Your privacy is important to us. This Privacy Policy explains how S.C. ROCK STAR CONSTRUCT S.R.L. („PIATRAONLINE”, the „Company”, the „Society”) manages and handles your personal data when you register on or visit our website, https://piatraonline.com/ (the „website”); enter into a relationship with us in order to use the services offered by our company (the „services”); apply for a position within our company; supply us with goods or services or act as a representative, employee or agent of any kind of a company that supplies us with goods or services; we process your data on the instructions of, or as a result of the actions of, third parties.
1. Purpose of this policy
This Privacy Policy („Privacy Policy”, the „Policy”) explains our approach to any personal data that we collect from you or that we have obtained about you from a third party, and the purposes for which we process your personal data. It also sets out the rights you have in respect of the processing of your personal data.
This Privacy Policy is intended to help you make informed decisions when using our website and services, to help you understand how your personal data may be processed by us as a result of the provision of the services or when you apply to work at or with our company. Please take a moment to read and understand it
2. Who we are and what we do
We are S.C. ROCK STAR CONSTRUCT S.R.L. („PIATRAONLINE”, the „Company”, the „Society”), with its registered office in the Municipality of Bucharest, Aleea Teisani no. 137a, sector 1, CUI (tax registration number) 22680005, J40/20648/2007, legally represented by administrator Mariana Constantinescu Brădescu.
PIATRAONLINE is the first online natural stone shop, and also the largest in Romania. For over 15 years, the company has been selecting and importing the finest natural stone from every corner of the world, giving all design enthusiasts and fit-out specialists the opportunity to turn their vision into reality.
3. How to contact us
If you have any questions regarding this privacy policy or wish to exercise your rights in relation to the protection of your personal data, you may send us an email at [email protected].
4. What personal data we collect
We may collect personal data from you in the course of our activity, including through your use of our website, when you contact us or request information from us, when you engage our services, or as a result of your relationship with one or more members of our staff or with our customers.
Both the website and our services are aimed at persons over the age of 18, so we do not intend to collect and process, through our website, the data of persons under this age.
In order to carry out our activity, we, or third parties who provide services to us, process personal data that helps us with:
• verifying your identity
• providing our products and services
• improving, developing and marketing new services and products
• performing our contracts with you
• resolving requests made by you on the website or in connection with our activity
• investigating or resolving requests or disputes
• complying with any applicable law, court ruling, judicial act or the requirements of an authority
• protecting our rights, property or safety or those of third parties, including our staff, customers or website users
• recruitment purposes
• business administration and legal compliance
• carrying out marketing communications and use in other cases where this is required or permitted by law
a) If you are a visitor to the website:
We process information obtained through cookies, such as website display preferences, your consent regarding the processing of data through cookies and to our Terms and Conditions, or information that cannot be used to identify you through a unique profile.
All information about the cookies used on our website can be found in the Cookie Policy.
b) If you are a visitor to the website and enter into a relationship with us using the contact form on the website or the chat/WhatsApp service:
• first and last name
• contact details (email address and telephone number)
• information that you choose to provide us through the „Message” field of the contact form
c) If you create a user account on our website
• first and last name
• contact details (email address and telephone number)
• password
• if you log in with Facebook – name, email, profile picture
• if you log in with Google – name, email, language preferences and profile picture
• order history
• billing address
d) If you place an order on our website:
• user account details
• order summary
• price
• payment method
• delivery address
• additional details such as the preferred delivery window, the option for installation insurance
• details regarding the scheduling of a showroom visit
e) If you make payment for an order through our website
• first and last name
• amount
• transaction ID
f) If you place an order through channels other than the website (in the showroom, by email, etc.):
• first and last name
• contact details (email address and telephone number)
• order summary
• price
• payment method
• billing address
• delivery address
• additional details such as the preferred delivery window, the option for installation insurance
g) If you return a product you ordered and we need to refund you its price
• first and last name
• contact details (email address and telephone number)
• the returned product
• the amount to be refunded
• bank account details
h) If you post comments on the product presentation page or on the blog
• first and last name
• email
• subject
• comment
i) For customers and prospective customers we may also process other categories of data, such as:
● content of requests
● data necessary for resolving complaints, including a complaint identifier
● data regarding marketing preferences
● data provided for the purpose of taking part in competitions, prize draws or events
● data contained in audio/video recordings or photographs taken in connection with, or in relation to, the provision of our company’s services (such as recordings of telephone calls, CCTV recording content or online conference content)
● data contained in photographs or recordings from or for events
● any other personal information relating to you or other third parties which you may provide to us in connection with receiving our services
j) If you act as an individual collaborator or representative, employee or agent of any kind of a company that is our Customer or that supplies us with goods or services
In the course of our relationship with other legal entities, personal data may be transmitted to us, such as personal data relating to the staff, managers, agents, collaborators, consultants and similar persons of our suppliers or customers or of their Processors. The data processed regarding you in this context are, as a rule:
● first and last name
● contact details (email address and telephone number)
● identification details of the legal entity represented
● position and/or the relationship in which you stand to the legal entity
● any identification details from a power of attorney granted by the legal entity
● details regarding the activity (appointments, etc.)
● data necessary for resolving complaints, including a complaint identifier
● data contained in audio/video recordings or photographs taken in connection with, or in relation to, the provision of our company’s services (such as recordings of telephone calls, CCTV recording content or online conference content)
● data contained in photographs or recordings from or for events
● special categories of personal data, which you provide to us for the purpose of taking part in meetings and events, such as dietary preferences, which may reveal information about your health or religious beliefs, or other data which may reveal your state of health, in the context of the legal restrictions imposed on holding events, where applicable
● any other personal information relating to you or other third parties which you may provide to us in connection with our services
k) If you are an individual collaborator who helps us to promote our products and/or run our events (such as an architect, designer, builder, speaker, influencer, etc.):
• first and last name
• pseudonym
• contact details (email address and telephone number)
• position/capacity
• company represented
• biography, distinctions
• details regarding the activity carried out in relation to us (event bookings, filming, interviews, etc.)
• information about areas of expertise
• details contained in the content of promotional materials
• content of testimonials, reviews, interviews
• data contained in audio/video recordings or photographs taken in connection with, or in relation to, the provision of our company’s services (such as recordings of telephone calls, CCTV recording content or online conference content)
• special categories of personal data, which you provide to us for the purpose of taking part in meetings and events, such as dietary preferences, which may reveal information about your health or religious beliefs, or other data which may reveal your state of health, in the context of the legal restrictions imposed on holding events, where applicable
• any other personal information relating to you or other third parties which you may provide to us in connection with our activity
l) If you interact with us through social media
• first name, last name
• social media and online platform profile data (username, photograph, biography)
• social media message content, reviews, ratings, location data
m) If you are a prospective candidate:
PIATRAONLINE collects information from and about candidates in connection with available employment or collaboration opportunities. This information may include all types of data contained in CVs, identification documents, photographs, academic records, courses or certifications obtained, employment history, employment and references, and other such information.
PIATRAONLINE uses your personal data to match your skills, experience and education with the specific positions offered. This information is passed on to hiring managers and persons involved in the recruitment process to decide whether to invite you to an interview. PIATRAONLINE may collect additional data from you if you are invited to the interview stage (or equivalent) and thereafter.
In connection with our recruitment activities, we may also collect special categories of personal data from candidates in respect of which we have an obligation under labour law, if the information is relevant to their future working environment at PIATRAONLINE or the future provision of employment-related benefits, or with the explicit consent of the person concerned. For example, we may need to collect information about a candidate’s disabilities in order to provide a suitable working environment for that candidate, if they are recruited.
PIATRAONLINE may collect personal data about candidates from the following sources:
• directly from you – for example, the information you provide when you apply for a position directly, through the company’s website or using our contact details, or when you are a student, intern or trainee at our company
• from recruitment agencies – for example, when a recruitment agency puts you forward as a prospective candidate
• through publicly available online sources – for example, if you have a professional profile published online that is relevant to the type of position (for example, on your current employer’s website, on a recruitment platform, or on a social network such as LinkedIn)
• through referral – for example, through a reference from a former employee/employer or a person who recommended you
n) If we process your data on the instructions of, or as a result of the actions of, third parties
If you are a person whose personal data is processed by us as a result of the provision of services to our customers, or as a result of the actions of third parties, we may process a variety of different personal data depending on the services provided.
1. If your data is provided to us in the context of events
We may process your data on the instructions of our customers or partners in the context of organising or taking part in events. The data we may process on such occasions are:
- first and last name
- contact details (email address and telephone number)
- identification details of the company represented
- photographs or audio/video recordings
2) If your data is provided to us through social media
We may also process your data as a result of the actions of third parties in the course of using social media, for example when you are tagged by a friend in a context connected with our company. The data we may process on such occasions are:
● first and last name
● social media and online platform profile data (pseudonym, photograph, biography)
● social media message content, posts, reviews, ratings, location data
● photographs or audio/video recordings
If you are in a position to provide us with the personal data of other individuals, please inform them of this fact before disclosure, as well as of the manner in which the data will be processed, in accordance with this privacy policy.
If we ask you to provide any other personal data not described above, the personal data we request and the reasons why you are asked to provide it will be clarified at the time you are asked to provide such personal data.
o) Data processed by third parties
1. Data processed through social media plugins
We inform you that, by accessing our website, third parties may collect data about you as a result of the integration of social media plugins, such as the „Like” and „Share” buttons, even if you have not clicked on them or are not a member of the respective social networks. Our company is not involved in any way in the data processing operations carried out by the social networks, other than the collection and transmission, which take place automatically, without us having access to or control over the data collected by the social networks. For more information, please consult the privacy policies of the social networks whose plugins appear on our website (Facebook, Instagram, Pinterest, Twitter, etc.).
2. Data processed for payments made through the website
We use third-party payment services to collect payments made through the website (e.g. www.mobilpay.ro). If you wish to make a payment through the website, you will be directed to a web page hosted by the payment service provider (or a party authorised by it) and not by PIATRAONLINE. Any personal data you provide on the payment service provider’s page, such as the card number, CVV, etc., will be collected by it and not by PIATRAONLINE, and will be subject to its privacy policy – https://www.mobilpay.ro/public/politica-de-confidientialitate. Our company has no control over, and is not responsible for, the use of information collected by payment service providers.
3. External links
Our website may contain links to third-party websites. We provide these links solely as a convenience, and our company does not control and is not responsible for the privacy practices or content of these websites. Responsibility for the manner in which your personal data is processed by these third parties rests entirely with them. Before accessing these websites, please review their privacy policy and terms of use to ensure that your data is processed in accordance with your expectations.
5. How we use personal data
I. For the performance of services, delivery of products and resolution of your requests
We collect and retain the personal data you provide to us while using the Website and/or our services in order to enable us to:
• process your orders and requests
• resolve complaints, returns or matters of any nature relating to a request
• provide support services, including answering your questions about your orders or our services
Our website uses various user interfaces to allow you to request information about our services, including electronic contact forms, a telephone information service and a chat service. Contact details may be requested in each case, together with other details about personal data that are relevant to your request. This information is used to enable us to respond to your requests. With regard to communications concerning your requests, we may send them to you by email or telephone, including by SMS.
What is our legal basis?
If you contact us in your own name, we need to process your personal data in order to fulfil our obligations under a contract we may have with you. If you contact us as a representative of a company that is a prospective customer or customer, we process your data by virtue of our legal obligation to validly conclude, and to perform, the contract with the legal entity you represent. Failure to provide such data will automatically result in the impossibility of concluding and/or performing the contract, and consequently in the impossibility of resolving your request.
II. Business administration and legal compliance
We may use your personal data for the following business administration and legal compliance activities:
● managing registration on the website;
● administering customer accounts
● improving the quality of services and contract maintenance activities
● analysing and monitoring sales
● running promotional campaigns and loyalty programmes
● in connection with potential business transactions, such as a merger, restructuring or sale
● preventing fraud
● protecting the rights, safety or property of the company or of the persons comprising it, its employees, suppliers or others
● exercising legal rights, including, without limitation, organising the recovery of the company’s debts and/or property and conducting court proceedings or extrajudicial formalities in connection with the performance of the contract; resolving any legal and/or judicial situations connected with the performance of the Contract; resolving disputes or complaints
● complying with legal obligations and requests from authorities, including transmitting/disclosing personal data to public institutions or authorities, to the extent required by law
What is our legal basis?
When it comes to business administration activities, we process personal data because it is in our legitimate interest, or that of a third party, to do so. In connection with activities involving the exercise of legal rights, processing is necessary for the establishment, exercise or defence of a legal claim. Where we use your personal data to comply with legal obligations, we do so precisely because it is our legal obligation to use your personal data for that purpose.
III. Marketing
We may carry out marketing and remarketing activities using your personal data. Our communications are intended to inform you about our services or those of our partners, loyalty programmes, promotional offers, events or other subjects that might interest you.
To this end, we may send you various types of messages, such as email/SMS/telephone/mobile push/webpush/etc, containing general and thematic information, information about products similar or complementary to those you have purchased, about offers or promotions in which you have shown interest, as well as other commercial communications, such as regarding market research and opinion polls, and we may display personalised recommendations on the website.
In order to provide you with information of interest to you, we may use data regarding your purchasing behaviour (e.g. services or products viewed, added to the basket or purchased) to create a profile for you. In most cases, we base our marketing communications and remarketing activities on your prior consent.
You may change your mind and withdraw your consent to marketing at any time by:
• accessing the unsubscribe link displayed in the messages you receive from us
• sending an email to [email protected]
You can withdraw your consent to remarketing by accessing the links below:
• for Google: https://support.google.com/ads/answer/2662922?hl=en
• for Facebook: https://www.facebook.com/ads/website_custom_audiences/
• by managing your preferences using the cookie module displayed on the website
In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our commercial activity, such as when we ask for your opinion regarding your collaboration with us, or inform you about a product similar to one you have purchased from us or for which you have contacted us in the past. In any situation where we process data about you for a legitimate interest of ours, we take all necessary measures to ensure that your fundamental rights and freedoms are not affected. Nevertheless, you may ask us at any time, by the means described above, to stop processing your personal data for marketing purposes.
We may use your personal data to send you important information about the website, products, services, our contract, this Privacy Policy or any other policies, agreements or transactions relevant to your use of the website, products and/or our services. This information may be important for your use of the website and/or services and does not constitute direct marketing, but rather a way of managing our contractual relationship with you or with the company you represent and/or of complying with a legal obligation.
As part of our promotional activities, we may reshare your posts that relate to the company or our events.
What is our legal basis?
It is in our legitimate interest in promoting our services to use personal data for marketing purposes. You have the right to object at any time to the processing of personal data concerning you for direct marketing purposes, and your personal data will no longer be processed for that purpose.
Whenever necessary, in accordance with applicable law, we will ask for your consent before processing your personal data for direct marketing purposes. In this case, you will be able to withdraw your consent to processing for marketing purposes at any time, in which case you will no longer receive any marketing communications from us.
IV. Analysis
We use cookies to provide you with a personalised experience of browsing and using the website. By using this information, we measure the effectiveness of our content and how visitors use our website and services. While the information obtained through cookies helps us to find out which pages of the website are most attractive to visitors, it is not capable of identifying you uniquely.
Please refer to the Cookie Policy for further information.
What is our legal basis?
We use your personal data collected through cookies where you have given your consent, so as to ensure that we provide you with the best possible experience.
You have the right to withdraw your consent at any time, through the cookie management module accessible via our website, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
V. Recruitment
We use your personal data to assess your suitability for any position for which you may apply within PIATRAONLINE, including positions as an employee, apprentice, volunteer, collaborator, as well as any administrative or service-provision position, regardless of whether such an application was received online, on paper or in person.
What is our legal basis?
Where we use your personal data as part of the recruitment process, this is because it is in our legitimate interest to review your application in order to assess your suitability for any position for which you may apply within PIATRAONLINE.
Where we use your personal data as part of the process of hiring or formalising a collaboration, this is because we are taking steps at your request to enter into a contract that we may have with you. Failure to provide this information automatically results in the impossibility of concluding and/or performing the contract.
In connection with our recruitment activities, we may also process special categories of personal data from candidates where:
● the processing is necessary for the purpose of carrying out our specific obligations in the field of employment (health data, for example)
● the processing relates to personal data which are manifestly made public by you (for example, sexual orientation, philosophical or religious beliefs)
We may process data relating to criminal convictions and offences where the processing is authorised by Union law or domestic law providing for appropriate safeguards for the rights and freedoms of data subjects.
VI. Profiling and automated decision-making
We may use your personal data to create profiles for the purpose of carrying out our remarketing campaigns. In this way, we may collect and process information about your behaviour while visiting our website, in order to personalise your online experience and provide you with information tailored to your profile. We always ensure that such processing is carried out in compliance with your rights and freedoms and that decisions taken on this basis do not have legal effects on you and do not similarly significantly affect you.
If you have given us your consent to remarketing and subsequently wish to exercise your right to opt out, you may withdraw from remarketing in accordance with point 5, section III of this Privacy Policy.
What is our legal basis?
Where we use your personal data as part of our remarketing activities, we do so on the basis of your consent.
6. WHAT IS THE LEGAL BASIS ON WHICH WE PROCESS YOUR PERSONAL DATA
We process your personal data:
● in order to fulfil our obligations under any contract we may have with you
● where it is in our legitimate interest or the legitimate interest of a third party to use personal data so as to ensure that we provide our services in the best possible manner
● where it is our legal obligation to use your personal data in order to comply with applicable legal regulations
● where you have given us your consent
We may process special categories of data where:
● the processing is necessary for the purpose of carrying out our specific obligations in the field of employment (health data, for example)
● the processing is necessary for the establishment, exercise or defence of a legal claim
● the processing relates to personal data which are manifestly made public by you (for example, data concerning dietary preferences, which may indicate data about your health or religious beliefs or sexual orientation)
● you have given us your explicit consent to the processing of that personal data for one or more specific purposes
● the processing is necessary for reasons of public interest in the area of public health
We may process data relating to criminal convictions and offences where the processing is authorised by Union law or domestic law providing for appropriate safeguards for the rights and freedoms of data subjects.
7. Who we share your personal data with
PIATRAONLINE may share personal data with various categories of third parties, as necessary:
• third parties involved in the services we offer to customers, such as payment processors, banking service providers, potential partners and suppliers for organising events, loyalty campaigns or promotional offers, marketing, PR, advertising and advertising production agencies, event organisers
• internet and telephony providers, IT systems and software, cloud and hosting providers, IT support, document and information storage, confidential waste disposal, document and activity review or management platforms and/or providers, document processing and translation, secretarial services, audit, training
• our professional advisers, such as lawyers, valuers, tax consultants and accountants or other experts;
• human resources and payroll companies and platforms, security firms and building management bodies, delegates, postal or courier providers
• third-party service providers who assist us in operating and interpreting the data obtained through online promotional campaigns or who manage the newsletter service
• potential buyers of the business or of parts of our business
• public or regulatory authorities, tax authorities
Please note that this list is not exhaustive and there may be other instances in which we need to share personal data with other parties in order to provide our services as effectively as possible or to protect the rights, safety and property of our company or of the individuals who make it up, employees, suppliers or others of this kind, to respond to complaints or to prevent fraud and unlawful activities.
8. Use of cookies
Our website uses cookies for the purpose of analysing traffic trends and the preferences of our users, or in order to be able to send you advertising messages through remarketing techniques (for example, you may see our advertising banners on other websites that offer advertising space, after you have visited our website).
Cookies are generally text files, modules or similar technologies which the browser on your computer, tablet or mobile telephone may store when you visit our website. Files of this type have set retention periods and remain passive, do not contain malware and do not access information on your hard drive. These types of files can only be accessed by the web server that placed them.
By using this information, we can measure the effectiveness of our content and the way in which visitors use our website and our services. This enables us to find out which pages of our website are most attractive to our visitors and which parts of our website are of most interest.
This website uses the Google AdWords and Facebook remarketing service to advertise on third-party websites to visitors who have previously accessed our website. This may mean that we advertise to previous visitors who have not completed an action on our website, such as using the contact form to make an enquiry. This could take the form of an advertisement on the Google search results page, on a website within the Google Display Network or somewhere on Facebook. Third-party vendors, including but not limited to Google, Facebook, Tik Tok and Instagram, use cookies to serve advertisements based on a user’s previous visits to the www.piatraonline.ro website. All data collected will be used in accordance with our privacy policy, as well as with Google’s and Facebook’s privacy policies.
Thus, through cookies and action tags which we and our partners use on this website (via advertising servers, content servers, website analytics agents, etc.), we may have access to anonymous information relating to you:
• IP address
• the country and server to which your computer is connected
• the operating system, browser type and computer type that you use
• java or cookie configuration
• your purchasing preferences and behaviour on this website (the pages you have visited, the searches you have carried out and the products you have viewed and purchased, the date and time of the visit or order, the number of visits and orders, the number of visits per browsing session and per server type, the URL addresses from which you came, the domain names and web pages you browse), your hobbies and lifestyle, the groups you are affiliated with
• demographic information and information about the area code associated with your server
• applications and plug-ins, as well as any terms used in searches on our website
• the address of the website that led you to our website
We collect this information in a manner that does not allow your personal identification. However, it is possible that at some point – we and/or our partners – may associate this information with your identity, if you have a user account. We may also subsequently collect and process certain information about your behaviour while visiting our website, in order to personalise your online experience and provide you with offers tailored to your profile.
Please refer to the Cookie Policy to find out all the information about the cookies we use, their purpose and duration, and how you can exercise your preferences.
9. Processors, independent controllers and joint controllers
The confidentiality of your data is important to us, which is why the transfer of personal data to processors, independent controllers and joint controllers is carried out only under a confidentiality undertaking from the recipients, whereby they guarantee that such data is kept secure and that the management of such information is carried out in accordance with the legislation in force and applicable policies. In any event, on each occasion we will transfer to recipients only the information strictly necessary for achieving that purpose.
We may appoint subcontracted processors as necessary to carry out our activity. We carry out appropriate due diligence and put in place the necessary contractual documentation in connection with any subcontractor, in order to ensure that it processes personal data appropriately and in accordance with legal and regulatory obligations.
Furthermore, we may appoint independent controllers of personal data where necessary for carrying out our activity (for example, but without limitation, accountants, lawyers, recruitment agencies or other third-party experts), complying with legal and regulatory obligations relating to personal data, including, but not limited to, the implementation of appropriate safeguards.
We may also share this information, in accordance with the legislation in force, with joint data controllers, such as affiliated or partner entities.
We and the independent and joint data controllers with whom we work establish our mutual rights and obligations under a “Data Processing Agreement between independent/joint controllers” (the “Agreement”), to which we are Parties. The Agreement adequately reflects our respective roles and relationships, as independent/joint controllers, towards you. As a general rule, the essence of this agreement is as follows:
• the parties act as independent/joint data controllers, determining independently/jointly the purpose and means of processing personal data
• the data is processed for the primary purpose of carrying out the activity and resolving enquiries, but also for preventing fraud, resolving disputes or complaints, protecting the rights, safety and property of the company – controller – or of the individuals who make it up, employees, suppliers or others of this kind, for complying with legal obligations and requests from authorities, or for marketing purposes (secondary purposes)
• each independent/joint controller is solely responsible for ensuring that the personal data under its control is processed lawfully
• each independent/joint controller will respond to requests from data subjects that are addressed to it. If data subjects’ requests relate to data or processing operations for which the other joint controller is responsible, the data subject’s request will be forwarded to the latter for resolution, and the data subject will be notified of this fact
• each independent/joint controller is solely responsible for ensuring the transmission of the information notice concerning the processing of personal data to the data subjects whose data belongs to it originally
• regardless of the provisions of the agreement, the data subject may exercise their rights under the GDPR in respect of and in relation to each of the controllers
10. Where do we transfer personal data?
In order to provide our services or for other processing purposes listed here and, in particular, where a foreign element is involved, it may be necessary for us to transfer your personal data to locations outside the European Economic Area. In any event, before transferring personal data to another jurisdiction, we will ensure that there is a decision on the adequacy of the level of protection or that the controller or processor in that jurisdiction provides appropriate safeguards, or that one of the following exceptions applies:
● you have explicitly expressed your agreement to the proposed transfer, after having been informed of the possible risks that such transfers may entail;
● the transfer is necessary for the performance of a contract between you and us or for the implementation of pre-contractual measures taken at your request;
● the transfer is necessary for the conclusion of a contract or for the performance of a contract concluded in your interest between us and another natural or legal person;
● the transfer is necessary for important reasons of public interest;
● the transfer is necessary for the establishment, exercise or defence of a legal claim;
● the transfer is necessary in order to protect your vital interests or those of other persons, where the data subject is physically or legally incapable of giving consent;
● the transfer is made from a register which is intended to provide information to the public and which is open to consultation by the public.
11. How long we keep your personal data
We retain the personal data we collect from and about you for as long as necessary to fulfil the purpose for which we collected it and for the purpose of satisfying any legal, accounting or reporting requirements (over an extended period of time, without a fixed interval being set).
The data retained includes, but is not limited to:
• we retain your data relating to an order, from the most recent return, until the termination of the legal obligation or our legitimate interest
• the data necessary for issuing invoices
• the data associated with your user account
• the data we use for marketing purposes will be processed until you unsubscribe from the newsletter service or exercise your right to object
Where we do not provide you with an exact period regarding the processing of your personal data, we rely on the following principles:
• we process information only for as long as we need it for the activities mentioned in this policy
• we always comply with the deadlines imposed by legal provisions
• we assess security risks in the context of the use and storage of your data
Where it reasonably appears that the data is no longer necessary, we may destroy it immediately, without any notification or liability (for example, in the case of candidates who have not been selected for a position within PIATRAONLINE, their CVs will not be retained).
12. Confidentiality and security of your personal data
We apply appropriate technical, physical and organisational measures, which are reasonably designed to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, and against other unlawful forms of processing. Access to personal data is limited to authorised recipients on a need-to-know basis. We maintain a comprehensive information security programme, proportionate to the risks associated with the processing. The programme is continuously adapted to mitigate operational risks and to protect personal data, taking into account accepted industry practices. We will also use enhanced security measures whenever we process any special categories of personal data.
All our partners, employees, consultants, workers, controllers and processors (that is, those who process your personal data on our behalf, for the purposes listed above), who have access to and are involved in the processing of personal data, are required to observe the confidentiality of such personal data and to guarantee the same level of protection as that provided by our foundation.
13. Right of access and other rights
Right of access
If you ask us, we will confirm whether we process your personal data and, where permitted by law, we will provide you with a copy of that personal data (together with certain other details). If you require further copies, we may need to charge a reasonable fee based on administrative costs.
Right to rectification
If the personal data we hold about you is inaccurate or incomplete, you have the right to request its rectification. If you are entitled to rectification and we have shared your personal data with others, we will inform them of the rectification where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you with whom we have shared your personal data, so that you can contact them directly.
Right to erasure
You may ask us to erase or suppress certain personal data of yours, in the specific circumstances provided for by law. If you are entitled to erasure and we have shared your personal data with others, we will inform them of the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will tell you with whom we have shared your personal data, so that you can contact them directly.
In accordance with the GDPR, we may decline to act on a request for erasure of your personal data insofar as the processing is necessary for the establishment, exercise or defence of our legal rights, or where we have a legal obligation to process the data.
Your right to restrict processing
You may ask us to “block” or stop processing your personal data in certain circumstances, such as where you contest the accuracy of that personal data or have objected. If you are entitled to restriction and we have shared your personal data with others, we will inform them of the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we will also tell you with whom we have shared your personal data, so that you can contact them directly.
Right to data portability
You have the right, in certain circumstances, to obtain the personal data you have provided to us, in a structured, commonly used and machine-readable format, and to reuse it elsewhere, or to ask us to transfer it to a third party of your choice.
Please note that this right applies only to automated information for which you initially gave us your consent for use, or where we have used the information to conclude a contract with you.
Right to object
You may ask us to stop processing your personal data, and we will do so if:
● We rely on our legitimate interests or those of a third party to process personal data, unless we can demonstrate compelling legitimate grounds justifying the processing
● We process your personal data for direct marketing purposes
In the context of our events or courses, photo/video content may be captured to help us promote our brand and our services. It is not our intention to capture content that highlights a particular person, our purpose being solely to make the atmosphere of our activities known to the public. If, however, you are identifiable in the photo/video materials disseminated by us and we have not requested your consent, you have the right to object to the processing on grounds relating to your particular situation. In any event, in observance of your right to privacy, before any photo and/or video session, we will give prior notice that photo/video content is about to be captured.
PIATRAONLINE will never use your personal data to subject you to an automated individual decision that produces legal effects concerning you or similarly significantly affects you. However, you may at any time object to profiling or automated decision-making carried out as part of our remarketing activities in accordance with point 5, section 3 – “Marketing” above.
Your right to withdraw your consent
If we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw that consent at any time.
Your right to lodge a complaint with the supervisory authority
If you have any concerns about any aspect of our privacy practices, including the way we have handled your personal data, you may report it to the competent supervisory authority (www.dataprotection.ro).
If you wish to exercise the rights set out in this privacy policy, please contact us by sending an email to [email protected], noting that we may ask you for information specific to you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information relating to your request, in order to speed up our response.
14. CHANGES TO THIS PRIVACY POLICY
To ensure that you are always kept up to date on how we use your personal data, we will update this Privacy Policy from time to time to reflect any changes in the use of your personal data. We may also make changes in order to comply with changes to applicable legislation or regulatory requirements. Where possible, we will notify you by email of any significant changes. Nevertheless, we recommend that you periodically review this privacy policy on our website to stay informed about how we use your personal data.
**Withdrawal of Consent**
If you have given your consent to the processing of your personal data, you have the right to withdraw your consent at any time, free of charge, for example, if you wish to stop receiving marketing messages from us. If you wish to withdraw your consent, please contact us using the information at the end of this page.
**Contact us**
To request a copy of your information, to unsubscribe from our mailing list, to request the deletion of your data, or to ask a question about the privacy of your data, we have simplified the process:
To contact us, please send an email to [email protected]
Write to us at:
The Data Protection Officer at Piatraonline
Aleea Teișani 137 A, 014034, Bucharest, Bucharest