Respecting your privacy is one of our fundamental commitments, and therefore, we pay the utmost attention to the processing of your personal data, in accordance with applicable legislation.

LAUREALUXE TRAVELS S.R.L., headquartered at Main Street [STR. PRINCIPALĂ], No. 180, Sovata, Mureș, fiscal identification code 48669507, registered at the Trade Register Office under no. J26/1253/2023 (“LAUREALUXE TRAVELS S.R.L.”, “we”), processes your personal data (“Personal Data”) as a data controller. The purpose of this information note (“Policy”) is to detail how LAUREALUXE TRAVELS S.R.L. processes your Personal Data.

1. PROCESSED PERSONAL DATA, PROCESSING PURPOSES, AND LEGAL GROUNDS

A. Contacting the customer online

• Processed Personal Data: name, surname, e-mail address, phone number.

• Purpose: Contacting the customer online regarding the requested offer or to resolve the indicated problem.

• Legal Basis: Execution of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).

B. Ordering and delivery of products

a. Making the payment

• Processed Personal Data: name, surname, amount to pay, bank card details.

• Purpose: Processing payment for purchased products.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

b. Order delivery

• Processed Personal Data: name, surname, purchased products, delivery address, phone number, any additional information provided by the customer.

• Purpose: Delivering the placed order.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

c. Adding to the shopping cart

• Processed Personal Data: name, surname, added product.

• Purpose: Adding the product to the shopping cart.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

d. Placing the order

• Processed Personal Data: name, surname, purchased products, delivery address, phone number, e-mail address, any additional information provided by the customer.

• Purpose: Finalizing and placing the order.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

e. Issuing the invoice

• Processed Personal Data: name, surname, home address, purchased products, amount to pay.

• Purpose: Issuing the invoice for the purchased products.

• Legal Basis: Compliance with a legal obligation to which the Company is subject (Art. 6(1)(c) GDPR). Details: fulfillment of fiscal obligations.

C. User Account

a. Creating the user account

• Processed Personal Data: name, surname, e-mail address.

• Purpose: Creating the customer’s user account.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

b. Completing the user profile

• Processed Personal Data: image (profile picture).

• Purpose: Completing the customer’s user profile.

• Legal Basis: Consent of the data subject (Art. 6(1)(a) GDPR).

c. Order history

• Processed Personal Data: name, surname, order date, ordered products, amount paid.

• Purpose: Displaying the order history.

• Legal Basis: Execution of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

D. Marketing (Newsletter, promotions, offers)

a. Commercial messages

• Processed Personal Data: name, surname, phone number, e-mail address.

• Purpose: Sending commercial messages to promote the company’s services.

• Legal Basis: Consent of the data subject (Art. 6(1)(a) GDPR).

E. Customer feedback

a. Customer opinion (feedback)

• Processed Personal Data: name, surname, e-mail address, other information mentioned by the customer.

• Purpose: Requesting and analyzing customer opinions to improve services.

• Legal Basis: Consent of the data subject (Art. 6(1)(a) GDPR).

F. Dispute Resolution

a. Litigious issues

• Processed Personal Data: name, surname, home address.

• Purpose: Defending legitimate rights and interests, and supporting any claims before judicial bodies or any other public authorities.

• Legal Basis: Legitimate interest of the Company (Art. 6(1)(f) GDPR). Details: the company’s legitimate interest in defending its rights or legitimate interests, or to support claims resulting from or closely related to the conclusion or execution of the contract, or to exercise the right of defense in the event of litigious proceedings initiated against the company.

2. PROVISION OF PERSONAL DATA

You may refuse to provide certain Personal Data, but in such a case, you may not be able to benefit from certain specific services related to the relationship described in this Policy.

3. ABOUT THE LEGAL GROUNDS

The legal basis for processing varies depending on the specific situation and the Processed Personal Data.

In situations where we process your Personal Data based on consent, we will request your free, informed, specific, and unambiguous consent for that processing. By expressing your consent, you agree that we may collect, use, disclose, process, and transfer your Personal Data in accordance with this Policy.

4. SOURCE OF PERSONAL DATA

The source of the Personal Data is: the online customer.

5. AUTOMATED PROCESSING OF PERSONAL DATA

Your Personal Data will not be processed to generate decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22(1) of the GDPR.

6. PROCESSING DURATION

The processing duration of Personal Data varies depending on the specific processing operation:

In certain circumstances, we may retain Personal Data for longer periods to maintain an accurate record of your dealings with us in the event of any complaints or if we reasonably believe there is a prospect of litigation.

7. TRANSFER OF PERSONAL DATA

We may transfer Personal Data, to the extent necessary, to the following categories of recipients: IT service providers, payment service providers, courier service providers, accounting service providers, marketing service providers, and state authorities.

These recipients may be located in the European Union and/or the European Economic Area, as well as outside them, including in countries not recognized as ensuring an adequate level of protection, in which case the transfer of Personal Data is carried out only if there are adequate safeguards in accordance with applicable law (such as standard contractual clauses issued by the European Commission). You can request a list of recipients in third countries, as well as a copy of the agreed provisions ensuring an adequate level of protection for Personal Data.

8. SECURITY OF PERSONAL DATA

The security of your Personal Data is important to us. Therefore, your Personal Data will be processed by applying reasonable technical and organizational measures to protect it, such as limiting access to Personal Data, encrypting or anonymizing Personal Data, and storing it on secure media. However, despite our efforts, we cannot always guarantee the effectiveness of the implemented security measures, and therefore, we cannot guarantee the security of Personal Data at all times.

9. RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA

• Right of access: You have the right to obtain confirmation from us as to whether or not your Personal Data is being processed, as well as information regarding the specifics of the processing such as: purpose, categories of Processed Personal Data, their recipients, the retention period, their source, whether we transfer them abroad and how we protect them, your rights, and the right to lodge a complaint with the supervisory authority.

   

   

• Right to rectification: You may request the rectification of your Personal Data, provided the applicable legal requirements are met. In the event of errors, we will immediately correct your Personal Data upon notification.

• Right to erasure: In certain cases, you may request the deletion of your Personal Data, such as when: (i) they are no longer necessary for the purposes for which we collected and processed them; (ii) you have withdrawn your consent, and we can no longer process the Personal Data on other legal grounds; (iii) the Personal Data is processed unlawfully; (iv) you exercise a legal right to object. We are not obliged to comply with your deletion request if the processing of Personal Data is necessary for compliance with a legal obligation, or for the establishment, exercise, or defense of legal claims. There are also other circumstances in which we are not obliged to comply with a request to delete Personal Data.

• Restriction of processing: You may request that we restrict the processing of your Personal Data in the following situations: (i) you contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy of the data in question; (ii) the processing is unlawful, and you oppose the erasure of the Personal Data and request the restriction of their use instead; (iii) we no longer need the Personal Data for the purposes of processing, but they are required by you for the establishment, exercise, or defense of legal claims; (iv) you have objected to processing, pending the verification of whether our legitimate grounds as a controller override those of the data subject. We may continue to use the Personal Data following a restriction request if: (i) we have your consent; (ii) to establish, exercise, or defend legal claims; or (iii) to protect the rights of another natural or legal person.

• Right to data portability: To the extent that the Personal Data is processed based on your consent or for the execution of a contract, and the processing is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and you have the right to transmit this Personal Data to another controller. This right must not adversely affect the rights and freedoms of others.

• Right to object: In certain situations, such as when we process your Personal Data based on legitimate interest, you have the right to object to our processing of your Personal Data. In case of unjustified objection, LAUREALUXE TRAVELS S.R.L. is entitled to continue processing the Personal Data. You may also object to the processing of your Personal Data for the purpose of sending commercial messages.

• Withdrawal of consent: To the extent that we process your Personal Data based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.

• Automated individual decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply if the decision: (i) is necessary for entering into, or the performance of, a contract between you and us; (ii) is authorized by law that also lays down suitable measures to safeguard your rights and freedoms; (iii) is based on your explicit consent.

   

   

• Right to lodge a complaint with the supervisory authority: You have the right to file a complaint before the National Authority for the Supervision of Personal Data Processing (“ANSPDCP”) regarding any violation of your rights concerning the processing of your Personal Data. The contact details of the ANSPDCP are: 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, postal code 010336 Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.

To exercise the rights mentioned above, please contact us at the email address: laurealuxetravels@gmail.com.

10. CONTACT

If you have questions or concerns regarding this Policy or its implementation, you can contact us at the email address: info@lluxefruvino.com