Processing of personal data

Gradina Noastra is the commercial name of BALKAN PARTNER SRL , a legal entity of Romanian nationality, with headquarters in Strada Ghioceilor 8A, Sat Petresti, Com. Corbeanca, registered at the Trade Register under no. J23/1031/2022, unique tax registration code RO32281303 (hereinafter "Gradina Noastra" or "we") which acts with regard to personal data as an Operator, in accordance with the provisions of Regulation (EU) 2016/679 (Regulation general data protection or RGPD) and subsequent legislation.

This information is equally addressed to website visitors, but also to customers who place orders in the online store and presents our policies regarding collection, recording on various media, organization, storage, adaptation or modification, extraction, consultation, joining or combining , transmission or disclosure to third parties, deletion or destruction of personal data (hereinafter "personal data processing") when they interact with us in connection with the products and services we offer.

1. Categories of personal data processed

We generally collect personal data that you provide us directly when you interact with us. With the example title:

  • - when you create a Gradina Noastra account, you send us your name and e-mail address;
  • - when you contact the Online Store Assistance service by phone, e-mail or via chat, you send us your name, phone number and/or e-mail address, as appropriate;
  • - when you add additional information in the My Account section, such as phone number, billing address, delivery address, etc.;
  • - when you place an order, you provide us with data such as the purchased product, quantity, delivery address, phone number, e-mail address, etc.

We can also process personal data automatically. For example, when accessing any page, visitors to our website send a series of technical data such as IP address, type of browser used, operating system, etc. We use such data for website navigation statistics, in order to improve the visitor experience.

Other technical data are collected through cookie files, when visiting the site or when interacting with our advertisements encountered while surfing the Internet. More details on this subject can be found in the Privacy and cookies section.

We do not collect or process sensitive data, included by RGDP in special categories of personal data. Also, we do not want to collect or process data of people who have not yet reached the age of 18.

2. The purpose and legal basis of personal data processing

a) in order to offer you our products and services

This purpose may include:

  • - creation and management of the Gradina Noastra account within our online store;
  • - the processing of orders, including their receipt, verification, invoicing and delivery;
  • - resolving your requests of any nature regarding an order, or our products or services;
  • - returning the products and refunding their value, in accordance with the legal provisions, following your request;
  • - services associated with the Gradina Noastra account (wishlist, newsletter subscription, etc.);
  • - assistance for visitors and customers.

    In all these cases, the processing of personal data is necessary for the conclusion and execution of a contract between you and us.

    Also, certain data processing is required by the tax legislation in force or by the legislation on the prevention of money laundering.

    The legal basis for this data processing is provided in the RGPD Regulation in art. 6 para. 1 lit. b (execution of a contract) and letter c (fulfilment of a legal obligation). In this context, refusing to provide us with mandatory data (marked as such with *) when we request them will make it impossible for us to honor your requests.

    b) in order to improve our services

    We can invite you to fill out satisfaction questionnaires after placing an order or we can perform tests to improve your experience through A/B tests of website changes (with anonymized data).

    The legal basis for this data processing is provided in the RGPD Regulation in art. 6 para. 1 lit. f (legitimate interest) for communications with clients in order to improve the activity.

    c) for marketing purposes

    Most often we make marketing communications based on the consent you have given us in advance. For example, by subscribing to the Newsletter or to browser notifications.

    We may also use certain data regarding purchasing behavior (for example, products purchased or viewed or added to wishlist) to create a profile, for the purpose of personalizing the marketing messages for which you have given us consent, or for the purpose of statistical analysis of the data.

    The legal basis for this data processing for marketing is provided in the RGPD Regulation in art. 6 para. 1 lit. to (consent).

    d) in order to protect our legitimate interests

    There are situations in which we process personal data by using or transmitting information to third parties to protect our commercial activity:

    • - site protection measures against cyber attacks;
    • - measures to prevent and detect fraud attempts, including the transmission of information to the competent public authorities.

    The legal basis for this data processing is provided in the RGPD Regulation in art. 6 para. 1 lit. f (legitimate interest).

    3. Disclosure of processed personal data

    Your personal data may be disclosed:

    • - to certain employees of Our Garden;
    • - certain recipients or third parties Our Garden.

    Certain Gradina Noastra employees from departments such as general management, financial-accounting, legal, sales, IT, logistics can have access to personal data, only in connection with their job duties and exclusively for the purposes provided above.

    Depending on the specific situation, Gradina Noastra may transmit, make available or offer access to certain relevant and necessary personal data to recipients and third parties (contractual partners or authorized representatives), from the following categories, individually, depending on the purposes of the processing previously mentioned and the services provided by them:

    • - suppliers of products and services available through the online store;
    • - courier service providers;
    • - providers of financial-banking services;
    • - providers of marketing and market research services;
    • - providers of IT services directly related to the operation of the online store (web hosting, e-commerce, etc.).

    Recipients and third parties have the obligation to use personal data safely and exclusively for the purposes specified by Gradina Noastra. They only have access to the personal data strictly necessary to provide the requested service and cannot use the data for their own purposes.

    We will always ensure that access to personal data by employees, recipients and third parties is carried out in accordance with the legal provisions regarding data security and confidentiality, based on adequate guarantees, or based on contracts concluded with them.

    In cases where we have a legal obligation or it is necessary to defend a legitimate interest, we may also disclose certain personal data to government authorities and/or law enforcement bodies.

    4. The countries where we process personal data

    Currently, we process personal data only on the territory of the European Union.

    5. The length of time we keep personal data

    Where there are legal provisions regulating the archiving of information, we keep the data for the entire period of time provided for in the legislation.

    If there are no such specific legal provisions, we keep personal data depending on the purpose of the processing, for the following maximum periods of time:

    • - for the purpose of offering our products and services: 5 (five) years from your last interaction with us;
    • - for the purpose of improving our services: 3 (three) years from obtaining the answers to the satisfaction questionnaires or the data from the A/B tests;
    • - for marketing purposes: until the consent is withdrawn or until the right of opposition is exercised or after 3 (three) years have passed since the last interaction with us;
    • - in order to protect our legitimate interests: 1 (one) year in the case of site protection measures against cyber attacks and in the case of measures to prevent and detect fraud attempts.

    6. Personal data protection measures

    We ensure the security of personal data through appropriate technical and organizational measures:

    • - the use of secure https connections between your devices and our website;
    • - keeping data on secure servers, ensuring redundant storage and making backup copies;
    • - the use of payment information encryption technologies.

    7. The rights of the persons concerned by the processing of personal data

    a) the right of access

    The data subject has the right of access to the processed personal data, without any kind of restriction on our part.

    b) the right to delete data

    The data subject has the right to obtain the deletion of personal data concerning him, and we have the obligation to delete personal data from our database without undue delay, in the event that:

    (i) the personal data are no longer necessary to fulfill the purposes for which they were processed;

    (ii) the data subject withdraws the consent on the basis of which the processing took place and there is no other legal basis (legal or contractual) for this processing;

    (iii) the data subject objects to the processing, provided that there are no legitimate and compelling reasons that justify the processing and that prevail over the interests, rights and freedoms of the data subject or provided that the purpose of the processing is not to ascertain, exercise or defend a right in the court;

    (iv) the data subject opposes the processing of personal data for the purpose of direct marketing;

    (v) the data has been processed illegally;

    (vi) the data subject objects to the processing of personal data for scientific or historical research purposes or for statistical purposes, with the exception of the case where the processing is necessary for the performance of a task for reasons of public interest.

    c) the right to rectification of data

    The data subject has the right to obtain, without undue delay, the rectification of inaccurate personal data concerning him. To the extent that the data subject has a Rovere account, data correction can be done freely by him directly in this account. Both the data subject who holds a Rovere account and the data subject who does not hold such an account can ask us to complete or rectify the data by means of a written request.

    d) the right to restriction of processing

    The data subject has the right to obtain from us the restriction of processing if one of the following situations applies:

    (i) the data subject contests the accuracy of the data, for a period that allows us to make the necessary checks;

    (ii) the processing is illegal, and the data subject opposes the deletion of personal data, requesting, instead, the restriction of their use;

    (iii) the data are no longer necessary for the purposes for which they were collected, but the data subject needs them to ascertain, exercise or defend a right in court;

    (iv) the data subject has exercised his right to object to the processing, but the verification of whether our rights prevail in the respective case is still ongoing.

    e) the right to data portability

    The data subject has the right to receive the personal data concerning him in a structured format, currently used and which can be read automatically. It also has the right to request us to transmit this data to another operator if:

    (i) the processing is based on consent or the conclusion or execution of a contract;

    (ii) the processing is carried out by automatic means.

    f) the right to opposition

    At any time, the data subject has the right to oppose, for reasons related to his particular situation, the processing of personal data concerning him, including the creation of profiles based on that data.

    From the moment of receiving the notification, we undertake to stop processing personal data, except in the case where we have legitimate and imperative reasons that justify the processing and that prevail over the interests, rights and freedoms of the person concerned, or when the purpose is to ascertain, exercise or defending a right in court.

    When the processing of personal data is aimed at direct marketing, the data subject has the right to object at any time to the processing for this purpose of the personal data concerning him, including the creation of profiles.

    g) making automatic decisions

    We do not make automatic decisions or create profiles that have legal effects or other significant effects for the persons concerned.

    8. Exercise of rights by the concerned person

    To exercise his rights in relation to the processing of personal data, the data subject can contact us using the contact details provided below, taking into account the following:

    Identity establishment . We take seriously the confidentiality of all records containing personal data. For this reason, please send us your requests using the e-mail address you used in your interactions with us or, if you have a Gradina Noastra account, the e-mail address related to it. Otherwise, we reserve the right to make additional checks by requesting information aimed at confirming your identity.

    Providing information . In exceptional cases, when the requests of a data subject are unfounded, repetitive or excessive, we reserve the right to reject the request for the provision of information, in accordance with art. 12 of the GDPR Regulation.

    Response time . We want to respond to any valid requests of the persons concerned within a maximum of 30 (thirty) days. This term can be extended by a maximum of 60 (sixty) days in more complicated cases, such as for example the situation in which the concerned person has made several requests, or the requests require complex operations.

    Third party rights . We will accept all the requests of the persons concerned and will treat them accordingly, taking into account that the answers and solutions offered do not affect the rights of third parties, when this possibility exists.

    9. Additional information

    You can contact us at any time:

    • - by e-mail to the address: office@gradina-noastra.ro;
    • - by post or courier to the address: Calea Bucurestilor no. 26, Petresti Village, Corbenaca Commune, Jud. Ilfov.

    For more details on the regulations in force regarding personal data or to file a complaint, you can contact the National Supervisory Authority for the Processing of Personal Data (ANSPDCP), at the following contact details:

    • - by e-mail to the address: anspdcp@dataprotection.ro or dpo@dataprotection.ro ;
    • - by post or courier to the address: Bd. G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest;
    • - by phone at the following numbers: 0318.059.211 or 0318.059.212.