Privacy Policy

This site, bookatar.ro, belongs Ces Brands SRL, with registered office in Bucharest, sector 2, Maria Rosetti street no.6, 4th floor, with unique registration code 16517969.

1.What information we collect about you

We collect and process your personal data when you interact with us (for example, the information you provide to us by filling in forms on the website or by corresponding with us by phone, email or in any other way). This includes information you provide when you register, when you subscribe to our services, participate in discussion forums or other social communication activities on the Website, by completing a registration form or otherwise, and when you report a problem with our Website. The information you provide to us may include your name, address, e-mail address and telephone number, personal description and photograph, age, date of birth and gender, and other information as appropriate. We will not collect or process sensitive personal data about you (for example information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation) unless (i) we are required to do so by law; and/or (ii) you have provided us with your explicit consent separately. If you voluntarily provide us with personal data (including sensitive personal data) through your interaction with our Website or correspondence with us by telephone, email or otherwise, of your own volition and not at our request, we will delete such personal data from our systems if we do not believe that its processing is necessary for a legitimate purpose, unless you have made such data public (for example, in a message board that is visible to the public), in which case we will delete such data from our Website only if required to do so by law or if we do not wish to retain it. Each time you visit our Website, we automatically collect the following data:

• technical data, for example this may include the Internet Protocol (IP) address used to connect your computer to the internet, login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device type and mobile device brand; this data may be collected and processed on our behalf by third party cookies and you can find more information about this at https://bookatar.ro/privacy-center/cookie-policy/
• data about your visit, for example this may include full Uniform Resource Locators (URLs), sequence of clicks to, through and from our Website (including date and time), information or products you viewed or searched for (including top articles read, top categories accessed, page response times, download errors, duration of visits to particular pages (including average time spent on particular pages, viewing certain content or videos), the average number of articles viewed on our Website, information about page interaction (such as scrolling, clicks and mouse-overs), the methods used to navigate the page, data about Users' behavior, and any phone numbers used to call or email addresses used to contact us.

In some cases, we obtain your personal data (such as name, address, email address and phone number, personal description and photograph, age, date of birth and gender) from third parties such as business partners, technical, payment and delivery service subcontractors, advertisers, analytics service providers, market research service providers. When you visit and register on our Website, we may obtain your personal data from a third party social media provider if you voluntarily choose to register through that third party social media platform. If we obtain your personal data from a third party, we will provide you with all relevant information about the processing as soon as possible, but in any case no later than one month after obtaining your personal data, including on the categories of personal data being processed, the purpose of the processing and the legal basis for the processing.

 2.How we use personal data and what is the legal basis for processing

General aspects

We may process your personal data if we need to perform a contract we have entered into with you; if we need to comply with a legal obligation (e.g. applicable laws in employment relations, accounting, auditing, equal opportunities monitoring); where it is necessary for our legitimate interests (or those of a third party) and your interests (e.g. to detect and prevent fraud or to ensure IT and network security), unless your fundamental rights override those interests; if it is necessary to protect your vital interests (or the vital interests of others); and/or where it is necessary for public interest or official purposes. We process your personal information for various technical, administrative and operational reasons, such as to ensure that we present content in the most effective way for you and your computer; to improve our Website, including its functionality; to administer our Website; for internal operations, including for troubleshooting, data analysis, testing, research, statistical and research purposes; for advertising and marketing, including for targeted marketing purposes, so that we can provide content, including customized content, that may be of greater interest to you; and as part of our efforts to keep our Website secure. In some cases, we will only process your personal data with your consent. In these cases, we will ask for your consent separately and transparently when you provide your personal data. Subsequently, you will be able to withdraw your consent at any time via the e-mail address next. However, withdrawal of consent will not affect the lawfulness of any processing that took place before the withdrawal of consent. Where we require personal data to comply with legal or contractual obligations, your provision of such personal data is mandatory. This means that if such personal data is not provided, we will not be able to manage contractual relationships or comply with obligations imposed on us. In all other cases, the provision of personal data is optional and you are under no obligation to provide it. We may also process your personal data, such as identification data, contact details and address of residence, for the purpose of possibly exercising our rights or claims against you in the future. This processing is based on our legitimate interest, as it is necessary to exercise our rights in the event of possible litigation. Most commonly, we will use your personal information in the following situations: a. Trade partners: For the purposes of providing services, delivering goods and making payments under the relevant contracts, we may process your personal data, such as identification data, business contact data, bank details and tax identification code, for persons registered for VAT purposes. This processing is based on (i) the performance of a contract to which you, as a Business Partner, are a party, (ii) legal obligations imposed on us and (iii) our legitimate interest. In some cases, we process personal data, such as the names and contact details of employees or contractors of Trading Partners for the purpose of communications related to the performance of a particular contract with Trading Partners. This processing is based on (i) the performance of a contract to which the Business Partners are party, (ii) legal obligations imposed on us and (iii) our legitimate interest. As a Business Partner, we may provide you with communications about our new products and services. If you no longer wish to receive these communications, you may opt-out by sending us an e-mail at dan.radu@cesbrands.ro. b. Users and customers: For the purposes of providing services, delivering goods and making payments under the relevant contracts (including subscriptions), we may process your personal data, such as identification data, contact data, banking data. This processing is based on the performance of a contract to which Users (in particular subscribers) are party or a legal obligation imposed on us. We may process personal data so that we can provide you with information about goods or services that we think may be of interest to you. If you are an existing customer, we will contact you with information about goods and services similar to those which have been the subject of a previous sale or negotiation with you for sale, unless you have previously opted out. If you are a new customer, we will only contact you electronically if we have your prior consent. If you do not want us to use your data in this way, please tick the appropriate box on the form where we collect your data in the registration form. We will not share your personal data with third parties for marketing purposes without your explicit consent to do so. We may also use your personal data to measure or understand your preferred content and to provide content relevant to you; to allow you to participate in interactive features of our service when you choose to do so; to measure or understand the effectiveness of advertising we provide to you and others and to provide you with relevant advertising; and to make suggestions and recommendations to you and other Users of our Website about products or services that may be of interest to you or them.

 3.How and to whom we disclose your personal data

We do not sell your personal data to third parties. Within the Company, only a limited number of staff members have access to your personal data on an "on a need to know basis". These staff members are subject to confidentiality obligations with respect to personal data. Appropriate technical and organisational measures are taken to protect personal data. Company staff members are entitled to handle personal data only on the instructions of the Company and, if necessary, in connection with their job responsibilities. Personal data may be disclosed to government authorities and/or law enforcement agencies if required by applicable laws or if necessary to exercise our rights, including the Terms of Use, or to protect our legitimate interests (including the legitimate interests of third parties) in accordance with applicable laws. Your personal data may also be disclosed to third parties, including: (i) service providers who provide administrative, professional and technical support to the Company for IT support, security and business resources; (ii) business partners, suppliers and subcontractors for the performance of all contracts we enter into with you (including subscriptions to our services); (iii) advertisers and advertising networks that request your information to select and serve advertisements relevant to you. We do not disclose personally identifiable information to advertisers, but we will provide them with aggregate information about our Users (for example, we may inform them that 500 men/women under the age of 30 clicked on their advertisement on a given day). We may also use such aggregate information to help advertisers reach the type of audience they are targeting. We may use the personal information we have collected from you to comply with the advertisers' wishes by displaying their advertising messages to the intended audience; (iv) analytics and search engine service providers that assist us in improving and optimizing our Websites. The Company may also disclose personal data to outside consultants (e.g., lawyers, accountants, auditors) if necessary. We may share personal data with other third parties in the context of certain types of transactions, including in the context of transactions involving a change of control of the Company, the sale of substantially all of its assets, or business restructurings. The Company wishes to conduct appropriate due diligence in selecting third party service providers and requires such service providers to maintain appropriate technical and organizational security measures to protect personal data and to process personal data only as instructed by the Company. Service providers will have the right to use subcontractors in providing services to the Company, provided that the subcontractor complies with the same data protection obligations as the service providers.

4. Storage of your personal data and transfers abroad

Your personal data that we collect is stored in the European Union ("EU") and the European Economic Area ("EEA"). However, information collected by third parties via cookie files (e.g. Google Double Click for Publishers) will generally serve traffic from a data centre that is closest to where the traffic originates. This means that such information, including advertising traffic, may be handled by servers located in the EEA and may be transferred outside the EEA. For more information, see the Cookie Policy https://bookatar.ro/privacy-center/cookie-policy/. In addition, your personal data may be transferred to and stored in a location outside the EU and EEA. When your personal data is transferred from your own country to another country, the laws and rules protecting your personal data in the country to which your information is transferred may be different (or provide less protection) than in the country where you work. We intend not to transfer your personal data outside the EEA unless there are adequate protections, including: (i) an adequacy decision issued by the European Commission with respect to the destination country or countries; (ii) a "privacy shield" certification; (iii) appropriate binding corporate rules; (iv) an approved code of conduct, together with binding and enforceable commitments by the data controller or processor in the country outside the EU and EEA; (v) an approved certification mechanism, together with the binding and enforceable commitment of the data controller or processor in a country outside the EU and EEA to apply the appropriate safeguards; or (vi) EU standard contractual clauses approved by the European Commission.

5. YOUR RIGHTS

You can ask us to confirm whether or not your personal data is processed by us, to provide you with a copy of your personal data and/or to correct it. In certain circumstances, you have the right to ask us to delete your personal data or, based on your right to portability, to ask us to transfer part of your personal data to you or to other entities. You also have the right to object to certain processing of your personal data (e.g. the use of processing for direct marketing purposes or certain decisions taken solely by automated processing (including profiling). Where we have asked you to consent to the processing of your personal data, you have the right to withdraw this consent without adverse effect on you. Where we process your personal data because we have a legitimate interest in doing so (as explained above), you also have the right to object to such processing. You also have the right to restrict the processing of your personal data in certain circumstances. Please note that your rights described above may be limited in certain circumstances and are subject to applicable laws and regulations on the protection of personal data; for example, your right to object to the processing of your personal data may be limited if we can demonstrate compelling legitimate grounds for processing your personal data that override your interests. You will need to prove your identity and provide us with other details to help us respond to your request. We will not charge a fee for responding to your request unless permitted by law and, if such a fee is charged, it will be reasonable and proportionate to your request. If you wish to exercise these rights, please contact us via the contact persons listed below. We hope that we can answer any questions you may have about how we process your personal data. However, you also have the right to lodge a complaint with the data protection supervisory authorities. You can lodge your complaint in the Member State where you live, work or where the alleged data protection breach took place.

6. How long we keep your personal data

We intend to retain your personal data only for as long as necessary, in accordance with our Data Retention Policy, for no longer than is necessary to fulfil the purposes listed and/or required by applicable law, in accordance with applicable minimum legal retention periods and/or as long as is necessary to exercise our legitimate rights (and the legitimate rights of others). For example, if you are a Business Partner, we will retain your personal data for the duration of our contractual relationship with you. If we have a continuing business relationship with you as a Business Partner (for example where we may use the same personal data in separate contractual relationships with you), we will continue to retain this personal data until the termination of our business relationship and for the minimum retention period required by law, subject to our Data Retention Policy. If you would like more information about how long we retain your personal data, please contact us at dan.radu@cesbrands.ro. Please be aware that we may process any of your personal data that has become anonymous without prior notice to you. If we process your personal data on the basis of your consent, this personal data will only be processed for the period of time provided by your consent, unless you withdraw or limit your consent before the expiry of this period. In such cases, we will cease processing such personal data for the relevant purposes, subject to any legal obligation to process such personal data and/or our need to process such personal data for the purpose of exercising our legitimate rights (including the legitimate rights of others).

7. Data security

We store your data on servers hosted by third parties (including third party cloud-based services). We use appropriate technical and organisational measures to protect your personal data and prevent unauthorised access. We have entered into contractual relationships with third parties that provide hosting services and these contracts include obligations regarding organisational and technical security of personal data. All payment transactions will be encrypted (e.g. using the TLS protocol). You are responsible for maintaining the confidentiality of all means of authentication (e.g. passwords) used by you to access parts of our Website. Transmission of data over the Internet is not completely secure. While we will do our best to protect your data, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we receive your data, we will use strict procedures and security features to try to prevent unauthorised access.

8. Confidentiality of minors' data

The Company does not knowingly collect personally identifiable data on its Website from persons under the age of 16. If a parent or guardian becomes aware that his or her children have provided the Company with their personal data, he or she must notify the Company immediately. If the Company discovers that a person under the age of 16 has provided the Company with personal data, the Company will destroy such information from its servers immediately, unless the parent or guardian explicitly consents to the Company's processing of the child's personal data for the specified purposes.

9.Cookie files and social communication widgets

Our Website uses Cookies to distinguish you from other Users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our Website. This processing is based on your consent expressed on our Website or through your browser settings. For detailed information about the cookies we use, how long we use them and the purposes for which we use them, please see our Cookie Policy. https://bookatar.ro/privacy-center/cookie-policy/. Our websites may include social media features such as Facebook, Twitter, Instagram, LinkedIn or Youtube buttons. These features may collect information about you, such as your IP address and the websites you visit, and may set a cookie file to enable it to function properly. The processing of this information through your interactions with these features is governed by the privacy notice/policy of the company providing them (see section on your rights above).

10.Links to other websites

A Website of ours may provide links to websites that the Company does not control. Once you click on a third party link, you will be directed to the third party website. If you visit any of these linked websites, you should review their privacy policies. We are not responsible for the policies and practices of other companies. Our company does not control and assumes no responsibility for the content, privacy policies and notices or practices of third party websites or services.

11.Contact

If you have any questions or concerns regarding the processing of your personal data or if you wish to exercise a right, you may contact the Privacy Officer of Ces Brands SRL at dan.radu@cesbrands.ro or you can send a letter to the attention of the Privacy Officer of Ces Brands SRL at Ces Brands S.R.L., str. Maria Rosetti nr.6, Rosetti Tower, 4th floor, sector 2, Bucharest, Romania. Please do not disclose sensitive personal data (e.g. information related to racial or ethnic origin, political opinions, religious or other beliefs, health or trade union membership), social security numbers or criminal record information when contacting us. *** Last update: 26 October 2021. We may update this Information Notice from time to time and will notify you of any changes by posting the new version on our website. If you have provided us with your contact information and authorized us to contact you, we will notify you if we change this Notice substantially. Please check this Notice periodically for any changes.