POLICY
REGARDING THE
PROCESSING OF PERSONAL DATA
Your privacy is one of our fundamental commitments, and therefore, we
take utmost care to process your personal data in accordance with the
principles set forth in the applicable legislation.
The online store www.arplay.ro is owned and managed by INVEST NET GROUP
S.R.L., having its headquarters in str. Intrarea Reconstructiei, nr.8, bl.28
bis, sc.2, et.10, ap.87, Bucharest, Sector 3, tax identification code
RO11645460, registered with the Trade Register Office under no. J40/15732/2004
Contact details for customers: phone
number +40 755 33 00 35, e-mail address: support@arplay.ro hereinafter referred
to as AR PLAY („AR PLAY”, „we”) processes, as controller,
your personal data („Personal Data”).
The purpose of this information note
(„Policy„) is to detail how AR PLAY processes your Personal
Data.
1.
CATEGORIES OF PERSONAL DATA, PROCESSING
PURPOSES AND LEGAL GROUNDS
A.
Contacting the user
a.
Contacting the user
Personal Data: first
name, last name, phone number, e-mail address.
|
Processing purpose |
Legal ground |
|
Contacting the user in order to
solve the issue or to respond to the request |
Performance of a contract to
which the data subject is party or in order to take steps at the request of
the data subject prior to entering into a contract (art. 6, para. 1, let. b
of GDPR) |
B.
Ordering and delivering products
a. Payment
Processed personal data: name, surname, payment amount, bank card
details.
|
Purpose of processing |
Legal basis |
|
Making payment for purchased products |
Performance of a contract to which the
data subject is party or in order to take steps at the request of the data
subject prior to the conclusion of a contract (Art. 6, para. 1, lit. b, GDPR) |
b. Delivery of the order
Processed personal data: name, surname, products purchased, delivery
address, telephone number, any additional information provided by the customer.
|
Purpose of processing |
Legal basis |
|
Delivery of the placed order |
Performance of a contract to which the
data subject is party or in order to take steps at the request of the data
subject prior to the conclusion of a contract (Art. 6, para. 1, lit. b, GDPR) |
c. Adding to your shopping cart
Personal data processed: name, surname, added product.
|
Purpose of processing |
Legal basis |
|
Add the product to your shopping cart |
Performance of a contract to which the
data subject is party or in order to take steps at the request of the data
subject prior to the conclusion of a contract (Art. 6, para. 1, lit. b, GDPR) |
d. Placing the order
Processed personal data: name, surname, purchased products, delivery
address, telephone number, e-mail address, any additional information provided
by the customer.
|
Purpose of processing |
Legal basis |
|
Completion and placing of the order |
Performance of a contract to which the
data subject is party or in order to take steps at the request of the data
subject prior to the conclusion of a contract (Art. 6, para. 1, lit. b, GDPR) |
e.
Issuing the invoice
Processed personal data: name, surname, home address, products purchased,
payment amount.
|
Purpose of processing |
Legal basis |
|
Issuing the invoice related to the
purchased products |
Fulfillment of a legal obligation of the
Company (art. 6, para. 1, lit. c of GDPR) |
C.
User account
a.
Creating the user account
Personal Data: first
name, last name, e-mail address.
|
Processing purpose |
Legal ground |
|
Registering and creating the user
account |
Performance of a contract to
which the data subject is party or in order to take steps at the request of
the data subject prior to entering into a contract (art. 6, para. 1, let. b
of GDPR) |
b.
Adding information to the user profile
Personal Data: image.
|
Processing purpose |
Legal ground |
|
Adding information to the profile |
Data subject’s consent (art. 6,
para. 1, let. a of GDPR) |
c.
Order history
Processed personal data: name, surname, order date, ordered products,
payment amount.
|
Purpose of processing |
Legal basis |
|
Display your order history |
Performance of a contract to which the
data subject is party or in order to take steps at the request of the data
subject prior to the conclusion of a contract (Art. 6, para. 1, lit. b, GDPR) |
D.
Marketing (Newsletter, promotions,
discounts)
a.
Marketing messages
Personal Data: first
name, last name, phone number, e-mail address.
|
Processing purpose |
Legal ground |
|
Sending marketing messages in
order to advertise the company’s services and/or products |
Data subject’s consent (art. 6,
para. 1, let. a of GDPR) |
E.
Customer opinion (feedback)
a.
Customer opinion (feedback)
Processed personal data: name, surname, e-mail address, other information
mentioned by the client.
|
Purpose of processing |
Legal basis |
|
Soliciting and analyzing customer
opinions for the purpose of improving services |
Consent of the data subject (Art. 6,
para. 1, lit. a, GDPR) |
F.
Dispute resolution
a.
Legal disputes
Personal Data: first
name, last name, domicile address.
|
Processing purpose |
Legal ground |
|
Defending the legal rights and
the legitimate interests and filing any claims before the judicial bodies or
any other public authority |
Legitimate interest of the
company (art. 6, para. 1, let. f of GDPR) |
2.
PROVIDING YOUR PERSONAL DATA
You may refuse to provide certain Personal Data but in such a case you
may not be able to benefit from certain services specific to the relationship
described in this Policy.
3.
ABOUT LEGAL GROUNDS
The legal ground for processing the personal data differs depending on
the specific situation and the Personal Data processed.
When we process your Personal Data based on your consent, we will seek
your free, informed, specific and unequivocal consent for the respective
processing. By expressing your consent, you will agree that we may collect,
use, disclose, process and transfer Personal Data in accordance with this
Policy.
4.
THE SOURCE OF PERSONAL DATA
The source of Personal Data is: online user.
5.
AUTOMATED
INDIVIDUAL DECISION-MAKING
Your Personal Data shall not be processed in order to be subject to
decision based solely on automated processing, including profiling, which
produces legal effects concerning you or similarly significantly affects you,
pursuant art. 22 para. (1) of GDPR.
6.
PROCESSING DURATIONS
The duration of processing of Personal Data varies depending on the
specific processing operation:
|
Operations |
Duration |
|
Contacting the
user |
as long as it takes to solve the
request |
|
Creating the
user account |
as long as the user account
exists |
|
Adding
information to the user profile |
as long as the user account
exists |
|
Marketing
messages |
until the data subject withdraws
the consent |
|
Legal disputes |
as long as it takes to solve the
legal dispute |
In certain circumstances, we may retain your Personal Data for longer
periods of time in order to have an accurate record of your relationship with
us in the event of any complaints or if we reasonably believe that there is a
prospect of a litigation.
7.
TRANSFER OF PERSONAL DATA
We may transfer Personal Data, to the necessary extent, to the following
categories of recipients: IT services suppliers, marketing services suppliers,
public authorities.
These recipients can be located in the European Union and/or in the
European Economic Area. Where recipients are located outside the European Union
and the European Economic Area, including in countries not recognized as
ensuring an adequate level of protection, the transfer of Personal Data shall
be carried out only if there are appropriate guarantees, in accordance with
applicable law. In this respect, we rely on several guarantees, such as the
standard contractual clauses issued by the European Commission. You may receive
from us a list of recipients from third countries, as well as a copy of the
agreed provisions that ensure an adequate level of protection of Personal Data.
For any request to this effect, please contact us at the contact details
mentioned below.
8.
SECURITY OF PERSONAL DATA
The security of your Personal Data is important for us. Your Personal
Data will therefore be processed by applying reasonable technical and
organizational measures to protect Personal Data, such as limiting access to
Personal Data, encryption or anonymization of Personal Data, storage on secure
environments. However, despite our
efforts, we cannot always guarantee the effectiveness of the security measures
implemented, and therefore we cannot guarantee the security of Personal Data at
any time.
9.
RIGHTS IN CONNECTION WITH THE PROCESSING
OF YOUR PERSONAL DATA
Access right: You have the right to obtain from us confirmation that your Personal
Data is processed by us, as well as information on the specific processing,
such as: the purposes of processing, categories of processed Personal Data,
recipients of Personal Data, the period for which Personal Data is stored, the
source of Personal Data, if we transfer the Personal Data abroad and how we
protect it, your rights, the right to lodge a complaint before the supervisory
authority.
Right to rectification: You have the possibility to request
rectification of your Personal Data, provided that the applicable legal
requirements are met. In the event of errors, after notification, we will
immediately correct your Personal Data.
Right to erasure: In certain cases, you have the possibility to
request the deletion of Personal Data, namely when: (i) the Personal Data are
no longer necessary in relation to the purposes for which they were collected
or otherwise processed; (ii) you withdraw consent on which the processing is
based according and where there is no other legal ground for the processing;
(iii) the Personal Data have been unlawfully processed; (iv) you exercise the
right to object to the processing. We are not obliged to comply with your
request when the processing is necessary (among others) for compliance with a
legal obligation or for the establishment, exercise or defence of legal claims.
There are also other circumstances in which we are not obliged to comply with
this request for the deletion of Personal Data.
Restriction of processing: You may request us to restrict the processing
of your Personal Data in the following circumstances: (i) you contest the
accuracy of the Personal Data, for a period enabling us to verify the accuracy
of the Personal Data; (ii) the processing is unlawful and then you oppose to
the erasure of the Personal Data and request the restriction of their use
instead; (iii) we no longer need the Personal Data for the purposes of the
processing, but you require them for the establishment, exercise or defence of
legal claims; (iv) you have objected to processing, pending the verification
whether our legitimate grounds override yours. However, we can continue to
process your Personal Data (i) when you consent; (ii) for the establishment,
exercise or defence of legal claims or (iii) for the protection of the rights
of another natural or legal person.
Right to data portability: Insofar the Personal Data is processed based on
your consent or on the execution of the agreement and the processing is carried
out by automated means, you have the right to have your data Personal Data
provided to you in a structured format, which is currently used and can be read
automatically and you have the right to request us to transfer this Personal
Data to another controller. This right shall not adversely affect the rights
and freedoms of others.
Right to opposition: In certain situations, such as when we process
your Personal Data on the basis of a legitimate interest, you have the right to
object to the processing of your Personal Data by us. In the event of
unjustified objection, INVEST NET GROUP SRL is entitled to continue processing
Personal Data. You also have the right to object to the processing of
your Personal Data for marketing purposes.
Withdrawal of consent: Insofar you consented to the processing of
your Personal Data, you can at all times withdraw your consent, without
affecting the lawfulness of processing based on consent before its withdrawal.
Right not to be subject to any automatic
individual decisions: You have
the right not to be subject to a decision based solely on automated processing,
including profiling, which produces legal effects concerning you or similarly
significantly affects you. Such right cannot be exercised when the decision:
(i) is necessary for entering into, or performance of, a contract between you
and us; (ii) is authorized by law which lays down suitable measures to
safeguard your rights and freedoms and legitimate interests; or (iii) is based
on your explicit consent.
Right to lodge a complaint with the supervisory
authority: You have the right
to lodge a complaint with The National Supervisory Authority for Personal Data
Processing (“DPA”) in relation to any breach of your rights regarding
the processing of your Personal Data. The contact details of the DPA are: 28-30
Gheorghe Magheru Boulevard, District 1, Postal Code 010336, Bucharest, Romania;
e-mail: anspdcp@dataprotection.ro.
To learn more about the manner in which you may
exercise the aforementioned rights, please contact us at: support@arplay.ro .
10.
CONTACT
If you have any questions or concerns about
this Policy or its implementation, you may contact us at: support@arplay.ro .
English 
Română 
