Privacy & Data Processing Policy
1. Purpose of this policy
This Privacy & Personal Data Processing Policy (hereinafter referred to as the "Policy") aims to inform you about how GADGET BIGBOYS SRL, known under the generic brand "Gadget Boutique" (which we may also refer to as "we", "the Organization" or "the Company") treats the confidentiality of the data it collects and when you provide it to us by using this site, including any data you will give us when, for example, you subscribe to our newsletter, participate in one of our promotions or purchase a product or service.
Our sites are not intended for children under 16 years of age, we do not collect and do not intend to knowingly collect data relating to children. For this purpose, we take all reasonable care to verify that the person providing us with the data is not a child, as defined above - the responsibility for any information provided to us in circumvention of these provisions is entirely with the person providing us with this data.
It is important that you read this policy together with all the data processing & privacy notices that we will provide on various occasions when we collect or process your personal data in order to be fully informed at all times about why and how we use this data. This policy comes as an addition to the other notices and is not intended to remove them.
2. Who are we?
Below you will also find our identification data:
|
Name: |
GADGET BIGBOYS SRL |
|
Registered office: |
Bucharest County, sector 1, BERCA Street no. 5 - Zeletin Street no. 1 |
|
Trade register number: |
J40/16585/24.09.2021 |
|
Unique identification code: |
44961028 |
|
Phone: |
0756 024 024 |
|
E-mail: |
To the extent that you have any concerns, comments or complaints regarding us or the personal data we process for you and the way we ensure the confidentiality of this data, you can send us an e-mail at any time to the address above or to the address indicated in section 2.
3. Copyright
The Company, as the author, owner, administrator of the website https://gb.ro/ (hereinafter individually referred to as the "Site"), collects and processes personal data belonging to the persons accessing the Site, in accordance with the legal provisions on the processing of personal data and the free movement of such data. Through this policy, we tell you what information we collect about you as a user of the Site (hereinafter referred to as the "User"), how we use (process) it, as well as the options you have regarding this data.
This Policy applies to all devices used to access the website https://gb.ro/ , such as, but not limited to, smartphone and tablet devices, laptops, smartwatches, as well as any other device with an internet connection that allows remote access to the Site. The Company owns all copyrights to all content that the Company posts on the site, and persons accessing the Site have no rights to the content, including, without limitation, reproduction, copying, distribution, modification, etc.
If you do not agree with the terms and conditions related to their use (set out in this document from the point of view of personal data protection, but also in the rest of the documents on the website from the point of view of confidential information, etc.), please do not use the site https://gb.ro/ .
4. Changes to this policy
This policy became applicable at the Company level on the date indicated at the top of this web page. To the extent that we deem necessary, this policy may be subject to occasional changes. When we make changes, the updated policy will be published on this page, also indicating the date from which it became applicable. In such a case, it will be at the discretion of the Company whether to notify individuals of these changes in a way other than simply displaying them on the website, as well as the manner in which this will be done (e-mail, pop-up, slide bar, announcement, etc.).
We encourage you to look for updates and changes to this policy by checking this date when you access our websites and mobile applications. We will notify you of any changes to this policy that may significantly affect how we use or disclose your personal information before the change becomes effective by means of a message on this site, when possible.
5. Links to other sites
The site is part of a set that also includes pages on social networks, namely Instagram: https://www.instagram.com/wwwgbro/?hl=en . Even though we use these platforms to contact you and present you with useful information or offer you the opportunity to place an order for a product or service, they are governed by their own privacy policy, which we encourage you to read here: Instagram .
The Site or the aforementioned social media pages may contain links to other sites over which the Company has no control, and such links do not constitute an indication of interdependence/connectivity with the respective entities. If you visit one of these websites, we recommend that you familiarize yourself with the rules for using the respective website, the privacy and data processing policy, as well as the security standards used. The Company is not responsible for the expressions and procedures used by the operators of these websites, and you are solely responsible for the transmission of personal data on these sites.
6. User Conduct
By accessing the Site, you agree to comply with the legal rules in force in Romania when using this Site, to act invariably in accordance with good morals and the respective rules, and not to damage in any way the reputation and rights of the Company or other users.
7. Liability
All risks that may affect you as a result of using this Site are entirely your responsibility and the Company is not responsible for them. All disputes arising in connection with the use of the Site will be resolved by the competent court in Romania.
You are also responsible for any comments, reviews or messages sent through the Site or on related social media pages that may affect other people or the Company. Although we constantly strive to delete or eliminate these messages or comments, it is possible that, due to the short time, we will not be able to act promptly on all reported issues. In the event of claims from the Company or third parties regarding the posted content, we fully reserve the right to fully recover our damages from you.
8. Information about the processing of personal data
8.1 Who does this policy apply to?
According to the legislation, as a User of the Site you are a beneficiary of our services (including by purchasing physical products). Regardless of whether you do so personally, through a representative or as a contact person of a company or a person in any kind of relationship with our Company, you are a "data subject", i.e. an identified or identifiable natural person.
In order to be completely transparent about data processing and to allow you to easily exercise your rights at any time, we have implemented measures to facilitate communication between us, the data controller, and you, as the data subject.
8.2 Compliance with legal regulations regarding the protection of personal data
In the course of its current activity, the Company processes certain personal data relating to its customers, users and employees and assumes the role of personal data controller in relation to the processing of such personal data.
When processing personal data, the Company carries out its activity in accordance with legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation" or "GDPR/RGDP").
In accordance with the above-mentioned provisions on the protection of individuals with regard to the processing of personal data and the free movement of such data, the Company processes and manages personal data for the purposes listed below, having implemented technical, organizational and security solutions in line with legal regulations.
During the use of the Site, the Company takes all necessary precautions to maintain the confidentiality of personal data transmitted by Users through the Site, both directly and indirectly.
This policy describes how the Company and its affiliates collect and use the personal data of users/employees in order to provide the products and services offered.
Examples of operations that fall under this category include, but are not limited to, the following:
- customer support, which involves requesting information or filing complaints, post-sales activities, including customer relations services, informing users/customers about the evaluation of the services offered (feedback);
- carrying out competitions organized by the Company through the Site or social networks;
- delivery of prizes won or products ordered;
- information about services, accounts, programs, contests and raffles;
- presenting special offers, personalized promotions, advertising messages, promoting products and events, loyalty programs or other marketing purposes;
- maintaining, improving and analyzing the websites, products and services we offer;
- maintaining appropriate records for internal administrative purposes, maintaining the functionality of our websites and maintaining their relevance to customer needs;
- providing information on the products sold;
- providing important information regarding product safety;
- for activities specific to the human resources department, in case you are interested in being part of our team and you have sent a CV to the Human Resources department through the Site, in the dedicated section or you have been redirected to the contact page;
- to respond to requests received at the Company's contact address or in the dedicated section on the Site;
Personal data will be kept for as long as necessary for the purposes mentioned above or, where applicable, in accordance with legal provisions (such as, for example, in the case of organizing competitions).
8.3 Personal data controller. Who are we?
As you have seen or will see, we request certain personal data from you depending on the stage you are in on the Site. In terms of personal data, we are a personal data controller. In this capacity, we also have a number of obligations, including informing you about the data we process, the way we do it, what rights you have and how you can exercise these rights.
Below you will also find our identification data:
|
Name: |
GADGET BIGBOYS SRL |
|
Registered office: |
Bucharest County, sector 1, BERCA Street no. 5 - Zeletin Street no. 1 |
|
Trade register number: |
J40/16585/24.09.2021 |
|
Unique identification code: |
44961028 |
|
Phone: |
0701185703 |
|
E-mail: |
If you have any questions, comments or complaints about us or the personal data we process for you or regarding orders, you can send us an e-mail at any time at info@gb.ro .
8.4 What information do we collect?
Personal data or personal information means any information about an individual that can help identify that person. This does not include data where the identity has been removed (anonymized data).
Depending on the products, services or functionalities you wish to benefit from, we will need to process certain personal data, which, in general, will be the following as appropriate (this list is indicative and will be, where appropriate, detailed):
|
Category |
Data included |
|
Identification data |
Name, surname, company name, trade register registration number, unique identification code, username or similar identifier, marital status, function, date of birth, gender, language in which you wish to interact with us, country, etc. |
|
Contact details |
Billing address, delivery address, email address, phone number |
|
Financial data |
payment or card/bank account information, purchase information |
|
Trading data |
Details of payments to and from you and other details of the products and services you have purchased from us |
|
Technical data |
IP (internet protocol) address, login details, browser type and version, location and time zone settings, browser plug-ins and their versions, operating system, operating platform and other technologies on the devices you use to access this Site. |
|
Profile data |
Username, password, orders placed by you, your interests and preferences, feedback provided, responses to surveys |
|
Usage data |
Information about how you use our Site, products and services |
|
Marketing & communication data |
Your preferences for receiving marketing materials from us and our third parties and your preferred methods of communication |
|
Biometric data |
Photo-video images from the review section, events you participate in (example: live broadcasts on social networks, other events) or when you provide us with photo-video testimonials. |
We also collect, use and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data may be derived from your personal data, but is not considered personal data within the meaning of the law because this information does not directly or indirectly reveal your identity.
For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific site feature. However, if we combine or correlate Aggregated Data with your personal data so that we can directly or indirectly identify you, we will treat the resulting combined data as personal data which will be used as described in this document.
We do NOT collect any Special Categories of Personal Data about you (this includes details about your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and the processing of genetic data, biometric data for the unique identification of you, data concerning health or data concerning your sex life or sexual orientation). We also do not collect information about criminal convictions and offences.
You will see that as you use our Site, we collect information about you and the services you use.
The information we collect falls into three different categories:
|
Source |
data |
|
Direct interaction (information we collect from you) |
You may provide us with information about yourself (such as Identification Data, Contact Data and Financial Data) directly by filling in the fields on the Site or by post, email, telephone or other method that we make available to you. This includes personal data that you provide to us when:
|
|
Automated technologies or interactions |
As you use our Site, we may automatically collect Technical Data about the equipment you use, how you browse, and various patterns. We will collect this information through the use of cookies, server logs, and other similar technologies. Please read our cookie policy for further details here . |
|
Third parties or publicly available information |
We may receive personal data about you from various third parties (or public sources), such as:
|
8.4.1 Information you provide to us
As a customer (user who has purchased a product from the Site) - some of the information we collect is provided by you when you use our services, purchase one of the products, subscribe to the newsletter or contact us on social media pages, e-mail or other means of contact. This may include your first and last name, username, password, e-mail address, postal address, telephone number, date of birth, as well as any other information provided/requested by us. Any information provided by you will be taken into account and you hereby agree that your personal data may be used by the Company for the purposes set out below.
For these situations, the following examples of personal data will be taken into account:
- your first and last name,
- place of residence,
- email address,
- date of birth,
- phone number,
- payment details,
- when applicable, appropriate information about the order placed and
- photo-video images that will be used in the review section, when you participate in off-line or on-line events.
In this case, your personal data is processed in accordance with the terms & conditions found on the Site and on the related social media pages. If you choose not to provide us with your data, we will not be able to complete your order, respond to your requests, enter you into contests and promotions, or allow you to enjoy the full customer experience.
Customers' personal data is processed for the following purposes:
- to facilitate the management of the respective customer's orders;
- marketing (for example, as part of the Company's marketing campaigns, to provide information about new products, to deliver the Company's commercial communications, or to provide notifications regarding prizes won and other customer benefits);
- monitoring customer satisfaction.
In the case of contests organized on the Site or through social media pages, personal data is processed for the purpose of awarding prizes to contest winners. Personal data may be used to send you information about products, services, events, etc. that we offer and host, provided that you tick the box corresponding to this option in the Loyalty Program or contest (promotion) registration form or have sent such data for one of the purposes mentioned above.
As a user - when you use the contact address, write to us on one of the social network pages or send us a request via email addresses through which you request certain information about the Company, you want to report certain aspects to us, etc. In order to be able to respond to the messages sent, the Company must process the data sent.
Attention! Any information and personal data that you transmit through any means or other to the Company falls under your full responsibility, you being solely responsible for the accuracy of the information and data transmitted to the Company.
8.4.2 Information we collect automatically using technologies
Some information is collected automatically by us, including when you access our Websites or otherwise use our services. This information includes:
- Purchase Information - We may collect information about your transactions on the Site, including what products you purchase, how often you access them, whether you have purchased other products, and any rewards or promotions associated with your purchases.
- Device and General Usage Information - We may collect information about your browser or device. This information may include the type of device you are using, your operating system, browser, Internet service provider, your domain name, Internet Protocol (IP) address, device and mobile advertising identifiers, the website that referred you to the Site, the web pages you view (including the date and time you viewed them), the services or functionality you access or use (including the date and time you access or use them), and the subject of the advertisements you click on or view. To collect this information, we use cookies, web beacons and/or similar technologies. The purpose of processing this data is to use it by the Company to compile statistics, through the use of Aggregated Data, which analyzes the use of the Site and to personalize advertising to Users, to the extent that they have agreed to this aspect.
8.4.3 Statistical data & anonymous data
The company may use statistical data or anonymous data resulting from processing for the following purposes:
- preparing reports/analyses;
- collecting information for own purposes;
- publishing, promoting, providing the services offered by the Company
8.4.4 Communication data. Cookies policy & other tracking technologies.
This section on cookies explains how and why cookies, web beacons, pixels, gifs and other similar technologies (collectively referred to as "Cookies and Other Tracking Technologies") may be stored and accessed on your device when you use or visit the Site.
8.4.4.1 What are cookies & other tracking technologies?
A "cookie" is a small text file with information that can be stored on your computer or mobile devices with Internet access (smartphone, tablet or other devices that allow connection to the Internet and access to a web instance) when you access the Internet. The cookie is installed by the request issued by a web server to a browser (e.g. Internet Explorer, Chrome) and cannot access information on the user's computer/mobile device. We mention that this technology does not contain software programs, viruses or spyware.
Other tracking technologies work similarly to cookies and place small data files on your devices or monitor your activity on the Site to allow us to collect information about how you use the Site. This allows the Site to recognize your device from other users of the Sites. The information provided below about cookies also applies to these other tracking technologies. You can find more information at www.allaboutcookies.org and www.youronlinechoices.eu.
8.4.4.2 What do we use cookies for?
Use of Cookies - We use cookies and other tracking technologies to make the Site easier to use and to better tailor our offerings to your interests and needs. Cookies are also used to speed up your future activities and experiences on our Site. These include your online privacy preferences or relevant advertising. We also use cookies to compile anonymous, aggregated statistics that allow us to understand how people use the Site and to help us improve its structure and content, excluding personal user identification.
8.4.4.3 What types of cookies do we use?
The company uses 3 types of cookies: (a) necessary cookies (b) analytical cookies and (c) other cookies.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously. Without them, the website cannot function and cannot provide the requested services.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information about visitor metrics, bounce rate, traffic source, etc.
Other cookies are uncategorized cookies that are being analyzed and have not yet been classified into a category.
A detailed overview of the strictly necessary cookies on our website can be viewed by accessing the link https://www.cookieserve.com/ and entering the page https://gb.ro/ in the search box .
Information obtained through the use of cookies may be collected only for the purpose of mediating and performing certain user functions. This data is encrypted in a way that disables access by unauthorized persons.
8.4.4.4 What are third-party cookies?
In some cases, our Site uses cookies provided by third parties. Please note that we are not responsible for their processing of personal data and we recommend that you read their privacy and cookie policies.
For example, we include in this category cookies provided by third parties such as YouTube (for playing video content), Facebook (for displaying our fan page, events, etc.), Instagram (for displaying the feed and the possibility of interacting with the respective posts), etc.
Although they are not mandatory, it is possible that if you choose not to accept these cookies, your experience with the Site may be limited (for example, you may not be able to view entire elements on a page, such as video content).
8.4.4.5 What types of similar tracking technologies do we use?
Our website uses Google Analytics, a web analysis service provided by Google, Inc. ("Google"), Active Campaign (for sending newsletters), SmartLook (for identifying user behavior habits). Google Analytics uses cookies to help the website analyze how users use the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties if required to do so by law, or if third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You can refuse the use of cookies by selecting the appropriate settings on your browser. If you choose to do this, you may not be able to use the full functionality of the website.
You can find out more about Google Analytics' privacy policy here .
To disable the Google Analytics option, you can access the following link .
Users' personal data are processed subject to their consent, which is voluntary and is provided by the User when they access the Site.
Most Internet browsers are initially set to automatically accept cookies. You can change your settings to block cookies or to be notified when cookies are sent to your computer or mobile device (smartphone, tablet). If you cancel the cookies we use, you will no longer receive personalized information when you visit the Site. If you use multiple devices to view and access the Site (e.g. computer, smartphone, tablet, etc.) you will need to ensure that each browser on each device is set to match your cookie preferences. By accessing the "cookie settings" in the browsers you use, you will find instructions explaining how to change your cookie settings. These settings are usually found in the "options" or "preferences" menu of your browser. For more details, you can also use the "help" option of your browser.
Your browser may allow you to delete all cookies after you close it. However, this option will delete permanent cookies that may store your preferences and personalized settings on websites you visit regularly. However, you can keep the cookies you want, as your browser may allow you to specify which websites are always or never allowed to use cookies.
You can find additional details on how to delete cookies or how to manage cookies on different internet browsers by accessing the links below:
9. How do we use the information obtained?
The Company collects this information in order to provide you with the Company's products and services, to improve the provision of services, and to develop new technologies to help you.
Specifically, we use the information:
- to be able to deliver the products and services you have purchased;
- to send you periodic commercial information;
- to keep you up to date with our latest news;
- to improve the safety and security of our users and services;
- for the assistance provided to users;
- for research and development;
- to enable communications to or between users;
- in connection with legal proceedings.
The company does not sell or distribute your personal information to third parties for third party direct marketing purposes.
9.1 Provision of services and assurance of functions
The Company uses the information collected to provide, personalize, maintain and improve its products and services. This includes using the information to:
- creating and updating your account on the Site;
- confirmation of your identity and/or the company you represent;
- allowing access to your account and viewing its status as well as transactions made;
- performing internal operations necessary to provide our services, including troubleshooting software and operational errors, performing data analysis, testing, studying, monitoring and analyzing usage and activity trends;
- activities specific to the human resources department, in case you are interested in being part of our team and have sent a CV to the Human Resources department through the Site;
9.2 Customer support
The Company uses the information provided by you (such as history in the application or on the Site, comments or reviews left on social media platforms or sent by email, payment methods, personal data, etc.) to improve the support service offered to users, such as for:
- to investigate and resolve your problems;
- to monitor and improve the responses received from customer support;
9.3 Research and development
The company is in a continuous process of improving the services and products offered to customers, through continuous research and development, in order to consistently provide quality services and products.
Therefore, your data is very important to us and we may use it for testing, research, analysis and product development. This allows us to improve the safety and security of our services, develop new features and products, and facilitate the provision and expansion of our services.
9.4 Messages
The Company may use the information you provide to provide you with messages (via the platform, email or social networks) regarding your account status, Site and social platform updates, loyalty, rewards, events, newly introduced services or products and the like, when we believe you would be interested.
9.5 Legal proceedings
We may use the information you provide to investigate or resolve disputes, complaints or any existing problems regarding the use of the products or for any other purpose permitted by applicable law. The Company may also transmit the information provided in accordance with requests from jurisdictional bodies that have jurisdiction regarding access to this information, such as criminal investigations, files pending in courts or in preliminary proceedings, etc.
9.6 Transfer of information obtained
We will only disclose your personal data for the purposes and to third parties described below.
|
Third party (name) |
Purpose (service provided) |
Privacy policy |
|
Stripe |
Payment processing |
|
|
SmartBill |
Issuing invoices, preparing accounting documents |
|
|
Frisbee |
Processing & sending orders |
https://www.frisbo.ro/politica-de-confidentialitate?hsLang=ro-ro |
Personal data may be shared with any other member company of our group, if we consider this to be in our legitimate interest for internal administrative purposes (e.g. data storage) or for auditing and monitoring our internal processes.
We may share personal data with and/or to companies in our group if they provide us with products and services, such as IT systems.
9.7 Transfer of personal data abroad
We work with a number of carefully selected partners and service providers to ensure that your data is secure. We consider it important that you are informed about where the data you provide to us is transferred.
The transfer of personal data to a third country may only take place if the country to which the transfer is intended ensures an adequate level of protection.
The transfer of data to a country whose legislation does not provide a level of protection at least equal to that offered by the General Data Protection Regulation is possible only if there are sufficient guarantees regarding the protection of the fundamental rights of the data subjects. These guarantees will be established by us through contracts concluded with the suppliers/service providers to which your personal data will be transferred.
Some of our service providers are/may be located outside the European Economic Area (EEA), so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data outside the EEA, we will ensure that there is a similar level of protection through one of the following safeguards:
- We will transfer your personal data to countries where it has been demonstrated by the European Commission that they provide an adequate level of security for personal data. For more details, click here .
- When we use certain service providers, we may use certain model contracts provided and approved by the European Commission that provide personal data with the same protection as it has in Europe. For more details, click here .
- When we use US providers, we may transfer data if they are part of the EU-US Privacy Shield, which requires them to provide similar protections for data shared between the EU and the US. For more details, click here .
If the Company is required to provide personal data or is not permitted to do so, only the data necessary to fulfill the strict purpose of the request will be disclosed.
9.8 Provision of data to third parties
The Company may disclose personal data to third parties. The Company only provides partners with personal data that it has already processed, for which technical and organizational measures for data protection have been established and the other obligations arising from the General Data Protection Regulation have been fulfilled. The Company's partners have access to personal data only to the extent necessary for the performance of their tasks.
The company does not under any circumstances provide personal data to third parties for a fee.
The categories of recipients to whom the collected personal data may be disclosed:
- the Company's contractual partners (such as the companies with which we have partnership relationships, but only on the basis of a confidentiality commitment from them, guaranteeing that this data is kept safe and that the provision of this personal information is made in accordance with the legislation in force);
- service providers that provide the Company with services related to placing personal data on the Company's servers, managing applications for loyalty programs, ensuring payments for purchases from the Company and evaluating marketing surveys (e.g. marketing services, payment/banking services or other services), including entities that assist the Company in data processing as processors, insurers, etc.); The personal data of the Company's employees are provided to the external accounting firm, which compiles the Company's accounting, tax and payroll records;
- to the competent authorities (Prosecutor's Office, Police, courts and other authorized state bodies), based on and within the limits of legal provisions and as a result of expressly formulated requests, as well as when required in accordance with applicable legislation;
- to other companies in the same group as the Company, its subsidiaries, and affiliated companies for management and analysis, decision-making, and other business purposes. For example, we may share your information with subsidiaries and affiliated companies to administer our loyalty or reward programs, process orders and requests, and to expand and promote our product and service offerings;
- specialists, lawyers, accountants and other professional service providers.
We may also transmit personal data to third parties:
- if you request or give us your consent to this;
- to persons who can demonstrate that they have the legal authority to act on your behalf;
- where it is our legitimate interest to do so in order to administer, expand or develop our business;
- if we are under a duty to disclose your personal data to comply with a legal obligation, any lawful request from government or executive authorities, and as may become necessary to meet certain national security or law enforcement requirements or to prevent certain illegal activities;
- to respond to any claims, to protect our rights or those of a third party, to protect the safety of any person or to prevent any illegal activity; or to protect the rights, property or safety of the Company, its employees, its customers, suppliers or others. Some of these recipients (including our affiliates) may use your data in countries outside the European Economic Area.
10. Safety and security
We understand how important the confidentiality and security of personal data is and we take the necessary measures to protect our clients and other persons whose data we process from unauthorized access to personal data, as well as from unauthorized modification, disclosure or destruction of the data we process in the course of our current activity.
We have implemented the following technical and organizational measures for the security of personal data:
Dedicated policies. We adopt and constantly review internal personal data processing practices and policies (including physical and electronic security measures) to protect our systems from unauthorized access or other possible threats to their security. These policies are subject to constant verification to ensure that we comply with legal requirements and that the systems function adequately.
Data minimization. We ensure that your personal data that we process is limited to what is necessary, adequate and relevant for the purposes stated in this Notice.
Restricting access to data. We try to restrict access to the personal data we process to the minimum necessary: employees, collaborators and other persons who need to access this data to process it and perform a service. Our partners and collaborators are subject to strict confidentiality obligations (either by contract or by law).
Specific technical measures. We use technologies to ensure the security of our customers, always trying to implement the most optimal solutions for data protection. We also make periodic data back-ups to be able to recover them in the event of a possible incident and we have implemented periodic audit procedures regarding the security of the equipment used. However, no website, no application and no internet connection is completely secure and untouchable (see NASA).
Ensuring the accuracy of your data. Sometimes we may ask you to confirm the accuracy or timeliness of your data to ensure that it reflects reality.
Staff training. We constantly train and test our employees and collaborators regarding legislation and best practices in the field of personal data processing.
Data anonymization. Where we can, we try as much as possible to anonymize/pseudo-anonymize the personal data we process, so that we can no longer identify the persons to whom they refer.
However, although we make constant efforts to ensure the security of the data you entrust to us, it is possible that we may experience less fortunate events and have security incidents/breaches. In these cases, we will strictly follow the security incident reporting and notification procedure and will take all necessary measures to return the situation to normal as soon as possible.
11. Data retention
The company retains personal data only for the period of time necessary to achieve the purpose of its processing and does so in accordance with the rules specified below:
- in the case of contests organized on the Sites or on social networks, personal data are kept only for the period of time in which you participate in the respective contest (including the prize delivery procedure), except for certain financial and fiscal provisions that may require a longer period of time. After this date, we may continue to keep the data obtained, after they have been anonymized, in order to use them for statistical purposes, for research, development, expansion and improvement of the services offered;
- Users' personal data is kept for a maximum of two years from the last visit to the Site. After this period, in the event of account deletion, the Company may continue to keep the data obtained, after they have been anonymized, in order to use them for statistical purposes, for research, development, expansion and improvement of the services offered;
- in the case of employees, personal data is kept for a period in accordance with the archiving deadlines provided by law;
- in the case of posts on social networks, events, conferences, promotional materials of any type (indoor/outdoor/digital format/print format), the images or photo-video materials of the Customers or Users will be maintained until an express request from the persons appearing in such materials. However, in the case of a request for deletion, the Company reserves the right not to comply with such a request if it considers that its interest prevails over the interest of the consumer/person concerned.
- the images recorded by security cameras (if the events take place at the Company's headquarters) are kept for a maximum period of thirty days;
- We retain transaction information and usage statistics in accordance with regulatory, tax and insurance requirements and other requirements in force where we operate. After this period, the Company deletes or anonymizes this information in accordance with applicable laws.
Below you will also find an overview of our main activities in relation to you and the related retention periods:
|
Scope |
Additional Information |
|
Registering as a User |
We will keep your data until you decide that you no longer have User status (delete your account). |
|
Conclusion and execution of the sales or service contract that you conclude with us |
We will process your data for the time necessary to manage the purchase of the products or services you purchase, including any returns, claims, warranties or complaints related to the purchase of that product or service. |
|
Requests or requests made through Customer Service/Support |
We will process the data for as long as necessary to satisfy the request or demand. |
|
Marketing |
We will process the data until you unsubscribe from the newsletter/other marketing methods. |
|
Improving services |
We will process the data punctually, only for the duration of the respective action (i.e. survey, feedback form, etc.) |
|
Hiring procedures |
If you apply for a position with us, but the recruitment process is not completed, we will retain your personal data for a limited period of time, according to our internal policy for processing personal data regarding candidates. If you are an employee of the Company, we will retain your personal data for the legal period provided by law where mandatory and/or for another period necessary to fulfill our legitimate interests (for example, regarding the resolution of possible disciplinary procedures or patrimonial liabilities), in accordance with the employee personal data processing policy made available. |
In short, we will retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements.
We try as much as possible to determine from the outset the period for which we will store personal data, but this is not always possible. In determining the appropriate retention period for personal data, we consider the value, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process the personal data and whether we can achieve those purposes by other means, and applicable legal requirements.
By law, we must retain basic information about our clients (including contact details, identity, financial and transaction data) for 5 years after they are no longer clients for tax purposes.
In certain circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for scientific, historical or statistical research purposes, in which case we may use this information for an unlimited period without prior notice to you.
Please note that in certain expressly regulated situations, we store data for the period required by law.
12. Storage of provided data
The personal data you provide to us and that we process is processed in the EEA ("European Economic Area") and stored on servers in Europe. However, this data may be processed by personnel outside the EEA who work for us or for one of our business partners or service providers, such as Talent LMS, who are covered by the EU-US Privacy Shield.
A complete list of third-party sub-processors and details of their privacy policies will be available on our website when they become available.
Some countries outside the EEA may not provide the same level of adequate protection of your rights and freedoms with regard to the processing of personal data; however, by using our services, you consent to your personal data being disclosed by the Company to third parties.
Please contact us if you would like more details about the specific safeguards applied to the transfer of your personal information outside the EEA.
13. Purpose of processing
The company uses the information you provide to provide you with access to:
- our current products and offers;
- information regarding the Company's activity
- marketing campaigns carried out by the Company;
- various promotional offers run by the Company on a regular basis or during certain periods;
- various campaigns that we believe you would be reasonably interested in at some point given your history with the Company;
For the proper performance of these services, the Company may also use the information provided for other purposes such as billing, statistics, research & development, etc. To the extent that the Company considers that the information provided may be used for purposes other than those previously mentioned, it will immediately inform users about this aspect.
14. What do we rely on when processing your data?
14.1 Data processing is necessary to provide the services you request
The Company must collect and use certain information to provide the Services. These include:
- information about the user's profile for participation in promotions and contests, necessary for creating and maintaining the account, including to confirm identity, and to be able to make or receive payments;
- *information about candidates and employees (CVs, documents necessary for employment), documents necessary to verify compliance with legal conditions and background, as well as other information necessary to allow the Company to conclude the employment contract;
- information about Customers or Users (for promotional purposes) in case of participation in events organized by the Company, where photos and video recordings may be taken with the participants/persons present at the event, regardless of their quality. The Company reserves the right to use such data for the subsequent promotion of other events/in the Company's current promotional activity to show other people how past events were, in order to increase interest in future events;
- information about transactions and cases entered into the platform, which must be generated and stored in relation to the way the user interacts with the products and services they benefit from;
- *information about the use of the Company's services, necessary to maintain, optimize and improve the services.
14.2 Processing is necessary for the legitimate interests of the Company
The Company collects and uses personal information to the extent necessary to fulfill its legitimate interests. This includes collecting and using information:
- to maintain and improve the safety and security of users;
- to prevent, detect and combat fraud that may be related to the use of our services;
- to provide customer support services;
- to optimize the service offered and develop new services;
- for research, development and analysis purposes (this includes analyzing usage trends to improve user experience and offer new services)
- to establish the marketing and communication strategy;
- to carry out any promotions, contests or campaigns organized
14.3 Processing is necessary to comply with the Company's legal obligations
The Company is subject to the applicable law of the jurisdiction where it operates, and certain personal data will have to be processed in accordance with these regulations (for example, obligations to maintain financial and accounting records, employment documents, information regarding the resolution of complaints, etc.)
At the same time, there may be situations in which the Company must transmit your personal data to the competent bodies and authorities when they are requested to provide this data for the resolution or prevention of disputes.
14.4 Other grounds
The company uses various grounds for processing the data provided by you in order to provide you with the services. These are:
|
Data element |
Grounds for processing |
|
Name, surname, email address, phone number, |
Article 6 paragraph (1) letter b GDPR - to fulfill the contract you conclude with us remotely when creating an account on the Site when you want to benefit from one of our products or services |
|
Name, surname, transaction, date, location |
Article 6 paragraph (1) letter b GDPR - by virtue of the contract you have concluded with us, either remotely or through location, in order to collect feedback from you regarding your experience and to resolve any complaints you bring to our attention. |
|
Billing data |
Article 6 paragraph (1) letter b GDPR - to fulfill a legal obligation provided for by applicable law. |
|
Delivery details (name, surname, address, telephone number) |
To be able to send you the ordered products you purchase, as well as the prizes obtained within the various promotional campaigns run by us. |
|
Promotional & marketing activities |
Article 6 paragraph (1) letter a) GDPR - consent - in the case of direct marketing, if you do not wish to receive information and newsletters regarding our activity and the services offered, you can withdraw your consent at any time. Article 6 paragraph (1) letter f) GDPR - legitimate interest - to promote our services and products offered for which you can withdraw your consent at any time. |
|
Credit card data, information exchanges between users, etc. |
Article 6 paragraph (1) letter f) GDPR - legitimate interest - we may use this and similar data to improve the services offered, complete the transaction process, identify and resolve user problems, etc. |
|
Images: ambient photos and video; close-up/portrait photos and video (including testimonials) |
Article 6 paragraph (1) letter f) GDPR - legitimate interest - we may use this data to carry out marketing activities, advertising on digital channels to promote the Company's brand on social networks and other online platforms. |
15. Data belonging to minors
The company does not pursue in its data processing activities the processing of personal data of minors under the age of 16. Particular attention is paid to ensuring that any processing of personal data of minors is carried out in accordance with legal requirements and in strictly determined cases.
The Company does not conduct direct marketing promotional activities towards minors. Minors under the age of 16 are not permitted to request services, communicate on the Company's Website, or participate in the Company's contests, events, or campaigns, unless this is done on behalf of the minor by the legal representative or guardian of the minor in question, in accordance with the law.
Minors under the age of 16 may purchase products or services and request and receive communications from the Company only if they have the consent of their legal representative or guardian, according to the law.
Also, any person who provides us with personal data through the Sites or other applications or devices covered by this Policy guarantees that they are of legal age, respectively have full legal capacity.
Any collection or processing of personal data of minors will be carried out only in accordance with the law, and taking into account the above.
16. Your rights
Under the GDPR, you have a number of rights regarding your personal data:
|
The right conferred |
Additional Information |
|
Right of access |
You have the right to ask us for information about the personal data we process and which concerns you. We will try, as much as possible, to provide you with information about your data in a clear, accessible, structured and machine-readable manner. To do this, we will need to be sure that the data in question relates to you, so we will identify you by providing a copy of your identity card. |
|
Right to rectification |
Your data should be kept up to date and complete at all times. Although we make every effort to ensure that the data provided is always correct, we will also need your help. If you discover that your data is incorrect, that changes have occurred, or that you would like to add something, you can send us a request asking us to rectify that data, whether we are talking about an update, modification, or addition. |
|
Right to erasure/right to be forgotten |
You can ask us to delete your personal data in the following cases:
Users may request to delete their account at any time. Upon such request, the Company will delete information that is no longer required to be retained and will restrict access to or use of any information that is still required to be retained. |
|
The right to restriction of processing |
You can ask us to restrict the processing of your personal data in the following cases:
|
|
Right to data portability |
You can request that we transmit the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controller in the following cases:
|
|
The right to opposition |
You have the right to object to processing when:
In such a case, we no longer process your personal data, unless we demonstrate that we have legitimate and compelling reasons that justify the processing and that override your interests, rights and freedoms or that the purpose is to establish, exercise or defend a right in court. |
|
The right to object to automated individual decision-making, including profiling |
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right has certain limitations, namely:
In such a case, you can send us a request for your personal data to be subject to a manual processing process. |
Please note that:
- You can withdraw your consent for direct marketing at any time by following the unsubscribe instructions in each email/sms or other electronic message.
- If you want to exercise your rights, you can do so by sending a written, signed and dated request to the e-mail address: info@gb.ro or by any other means that the Company makes available to you and is highlighted in this Policy.
- The rights listed above are not absolute. There are exceptions, therefore each request received will be analyzed in order to decide whether it is well-founded or not. To the extent that the request is well-founded, we will facilitate the exercise of your rights. If the request is unfounded, we will reject it, but we will inform you of the reasons for the refusal and of your rights to file a complaint with the Supervisory Authority and to address the courts.
- We will try to respond to your request within 30 days. However, this deadline may be extended depending on various aspects, such as the complexity of the request, the large number of requests received, or the impossibility of identifying you within a reasonable time.
- It is possible that in certain cases we may have to request a certain fee for the exercise of rights, especially when we consider it unjustified. In this case, we will inform you within the legal term about the need to pay the fee and we will proceed to resolve the request only after this fee has been paid.
- In some cases, we may not be able to provide the information you request because it would involve "mixed data", i.e. personal data belonging to other people that we cannot reasonably and effectively keep confidential. In such a case, we will inform you within the legal deadline, including the fact that you may file a complaint with the competent authority.
- If, despite our best efforts, we are unable to identify you, and you do not provide us with additional information to enable us to identify you, we are not obligated to comply with the request.
17. Complaints
If you wish to have your personal data accessed, updated, rectified or deleted in certain circumstances (for example, when the personal data is no longer necessary for the purposes mentioned above), if you wish to request the restriction of data processing in certain circumstances (for example, when you contest the accuracy of the data - for a period that would allow us to verify the accuracy of the data in question); if you wish to file a complaint with us, if you wish to object to the processing of your data and if you wish, at any time, to withdraw your consent for the processing of your personal data that you have previously granted, you may notify us at any time by means of a written, dated and signed request, to the e-mail address info@gb.ro or you may contact the data protection officer at the Company level, [...], in relation to the processing of personal data within the Company.
To exercise these rights, as well as for any additional questions regarding this notification or regarding the Company's use of personal data, please contact us by choosing any of the communication methods described above, also specifying your name, postal or email address (depending on the method by which you wish us to communicate), your telephone number and the purpose of your request.
We will make every effort to resolve your request as soon as possible.
You can also file a complaint with the personal data supervisory authority. For Romania, the contact details can be found below:
|
Name |
National Supervisory Authority for Personal Data Processing |
|
Address |
B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, Romania |
|
Phone: |
+40.318.059.211 or +40.318.059.212 |
|
|
anspdcp@dataprotection.ro |
18. Changes to this Note
We may update this Notice from time to time and will notify you via the Platform or by email of the most recent version. All updates and changes to this Notice are effective immediately upon notification, which we will provide by posting on the Site and/or by email. Even if you do not receive a notification, we encourage you to periodically access and read this Notice to stay up to date with the latest versions.
This document was last updated on 22.03.2023.
Do you have any questions?
You can send us a message using the form below.
Official Reseller
