Privacy Policy
Information document regarding the processing of personal data, drafted in accordance with Regulation (EU) 2016/679 (hereinafter referred to as "GDPR")
Through this "Privacy Policy", KA&MA TRADING SRL assumes proactive responsibility for the protection of personal data, ensuring constant compliance with European and national standards.
1. Introduction
1.1 This Privacy Policy establishes the legal framework for how KA&MA TRADING SRL ("the Company", "the Operator", "We") collects, uses, transfers, and protects personal data, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), as well as applicable national legislation (Law 190/2018 regarding measures for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [the General Data Protection Regulation]).
1.2 The main purpose of the document is to ensure transparency, compliance, and effective protection of the data subjects' rights in the context of personal data processing by KA&MA TRADING SRL in all its activities, regardless of the capacity in which the data is processed (customer, contractual partner, employee, collaborator, etc.).
1.3 The Policy applies to all customers, contractual partners, employees, and other natural persons who interact with KA&MA TRADING SRL.
2. Identification of the Operator and Contact Details
2.1 The personal data operator: KA&MA TRADING SRL, with its registered office in Str. Riga, no. 4, Moșnița Nouă, Timiș County, registered with the Trade Register under no. J35/105/2011, tax code RO27921414.
2.2 Contact details for exercising rights (indicated in point 8) and requests regarding personal data processing:
· postal address: Str. Riga, no. 4, Moșnița Nouă, Timiș County
· e-mail: contact@depozituldesaltele.ro
3. Categories of Personal Data Processed
3.1 Depending on the relationship with the data subject, KA MA Trading processes the following categories of personal data:
· identification data: first name, last name, ID card/passport series and number, home/residence address, nationality, gender, date of birth.
· contact data: phone number, email address, postal address.
· professional data: professional and/or social experience, education and training, skills, information from CV and cover letter, interview results.
· financial data: bank account number.
· technical data: IP addresses, browser type, operating system, internet provider, device used, accessed pages and files, cookies and similar technologies.
· website activity data: location, visit duration, pages accessed.
· consent data: expressed options for marketing communications.
· other data: any other information voluntarily provided through forms, correspondence, or direct interactions.
2.3 Processing of personal data in the context of employment relationships:
In accordance with the provisions of art. 5 of Law 190/2018, in cases where video surveillance means are used at the workplace, KA MA Trading processes employees' personal data exclusively for the purpose of realizing legitimate interests and with the observance of the following conditions:
· the legitimate interest pursued is thoroughly justified and prevails over the interests or rights and freedoms of the employees.
· mandatory, complete, and explicit prior information has been provided to employees.
· the employee representative was consulted before the introduction of monitoring systems.
· the data storage period is proportional to the processing purpose, but not more than 30 days, except in situations expressly regulated by law or in duly justified cases.
4. Purposes and Legal Basis for Data Processing
4.1 Personal data is collected and processed strictly for the purposes determined in point 4.2, which are explicit and legitimate, in accordance with art. 5 para. (1) letter b) GDPR, and will not be further processed in a manner incompatible with these purposes.
4.2 Personal data processing is carried out in the context of:
· the conclusion and execution of contracts [art. 6 para. 1 letter b) GDPR]: managing contractual relationships with clients, partners, collaborators, employees, including recruitment, order processing, invoicing, product/service delivery.
· fulfilling legal obligations [art. 6 para. 1 letter c) GDPR]: archiving, accounting, reporting to authorities, compliance with legal requirements.
· the consent of data subjects [art. 6 para. 1 letter a) GDPR]: transmitting commercial and marketing communications, promotional campaigns, other activities for which explicit consent is required.
· legitimate interests [art. 6 para. 1 letter f) GDPR]: ensuring information and infrastructure security, fraud prevention, defending the Company's rights and interests, optimizing services, internal control, and auditing.
4.3 For the conclusion and execution of service provision and partnership/collaboration contracts, the following types of personal data are processed: first name, last name, ID card/passport series and number, gender, home/residence address, bank account number, email address, phone number, IP addresses, operating system used, browser type from which you access our sites or control panels, internet provider, pages.
4.4 In the context of personnel recruitment, we process the following types of personal data: first name, last name, address, date of birth, nationality, gender, phone number, email address, data regarding professional and/or social experience, education and professional training, skills, and other personal data resulting from the information contained in the submitted CV and cover letter, and, where applicable, from discussions during the employment interview.
4.5In order to complete and submit the contact form ("Contact") and order form ("Order") on the website www.bestsleep.ro (hereinafter, "the website"), we process the following types of personal data: first name, last name, email, phone number, address and, where applicable, other data if voluntarily provided by the data subject.
4.6 For website visitors, we may collect data through cookies or other similar technologies, such as: IP address, internet browser, location, web pages accessed on our website, time spent on the website, internet network, device used.
For more details on this, please consult the Cookie Policy – http://www.depozituldesaltele.ro/pages/politica-cookies (see on site)
4.7 We do not use personal data to send marketing communications, such as newsletters, unless you expressly consent to such communications by checking a consent box.
In this regard, we only process your email, first name, and last name and ensure that you have a simple option to unsubscribe at any time, or to withdraw your consent to receive these types of communications.
4.8 In the case of processing special categories of data (Article 9 GDPR: "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation"), an additional legal basis will be ensured, in accordance with Article 9 paragraph (2) GDPR, as well as in accordance with the strict interpretation of the derogations provided by the CJEU.
4.9 Data will not be processed for purposes incompatible with those mentioned above.
5. Data Recipients and International Transfers
5.1 Any transfer of data to third countries or international organizations is carried out only in strict compliance with Articles 44-49 GDPR. The transfer will only take place if there are adequate safeguards and enforceable rights for data subjects.
5.2 Personal data may be communicated to the following recipients, exclusively within the limits imposed by law:
· Authorities and public institutions, based on a legal obligation or for the defense of KA MA Trading's legitimate rights (consultants, lawyers).
· Contractual partners and collaborators, for the development of contractual relationships or the provision of services. The list of entities to which we provide your information is as follows: EuPlatesc, Google, Microsoft, CloudFlare, DIGITALCLOUDER SERVICES SRL, Meta (/Facebook, Instagram), TikTok, the courier company responsible for transporting the order (Dragon Star, Fan Courier, Sameday).
List of authorized operators:
|
Company |
Service |
|
EuroPayment Services |
Online Card Payments |
|
Google Analytics |
Analytics: Control panel. Anonymous data reporting. |
· Other third parties, exclusively based on the data subject's express and specific consent.
5.3 The list of recipients may change, and the Policy will be updated accordingly.
6. Data Storage Period
6.1 The data storage period will be established in accordance with Article 5 paragraph (1) letter e) GDPR ("storage limitation"), as well as legal obligations for archiving or retaining certain documents.
6.2 Personal data is kept for the period necessary to achieve the purposes for which it was collected, respecting applicable legal criteria and deadlines (e.g., archiving deadlines, accounting records, legal statutes of limitations).
After these deadlines expire, the data will be deleted, anonymized, or destroyed securely.
6.3In cases where KA MA Trading has made personal data public and is obliged, in accordance with section 6.2, to erase it, taking into account available technology and the cost of implementation, it will take reasonable steps, including technical measures, to inform processors who are processing the personal data that the data subject has requested the erasure by such processors of any links to, or copy or replication of, those personal data.
7. Security Measures
7.1 KA&MA TRADING SRL implements appropriate technical and organizational measures, in accordance with Articles 32-34 GDPR, to ensure a level of security commensurate with the risks.
7.2The Operator implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data, including:
· Methods and technologies for securing IT systems and communications.
· Internal procedures regarding data access, control, and audit.
· Staff training and instruction on data protection.
· Periodic evaluation and updating of security measures to prevent unauthorized access, loss, destruction, or unauthorized disclosure of data.
· Collaboration with suppliers who comply with similar data protection standards.
8. Data Subjects' Rights
8.1 In accordance with Chapter III GDPR, data subjects benefit from the following rights:
· Right of access to personal data held: the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed [Art. 15 GDPR].
· Right to rectification of inaccurate or incomplete data: the data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her [Art. 16 GDPR].
· Right to erasure ("right to be forgotten") under the conditions provided by law: The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data without undue delay. The right to erasure of personal data applies in the following situations: (i) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) data subjects who have given their consent to data processing withdraw this consent or object to further processing of this data; (iii) personal data has been collected in relation to the offer of information society services [Art. 17 GDPR].
· Right to restriction of processing: the data subject has the right to obtain from the controller restriction of processing where: (i) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (iv) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; (v) the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject [Art. 18 GDPR].
· Right to data portability to another controller: the data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided [Art. 18 GDPR].
· Right to object to data processing for marketing purposes or on legitimate interest grounds: at any time, the data subject has the right to object, on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims [Art. 21 GDPR].
· Right not to be subject to a decision based solely on automated processing, including profiling: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her [Art. 21 GDPR].
· Right to lodge a complaint: to the National Supervisory Authority for Personal Data Processing ("ANSPDCP") or to address the competent courts:
9. Contact Methods and Procedure for Exercising Rights
9.1 To exercise any right provided by GDPR, data subjects can send a written, dated, and signed request to the postal address or email addresses mentioned below:
· e-mail: contact@depozituldesaltele.ro
· postal address/courier: Str. Riga, no. 4, Moșnița Nouă, Timiș County
9.2 KA MA Trading will analyze and respond within the legal timeframe, in compliance with Art. 12 para. (3)-(4) GDPR.
9.3 For further clarifications, you can also contact the A.N.S.P.D.C.P. at ansdpdc@dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, phone: +40.318.059.211.
10. Policy Changes and Updates
10.1This Privacy Policy may be revised and updated periodically to reflect changes in legislation, internal practices, or services provided.
10.2 Any changes will be published on the website www.depozituldesaltele.ro, effective from the date of display, in compliance with legal requirements regarding the informing of data subjects.
10.3 It is recommended to periodically consult the Policy to stay informed about any updates.
10.4 For further details, it is recommended to consult the following normative acts and jurisprudential decisions:
· Regulation (EU) 2016/679 (GDPR).
· Law no. 190/2018 on the implementing measures of GDPR.
· Case C-131/12, Google Spain v. AEPD and Mario Costeja González.
· Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems.
· Case C-13/16, Rīgas Satiksme.
· Case C-136/17, GC and others;
· Case C-287/22, SCHUFA Holding AG.
· Case C-340/21, Natsionalna agentsia za prihodite.