General Information

Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter – GDPR, Regulation, or RGPD) was adopted by the European Parliament and the Council of the European Union on April 27, 2016, and its provisions have been directly applicable since May 25, 2018. This Regulation expressly repeals Directive 95/46/EC, thereby also replacing the provisions of Law No. 677/2001 (now repealed).

The Regulation is directly applicable in all Member States, protecting the rights of all natural persons within the European Union. From a substantive standpoint, the Regulation applies to all controllers that process personal data. The Regulation does not apply to the processing of personal data relating to legal entities and, in particular, to undertakings with legal personality, including the name and type of the legal entity and the contact details of the legal entity.

Personal data is defined as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors specific to the individual’s physical, physiological, genetic, mental, economic, cultural, or social identity.

The processing of personal data means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Operator Identity

In light of Article 4(7) of the Regulation, which defines the term “controller” as a natural or legal person, a public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data, the controller processing personal data through this website is SC TĂRÂMUL CAILOR SRL, with its registered office in Brașov County, Hărman Commune, Podu Oltului Village, No. 1063H, registered with the Trade Registry Office under No. J08/685/2017, with Tax Identification Number (CUI) 37297777, legally represented by Monica Tudor, with contact information: contact@centruechitatiebrasov.ro.

Collection of Personal Data

What personal data is collected?

The operator of this website collects, stores, and processes the following personal data about you:

• Last Name, First Name
• Contact information (such as email, phone number)

Obtaining Consent

General Information

For the processing of personal data to be lawful, the GDPR requires that it be carried out on the basis of a legitimate ground, such as the performance or conclusion of a contract, compliance with a legal obligation, or on the basis of valid consent previously given by the data subject. In the latter case, the controller is required to be able to demonstrate that the data subject has given consent to such processing. Consent given under Directive 95/46/EC remains valid if it meets the conditions set forth in the GDPR.

Consent must be given through a statement or an unambiguous action that constitutes a freely given, specific, informed, and unambiguous indication of the data subject’s agreement to the processing of their personal data. If the data subject’s consent is given in the context of a statement—whether in electronic or written form—that also addresses other matters, the request for consent must be presented in a form that clearly distinguishes it from the other matters, which may even be achieved by checking a box. For the processing of personal data to be lawful, the GDPR requires that it be based on a legitimate ground, such as the performance or conclusion of a contract, compliance with a legal obligation, or valid consent previously given by the data subject. In the latter case, the controller is required to be able to demonstrate that the data subject has given consent to such processing. Consent given under Directive 95/46/EC remains valid if it meets the conditions set forth in the GDPR.

Cookies

This website uses cookies. They do not harm your computer and do not contain viruses; rather, they are designed to make the website easier, more efficient, and safer to use. They are small text files that are stored on your computer by your browser.

Many of the cookies used are called “session cookies,” which are automatically deleted after you visit this site. Others remain stored on your computer until you delete them; these enable us to recognize your browser on a subsequent visit.

You can configure your browser to notify you about the use of cookies, so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be configured to automatically accept cookies under certain conditions, to always reject them, or to automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Cookies that are necessary to enable electronic communications or to provide certain features you wish to use (such as the shopping cart) are stored in accordance with the provisions of Article 6(1)(f) of the GDPR, according to which processing is lawful only if and to the extent that it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. Therefore, the operator of this website has a legitimate interest in storing certain cookies to ensure optimal performance without technical errors. Other cookies (such as, for example, those used to analyze your browsing behavior) are also stored and will be addressed separately in this document.

Log files on the server

The provider of this website automatically collects and stores the information that your browser automatically transmits to us via log files. These include:

• Browser type and version
• Operating system used
• The URL of the page that initially generated the request to display the current page or object (Referrer URL)
• The hostname of the computer accessing the site
• Server Access Logs
• IP Address

The legal basis for processing such data is Article 6(1)(b) of the GDPR, which permits the processing of data when it is necessary for the performance of a contract to which the data subject is a party or to take steps, at the data subject’s request, prior to entering into a contract.

Contact Form

If you send us questions via the contact form, we will collect the data you enter in the form, including the contact information you provide, in order to respond to your questions and any follow-up inquiries. We do not share this information without your permission. Therefore, we will process all data you enter in the contact form only with your consent [in accordance with Article 6(1)(a) of the GDPR]. You may revoke your consent at any time; an informal email to that effect is sufficient. Data processed prior to receiving your request may still be processed lawfully. We will retain the data you provide via the contact form until:

• request the deletion of your data;
• withdraw your consent to their storage, or if
• The purpose for storing it is no longer valid.

Any mandatory legal provisions, particularly those regarding mandatory data retention periods, are not affected by the above.

Contact us by email, phone, or fax

If you contact us by email, phone, or fax, your request—including any personal data you provide—will be stored and processed by us for the purpose of addressing your request, based on the consent you have provided.

Therefore, we will process all the data you provide in accordance with the following legal provisions of the GDPR, namely:

• only with your consent—in accordance with the provisions of Article 6(1)(a) of the GDPR
• for the performance of a contract or during the pre-contractual phase—in accordance with the provisions of Article 6(1)(b) of the GDPR
• to fulfill the purpose and legitimate interest we pursue, namely the efficient processing of the requests you submit—in accordance with the provisions of Article 6(1)(f) of the GDPR.

We will retain the data you provide in this manner until:

• request the deletion of your data;
• withdraw your consent to their storage, or if
• The purpose for which the data is stored is no longer valid, in all cases except for mandatory data retention periods.

Comments Section

When you access the Comments section, certain personal data (such as, but not limited to, your email address, username, and IP address) will be processed and stored; some of this data is necessary to prevent illegal activities or defamatory content.

You also have the option to register or subscribe on this site to receive comments via the email address you provide, so:

• The email address may be verified via a confirmation email;
• You can unsubscribe at any time by clicking the link in the email, and the data you provided will be deleted immediately, except for data provided when accessing other sections (for example, when subscribing to the newsletter), which will remain stored;

Purpose of Processing the Collected Data

Some of the data collected on this site is used for:

• Providing the services we offer for your benefit (for example, to resolve any issues related to our products and services, to provide support services, etc.)
• Delivery of products ordered through our online store.
• Optimal operation and optimization of this website (statistics and analytics) – We are constantly striving to provide you with the best experience on our website, which is why we may collect and use certain information regarding your satisfaction while browsing this site, and we may invite you to complete suggestion surveys or similar forms.
• Online advertising and promotional activities. You may request at any time, through the means described in this document, that we stop processing your personal data for marketing purposes, and we will comply with your request as soon as possible.
• Periodic User Updates – We want to keep you informed about our offers. To this end, we may send you any type of message containing general and topic-specific information, information about offers or promotions, as well as other commercial communications such as market research and opinion polls. For communications of this type, we rely on the consent we have obtained from you in advance. You may change your mind and withdraw your consent at any time.
• To protect our legitimate interests. There may be situations in which we use or disclose information to protect our rights and business operations. These may include: measures to protect our website and its users from cyberattacks; measures to prevent and detect fraud attempts, including the disclosure of information to the relevant public authorities; and measures to manage other types of risks.

The processing of personal data is carried out in accordance with the provisions of the General Data Protection Regulation, based on both the consent of the data subject and the need to fulfill contractual obligations or to pursue the legitimate interests of the controller (unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, take precedence, particularly when the data subject is a child).

User Rights

Your rights regarding personal data and the means to exercise them are: The right to be informed, The right of access, The right to rectification, The right to erasure, The right to restriction of processing, The right to data portability, The right to object, The right not to be subject to a decision based solely on automated processing, The right to file a complaint and to bring a matter before the courts, The right to withdraw consent.

• Right to information – you may request information regarding the processing of your personal data, the identity of the data controller and its representative, or the recipients of your data;
• Right of Access – You may obtain from the controller confirmation as to whether or not personal data concerning you are being processed and, if so, access to such data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; where possible, the period for which the personal data are expected to be stored or, if this is not possible, the criteria used to determine that period; the right to request from the controller the rectification or erasure of personal data, or the restriction of the processing of personal data, or the right to object to the processing, etc.
• Right to rectification – you may correct inaccurate personal data or complete it;
• Right to erasure – you may request the erasure of your data if its processing was unlawful or in other cases provided for by law;
• Right to restrict processing – you may request that processing be restricted if you contest the accuracy of the data, as well as in other cases provided for by law;
• Right to data portability – under certain conditions, you may receive the personal data you have provided to us in a machine-readable format, or you may request that such data be transferred to another controller
• Right to object – in particular, you may object to data processing based on the controller’s legitimate interest;
• The right not to be subject to a decision based solely on automated processing —you may request and obtain human intervention regarding such processing or express your own point of view regarding this type of processing;
• The Right to File a Complaint and to Take Legal Action – You may file a complaint regarding the processing of your personal data with the National Supervisory Authority for Personal Data Processing and/or bring a case before the courts to ensure your rights are respected;
• The Right to Withdraw Consent – In cases where processing is based on your consent, you may withdraw it at any time. Withdrawal of consent will only take effect going forward; processing carried out prior to withdrawal remains valid.

Obligations of the Data Controller

Hosting

Personal data collected on this website is stored on our own servers. The processing of the data provided and stored complies with the following legal provisions:

• Article 6(1)(a) of the GDPR—the processing of personal data is based on your consent, obtained after you have been provided with accurate and complete information;
• Article 6(1)(f) of the GDPR—the processing of data is carried out for the purposes of our legitimate interests.

Data Encryption

This site uses SSL encryption for security reasons and to protect the transmission of confidential information. You can recognize this encryption by the lock icon that appears in the browser bar and by the change in the browser address from http:// to https://. Once this type of encryption is activated, the data transmitted or transferred cannot be viewed by third parties.

Under the GDPR, if a personal data breach is likely to result in a high risk to your rights and freedoms, the operator of this website will inform you, without undue delay, of this breach, unless the supplementary provisions of the same Regulation (Article 34(3)) apply.

Data Protection Officer

Since the provisions of the GDPR regarding the obligation to appoint a Data Protection Officer do not apply (Art. 37, para. 1— according to which the Controller and the processor shall designate a Data Protection Officer whenever:

1. the processing is carried out by a public authority or body, with the exception of courts acting in the exercise of their judicial functions;
2. the main activities of the controller or the processor consist of processing operations which, by virtue of their nature, scope, and/or purposes, require regular and systematic monitoring of data subjects on a large scale; or
3. the main activities of the controller or the person authorized by the controller consist of the large-scale processing of special categories of data pursuant to Article 9 or of personal data relating to criminal convictions and offenses, as referred to in Article 10)

For any information or clarification regarding the operation of this website, please contact us using the following contact information:

• Name: Monica Tudor
• Email: contact@centruechitatiebrasov.ro
• Phone: –
• Fax: –
• Mailing Address: Brașov County, Hărman Commune, Podu Oltului Village, No. 1063H

Records of Processing Activities

Under the GDPR, the controller or the processor should maintain, for a reasonable period of time, records of the processing activities under its responsibility. These records shall include the following information:

• the operator’s name and contact information
• the purposes of the processing;
• a description of the categories of data subjects and the categories of personal data;
• the categories of recipients to whom the personal data have been or will be disclosed;
• if applicable:
  • transfers of personal data
  • the expected deadlines for deleting the various categories of data
  • a general description of technical and organizational security measures

The obligation described above does not apply to a company or organization with fewer than 250 employees, unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing involves special categories of data or personal data relating to criminal convictions and offenses.

Appropriate technical and organizational measures

Given the current state of technology, the context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed.

Notification to the Supervisory Authority in the Event of a Personal Data Breach

Pursuant to Article 33(1) of the GDPR, in the event of a personal data breach, we will notify the National Supervisory Authority for the Processing of Personal Data without undue delay and, if possible, within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to the rights and freedoms of natural persons.

Notifying the Data Subject of a Personal Data Breach

In accordance with the provisions of Article 34 of the GDPR, if a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will inform the data subject without undue delay of this breach, except in cases where:

• Appropriate technical and organizational safeguards have been implemented, and these measures were applied to the personal data affected by the personal data breach, in particular measures ensuring that the personal data becomes unintelligible to any person not authorized to access it, such as encryption;
• Further measures have been taken to ensure that the aforementioned high risk to the rights and freedoms of the data subjects is no longer likely to materialize;
• would require a disproportionate effort. In such a situation, a public announcement is made instead, or a similar measure is taken to inform the data subjects in an equally effective manner.

Social Media

Facebook plugins (Like & Share buttons)

This service uses social plugins (“plugins”) managed by the social network facebook.com. The plugins can be identified by a Facebook logo (a white “f” on a blue background or a “thumbs up” icon) or are labeled with the phrase “Facebook Social Plugin.” The list and appearance of Facebook plugins can be viewed here: https://developers.facebook.com/docs/plugins/. If you use the “Like” button, you can “like” our website’s Facebook page without having to leave it. If you use the Share button, you can share our website or specific content from it on your personal Facebook page without having to leave the site.

Through the plugin, Facebook receives information about the content you access on our website. If you are logged into Facebook at the same time, Facebook can associate the actions you take on the page with your account and, by extension, with you personally. When you interact with the plugins—for example, by clicking the “Like” button or sharing specific content from the site—the corresponding information is transferred directly from your browser to Facebook and stored there. Even if you are not a Facebook member, it is still possible for the social network to obtain and store your IP address.

By clicking on one of these buttons, you agree to the use of this plugin and, consequently, to the transfer of personal data to Facebook. We have no control over the nature and purpose of the data transmitted, nor over its subsequent processing. Regarding the purpose and scope of data collection, the processing and further use of data by Facebook, as well as the permissions and settings for protecting your privacy.

If you do not want Facebook to associate your visit to this site with your Facebook account information, you can log out.

Instagram Plugin

This service uses social plugins (“plugins”) managed by the Instagram social network, features provided by Instagram Inc., headquartered at 1601 Willow Road, Menlo Park, CA 94025, USA. The plugins can be identified by an Instagram logo or are labeled with the phrase “Instagram Social Plugin.”

Through the plugin, Instagram is notified of the actions you take on our page. If you are also logged into your personal social media account at the same time, Instagram may associate the actions taken on our page with your Instagram account and, by extension, with you personally. When you interact with the plugins, the relevant information is transferred from your browser to the social media platform and stored there. Even if you are not an Instagram member, there is still a possibility that Instagram may obtain and store your IP address.

By clicking on one of these buttons, you consent to the use of this plugin and, consequently, to the transfer of personal data to Instagram. We have no control over the nature and purpose of the data transmitted, nor over its subsequent processing. For information regarding the purpose and scope of data collection, the processing and further use of data by Instagram, as well as the permissions and settings for protecting user privacy, please refer to Instagram’s privacy policies at: https://help.instagram.com/155833707900388.

If you are an Instagram user and do not want Instagram to collect your data through the plugin and link it to the data already stored on Instagram, you must log out of the social network before visiting this site.

The Tumblr Plugin

This site uses certain Tumblr plugins, which are operated by Tumblr Inc., headquartered at 35 East 21st Street, 10th Floor, New York, NY 10010, USA. These plugins allow you to share a post or page on Tumblr. When you visit this site using Tumblr, your browser establishes a direct connection to Tumblr’s servers. We have no control over the amount of data accessed by Tumblr and transmitted through this plugin. Based on our experience, it is possible that your IP address and the URL of the website in question may be transmitted.

More information can be found in Tumblr’s privacy policy: https://www.tumblr.com/privacy

Twitter plugin

This service uses social plugins (“plugins”) managed by the social network twitter.com. The plugins can be identified by a Twitter logo.

Through the plugin, Twitter receives information about the content you view on our website. If you are logged into Twitter at the same time, Twitter can associate the actions you take on the page with your Twitter account and, by extension, with you personally. When you interact with the plugins, the corresponding information is transferred directly from your browser to Twitter and stored there. Even if you are not a Twitter member, it is still possible for Twitter to obtain and store your IP address.

By clicking on one of the plugin buttons, you can consent to their use and, consequently, to the transfer of personal data to Twitter. We have no control over the nature and purpose of the data transmitted, nor over its subsequent processing. For information regarding the purpose and scope of data collection, the processing and further use of data by Twitter, as well as the permissions and settings for protecting user privacy, please refer to Twitter’s privacy policies at: https://twitter.com/en/privacy.

If you are a Twitter user and do not want Twitter to collect your data through the plugin and link it to the data already stored on Twitter, you must log out of the social network before visiting the website.

Google+ plugin

This service uses social plugins (“plugins”) managed by the Google+ social network. The plugins can be identified by a Google+ logo.

Through the plugin, Google receives information about the content you access on our website. If you are logged into the social network at the same time, Google can associate the actions you take on the page with your Google+ account and, by extension, with you personally. When you interact with the plugins, the corresponding information is transferred directly from your browser to Google+ and stored there. Even if you are not a Google+ member, there is still a possibility that Google+ may obtain and store your IP address.

By clicking on one of the plugin buttons, you can consent to their use and, consequently, to the transfer of personal data to Google+. We have no control over the nature and purpose of the data transmitted, nor over its subsequent processing. For information regarding the purpose and scope of data collection, the processing and further use of data by Google+, as well as the permissions and settings for protecting user privacy, please refer to the Google+ Privacy Policy at: https://policies.google.com/privacy?hl=en.

If you are a Google+ member and do not want Google+ to collect your data through the plugin and link it to the data already stored on Google+, you must log out of the social network before visiting the site.

Pinterest plugin

This service uses social plugins (“plugins”) managed by the social network Pinterest.

Through the plugin, Pinterest receives information about your activity on our website. If you are also logged into Pinterest at the same time, Pinterest may associate the actions you take on the page with your account and, by extension, with you personally. When you interact with the plugins, the relevant information is transferred directly from your browser to Pinterest and stored there. Even if you are not a Pinterest member, it is still possible for Pinterest to obtain and store your IP address.

By clicking on one of the plugin buttons, you can consent to their use and, consequently, to the transfer of personal data to Pinterest. We have no control over the nature and purpose of the data transmitted, nor over its subsequent processing. For information regarding the purpose and scope of data collection, the processing and further use of data by Pinterest, as well as the permissions and settings for protecting user privacy, please refer to Pinterest’s privacy policy at: https://policy.pinterest.com/en/privacy-policy.

If you are a Pinterest member and do not want Pinterest to collect your data through the plugin and link it to the data already stored on Pinterest, you must log out of the social network before visiting the site.

Newsletter

To receive a newsletter, you must provide a valid email address, along with specific information that can be used to identify the owner of that address. We also require your consent to send you the newsletter; therefore, we would like to inform you that any other personal data will be collected and stored only with your consent. The data collected in this manner is processed solely for the purpose of sending the newsletter and will not be disclosed to third parties.

Therefore, we will process any data you enter in the contact form only with your consent, in accordance with the provisions of Article 6(1)(a) of the GDPR.

Plugins and Tools

YouTube

Our website uses plugins from the YouTube platform, which is operated by Google. The website operator is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.

If you visit a page on our website that includes a YouTube plug-in, a connection will be established with YouTube’s servers. As a result, YouTube will be notified which pages you have visited.

In addition, YouTube may also set various cookies, which will be used to collect information about visitors to our website. Among other things, this information will be used to generate video statistics in order to improve the user experience on the site and prevent fraud attempts.

If you are signed in to your YouTube account while visiting our website, you are allowing YouTube to directly associate your browsing activity with your personal profile. You can prevent this by signing out of your YouTube account.

Our use of YouTube is based on our interest in presenting online content to you in an engaging way. Pursuant to Article 6(1)(f) of the GDPR, this constitutes a legitimate interest.

In light of the Judgment of July 16, 2020 (rendered in Case C-311/18 – Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice ruled that the protection provided by the EU–US Privacy Shield is not adequate. Consequently, the transfer of personal data to the United States and other countries outside the European Economic Area (EEA) should be based on the European Commission’s Standard Contractual Clauses (SCCs).

For more information on how YouTube handles user data, see the YouTube Privacy Policy regarding data at: https://policies.google.com/privacy?hl=en.

Google Web Fonts

This site uses Web Fonts provided by Google to ensure consistent font usage throughout the site.

When you visit a page on this website, your browser will load the web fonts needed to display the text and fonts correctly by establishing a connection with Google’s servers. Thus,

The use of Google Web Fonts is based on Article 6(1)(f) of the GDPR, as there is a legitimate interest in ensuring a consistent font display on this website. If express consent has been given in this regard (for example, consent to the use of cookies), the data will be processed exclusively pursuant to Article 6(1)(a) of the GDPR.

For more information on how Google Web Fonts handles user data, see the Privacy Policy available at: https://policies.google.com/privacy?hl=en.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our website. The provider is Google Inc., located at 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). The purpose of reCAPTCHA is to determine whether the data entered on our website (for example, information entered into a contact form) is provided by a human user or by an automated program. To determine this, reCAPTCHA analyzes the behavior of website visitors based on a variety of parameters. This analysis is triggered automatically as soon as a website visitor accesses the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g., IP address, the time the site visitor spent on the site, or user-initiated cursor movements). The data tracked during these analyses is sent to Google. reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is in progress. The data is processed pursuant to Article 6(1)(f) of the GDPR. The website operators have a legitimate interest in protecting the operator’s web content against misuse by automated industrial espionage systems and against spam.

In light of the Judgment of July 16, 2020 (rendered in Case C-311/18 – Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice ruled that the protection provided by the EU–US Privacy Shield is not adequate.

Therefore, the transfer of personal data to the United States and other countries outside the European Economic Area (EEA) is based on the European Commission’s Standard Contractual Clauses (SCCs). The Commission has issued two sets of Standard Contractual Clauses for data transfers from data controllers in the EU to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of standard contractual clauses for data transfers from EU data controllers to data processors established outside the EU or the EEA. For more information on these clauses, we recommend visiting https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Google reCAPTCHA uses Standard Contractual Clauses as an adequate safeguard for data protection, in accordance with the level of protection guaranteed by the GDPR. For more information, please see Google’s Privacy Policy, available here: https://policies.google.com/privacy and here https://policies.google.com/terms?hl=en

Conclusion

This policy on the processing of personal data is established in accordance with the provisions of Regulation No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as other applicable national legal provisions.

We reserve the right to make any additions or changes to this policy. We recommend that you review the Policy regularly to ensure you have accurate and up-to-date information regarding the processing of personal data.

For more details regarding this GDPR Policy, as well as to exercise any of the rights mentioned above, please send a written notice to the contact information provided above.