Crivio Impex SRL with its registered office in Bucharest, Sector 3, ION PILLAT Street, No. 2, Block G1, Staircase 1, Floor 5, App. 22, registered with the Trade Register Office under no. J23/3299/2011, fiscal code 49251218 (the “Operator”) collects and processes personal data in accordance with the legal provisions on the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 (“GDPR”) and Law no. 190/2018 – in order to carry out trade operations with various products in the online environment (“Activity”), as well as in situations where interested persons visit the online store aromacups.com.
Categories of personal data that may be processed by the Operator
The categories of personal data processed in the Operator’s activity are the following:
1.1. Personal identification data (name, surname, address, age, date of birth, telephone, e-mail, nationality, language and country from which you interact with us). The data is necessary for the creation of the user account, respectively for the valid conclusion and performance of the contractual relationship with the Operator.
1.2. Economic and transactional information (for example, payment or bank card information, information about purchases, orders, product returns, etc.).
1.3. Information we receive from you as a result of requests sent by e-mail, telephone, or any other means of communication (including the addresses, names and contact details of the persons to whom deliveries of products purchased through the aromacups.com website will be made.
1.4. Online activity data – we record information about how you use our website, such as when and/or how you visit or use the website, the time spent on the website, what types of ads you have viewed, IP address, the navigation system used, the type of device used, demographic information and user interests. We also use cookies and similar technologies to remember your preferences. More information about processing through cookies can be found in the Cookie Policy – https://aromacups.com/privacy-policy
1.5. Data obtained from third parties – we may receive information about your visits to other websites or platforms that include advertisements, cookies or similar technologies.
It is your decision whether you want to you provide us with data and what kind of data you provide us with, but please note that when making purchases in the online store, the provision of certain data will be mandatory for the execution of the sales contract, because without them we will not be able to process the order.
Refusal to provide the requested data will make it impossible to place the order, respectively its delivery.
It is not mandatory to give your consent to receive commercial information at the e-mail address provided or the telephone number provided in order to conclude an agreement for the sale of goods. If you give your consent, you can withdraw it at any time according to your rights under section 6 below.
The online store platform will also be accessible through your Facebook or Google account. If you opt for one of these options, you will be directed to a page managed by Facebook Inc / Google LLC, where they will inform you about the transfer of your data to www.cafeazavida.ro. You can consult the privacy policies of Facebook and Google, respectively, using the following links:
https://www.facebook.com/about/privacy
https://policies.google.com/privacy
We would like to point out that we do not collect or otherwise process sensitive data, which are included in the GDPR as special categories of personal data. We also do not wish to collect or process data from minors under the age of 16.
Purposes and grounds for processing your personal data
We process your personal data for the following purposes:
The Operator’s conduct of the Trade Activity through the website, including but not limited to: registering the user account on the website, confirming and placing orders, fulfilling the delivery obligation, notifications regarding the status of the order, resolving complaints regarding defects in the purchased products, ensuring the return of the products and the reimbursement of the related amounts, as well as fulfilling any other obligations assumed towards you as a buyer, making available the offers and information available on the Operator’s website, (legal basis: conclusion and execution of the contract – art. 6 (1) letter b) GDPR). The storage of the cards with which the payment for the products is made will be carried out based on the consent of the data subject – art. 6 (1) letter a) GDPR. In the case of personal data of legal or conventional representatives of our legal entity clients, we have a legitimate interest in ensuring the smooth conduct of legal relations with our clients (legal basis: legitimate interest – art. 6 (1) letter f) GDPR);
Fulfillment of the Operator’s legal obligations (e.g. communications or reports to the competent public authorities and institutions, including in terms of financial crimes, fulfillment of obligations to pay taxes and fees, archiving of documents and information transmitted within the procurement process, including in electronic format) (legal basis: art. 6 (1) letter c) GDPR);
Communication of commercial and tender information. We would like to send you information about new products on our website, promotional offers and discounts, as well as other information that we consider may be of interest to you. The processing is based on your consent, which you can withdraw at any time by unsubscribing from our newsletter (legal basis: consent of the data subject – art. 6(1) lit. a) GDPR);
Analysis of the data collected in order to improve the activity of the Operator, carrying out analyses and statistics regarding the marketing campaigns carried out, in order to offer relevant and personalized services, including through Google Analytics, […] (legal basis: legitimate interest – art. 6(1) lit. f) GDPR);
Transmission of non-commercial or administrative messages such as changes in or in relation to the website, user account, etc. (legal basis: consent of the data subject – art. 6(1) lit. a) GDPR);
Analysis of data collected using cookies and other similar technologies placed on the Operator’s or third party’s website, in order to improve the functioning of the website, adapt its content according to the preferences and interests of visitors, as well as carry out advertising, respectively (legal basis: legitimate interest – art. 6 (1) letter f) GDPR and, where applicable, your consent – art. 6 (1) letter a) GDPR);
Resolving potential disputes, establishing, exercising or defending a right in court, resolving complaints and requests from customers (legal basis: legitimate interest – art. 6 (1) letter f) GDPR).
Categories of recipients to whom personal data may be disclosed
We may disclose your data to the following categories of recipients:
– state authorities and public institutions, as a result of legal obligations of the Operator;
– service providers directly/indirectly involved in the execution of the Trade Activity who hold the status of authorized persons of the Operator according to the provisions of art. 28 of the GDPR Regulation (e.g. marketing, advertising service providers, billing and accounting service providers – , IT support service providers, data center service providers, courier service providers);
– payment processors to ensure that the taking over and administration of payments is carried out in safe conditions – Banca Trasilvania
courts or arbitration courts, notaries public, lawyers, bailiffs, translation offices, if necessary.
– third party providers of cookies and similar technologies as described in the Cookies Policy – https://www.mrpich.com/cookies.html in these situations, your personal data collected through cookies / similar third party technologies may be transferred to third countries (i.e. outside the European Union).
The Operator may transfer personal data to countries outside the European Union or the European Economic Area. For such transfers, the Operator takes a series of measures to ensure an adequate level of protection of personal data of individuals. Among these measures may be the conclusion of standard contractual clauses approved at European level.
Duration of processing and storage of personal data
We will process your data for the time necessary to manage the purchase of products ordered on the site, including any returns, claims or complaints related to the purchase of the product, unless a shorter period is imposed by mandatory legal regulations.
In some cases, we will only process the data until the time you specify, such as the payment data (by card) that you request us to store for possible future purchases.
Your user data will be kept for the period of your registered user status (until you decide to unsubscribe). Your User account may be deleted both at your request, but also as a result of the withdrawal of consent to data processing, your objection to data processing and in the case of a request to delete the data.
Certain data may be kept for the entire period provided by law for the archiving and storage of financial and accounting documents, or until the expiration of the statute of limitations applicable to the right to action, in order to defend our rights.
Data related to cookies and similar technologies are stored according to the terms specific to those technologies, the storage term being between the duration of the browsing session and a duration of 2 years (or more, in the case of third-party cookies).
Personal data protection
We use a series of IT and organizational security measures aimed at minimizing the risk of data leakage, destruction and disintegration, such as: firewall system, antivirus and anti-spam systems, internal access procedures, data processing and emergency recovery as well as a multi-level backup system.
Our store offers a very high level of security by using the Web Firewall (WAF) application and the security system against DDoS attacks, we use a level of HTTPS / SSL connection encryption in accordance with best practices, we work with the hosting provider clausweb
We remind you that using the Internet always brings the risk of security incidents, but we assure you that thanks to the implemented procedures of IT system reviews and updates, as well as active monitoring of critical system points, our goal is to reduce this risk as much as possible.
Your rights as a data subject
In relation to the processing of your personal data, you may exercise any of the following rights:
Right of access to your personal data
You have the right to obtain from us confirmation as to whether or not the Controller is processing your data and, if so, you have the right to access that data.
Right to rectification of your personal data
You have the right to request and obtain the rectification, updating or completion of your inaccurate or incomplete personal data.
Right to withdraw your consent
When the processing of personal data has been carried out on the basis of your consent, it may be withdrawn at any time.
Right to erasure of data (“right to be forgotten”)
You have the right to request the erasure of your personal data, for the following reasons:
– the personal data are no longer necessary for the purposes for which they were collected or processed;
– the data processing was carried out based on your consent, and it was withdrawn;
– the personal data were processed unlawfully;
– you exercise your right to object and there are no overriding legitimate reasons or you object to the processing for the purpose of direct marketing;
– the personal data must be deleted in order to comply with a legal obligation of the Operator.
Please note that before exercising this right, you must download from your user account all documents related to orders placed in the online store, regardless of whether the billing was made to you or to another natural or legal person (such as: invoices). If you do not take this step before exercising your right to deletion, you will lose all these documents and the Operator will be unable to make them available to you, as appropriate, because the process of deleting data, namely the user account of the online store, together with all related data and documents, represents an irreversible measure.
Right to restriction of processing
You have the right to request and obtain restriction of processing of your personal data in the following cases:
– when you contest the accuracy of the data, for a period that would allow the Operator to verify the accuracy of those data;
– the processing is unlawful and you oppose the erasure of the data, requesting instead the restriction of their use;
– when the Operator no longer needs the personal data for the purposes of the processing, but you request them for the establishment, exercise or defense of a right in court;
– when you have opposed the processing by virtue of the right to object, for the period during which it is verified whether the legitimate rights of the Operator prevail over those of the data subject.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us, with the right to transmit them to another controller, when the data processing is based on your consent or on a contract to which you are a party and the processing is carried out by automated means.
Right to object
You have the right to object, on grounds relating to your particular situation, to processing carried out in the legitimate interest of the Operator or to processing for direct marketing purposes, including profiling.
Right not to be subject to a decision based solely on automated processing of your data, including profiling
Right to lodge a complaint with the competent data protection authority:
Contact details of the National Data Protection Authority for Romania:
NATIONAL PERSONAL DATA SUPERVISORY AUTHORITY (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30
RO- 010336 Bucharest, RomaniaRO – 010336 Bucuresti,
Tel.: +40.318.059.211
http://www.dataprotection.ro/
To exercise any of these rights, except for the right to file a complaint with the Supervisory Authority, please contact us by choosing any of the communication methods below, specifying your name, postal or e-mail address where you would like the response to be communicated, as well as the purpose of the request.
You can contact us:
– by e-mail – at the address: [email protected]
– by a request sent by post to the address: Bucharest Sectorul 3, Strada ION PILLAT, Nr. 2, Block G1, Staircase 1, Floor 5, Ap. 22
We will try to complete your requests as quickly as possible and answer your questions regarding personal data. In any case, you should receive a message from us within a period that will not exceed 30 days from the date of receipt of your request. During this period, we will give you a response or inform you about the extension of the deadline and explain the reasons. If we have doubts about the authenticity of the identity of the person making a specific request, we may ask more questions to verify it.
We may update this Policy from time to time and will notify you of any changes by posting the new version on our Site. Please periodically consult this Policy for any changes.
The Crivio Impex SRL Team