GDPR Information Note (Personal Data Processing Regulation)

The document below will explain what data we use, for what purposes and for how long, who has access to it and what your rights are with regard to the data processed.

Who manages innergy.ro?
INNER CHI NATURE SRL (hereinafter referred to as „innergy”, „we” or similar) is a Romanian company, based in Constanta, registered with the Trade Register under number J13 / 1756/2013, fiscal code RO25725543, email: office @ innergy .ro, email the person designated with data protection: dpo@innergy.ro.
Innergy.ro is a site that also manages an online store. In order to be able to fulfill this goal, we get in touch with our visitors who want, at their initiative, to place orders. Subsequently, we process the data in order to deliver the orders registered on the site. We also conduct marketing / promotional campaigns to attract buyers for various products and other personal data processing operations that we explain below.
The document below will explain why we need certain personal data in order to provide certain services. Please read it carefully to understand a number of useful principles and concepts both in the interaction with our site and in the interaction with the online environment.

What is personal data?
According to the GDPR, „personal data” means any information about an identified or identifiable natural person („data subject”). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifying element, such as a name, an identification number (CNP), location data, an online identifier or one or several specific elements, specific to his physical, physiological, genetic, mental, economic, cultural or social identity.
There is no list of personal data, and the GDPR does not require states to make such a list, for the simple reason that a date may in one context become personal data, and in another context be simply a worthless personal data.

Examples of personal data:

• the name;
• one’s domicile or residence;
• an email address
• identity card or passport number;
• blood type
• medical history
• location data (for example, the location data feature available on a mobile phone)
• IP address;
• a cookie ID;
• the silhouette of one of the CCTV recordings;

The definition of personal data also contains some important elements:

1. Personal data refers to information about individuals, not legal entities. The distinction is important because, for example, the registration number from the Trade Register, the Fiscal Code or other identification elements of some companies are not personal data, they being public and easily accessible on the websites of state institutions.
2. It does not matter if the processing of this personal data is done through an automatic system or through a non-automated system (eg manual processing), if it is part of a structured data record system. The only important thing is that we are talking about processing such data.

Within the meaning of the Regulation, processing means any operation or set of operations performed on personal data or personal data sets, with or without the use of automated means, such as collecting, recording, organizing, structuring, storing, adapting or modifying, extracting, consulting , use, disclosure by transmission, dissemination or provision in any other way, alignment or combination, restriction, deletion or destruction

The information we collect
Innergy.ro collects personal data only through information provided directly by you, through innergy.ro forms (for example: as a result of registering as a member of the innergy.ro community, as a result of requesting an innergy.ro service or as a result of orders placed on the site).
Innergy.ro uses forms through which you can create an account, you can order or comment on products. These forms include fields such as name, email address, cell phone number, password, product delivery address details, billing details, etc.
We use this data to allow you to access the site and to be able to deliver the products and services you have chosen to receive. The legal basis for this processing is the entry on the site / account and the execution of a contract to which you are a party (whenever you perform the above operations, you agree to the terms and conditions of providing those services) or consent, if we talk about of commercial communications to you, not to mention similar products and services that you have already purchased from us, where we are entitled to send you commercial communications (but we will continue to offer you the opportunity to unsubscribe from that kind of communication).
We may also need to request additional tax information in the event that we are required by law to file tax returns in connection with the products and services you order. In that case, we’ll refer to your address. (necessary to be entered on the tax invoice), but also other tax data that the law requires us to collect and process in connection with the transaction in question. In this situation, the legal basis for processing will be the obligation to comply with the provisions of the legislation.
We will not use your data to send marketing communications unless you explicitly opt for such communication. Even in such cases, we assure you that you have an easy-to-use option to unsubscribe (withdraw your consent) at any time, either in the communication itself or by contacting us by email or phone.
Innergy.ro also offers the possibility to send us a message. The data you send following the use of this contact option is processed on the basis of our legitimate interest in responding to your request and / or keeping a record of your complaint, request for advice and the like.

What are the purposes of processing personal data?
We process your personal data exclusively for the following purposes:

1. For the benefit of our services

This general purpose may include, as appropriate, the following:

• Account creation and administration within the Site;
• Order processing, including taking over, validating, shipping and invoicing;
• Solving cancellations or problems of any kind related to an order, the goods or services purchased;
• Return of products according to legal provisions;
• Reimbursement of the value of the products according to the legal provisions;
• Providing support services, including providing answers to your questions about your orders or our goods and services.

Directly collected data and legal grounds
Legal grounds on which personal data may be collected

• consent;
• concluding or executing a contract;
• fulfillment of a legal obligation of the operator;
• protection of the vital interests of the data subject or of another individual person;
• fulfilling a task related to a public interest;
• for the legitimate interest of the operator or a third party.

Creating the customer account
The following data is required to create a customer account. name, surname, e-mail, telephone number, address. A new account can be created either in the process of requesting you to open a new customer account, or as a result of placing an order for the first time, in which case, in order to honor your order, we will automatically activate an account. client.

Legal basis for such processing: Consent
Shopping in the Online Store
You can make purchases when you have a customer account by placing products in the shopping cart and then finalizing an order. Alternatively, even if you don’t have an activated account, you can create one once you place a new order. An order can also be taken following a message on social media / email or phone call platforms.
The data collected after placing an order are: name and surname; delivery address; phone number.
When confirming the order, or when we announce that the products have reached the pick-up points, we will process: the phone number and / or the e-mail address to inform you about the status of your order / delivery.

Legal basis for these processing: Execution of the contract
In order to fulfill the orders, deliver the products to the indicated address / deliver the products to the pick-up points, or, as the case may be, make a return of the products.

Payment by card / refund of payment in case of product return / order cancellation.
The details of the card you use for 3D Secure payment for purchases in the Online Store cannot be accessed by Innergy, but only by the online payment processor. In the step of actually entering the details of the card you use for online payment, the identity of the online payment operator is also specified.
In case of returns / cancellations of orders that cannot be processed in the payment operator’s platform, we collect and process the IBAN and the bank where you opened the bank account in order to return the money paid for the returned products / canceled orders.

Legal basis for these processing: Execution of the contract
We provide the necessary support for processing by our authorized partners to mediate the payment of the products ordered by you.

Delivery of orders
In order to deliver the products to the indicated address, we communicate to the couriers the strictly necessary data: name, surname; delivery address; phone; the amount payable by cash on delivery (if applicable).
When picking up the products from our collection points, in order to identify you, we will ask you for the name left in the order and the unique identification code of the shipment.

Legal basis for these processing: Execution of the contract:
We fulfill our obligations related to the management and delivery of products to the customer under the agreed conditions and times.

Customer support and assistance
To be able to provide support for your account. of the client / orders placed, we will identify you by confirming: name and surname; your email address and phone number; Order ID.
We can process with your consent. beforehand, your voice from phone call recordings with you to respond to requests for assistance or to resolve any complaints or notifications.

Legal basis for these processing: Execution of the contract
We fulfill our responsibilities / activities during the execution of the contract

Loyalty actions
We can grant various discounts and benefits related to loyalty actions (subscription to the newsletter, activity on the facebook page or blog, placing orders on the site) in the form of vouchers, discounts or loyalty points.
Legal basis for these processing: Execution of the contract
In order to carry out our loyalty actions and offer commercial discounts in relation to you.
We do not collect personal data of individuals for marketing or behavioral advertising purposes, nor do we provide your data to other companies for advertising purposes.

Audit and reporting
We process your data for the annual financial audit, as well as for the submission of the fiscal and accounting declarations to the fiscal authorities.
Legal basis for such processing: Fulfillment of a legal obligation
For compliance with the legal obligations imposed by the applicable legal provisions in fiscal and accounting matters

Defending the rights in court
When we defend our rights in court to recover amounts due, or when we protect our interests against unjustified claims / claims, we will process your data necessary to formulate objections, written conclusions, requests and specific documents.
Legal basis for such processing: Legitimate interest
Exercising any defenses / rights before the courts, or public / control authorities or institutions

Procedures and investigations of judicial authorities and / or bodies
Exceptionally and in accordance with the law, we will provide to the competent authorities and institutions, within formal procedures / investigations or other steps provided by law, according to the procedure provided by law, the following data: name, surname, address, e-mail, telephone .
Legal basis for such processing: Fulfillment of a legal obligation
To comply with the specific legal obligations imposed by the applicable legal provisions on protection against fraud, money laundering and terrorism.

Data we collect from other sources

Browse social networks
If you like us on the Facebook page or if you log in to the customer account with the Facebook address and password, we will receive this data without using it other than to be able to communicate with you. and possibly to send you some personalized offers through your Facebook account based on personalized audiences.
Legal basis for such processing: Consent
Submitting personalized offers on Facebook (by using the personalized audience service based on the Facebook pixel)

Retention period of personal data.
Your personal data will be stored as long as your account exists in our database. You can at any time request the deletion of personal data stored by Innergy, an action that is completed within 30 days (maximum) as long as the legitimate basis does not intervene. This means that if a certain law provides for the storage of personal data for a certain period of time then, in that period, your personal data referred to in that law shall not be deleted.

Response time to a request
We will try to respond to your request within 30 days and we may extend this period for specific reasons related to the complexity of your request. In any case, if this period is extended, we will inform you about the extension term and about the reasons that led to it.

Restrictions on the use of information by third parties
Any third parties to whom we disclose your personal information data in accordance with the above are limited (by law and contract) in their ability to use your personal information only for the purposes specifically identified by us. We will always ensure that any third parties to whom we disclose your personal information are subject to the obligations of confidentiality and security in accordance with the contracts signed with them and the applicable laws. However, for the avoidance of doubt, this may not be applicable where disclosure is not our decision.
Except as expressly stated above, we will never disclose, sell or rent your personal information to a third party without notice and, where applicable, without your consent.

What rights do you have as a user of Innergy.ro?
In accordance with the provisions of Regulation no. 679/2016 you have the following rights:

1. the right to information and access to personal data (art. 13-15). It allows the data subjects to know, right from the moment the collection is made, how that data will be used, to whom it will be disclosed or transferred, what rights the persons concerned have regarding the processed data, etc.
2. the right to rectification (art. 16). Allows you to obtain from us, without undue delay, the rectification or completion of inaccurate personal data concerning you
3. the right to erasure of data (“the right to be forgotten”) (art. 17). It allows you to obtain from us the deletion of personal data concerning you, without undue delay. There are, however, exceptions to this rule, such as the idea that some data is processed to give the public the right to information, that it is processed for statistical or archival purposes, that it is processed to fulfill a legal obligation or that we process it. for finding or defending a right in court.
4. the right to restrict processing (art. 18);
5. the right to data portability (art. 20)
6. the right to opposition (art. 21). You have the right to object, for example, to the processing of your personal data, when they are processed for direct marketing purposes.
7. the right not to be subject to a decision based exclusively on automatic processing, including the creation of profiles (art. 22), which produces legal effects concerning the data subject or similarly affects him to a significant extent.
8. The right to file a complaint with the National Authority for the Supervision of Personal Data Processing. B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, zip code / 010336, Bucharest, Romania. +40.318.059.211 / +40.318.059.212, anspdcp@dataprotection.ro.

Restricting access:
In some situations, we may not be able to give you access to all or some of your personal data due to legal provisions. If we decline your access request, we will inform you about the reason for the refusal.

Unidentified:
In some cases, we may not be able to search for your personal data due to the identifiers you provide in your request. In such cases, if we are unable to identify you as the data subject, we are unable to comply with your request to exercise the legal rights described in this section, unless you provide additional information that allows us to identify you. We will inform you and give you the opportunity to provide such additional details.

Exercising legal rights:
To exercise your legal rights, please access your Innergy.ro Account. If the desired transaction cannot be performed directly in your account, please contact us at one of the following addresses: office@innergy.ro or dpo@innergy.ro

Security
Innergy.ro is committed to protecting your personal data from loss, misuse, disclosure, alteration, unavailability, unauthorized access and destruction and takes all reasonable precautions to protect the confidentiality of such data, including by using appropriate organizational and technical measures. Organizational measures include controlling physical access to our headquarters, training staff and locking physical files in storage cabinets. Technical measures include the use of encryption, passwords for access to our systems, the use of security certificates for encrypting data in transit, etc.
During the provision of your personal data to you, personal data may be transferred over the Internet. Although we make every effort to protect the personal information you provide to us, the transmission of information between you and us, on the internet, are not completely safe (it is possible that the terminal from which you write is monitored by third parties, for example, without us being able to do anything about it). Therefore, we cannot guarantee the security of your personal information data transmitted over the Internet, however, once we receive personal data, we will use strict procedures and security features to prevent unauthorized access to it.

Changes in the information note
We reserve the right, in our sole discretion, to change our privacy practices and to update and make changes to this disclaimer at any time. For this reason, we encourage you to permanently return to this note. We will treat your personal data in a manner consistent with the notice of confidentiality on the basis of which it was collected, unless we have your consent to treat it differently.

Contact information
Please ask us any questions regarding the subject of data protection and any requests in the exercise of legal rights to the following contact details:
Email: dpo@innergy.ro
Website: www.innergy.ro
Headquarters address: Constanta, bld. Mamaia no. 284, desk 13, Constanta county
We will investigate and try to resolve any request or complaint regarding the use or disclosure of your personal information.
If you are not satisfied with our answer, you can file a complaint to the National Authority for the Supervision of Personal Data Processing.
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, zip code / 010336, Bucharest, Romania. +40.318.059.211 / +40.318.059.212, anspdcp@dataprotection.ro.