Privacy Policy

Privacy Policy

We consider ensuring the right to the protection of personal data as a fundamental commitment of ATELIERHONIS.RO. Therefore, we will dedicate all necessary resources and efforts to process your data in full compliance with Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), as well as with any other applicable legislation in Romania.

Since one of the key principles of this legal framework is transparency, we have prepared this document to inform you about how we collect, use, transfer, and protect your personal data when you interact with us regarding our products and services, including through our website or mobile applications.

We reserve the right to periodically update and modify this Privacy Policy to reflect any changes in the way we process your personal data or any modifications to legal requirements. In the event of such changes, we will display the updated version of the Privacy Policy on our website, and we encourage you to check its content periodically.

Preamble

ATELIERHONIS.RO (hereinafter referred to as the "Data Controller") is a company incorporated and operating in Romania, whose main business activity is the sale of products through the ATELIERHONIS.RO website.

In this Privacy Policy, the terms "company," "we," "ours," etc., always refer to the Data Controller. The terms "you," "user," and "client" refer to the person who either accesses ATELIERHONIS.RO, creates an account, or purchases the products sold by the company.

The user will confirm that they have been informed about the Privacy Policy by checking a designated box on the website, under the "Contact" section. By submitting a request for an offer, the user grants consent for the use of their data for marketing purposes, which can be withdrawn at any time through the platform or the means by which the information is communicated.

The Data Controller is responsible for drafting this Privacy Policy, ensuring full compliance by all relevant parties, and monitoring and implementing any necessary modifications. The Data Controller may unilaterally modify this Privacy Policy at any time. Certain business processes and improvements may require an expansion of some data management objectives. The Data Controller is committed to complying with GDPR guidelines in every case that requires the processing of personal data. The Privacy Policy takes effect upon its publication.

The Data Controller grants every interested person the right to be informed, particularly about the purpose of personal data processing and, if possible, the duration of data processing, the recipients of personal data, and the logic behind automated data processing, as well as the consequences of data management and the information the Data Subject may receive. This right should not negatively impact the rights and freedoms of others, including trade secrets or intellectual property, especially concerning software protection. However, these considerations should not lead to the complete refusal of information by the Data Controller toward the Data Subject.

The explicit acceptance of this Privacy Policy through electronic means is voluntary, specific, and informative, and by doing so, you confirm that you have acknowledged the provisions of this Privacy Policy. Consent is given by the user by checking the appropriate box on the Data Controller’s website, freely expressed, and with the possibility of withdrawal at any time through the means provided by the Data Controller.

The Data Controller is committed to protecting the personal data of users, managing them confidentially, and taking all necessary technical and organizational measures to ensure data security.

The Data Controller processes personal data lawfully, fairly, and transparently for the Data Subject. Any data collection can only take place for a specific, explicit, and legitimate purpose, adequate and relevant to its purpose, and limited to what is necessary. When processing personal data, the Data Controller strives to ensure that the data is accurate and up to date and will take all reasonable measures to promptly delete or rectify any inaccurate personal data.

Given that the Data Controller is based in Romania, the protection provided concerning the processing of personal data regulated by this Privacy Policy is guaranteed by the competent national supervisory authority, the National Authority for the Supervision of Personal Data Processing (ANSPDCP).

To exercise your rights and obtain additional information regarding the processing of personal data, you have the possibility to contact the Data Protection Officer at the email address: contact@atelierhonis.ro. 

APPLICABLE LEGISLATION

The Data Controller declares that, at all times, it will process the personal data of any subject with whom it is not yet in a contractual relationship, as well as any contracted User, in accordance with the applicable legislation, in particular:

• European Union Regulation: General Data Protection Regulation of the European Union 2016/679/EU ("GDPR")
• The Constitution of Romania
• The New Civil Code updated in 2019 - Law 287/2009
• Law no. 365/2002 on electronic commerce
• Law no. 363/2007 on combating unfair commercial practices in relation to consumers and harmonizing regulations with European consumer protection legislation
• Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, with subsequent amendments and additions

CATEGORIES OF DATA WE PROCESS

Personal data is collected directly through ATELIERHONIS.RO, with data collection occurring at different stages, such as:

• When you submit a request for an offer to ATELIERHONIS.RO, you provide us with: your email address, full name, and phone number.
• We may also collect and subsequently process certain information regarding your behavior while visiting our website to personalize your online experience and provide you with offers tailored to your profile. We invite you to learn more about this by reviewing the section below on the purposes of processing.
• On our website, we may store and collect information through cookies and similar technologies, in accordance with our Cookie Policy.

We do not collect or otherwise process sensitive data, which the General Data Protection Regulation (GDPR) categorizes as special categories of personal data. Additionally, we do not intend to collect or process data from minors under the age of 16.

TYPES OF DATA COLLECTED, PURPOSES, AND LEGAL BASES FOR PROCESSING

1. For the Provision of ATELIERHONIS.RO Services 

2. For the Improvement of Our Services 

We may collect and use certain information regarding your purchasing behavior, invite you to complete satisfaction surveys after an order has been completed, or conduct market studies and research, either directly or with the help of partners. 

3. For Marketing Activities 

For promoting the marketed products, expanding the visibility of ATELIERHONIS.RO, and informing you about marketing campaigns, we collect and use the following types of data. 

You can change your mind and withdraw your consent at any time by:

• Accessing the unsubscribe link displayed in the messages you receive from us; or
• Contacting ATELIERHONIS.RO using the contact details provided above.

You can request at any time, through the means described above, that we stop processing your personal data for marketing purposes, and we will comply with your request.

We will ask for your consent before processing your personal data for direct marketing purposes. In this case, please note that you may withdraw your consent for marketing processing at any time, in which case you will no longer receive any marketing communications from us. We will include an unsubscribe link that you can use if you no longer wish to receive messages from us.

4. For the Protection of Interests and Compliance with Legal Provisions 

There may be situations where we use or share information to protect our rights and business activities. These may include:

• Measures to protect the website and ATELIERHONIS.RO platform users from cyber-attacks;
• Measures to prevent and detect fraud attempts, including the transmission of certain information to the competent public authorities;
• Measures to manage various other risks.

The general legal basis for these types of processing is our legitimate interest in protecting our business activities, as well as complying with legal obligations under applicable laws. We ensure that all measures taken maintain a balance between our interests and your fundamental rights and freedoms.

How Long We Retain Your Personal Data

As a general rule, we will store your personal data provided for the creation and use of your ATELIERHONIS.RO account (email, full name, phone number) for a period of one year from the last submitted offer request.

You may request the deletion of certain information or the closure of your account at any time, and we will comply with these requests, subject to the retention of certain information when required by applicable legislation or our legitimate interests. This exception may apply in cases where the information is necessary for defending our rights in court, before competent authorities, or in other situations where the protection of our interests is required. In such cases, the data will be retained until the final resolution of legal proceedings.

We continuously review the necessity of retaining your personal data, and if processing is no longer necessary and there is no legal obligation to retain the data, we will destroy your personal data as soon as possible in a manner that prevents it from being recovered or reconstructed.

• If personal information is printed on paper, it will be securely destroyed to ensure that it cannot be reconstructed.
• If personal information is stored electronically, it will be deleted using technical means that ensure the data cannot be recovered or reconstructed

Billing-related data (address, client name, etc.) and accounting records are retained for a period of 10 years in accordance with applicable legislation, as this is a legal obligation of the company.

The processing and storage of other types of personal data will not exceed 3 years.

TRANSMISSION OF PERSONAL DATA

For the purpose of conducting business activities and fulfilling the objectives described above, we may, as necessary, transmit or grant access to certain personal data to the following categories of recipients:

• Companies within the same corporate group as ATELIERHONIS.RO;
• ATELIERHONIS.RO partners;
• Marketing / telemarketing service providers;
• Market research service providers;
• IT service providers;
• Other companies with whom we may develop joint programs for offering our products and services on the market.

If we have a legal obligation or if it is necessary to protect a legitimate interest, we may also disclose certain personal data to public authorities.

We ensure that third-party private legal entities access your data in compliance with legal provisions regarding data protection and information confidentiality, based on contracts concluded with them.

The confidentiality of your data is important to us, which is why, whenever possible, the transmission of personal data as described above is carried out only on the basis of a confidentiality commitment from the recipients. This ensures that the data is kept secure and that its disclosure is done in compliance with applicable legislation and policies.

In any case, we will always transmit only the strictly necessary information to recipients for the fulfillment of the specific purpose.

TRANSFER OF DATA TO OTHER COUNTRIES

Currently, we store and process your personal data within the territory of Romania.

However, we may transfer certain personal data to entities located within the European Union (EU) or the European Economic Area (EEA).

We will always take measures to ensure that any international transfer of personal data is carefully managed to protect your rights and interests. Transfers to service providers and other third parties will always be safeguarded by contractual commitments and, where applicable, by additional safeguards such as the Standard Contractual Clauses (SCCs) issued by the European Commission or certification schemes, such as the Privacy Shield for the protection of personal data transferred from the EU to the United States.

You may contact us at any time using the contact details provided above to learn more about the countries to which we transfer your data, as well as the safeguards we have implemented regarding these transfers.

SECURITY OF PERSONAL DATA

We are committed to ensuring the security of personal data by implementing appropriate technical and organizational measures, as outlined in our internal privacy policies and in accordance with industry standards.

The transmission of your personal data is carried out using state-of-the-art encryption algorithms, and we store the data on secure servers, ensuring data redundancy at the same time.

Despite the measures taken to protect your personal data, please be aware that transmitting information over the Internet or through other public networks is not completely secure, and there is a risk that data may be accessed and used by unauthorized third parties. We cannot be held responsible for such vulnerabilities in systems that are beyond our control.

YOUR RIGHTS REGARDING DATA PROCESSING

The General Data Protection Regulation (GDPR) grants you a series of rights regarding your personal data. According to the Regulation, you have the following rights:

(a) The right to be informed about the processing of your data.

(b) The Right of Access to Data

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and if so, access to that data and the information provided in Article 15 (1) of the GDPR.

(c) The Right to Rectify Inaccurate or Incomplete Data

You have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you.

(d) The Right to Erasure ("Right to Be Forgotten")

In the situations provided under Article 17 of the GDPR, you have the right to request and obtain the deletion of your personal data.

(e) The Right to Restrict Processing

In the cases provided under Article 18 of the GDPR, you have the right to request and obtain the restriction of processing.

(f) The Right to Data Portability

You have the right to request the transfer of your personal data to another data controller ("Right to Portability").

(g) The Right to Object to Data Processing

In the cases provided under Article 21 of the GDPR, you have the right to object to the processing of your data.

(h) The Right Not to Be Subject to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects concerning you.

(i) The Right to Seek Legal Action to Protect Your Rights and Interests

You have the right to address a court of law for the protection of your rights and interests.

(j) The Right to Lodge a Complaint with a Supervisory Authority

The contact details of the supervisory authority are provided below:

To exercise your rights, you can contact us using the contact details provided, namely contact@atelierhonis.ro or at the company's registered office.

Requests based on the exercise of rights provided under Articles 15-21 of the GDPR must be made in writing, ensuring compliance with the provisions of the GDPR can be verified.

Please Note the Following If You Wish to Exercise These Rights:

Identity Verification

We take the confidentiality of all records containing personal data seriously. For this reason, we kindly ask you to submit your requests regarding such records using the email address you used to submit your offer request. Otherwise, we reserve the right to verify your identity by requesting additional information to confirm your identity.

Fees

We will not charge a fee for exercising your rights regarding your personal data, unless your request for access to information is unfounded, repetitive, or excessive. In such cases, we will charge a reasonable fee under the given circumstances. We will inform you of any applicable fees before processing your request.

Response Time

We aim to respond to any valid request within a maximum of one month, except in cases where the request is particularly complex or if you have submitted multiple requests, in which case we will respond within a maximum of two months. We will notify you if we require more than one month to respond.

We may ask you to clarify what information you wish to receive or what specifically concerns you. This will help us process your request faster and reduce the response time.

Third-Party Rights

We are not required to comply with a request if doing so would negatively impact the rights and freedoms of other data subjects.

Powered by Froala Editor