Personal data protection

PERSONAL DATA PROTECTION POLICY - PDP

Implemented on 10.07.2023

INATECH PACKAGING S.R.L. is committed to respecting the confidentiality of your personal data and complying with the applicable data protection and privacy laws, including, but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereinafter referred to as “GDPR”.

In this Policy, references to “we”, “us” or “our” mean the company INATECH PACKAGING S.R.L. References to “you” refer to the person using our website and providing us with personal information and data.

Please carefully read the following Policy, hereinafter referred to as “PDP”, in order to understand how your information, meaning your “personal data”, will be handled.

The PDP explains the practices of INATECH PACKAGING S.R.L., hereinafter referred to as “INATECH”, regarding the application of GDPR provisions, as well as the rights you have regarding the way your information is processed by INATECH.

The processing of personal data carried out by INATECH will always be performed in accordance with the provisions of the GDPR, as well as with the personal data protection regulations specific to the country in which INATECH operates.

WHO ARE WE?

The website www.inatech-shop.ro is operated by INATECH PACKAGING S.R.L., a company legally established and registered under the laws of Romania, registered with the Trade Register under number J2012002842230, with its registered office at Strada Tudor Vladimirescu no. 393, Domnești Business Park, Office Unit OS, Domnești Commune, Ilfov County, having VAT number RO27835240.

HOW CAN YOU CONTACT US? DATA PROTECTION OFFICER (DPO)

If you have specific questions regarding your personal data or the way we use it, please send us an e-mail at: [email protected] / [email protected].

In addition, we inform you that INATECH, as data controller, has appointed SCA JANTEA și ASOCIAȚII, through lawyer Oprea Mădălina, as Data Protection Officer, hereinafter referred to as “DPO”, who has the obligation to verify compliance with GDPR provisions in the data processing operations carried out by the controller and to represent the controller in relation to data subjects, as well as with the supervisory authority.

Data subjects may contact the DPO directly at any time regarding any matters related to this PDP, using the following contact details: [email protected] or [email protected], DPO correspondence address: Bucharest, Sector 1, Strada Transilvaniei no. 9, or at the INATECH headquarters.

PROTECTION OF MINORS

The services provided by INATECH are not intended for or addressed to minors or persons under the legal age of consent. Any person who provides us with personal information understands and declares that they are 18 years old or have exceeded the legal age of consent according to their jurisdiction. If we learn that a minor has attempted to or has submitted personal information, we will not accept this information and will take steps to remove it from our records.

WHAT IS PERSONAL DATA?

“Personal data” means any information or information items that can identify you directly, for example your name, or indirectly, for example pseudonymous data such as a unique identification number.

WHAT DOES PERSONAL DATA PROCESSING MEAN?

“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, extraction, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

WHAT PERSONAL DATA DO WE PROCESS?

Your personal data that will be processed is the following:

• Data you provide by filling in product order forms on our website: last name, first name, delivery address, e-mail address, telephone number;

• Data you provide by filling in contact forms/questionnaires on our website: last name, first name, e-mail address, telephone number;

• Transaction data: bank account number, personal data related to the payment method for services: transaction date, transaction value, part of the card number, transaction number, transaction status, partial or complete IDs of electronic payment systems, transaction history related to the customer account, whether processed through the website or through third-party services, including login data;

• Information obtained through message exchanges with us through the website, e-mails, telephone, web chats, including complaints, photos, recordings of telephone conversations when you contact us and our specialized contact centers in order to serve you and improve our services;

• Other data necessary for carrying out our activity. In certain specific cases, we may also process other information necessary for the safe performance of our activity or for the legitimate interest of the company. Thus, we automatically collect certain data even if you simply use our website and do not use our services. This includes: your IP address, the date and time when you used our services, details about software and hardware, the browser you use, information about the operating system of the device using our services, for example the latest versions of applications and language settings, data regarding the clicks you make, the pages displayed to you and your response to information elements, the name of the internet service provider, video recordings when you visit our commercial and administrative websites.

LEGAL BASIS AND PURPOSES OF PERSONAL DATA PROCESSING

1. For the purpose of concluding and performing contracts between the parties - According to Art. 6 para. 1 letter b) of the GDPR

In order to provide you with our products and services, we need to process personal data that belongs to you.

2. For the purpose of fulfilling legal obligations - According to Art. 6 para. 1 letter c) of the GDPR

We request a series of personal data, including, in certain situations, the personal identification number, for the purpose of fulfilling the obligations imposed on us by the tax authorities in connection with invoicing and reporting to tax authorities, as well as for the purpose of monitoring transactions in order to prevent fraud, money laundering, deception, etc.

Refusal to provide the data may result in our inability to comply with our legal obligations and therefore our inability to provide you with services through our website.

3. For marketing purposes - According to Art. 6 para. 1 letter a) of the GDPR

We process personal data if the data subject has given consent for one or more specific purposes. Thus, in certain situations, your personal data will be used for the purpose of sending you marketing messages, offers, news about future campaigns, and invitations to various events.

If you have chosen to receive newsletter-type notifications, from time to time we may use your personal information, including your e-mail address and telephone number, to send you promotional notifications regarding our products or services that may interest you.

4. For the purpose of the legitimate interests pursued by the controller or by a third party - According to Art. 6 para. 1 letter f) of the GDPR

Thus, we collect your personal data in order to provide you with the most pleasant and secure experience possible on our website, including through the use of cookies.

Use of cookies

A cookie is a small file that may be placed on your computer’s hard drive for recording purposes. The use of the “cookie” mechanism is beneficial for visitors, as it allows certain browsing options on the website to be remembered, such as: the language in which the website is displayed, types of filters applied when displaying certain pages, remembering the username and password for quick access to the website content.

With the help of cookies, we can monitor and segment users’ interests in certain areas or applications of the website, which subsequently allows us to improve the browsing experience, introduce relevant content for the user, etc.

You are not obliged to accept a cookie from us or from any other website. You can update your browser so that it does not accept cookies. Please consult the “Help” section of your browser for instructions on how to do this correctly. With certain exceptions, not accepting a cookie does not mean that the user will be denied access to browse the website or read its content.

However, for legitimate security reasons, we may refuse access to certain website content if you do not accept the use of a cookie or similar device.

For more information about the cookies we use and the personal information we collect through the use of cookies, about how to disable them and about the use of third-party cookies, please consult our Cookie Policy, available here: https://inatech-shop.ro/politica-de-cookies

Optimizing service delivery

Your personal information is used to optimize service delivery, namely for:

• taking all necessary measures to ensure security and identification, including by carrying out appropriate verification checks;

• monitoring and improving the level of our services and improving customer satisfaction;

• tracking preferences regarding the products and services we offer;

• analyzing customer trends and better marketing our services or products by communicating information about available promotional offers;

• sending you updates regarding changes to our software and/or services.

5. For the purpose of resolving your requests, questions or complaints - According to Art. 6 para. 1 letters a) and b) and/or f) of the GDPR

For this purpose, we will process personal data such as last name, first name and contact details, which you provide to us in the corresponding section of the website, exclusively for the purpose of processing your request.

Please note that in order to process your requests, in certain circumstances we may be required to disclose your data to partners with whom INATECH collaborates and/or to other third-party service providers of INATECH.

INATECH may also have access to other personal data through your contact with INATECH, by processing data communicated during telephone conversations, e-mail conversations, visits to our headquarters for obtaining information, etc.

By contacting INATECH in any of the ways mentioned above or through any other method involving direct or indirect communication between you and INATECH, you understand and agree that your data will be processed in accordance with the provisions of INATECH’s PDP.

DATA STORAGE PERIOD

INATECH will keep the processed data for different periods of time considered reasonable, in accordance with the purposes indicated above. We keep your data only for the period necessary to achieve the purpose for which we hold the data, to meet your needs or to fulfill our legal obligations.

In order to determine how long your data may be kept, we use the following criteria:

1. When you access and benefit from the services offered by INATECH, we keep your personal data for the duration of our contractual relationship, as well as for a subsequent period if there is a legal retention obligation for INATECH;

2. If you contact us with a question, we keep your personal data for the period necessary to process your questions, but no longer than 12 months from the last correspondence sent;

3. If you have given your consent for marketing, we keep your personal data until you unsubscribe or request that we delete it. If you withdraw your consent for data processing for marketing purposes, the processing of your personal data for this purpose will cease, without affecting the processing carried out on the basis of the consent expressed by you before its withdrawal;

4. If your data has been processed as a result of INATECH’s legitimate interest, we keep your data for the period necessary to fulfill our legitimate interest.

RIGHTS OF DATA SUBJECTS

In accordance with the GDPR, you have a series of rights regarding the personal data that INATECH processes:

1. Right of access to processed data - You have the right to access the personal data we hold. The first provision of information will be made free of charge. If you need additional copies of information already provided, we may charge a reasonable fee taking into account the administrative costs of providing the information. Manifestly unfounded, excessive or repeated requests may not receive a response.

2. Right to rectification of data - You have the right to request that your data be rectified if it is inaccurate or outdated and/or to request that it be completed if incomplete.

3. Right to erasure of data (“right to be forgotten”) - In some cases, you have the right to obtain the erasure or destruction of your data. This is not an absolute right, because sometimes we may be required to keep your data for legal or judicial reasons.

4. Right to restriction of processing - You have the right to request restriction of the processing of your data. This means that the processing of your data is limited, so that we may keep the data but not use or process it. This right applies in specific circumstances provided by the General Data Protection Regulation, namely:

• the accuracy of the data is contested by the data subject, meaning by you, for a period allowing the controller, meaning INATECH, to verify the accuracy of the data;

• the processing is unlawful and the data subject, meaning you, opposes the erasure of the data and requests the restriction of its use;

• INATECH no longer needs the data for processing, but it is requested by the data subject, meaning you, for the establishment, exercise or defense of legal claims;

• the data subject, meaning you, has objected to processing based on legitimate grounds pursued by INATECH, pending verification whether the legitimate grounds of the controller override those of the data subject, meaning you.

5. Right to data portability - You have the right to move, copy or transfer the data that concerns you from our database to another one. This applies only to data you have provided, when the processing is based on your consent or on a contract and is carried out by automated means.

6. Right to object - You may object at any time to the processing of your data when such processing is based on a legitimate interest.

7. Right to withdraw consent at any time - You may withdraw your consent regarding the processing of your data when such processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8. Right to lodge a complaint with the competent supervisory authority - You have the right to lodge a complaint with the data protection authority in your country of residence or domicile in order to challenge the data protection practices provided by INATECH.

9. Right to object to the processing of your data for direct marketing purposes - You may unsubscribe or opt out of our direct marketing communications at any time. You can do this by clicking the “unsubscribe” link in any e-mail or communication we send you.

10. Right to object to the processing of your data by us when we carry out actions in the public interest or in our own legitimate interests or those of a third party - You may object at any time to the processing of your data when such processing is based on a legitimate interest.

When exercising one or more of your rights, we must verify your identity in order to ensure that the information is provided only to the person entitled to receive it.

INATECH is not obliged to respond to requests for information unless sufficient details are provided to allow identification of the location of the information and to verify the identity of the data subject who made the request.

In principle, INATECH will not disclose information about other persons in response to a request from a data subject. Access to such data will not be granted unless the persons concerned consent to the disclosure of their data.

INATECH is not obliged to provide copies of documents that are already in the public domain.

Automated decision-making, including profiling

We use systems to make automated decisions based on your personal information. This helps us ensure that our decisions are fast, fair, efficient and accurate, based on what we know. These automated decisions may affect the products, services or features we may offer you now or in the future, or your ability to use our services.

We may use automated decision-making in the following situations:

• adapting products and services - we may place you in groups with similar customers, meaning segments, in order to study and learn about your preferences and needs and to provide you with a more personalized experience;

• fraud detection - we use your personal information to decide and detect whether your account may be used for fraud or money laundering. If we believe there is a fraud risk, we may block or suspend the account;

• creating a customer account - when you create a customer account with us, we check whether the product or service is relevant to you, based on the information we know. We also check whether you meet the necessary conditions to open the account;

Data protection legislation aims to protect natural persons against harm that may result from decision-making, including profiling, which takes place without human intervention. You have the right not to be subject to a decision, including profiling, when it is based on automated processing of your personal data and produces legal effects concerning you or similarly significantly affects you.

PRINCIPLES REGARDING DATA PROCESSING

INATECH undertakes to comply with the personal data protection principles, hereinafter referred to as the “Principles”, provided by the GDPR, in order to ensure that all data is:

1. Processed fairly, lawfully and transparently;

2. Collected for specified, explicit and legitimate purposes;

3. Adequate, relevant and limited in relation to the purposes for which it is processed;

4. Accurate and kept up to date;

5. Kept in a form that does not allow identification of data subjects for longer than necessary in relation to the purpose of processing;

6. Processed in accordance with the rights of the data subject, in a manner that ensures appropriate security of processing, so that the data is intact, confidential and available.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

Personal data processed by INATECH may be disclosed and/or transferred to third parties only if you have expressly consented to this, except in situations where INATECH has a legal/contractual obligation to do so, including to detect, prevent and respond to acts of fraud, unauthorized use of any material belonging to us, violations of our terms or policies or other harmful or illegal activities, in order to protect ourselves, including our rights, property or materials, you and others, including in investigations or inquiries by regulatory authorities, or to prevent imminent death or bodily injury.

In order to facilitate the activities related to the processing purposes detailed above, INATECH may communicate this data to third parties, such as:

• operational service providers, such as courier services, telecommunications, IT, payments, processing, training, storage, archiving, investigation services related to customer support, authorized payment institutions, banks, as well as licensed postal transfer companies;

• any business partner, investor, assignee, current or potential, in order to facilitate business asset transactions, which may include a merger, acquisition, debt or sale of assets;

• professional advisers, such as auditors or lawyers;

• regulatory authorities, professional bodies and/or public authorities for compliance with applicable regulations. We do not transfer your personal data outside the European Union, except with appropriate safeguards and only with prior notification to you. In order to ensure that your personal information remains secure when transferred in this way, we will take all reasonable measures to maintain an adequate level of protection in accordance with this Policy.

PROCESSING SECURITY

INATECH has adopted technical and organizational measures for data processing, updated in accordance with GDPR requirements, in order to protect your personal data against any actions of unauthorized access, improper use or disclosure, unauthorized modification, destruction or accidental loss. All INATECH employees and collaborators, as well as any third parties acting on behalf of and for INATECH, are obliged to respect the confidentiality of your information and GDPR requirements, in accordance with the provisions of the PDP.

In order to protect all personal information under our control, we have implemented appropriate security policies, rules and technical measures covering practices of improper use or disclosure, unauthorized modification, unlawful destruction or accidental loss.

UPDATING THE PERSONAL DATA PROTECTION AND PROCESSING POLICY

Please note that this privacy policy may be updated periodically. If we modify this Privacy Policy in ways that affect how we use your personal information, we will inform you about the options you may have as a result of these changes. We will also post a notice confirming that this Privacy Policy has been updated. If significant changes are made to the Privacy Notice, for example changes affecting how we intend to use your personal information, we will send a notification, including, for certain services, notification of changes to the Privacy Policy by e-mail.

In addition, please note that in order to comply with regulatory requirements, the information we hold about you must always be kept up to date. You can update the information on our website from “My Account” or by contacting one of our operators.

EXTERNAL LINKS

This website may contain links or banners to other external websites operated by third parties. If you use any of these external links, you will be directed to a website that is not covered by our privacy policies. This privacy statement applies exclusively to information collected on the INATECH website. We do not assume any liability for the content of third-party websites.