Data Privacy Policy

This English translation is provided for information only. In case of any discrepancy, the Romanian version prevails.

1. Information on the collection of personal data

Under Article 4(1) GDPR, “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The policy of www.anvelopecalifornia.ro is to collect and process the minimum amount of personal data, limited to what is strictly necessary to offer you the most pleasant experience when you visit or shop on our website.

1.1. Data collected for placing the order and performing the contract

When you decide to purchase a product, the following personal data are requested in order to register and place the order:
• surname and first name;
• telephone number;
• e-mail address;
• billing address;
• delivery address;
• town/city;
• county.

We also collect indirect statistical data concerning shopping preferences and habits:
• interest in and preferences for the products presented;
• your level of use of and activities on the online shop platform;
• information about the products and services purchased.

The data collected by the data controller are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, this being one of the basic principles of the GDPR (Article 5(1)(c) – “data minimisation”). These personal data are collected for commercial purposes, in order to process the order, issue the invoice and dispatch the goods ordered. These data are absolutely necessary for the conclusion and performance of the contract itself; consequently, failure to provide them renders the contract invalid or, as the case may be, makes its performance impossible.

1.2. Data disclosed to third parties for commercial and/or legal purposes

The data required for commercial purposes are stored and processed by us and may be transmitted to third parties as part of the product ordering process, where this is absolutely essential for the ordering process. Accordingly, the personal data, together with the quantities of goods requested and the prices calculated, are recorded in the financial and accounting database as billing data and are kept on the company’s server. The billing data are transmitted to the courier company we work with for the purpose of dispatch and to the accounting firm for the preparation of accounting reports. The accounting documents relating to a financial year are archived for a period of 10 years in accordance with Accounting Law No. 82/1991 (Legea contabilității nr. 82/1991). For orders placed as part of a “purchase through a partner”, your billing data are sent to our partners, from whom the courier company collects the items according to your order for delivery. We assure you that all personal data transmitted to our partners are treated confidentially, the partners complying with the legal requirements when processing and using the data on the basis of the confidentiality clauses in the contracts concluded with us.

2. Purposes and legal basis of the processing

2.1. Purpose of the activities

The purpose of our data processing activities, unless stated or specified otherwise, is the pursuit of our own business purposes.
Access to the website www.anvelopecalifornia.ro is free and does not require you to log in. When you decide to purchase a product, a number of personal data collected for commercial purposes are requested in order to register and place the order; they are used to process the order, issue the invoice, receive confirmation of payment, dispatch the goods ordered by courier and manage the financial documents.
We also collect indirect statistical data concerning shopping preferences and habits:

• Interest in and preferences for the products presented;
• Your level of use of and activities on the online shop platform;
• Information about the products and services purchased;

2.2. Legal bases for the processing

We use different legal bases for processing data, as follows:
a) the data subject has given consent to the processing of his or her personal data for the purpose of purchasing goods (Article 6(1)(a) GDPR);
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR);
c) processing is necessary for compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) GDPR).

Further information on how the legal bases are implemented is included in Section 3.4 below.

2.3. Principles of data processing

The processing of personal data by the data controller is based on the principles of fairness and transparency towards the data subject, and the data are collected for specified, explicit and legitimate purposes and are not further processed in a manner that is incompatible with those purposes.
The data collected are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

2.4. Examples of data processed and legal bases

Purpose of collection and processing	Method of processing	Legal basis for the processing	Retention periods
Processing of orders placed through the online shop or by telephone	Electronic data registration form for issuing the invoice, completed by the data subject	Performance of the contract	10 years
Online payment for purchases	Transfer to the 3D Secure secure transaction platform, which involves redirecting the customer, at the time of payment, to a secure page where each cardholder is verified by means of an authorisation code assigned to each online transaction	Performance of the contract	10 years
Authorisation of online payments/transactions	Transmission of an electronic form in a secure application provided by the banks we work with, completed by the data controller www.anvelopecalifornia.ro	Performance of the contract	10 years
Delivery of the goods ordered by courier	Transmission of an electronic form in a secure application provided by the courier company we work with, completed by the data controller www.anvelopecalifornia.ro	Performance of the contract	10 years

3. Your rights and choices regarding the processing of personal data

3.1. Any request concerning the processing of personal data and your rights as a data subject

Any request concerning the processing of personal data and your rights as a data subject should be sent by post to the following address:
S.C. CALIFORNIA TYRES S.R.L.
Bd. Bucuresti nr. 42A, Baia Mare, Maramureș
Marked for the attention of: Personal Data Protection
or by e-mail to: sc.california@yahoo.com

3.2. Transparency of information (Article 12 GDPR)

You have the right to receive clear, transparent, easily understandable and easily accessible information about how we process your data, including details of your rights as a data subject. This information about the personal data, the purpose and the way in which we process your data is included in this Privacy Policy.
Before acting on any request concerning your rights, we will make sure that you are the owner of the data in respect of which you choose to exercise those rights; for this purpose, we may ask you for certain information/data to verify your identity, or we may ask for further details about your request. We may keep the correspondence we have with you in order to keep a record of the requests and responses concerning your rights.
The data controller provides the data subject with information on the action taken on a request under Articles 15 to 22 GDPR without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The data controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information is provided by electronic means where possible, unless otherwise requested by the data subject.
As a data subject, under Articles 15 to 22 GDPR, you have the rights described below.

3.3. Right to be informed (Articles 13–14 GDPR)

3.4. Right of access to data (Article 15 GDPR)

You have the right to obtain from the data controller confirmation as to whether or not personal data concerning you are being processed and, where that is the case, the right of access to those data. The data controller will provide a copy of the personal data undergoing processing free of charge. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. We reserve the right to refuse excessive or repeated and unjustified requests.

3.5. Right to rectification (Article 16 GDPR)

If you find that the data we process about you are incorrect, inaccurate or incomplete, you have the right to obtain from the data controller, without undue delay, the rectification or completion of the personal data concerning you, by means of a written request.

3.6. Right to erasure of data (Article 17 GDPR)

You have the right to ask us to erase your data in any of the following situations:
3.6.1. the personal data are no longer necessary for the purposes for which we previously processed them;
3.6.2. you withdraw the consent on which the processing of your data is based and there is no other legal ground for further processing;
3.6.3. you object to the processing of your data where we process the data for direct marketing purposes (including profiling for direct marketing purposes);
3.6.4. you object to processing of your data based on our legitimate interest and we cannot demonstrate that we have legitimate grounds for the processing which override your interests, rights and freedoms;
3.6.5. the personal data are processed unlawfully;
3.6.6. the personal data have to be erased in order to comply with our legal obligations.

This is not an absolute right. We may refuse your request for erasure of data if:
(i) we are required to comply with legal obligations to retain the data;
(ii) the data are necessary for the establishment, exercise or defence of our legal claims.
You may exercise this right in writing by submitting a request.

3.7. Right to restriction of processing (Article 18 GDPR)

You have the right to obtain from us restriction of the processing of your data in one of the situations described below. You may exercise this right in writing by submitting a request.
3.7.1. the accuracy of the data is contested by you (the data subject), for a period enabling us to verify the accuracy of the data;
3.7.2. the processing of the data is unlawful and you (the data subject) oppose the erasure of the data and request the restriction of their processing instead;
3.7.3. we no longer need your data, but you (the data subject) require them for the establishment, exercise or defence of legal claims;

3.8. Right to data portability (Article 20 GDPR)

Where we process your data on the basis of consent or the performance of a contract, and by automated means, you will have the right to ask us to transfer your data: (i) to you or (ii) to another data controller designated by you. The second situation means that you have the option of asking us to transmit your personal data to another data controller (e.g. to a controller that operates another online shop website). More specifically, you may only request the porting of the personal data that you have actively and directly provided to us (excluding any data derived or created/developed by anvelopecalifornia.ro, such as statistical data). You may exercise this right by sending a written request to the e-mail address: sc.california@yahoo.com. We will transmit the data you requested, as specified here, in a structured format that allows them to be reused (e.g. in XML, JSON or CSV format).

3.9. Right to object (Article 21 GDPR)

You have the right to ask us to erase your data in any of the following situations:
3.9.1. The right to object to direct marketing (including profiling for direct marketing purposes). You may object to and unsubscribe from our direct marketing communications at any time. You can do this easily by clicking the “unsubscribe” link in any e-mail sent to you. In addition, you may choose to withdraw the consent you previously gave for receiving personalised offers based on profiling through the same channels through which we send you these offers, namely e-mail, SMS or push notifications. The withdrawal of consent (by unsubscribing or by written request) does not affect the lawfulness of processing based on consent before its withdrawal.
3.9.2. The right to object to processing based on legitimate interest. You may object at any time to any data processing where we rely on our legitimate interest for such processing. You may exercise this right by submitting a written request.

3.10. Right to object to automated individual decision-making, including profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

3.11. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority (the National Supervisory Authority for Personal Data Processing, A.N.S.P.D.C.P.), in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the Regulation.
However, we hope that you will decide to talk to us first before lodging any complaint with the A.N.S.P.D.C.P. The protection of your data is very important to us and we will take all necessary measures to resolve any issue concerning the control and security of your data. You may also address any questions to the A.N.S.P.D.C.P., the data protection supervisory authority in Romania. You can find guides and guidelines on your rights on the authority’s website www.dataprotection.ro.

4. Protection of communications

To ensure adequate protection of your access to the website, our online shop uses the HTTPS protocol, which is the HTTP protocol encapsulated in an SSL/TLS stream that encrypts the data transmitted from a web browser to a web server, in order to provide encrypted and secure identification of the server. You can easily check this by looking for the padlock symbol followed by the word Secure in the browser’s address bar. When you access a site that uses HTTPS (a secure connection), the site’s server uses a certificate issued by a trusted organisation to prove the site’s identity to browsers.
If you have chosen to pay online by card, at the time of payment you will be redirected to a secure page where you will need to complete a form with your card details. This makes it impossible for your card details to be obtained by unauthorised persons when you make a payment. For online payments with credit/debit cards issued under the Visa and MasterCard (including Maestro) brands, the “3D Secure” system is used. The “3D Secure” system gives online transactions the same level of security as transactions carried out at a cash machine or in a bank branch. Regardless of the currency of your account, transactions are made in lei (RON), at your bank’s exchange rate. Card data are processed exclusively on Romcard’s servers, and anvelopecalifornia.ro does not request and will not store any data relating to the card you hold. We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of our customers’ personal information. These security measures include the fact that we may occasionally ask you to provide proof of your identity before disclosing personal information to you.
It is important that you protect yourself against unauthorised access to your password and your computer. If you share a computer with other people, you should make sure that you log out after each session.

5. Other questions and comments

Our company is constantly changing. Our Privacy Policy is reviewed and updated accordingly. We reserve the right to send you messages about our current practices from time to time. Nevertheless, you should visit our website regularly and take note of any changes.
Unless otherwise provided, the use of all the information we hold about you is governed by this Privacy Policy.

Width:	Width
Height:	Height
Rim size:	Rim size