND ITS CONSEQUENCES
The personal data provided for purposes 2.2., 2.3., 2.7., 2.8. represent a contractual obligation, and the data subject must provide personal data to benefit from the requested products and services, as well as to resolve requests addressed by them.
In the event that the data subject does not provide the data for the purpose mentioned above, the Company will be unable to carry out the activities related to the aforementioned purposes.
8. RIGHTS OF DATA SUBJECTS
In the context of processing your personal data, you have the following rights:
- Right of access to processed personal data: you have the right to obtain confirmation as to whether or not your personal data are being processed and, if so, to have access to the type of personal data and the conditions under which they are processed, by addressing a request to this effect to the data controller;
- Right to request rectification or erasure of personal data: you have the possibility to request, by addressing a request to this effect to the data controller, the rectification of inaccurate personal data, the completion of incomplete data or the erasure of your personal data in the event that:
(i) the data are no longer necessary for the initial purpose (and there is no new legal purpose)
(ii) the legal basis for processing is the data subject’s consent, the data subject withdraws their consent and there is no other legal basis
(iii) the data subject exercises their right to object, and the controller has no overriding legitimate grounds to continue processing
(iv) the data have been processed unlawfully,
(v) erasure is necessary for compliance with EU law or Romanian law, or
(vi) the data were collected in connection with information society services offered to children (if applicable), when specific requirements regarding consent apply - Right to request restriction of processing: you have the right to obtain restriction of processing in cases where:
(i) you consider that the processed personal data are inaccurate, for a period allowing the controller to verify the accuracy of the personal data;
(ii) the processing is unlawful, but you do not want us to erase your personal data, but rather to restrict the use of these data;
(iii) the data controller no longer needs your personal data for the purposes mentioned above, but you require the data to establish, exercise or defend a legal claim, or
(iv) you have objected to processing, for the time interval necessary to verify whether the legitimate grounds of the data controller override the rights of the data subject; - Right to withdraw your consent to processing, when processing is based on consent, without however affecting the lawfulness of processing activities carried out up to that point;
- Right to object to the processing of data for reasons related to the particular situation you are in, when processing is based on legitimate interest, as well as to object, at any time, to the processing of data for direct marketing purposes, including profiling;
- Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them;
- Right to data portability, meaning the right to receive the personal data you provided to the data controller in a structured, commonly used and machine-readable format, as well as the right to transfer those data to another controller, if the processing is based on your consent or the performance of a contract and is carried out by automated means;
- Right to lodge a complaint with the Data Protection Authority (ANSPDCP) and the right to address competent courts of law.
The above rights can be exercised at any time. Also, if you wish to withdraw your consent granted for direct marketing purposes, you have the option to use the “unsubscribe” option included in each marketing communication.
9. CHANGES TO THIS POLICY
This Privacy Policy may undergo changes from time to time and may be updated by the Company as necessary. The Company will notify you of any material or substantial changes to this Privacy Policy and will ensure that such notification is carried out in a manner that ensures you become aware of them, for example by using the e-mail address you provided to us, or any appropriate means to ensure effective communication.
10. CONTACT
You may address any question regarding this document to the Data Protection Officer, who can be contacted using the following contract details: [email protected]