THE PROCESSING OF DATA OF A PERSONAL CHARACTER (named in the following as “Policy”)
The purpose of the present Policy is to explain the type of data of a personal character that we collect, the way this is processed, the rights of the persons in question, the amount of storage time, as well as other information regarding the processing of data of a personal character. The protection of data is a priority for the management SC MrGift SRL with the office in jud. Mures, loc. Isla, nr. 97, registered at Registrul Comertului with nr. J26/14/2012, having the Fiscal identification code 29520850, named in the following as mrgift.ro. Navigating our website's pages is possible without any declaration of data of a personal character. However, for certain specific situations, such as completing a quiz, a questionnaire or participation in a competition, certain data of a person in question may be collected and processed. If the processing of data of a personal character is necessary and there is no statutory basis for this processing, we commit to obtaining consent from a person in question. The processing of data of a personal character – such as last name, first name, address, email address, phone number of a person in question – will be done each time in conformity with the provisions of Ruling nr. 679 from 27 April 2016 regarding protection of the data of individuals in relation with data of a personal character, and regarding the free circulation of this data, and of repeal of Directive 95/46/CE (“Regulations”) and in accordance with cu specific data protection regulations in the country that mrgift.ro operates in. Within this Policy, our company wishes to inform the general public about the nature, breadth and purpose for which we collect and process data of a personal character. In addition, the persons in question are also informed of the rights they enjoy (see the page "Processing your data"). In the quality of an operator, mrgift.ro has implemented various technological and organzational measures to ensure the complete protection of personal data.
The Present Policy has at its base the Regulations, as well as any of the applicable laws regarding protection of data of a personal character. The Policy needs to be comprehensible both for the general public, and for our clients and business partners. To ensure this, we will explain the terminology we use. In this policy we will use, inter alia, the following terms:
Personal data or Data of a personal character refers to any information that makes possible the identification of an individual (personal question).
Person in question - this means an identified or identifiable individual. An "identifiable" individual is a person who can be identified, directly or indirectly, including by referring to an identification number, or one or more characteristic factors of their physical, physiological, mental, economic, cultural or social identity.
Processing - this means performing any operation or set of operations over Data of a personal character, with or without automated tools, such as collecting, registering, organizing, storing, adapting or modifying, recovering, consulting, utilising, revealing (by transmission, broadcasting or making available in another way), aligning or combining, blocking, deletion or destruction.
Restriction of processing - this refers to marking the personal data that is processed with the purpose of limiting their processing in the future.
Creation of profiles - this refers to any authorized form of processing personal data that consists of using personal data to evaluate certain characteristic personal aspects of an individual, especially to analyze or predict aspects regarding work performance, economic situation, health, personal preferences, interests, reliability, location or travel routes of an individual.
Pseudonymization - this is the processing of personal data in such a manner that personal data cannot be attributed anymore to a person in question without the use of additional information, with the condition that this additional information be stored separately and be subject to technical and organizational measures to ensure that personal data is not attributed to an identified or identifiable individual.
Operator or operator responsible for the processing - it is an individual or legal entity, public authority, agency or other organ that, alone or with the help of a third party, determines the purposes or tools of processing personal data; where the purposes and tools of the processing are determined b lthe legislation of the Union or Member States, the operator or the specific criteria for their nominalization may be provided by the legislation of the Union or Member States.
Recipient - it is an individual or legal entity, public authority, agency or other organ, to whom the personal data is revealed, whether or not they are a third party. However, public authorities who may receive personal data within the frame of a particular investigation in accordance with the legislation of the Union or Member States will not be regarded as recipients; the processing of this data by public authorities will be in conformity with the applicable rules of data protection in accordance with the purposes of the processing.
Third party - it is an individual or legal entity, public authority, agency or other organ other than the person in question, operator, processer and persons who, under the direct authority of the operator, processor or the operator's representative, are authorized to process personal data.
Consent – the consent of a person in question is any indication given freely, speficially, with information and clearly that the person in question gives within a declaration or a clear affirmative action, signifying their agreement to the processing of their personal data.
2. The name and address of the operator mrgift.ro
SC WEDO LINE SRL with the office in jud. Mures, loc. Isla, nr. 97, registered at Registrul Comertului with nr. J26/491/2012, having the Fiscal identification code RO30228389.
Telephone:+40 365 730 017, Email: email@example.com, Website: www.mrgift.ro.
3. The address of the data protection representative
Any person in question can contact us at any time directly, with any questions or suggestions regarding protection of data of a personal character at the email address firstname.lastname@example.org.
5. Signing up for our newsletter
On the website mrgift.ro, users are offered the opportunity to voluntarily sign up for the company's newsletter; mrgift.ro might inform the clients and business partners regularly within a newsletter of the company's offers and sales. The company's newsletter can be received by a person in question only if (1) the person in question has a valid email address and (2) if the person in question voluntarily signs up to receive the newsletter. A confirmation email will be sent to the email address registered by the person in question for the first time regarding receival of the newsletter, for legal reasons. During sign-up for the newsletter, we store the IP address of the computer system attributed to the Internet Service Provider (ISP) and used by the person in quuestion in the moment of sign-up, as well as the date and time of sign-up. Collecting this data is necessary to understand the possible inadequate usage of the email address of a person in question at a later date, and as such serves the purpose of legal protection. The personal data collected as a part of sign-up for a newsletter will be used only to send the newsletter. In addition, those who sign up for the newsletter will receive information via email, as long as this is necessary for the newsletter service, or for a sign-up in question, as this might be the case in the eventuality of a modification of the newsletter offer, or in the eventuality of a change in technical circumstances. There will be no transfer of the personal data collected by the newsletter service to third parties. Sign-ups to our newsletter can be dissolved at any moment by the person in question. The consent to store personal data, given by the person in question for receiving the newsletter, can be revoked at any time. Each newsletter contains a link to unsubscribe. For more information, you can consult our page "Processing your data".
6. The possibility of contact through the website
The website mrgift.ro contains information that permits a short electronic contact with our company, as well as direct communication with us, by the inclusion of an email address. If a person in question contacts us via email or our contact form, the personal data voluntarily transmitted by them is stored automatically. Such personal data, voluntarily transmitted by a person in question to the operator, is stored for the purpose of processing and of contacting the person in question to reply to or resolve their request.
7. Routine deletion and blocking of personal data
mrgift.ro will process and store personal data of a personal data in question only for the period that is necessary to fulfill its purpose for storage, or for the period that is provided by European legislation or other laws that can be applied. If the purpose for storage cannot be applied, or if the storage period provided by the applicable current legislation, the personal data is deleted, in accordance with legal requirements.
8. The rights of a person in question
The right to access of a person in question. Regarding exercising their right to access, the person in question can at any moment contact mrgift.ro with a request in this sense, to obtain a report of data of a personal character.
The right to correction. Each person in question has to obtain the correction of data of a personal character when this is incorrect, has suffered a modification, or requires completion.
The right to deletion. Each person in question has the right to request deletion of data of a personal character as follows: 1) when the data is not necessary anymore for the purpose that it has been collected or processed, 2) the person in question revokes their consent that the processing was based on, 3) the person in question objects to the processing in accordance with article 21(1) of the Regulations, and there is no statutory basis for the processing, or the person in question objects to the processing in conformity with article 21(2) of the Regulations, 4) the data of a personal character has been processed in an illegal way, or a legal ruling imposes their deletion.
The right to restriction of the processing. Each person in question has the right to obtain the restriction of the processing, where one of the following cases can be applied: 1) the accuracy of the personal data is contested by the person in question, 2) the processing is illegal and the person in question is opposed to deletion of the personal data, but instead requests the restriction of its usage, 3) mrgift.ro does not need the personal data anymore with the purpose of processing it, but it is requested by the person in question for unity, to exercise certain rights, 4) the person in question is opposed to the processing in conformity with article 21(1) of the Regulation until it is verified whether the legitimate reasons of mrgift.ro are prevalent above those of the person in question.
The right to data portability. Each person in question has the right to request thhe transfer of data with a personal character to a third person, or to the person in question themselves.
The right to opposition. Each person in question has the right to oppose at any moment, from reasons related to their particular situation, the processing of their personal data, based on points (e) and (f) from Article 6(1) of the Regulations. This is applied to the creation of profiles as well. mrgift.ro will not process personal data in the event of an opposition, only if we can demonstrate convincing and legitimate reasons for the processing, which overwrite the interests,rights and liberties of the person in quesiton, or to establish, exercise or defend legal rights. If mrgift.ro processes personal data for the purposes of direct marketing, where there exists previous consent, the person in question will have the rightto oppose at any moment the processing of their personal data for such marketing. This is also applied to the creation of profiles until the point where this is related to such direct marketing. If the person in question objects to the processing done by mrgift.ro for the purposes of direct marketing, then mrgift.ro will not process their personal data anymore for such purposes. In addition,the person in question has the right, for reasons related to their particular situation, to object to the processing of their personal data by mrgift.ro for the purposes of scientific or historical research, or for statistical purposes, in conformity with Article 89(1) of the Regulations, only if the processing is necessary to carry out a task that serves a public interest.
The making of individual decisions, including the creation of profiles. Each person in question has the right to not be the object of a decision based exclusively on automatic processing, including the creation of profiles, which produces judiciary effects regarding them, or similarly affects them in a significant way, as long as the decision is not based on the express consent of the person in question. mrgift.ro will implement adequate sustaining measures to protect the rights and liberties of the person in question, as well as their legitimate interests, at least the right to obtain a human intervention from mrgift.ro, to express their point of view and to contest the decision.
The right to revoke consent. Each person in question has the right to revoke their consent regarding the processing of data of a personal character, in any moment.
The right to place a complaing with the supervising authority – in case that the person in question considers that their legitimate rights regarding personal data processing operations have been overstepped, they can address a complaint in this sens to Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, with its office in in B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucuresti, Romania.
If you wish to exercise your rights, you have the possibility to do it within the GDPR section dedicated to this, or you can send us a notification / request in this sense, using the contact details listed in the present Policy. mrgift.ro will respond to you in the shortest possible time, but not later than within 30 days. For any eventual delay, we will notify you and offer you justified reasons for the delay.
9. The legal basis for the processing
Art. 6(1) lit. of the Regulations serves as the judicary basis for the processing operations that we obtain consent for, regarding a certain purpose of processing. If the processing of data of a personal character is necessary to execute a contract that the person in question is a party to, such as, for instance, when the processing operations are necessary to provide goods or to provide any other service, the processing is based on article 6 paragraph (1) lit. b of the Regulations. This is also applicable to processing operations that are necessary for taking precontractual measures, for instance in the case of inquests referring to our products or services. Our company is subject to a legal obligation that makes necessary the processing of data of a personal character, such as fulfilling fiscal obligations, the processing will be done based on art. 6 (1) lit. c of the Regulations. In rare cases, the processing of data of a personal character might be necessary to protect the vital interests of a person in question or of another individual. This would be the case, for instance, in the case that a visitor got injured in our company and their name, age, health insurance details or other vital informations would need to be transmitted to a medic, hospital or other third party. Then, the processing will be based on Art. 6 (1) lit. d of the Regulations. In the following, processing operations may also be based on article 6 paragraph (1) letter f of the Regulations. This judicary basis is used for processing operations that are not covered by any of the above mentioned legal reasons, if the processing is necessary for the purposes of legitimate interests pursued by our company or by a third party, with the exception of the case when these interests are eliminated by the interests or fundamental rights and liberties of the person in question which necessitate the protection of data of a personal character. Such processing operations are permitted in a special way, as they have been specifically mentioned by the European legislator. He considered that a legitimate interest can be assumed if the person in question is the client of the operator (consideration 47 from proposal 2 of the Regulations).
10. The legitimate interests pursued by the operator or a third party
In the case when the processing of data of a personal character is based on article 6 paragraph (1) letter f of the Regulations, our legitimate interest is to perform our business with the wellbeing of all our employees and partners in mind.
11. The period that data of a personal character is stored for
Data of a personal character will be stored only for the period that is necessary to the purpose it has been collected for. After the expiration of said period, the corresponding data will be deleted. We will keep only the data of a personal character that is a part of files / documents for which the law provides a term of archival, and after the expiration of this archival period, these will be destroyed.
12. Providing data of a personal character as a legal or contractual obligation
The necessary requirement to make a contract; The obligation of a person in question to provide data of a personal character; the possible consequences for not fulfilling these requirements.
We clarify the fact that providing data of a personal character is partially required by law (for examply by fiscal regulations) or might result from contractual dispositions (for instance, information regarding a contractual partner). Sometimes it may be necessary to make a contract according to which the person in question provides us data of a personal character, which will later need to be processed by us. The person in question is, for example, obligated to provide us data of a personal character when our company signs a contract with them.
13. The protection of data of a personal character
mrgift.ro applies applies an internal framework of policies and minimal standards regarding the protection of data of a personal character. These policies and standards are updated periodically to reflect the regulations and evolution of the market. In conformity with current legal dispositions, we take adequate technical and organizational measures (policies, procedures, security etc.) exactly to ensure the confidentiality and integrity of data of a personal character, as well as to ensure the necessary framework for processing these.