Version dated May 2018
LAVACOW S.R.L. (hereinafter referred to as ‘Lavacow’), with registered office in Bucharest, District 1, 5 C.A. Rosetti St., building A, registered with the Trade Registry under no. J40/9523/2013, URC RO 32079313, in line with Regulation (EU) 679/2016 on the protection of natural persons regarding personal data processing and the free movement of those data and repealing Directive 95/45/EC (hereinafter referred to as ‘GDPR’), processes in compliance with the provisions of the law, under safety conditions and only for the purposes specified, the data that you supply to us for the purpose of the conclusion and execution of the sales agreement.
Personal data represent any information regarding an identified and identifiable natural person (hereinafter referred to as ‘the person in question’). An identifiable natural person is a person who can be identified, directly or indirectly, especially by reference to an identification element, such as a name, identification number, location details, online identifier, or to one or more elements specific to his/her own identity.
1. PURPOSES AND LEGAL GROUNDS FOR THE PROCESSING OF PERSONAL DATA
• We shall collect your personal data for the following purposes:
→ Client registration (online): we shall process the personal data of the clients, collected in the course of the online account registration
→ Advertising, marketing and publicity: we shall process the personal data of the clients, collected for the purpose of offering you information by e-mail, SMS, phone, regarding future events and/or other forms of publicity
→ CCTV video surveillance: we shall process your image for the purpose of monitoring/safety of the persons, spaces and/or private goods.
• We shall process your personal data based on one of the following grounds:
→ Conclusion and execution of the contract concluded with you, for which we must come into possession of certain data absolutely necessary for the invoice issuing and the delivery of your goods
→ Legitimate Lavacow interests, for instance, the prevention of frauds, maintaining goods security, direct marketing. Anytime we rest on these legal grounds in order to process your data, we assess our interests, so that they do not prevail over your rights
→ Compliance with an imperative legal requirement, including, for instance, accounting and tax requirements, which are the subject of a strict internal policy (such as the periods of data keeping), procedures and your right to restrict the use of your data, which control the object of the legal consultancy services which shall be provided; or
→ The consent that you grant when there are no legal grounds for the processing and which can be revoked by you at any moment.
2. CATEGORIES OF PROCESSED DATA
Data processing is necessary in order to be able to carry out your registration into the client account, for the purpose of participating in the online auction, for the execution of the sales contract and for the compliance with the legal reporting requirements: client surname and forename, full address, date of birth, personal identification number, Identity Card series and number, phone number, e-mail address, your image, IP of the device on which you visit the website www.lavacow.com
3. PERIOD FOR THE STORAGE OF PERSONAL DATA
Personal data shall be stored throughout the execution of the relationship with the client, to which a period of 5 years shall be added since the date of its termination, respectively, throughout the period laid down by the law.
After the expiry of this period, personal data shall be removed and/or destroyed.
Cookies are small text files, placed on the terminal. Anytime a person accesses a certain website, he/she can write or read in the cookie that he/she had placed on the terminal various information that the writer sent, directly or indirectly. Cookies play an important role in our website viewing activity. They hold information regarding the manner in which the website was visited, such as the language in which the pages are shown, the size of the letters, the area on the globe in which the user is found, the settings regarding safety and others. By using cookies, you shall benefit from a better experience of web surfing on our website, which without these could not be possible or would be significantly lower. However, if you prefer, by the settings made on the browser with which you surf the web, you can allow the launching or blocking of cookies.
5. DISCLOSING PROCESSED PERSONAL DATA
Personal data can be disclosed if it is in our legitimate interest, for administrative purposes, for instance, for the audit and monitoring of our internal processes.
Access is limited to those employees who must be in possession of the information.
Personal data can be also be disclosed to third parties, such as service providers: third parties which manage the e-mail newsletter, SMS marketing or other types of marketing, customer support or sales activities, suppliers and information technology systems support, including the archiving of e-mails, telecommunications providers, back-up and recovery service in case of catastrophes and cybernetic security service providers.
The disclosure can be done by accountants, auditors, lawyers and other external consultants, whose activity entails the need of knowing the data or where the law imposes a disclosure.
We ensure by contractual provisions, that these service providers (mandates) process the personal data in compliance with the European law on data protection, in order to guarantee a high level of data protection.
Some of these recipients (including our affiliates) can use the data in countries which are not part of the European Economic Area.
The images of our clients registered on CCTV are destined for the use by Lavacow and can be communicated only to the following recipients: the person in question and criminal prosecution bodies in compliance with the provisions of Law no. 333/2003 on the security of objectives, goods, values and protection of persons. There can also be other recipients, if there is a legal obligation to inform the competent public authorities or institutions, when the law provides it (e.g., fraud investigation; prevention of money laundering; submission of statements or financial statements to tax authorities, etc.), or sending data to courts of law for the purpose of defending one’s right before the courts, or before other public authorities.
6. DATA TRANSFER OUTSIDE THE EUROPEAN UNION
Personal information can be processed by the staff which operates outside the EEA (European Economic Area, which contains the countries of the European Union, Switzerland, Island, Liechtenstein and Norway; it is considered that these have equivalent laws regarding the protection of data and private life) of the third parties personal data operators for the purposes mentioned above.
In the case of the supply of personal data to entities outside the EEA, the appropriate measures for the safety of the processing shall be taken by contract.
7. YOUR RIGHTS
→ The right to be informed: the person in question is entitled to know, even from the moment when the collection is carried out, about the manner in which the data shall be used, to whom they shall be disclosed or transferred, what are the rights of the persons in question regarding the processed data.
→ The right to access the data: the person in question can obtain confirmation regarding the personal data processed, and if so, you have the right to access those data.
→ The right to remove the data (right to be forgotten): the person in question can obtain the removal of the data without unjustified delays (there are exceptions, such as: certain data are processed in order to offer the public the right to be informed, certain data are processed for statistical or archiving purposes, certain data are processed in order to meet a legal obligation, or the data are processed for the conclusion or defending of a right before a court of law).
→ The right to rectify: the person in question may obtain, without unjustified delays, the rectification of inaccurate personal data (for instance, the right to obtain the filling in of those incomplete personal data).
→ The right to restrict the data: the person in question has a temporary right to obtain the restriction of the processing if one of the following cases applies: (a) you challenge the accuracy of the data, for a period which allows us to check the accuracy of the data; (b) processing is illegal, and you oppose the removal of the personal data, requesting in exchange the restriction on their use; (c) we no longer need the personal data for the purpose of processing and you request from us the conclusion, exercise or defence of a right before the court of law; (d) you have opposed the processing in compliance with Article 21(1) of GDPR, for the period of time during which our legitimate rights prevail over your rights.
→ The right to oppose: the person in question has the right to oppose the processing by Lavacow of the personal data when these are processed for marketing purposes.
If you do not wish to receive marketing messages regarding our events, you can opt to give up all marketing notifications or only the methods selected (e-mail, SMS, MMS, telephone or mail).
We make available to you various means to give up the receiving of marketing messages:
• Log into your account and change your preferences;
• Send an e-mail to firstname.lastname@example.org for instructions;
• Click on the link at the end of the e-mail or the marketing text to unsubscribe;
→ The right to data portability: the person in question has the right to receive personal data regarding it in a structured format, in current use and which can be read automatically and the right to have the data directly transmitted to another operator, without any obstacles from our part, if: (a) the processing is based on a consent pursuant to Article 6(1)(a) or Article 9(2)(a) of GDPR or on a contract pursuant to Article 6(1)(b) of GDPR and (b) processing is carried out by automatic means.
→ The right to not be the subject of a decision based exclusively on automatic processing if that decision causes legal effects or significantly affects these and is based exclusively on the automatic processing of data meant to assess certain personal aspects.
→ The right to submit a complaint to the National Supervisory Authority for the Protection of Personal Data.
8. PERSONAL DATA SAFETY
Lavacow ensures a high level of protection and safety against accidental or illegal destruction, loss, modification, disclosure or unauthorised access, within the operations carried out on the personal data, by means of appropriate technical and organisational measures.
Organisational measures include the physical access to our headquarters, staff training and locking physical files into storage cabinets. Technical measures include the use of encryption, passwords for access into our systems, the use of SSL security certificates for the encryption of data in transit, etc.
In the case of your supply of data by means of Internet, although Lavacow takes all the measures to protect the data thus supplied, the transmission shall not be a completely safe one (for instance, third parties may observe the transmission activity; thus, it is impossible to guarantee absolute protection in Internet-based personal data transmission).
9. EXERCISE OF THE RIGHTS
In order to exercise your legal rights, please contact us by means of the e-mail address email@example.com or/and in writing to the mail address on 5 C.A. Rosetti St., District 1, Bucharest.
We shall endeavour to answer your request within 30 days and we can extend this deadline for reasons justified by the complexity of the request. In all cases, if this period is extended, there is the obligation of informing regarding the deadline and the reasons for the extension.
If it is impossible to properly identify you and thus, we shall not be able to answer you, we shall request additional information that would lead to your identification.
11. QUESTIONS AND REQUESTS
If you have questions or queries regarding the processing of your data or you wish to exercise your legal rights regarding the data that we own or if you have concerns regarding the manner in which we treat any issue of confidentiality, you may address a request at the e-mail address firstname.lastname@example.org or/and in writing to the mail address on 5 C.A. Rosetti St., District 1, Bucharest.
We shall investigate and endeavour to solve any complaint or request regarding the use or disclosure of your personal information.
If you are not satisfied with our answer, you may submit a complaint before the National Supervisory Authority for the Protection of Personal Data.
You may find more information on: