Privacy Policy for the processing of personal data

We consider the protection of personal data as a fundamental commitment of Pop Industry, therefore we will dedicate all necessary resources and efforts to process your data in full compliance with Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), as well as any other applicable legislation on Romanian territory. As transparency is one of the essential principles of this legal framework, we have prepared this document to inform you about how we collect, use, transfer and protect your personal data when you interact with us regarding our products and services, including through our website or mobile applications.

We reserve the right to update and periodically modify this Privacy Policy to reflect any changes in the way we process your personal data or any changes in legal requirements. In case of any such modifications, we will post the modified version of the Privacy Policy on our website, therefore please periodically check the contents of this Privacy Policy.

What categories of personal data we process

In general, we collect your personal data directly from you, so you have control over the type of information you provide us. For example, we receive information from you such as:

When you send a request on www.repo.com.ro, you transmit to us: your email address, first and last name;

When you place an order, you provide us with information such as: the desired product, your name and surname, the delivery address, billing details, payment method, phone number, etc.

We do not collect or otherwise process sensitive data, as included by the General Data Protection Regulation in special categories of personal data. Also, we do not intend to collect or process data of minors under the age of 16.

What are the purposes and legal basis of processing

We will use your personal data for the following purposes:

a) Processing orders, including their acceptance, validation, dispatch and billing;

b) Solving cancellations or any problems related to an order, goods or services purchased;

c) Returning products in accordance with legal provisions;

Processing your data for these purposes is in most cases necessary for the conclusion and performance of a contract between Pop Industry S.R.L. and you. Also, certain processing related to these purposes are imposed by applicable legislation, including tax and accounting legislation.

We base these activities on our legitimate interest to carry out commercial activities, always ensuring that your fundamental rights and freedoms are not affected.

The general legal basis for these types of processing is our legitimate interest to defend our commercial activity, understanding that we ensure that all measures we take guarantee a balance between our interests and your fundamental rights and freedoms.

Also, in certain cases we base the processing on legal provisions such as the obligation to ensure the protection of goods and values provided by applicable legislation in this matter.

To whom we transmit your personal data

As applicable, we may transmit or grant access to certain personal data of yours to the following categories of recipients:

courier service providers;

payment/banking service providers;

marketing/telemarketing service providers;

IT service providers;

other companies with which we may develop joint market offering programs for our goods and services.

If we have a legal obligation or if it is necessary to defend a legitimate interest, we may also disclose certain personal data to public authorities.

We ensure that access to your data by third-party legal entities is carried out in accordance with the legal provisions on data protection and confidentiality of information, based on contracts concluded with them.

We undertake to ensure the security of personal data through the implementation of appropriate technical and organizational measures, in accordance with industry standards.

Despite the measures taken to protect your personal data, we draw your attention that the transmission of information over the Internet, in general, or through other public networks, is not completely secure, and there is a risk that data may be seen and used by unauthorized third parties.

We ensure that access to your personal data by third-party legal entities is carried out in accordance with legal provisions regarding data protection and confidentiality of information, based on contracts concluded with them.

We are committed to ensuring the security of personal data by implementing adequate technical and organizational measures, in accordance with industry standards.

Despite the measures taken to protect your personal data, we draw your attention to the fact that transmitting information over the Internet, in general, or through other public networks, is not completely secure, and there is a risk that data may be seen and used by unauthorized third parties. We cannot be responsible for such vulnerabilities in systems that are not under our control.

Data Portability

You may request that we provide you with personal data in a structured, commonly used and machine-readable format, or you may request that it be directly “ported” to another data controller, but only if:

processing is based on your consent or the conclusion or performance of a contract with you; and

processing is carried out by automated means.

Objection

You may object at any time, for reasons related to your particular situation, to the processing of your personal data based on our legitimate interest, if you believe that your fundamental rights and freedoms outweigh this interest.

You may also object at any time to the processing of your data for direct marketing purposes (including profiling), without invoking any reason, in which case we will cease this processing as soon as possible.

Automated Decision Making

You can request that you not be subject to a decision based solely on automated processing, but only when that decision:

has legal effects concerning you; or

significantly affects you in a similar way.

This right does not apply if the decision reached as a result of automated decision making:

is necessary for the conclusion or performance of a contract with you;

is authorized by law and there are adequate guarantees for your rights and freedoms; or

is based on your explicit consent.

Complaints

You have the right to file a complaint with the supervisory authority regarding the processing of your personal data. In Romania, the contact details of the data protection supervisory authority are as follows:

National Supervisory Authority for Personal Data Processing

28-30 G-ral. Gheorghe Magheru Blvd., 1st District, postal code 010336, Bucharest, Romania

Phone: +40.318.059.211 or +40.318.059.212;

Email: anspdcp@dataprotection.ro

Without affecting your right to contact the supervisory authority at any time, please contact us beforehand, and we promise to make every effort to resolve any issue amicably.