Your personal data is collected by HEIDI CHOCOLAT S.A., a Romanian legal entity, company registration number (CUI) 6161022, with its registered office in Pantelimon, 125–127 Biruinței Boulevard, Ilfov County, registered with the Trade Register under no. J23/635/09.04.2002, tax registration number RO6161022, hereinafter referred to as HEIDI CHOCOLAT. Under the applicable legislation, we act as a data controller when we collect and process our customers’ personal data.

 

Your data is processed in full compliance with Regulation (EU) 679/2016 (the General Data Protection Regulation, or GDPR), as well as any other legislation applicable in Romania.

 

This document provides transparent and comprehensive information about the collection, use and protection of your personal data when you entrust it to us in connection with our products and services, and about your rights in relation to your personal data.

 

HEIDI CHOCOLAT S.A. reserves the right to periodically update and amend this notice in response to changes in how we process the data collected or changes in legislation. The amended content will be published on the website as soon as possible; therefore, we ask you to review it periodically.

 

For any further information, you can contact us at office@heidi-chocolate.com or by post or courier at 125–127 Biruinței Boulevard, Pantelimon, Ilfov County.

 

Categories of personal data we request/process

 

We collect data directly from our customers:

 

• When you wish to place an order directly or online: first name, last name, mobile phone number, email address, residential address – street, number, city, county (required for invoicing); if delivery is to a different address and recipient: first name, last name, delivery address – street, number, city, county, and recipient’s telephone number; payment method; company details (if you require an invoice issued to a company); bank card details if you wish to pay by card (payment processing by NETOPIA Payments).
• When you opt to receive marketing communications/commercial information: first name, last name, email address and mobile phone number.
• When you wish to enrol in our customer loyalty programme: first name, last name, mobile phone number, email address, residential address and date of birth.
• When you send us a message through the “Contact” section of shop.heidichocolate.com: name, email address and message. The data you enter in the contact form is processed on the basis of our legitimate interest in responding to your request and keeping records of requests, complaints, etc.
• When you contact us as an employee of a supplier or corporate customer: first name, last name, employer, department, job title, business address, business telephone number, and the content of messages sent to and received from employees.

 

We also collect and subsequently process certain information about your behaviour while accessing shop.heidichocolate.com in order to personalise your online experience and the offers sent to you. These matters are explained in detail in the section on the purposes of processing. This information is stored in cookies and similar technologies, in accordance with the Cookie Policy. This policy applies to all devices used to access shop.heidichocolate.com. If you do not agree to the terms and conditions governing their use, please do not use shop.heidichocolate.com.

 

We do not collect or process the data provided in any other way than as specified, and we do not intend to collect data from minors under the age of 18. Minors under the age of 16 may not request purchasing services or any communications on shop.heidichocolate.com, or participate in contests or campaigns, unless these activities are carried out on the minor’s behalf by their legal representative or guardian, in accordance with Article 8 of the Regulation.

Any person who provides us with personal data through the website, other applications or devices, or in writing, within the scope of this Personal Data Processing Policy, warrants that they are of legal age and have full legal capacity.

Any collection or processing of minors’ personal data will be carried out only in accordance with the law and subject to the provisions above.

 

We store and process your personal data within Romania.

 

In addition to shop.heidichocolate.com, we collect and process a limited number of categories of personal data when you use our Facebook and Instagram pages.

When you interact with our pages, we have access to the following personal data, some of which becomes visible when you choose to subscribe, follow us or interact with the content on our pages:

• If you post a message on a page, we can access your public profile and the content of the message.
• If you send a private message to a page, we can access your public profile and the content of the message. If you interact with page content (like, share), we can access your public profile and the reaction you selected.

 

When selecting the audience for social media posts or campaigns, we also set interest categories that may include you. These categories are provided directly by Facebook/Instagram, without giving us access to personal details or data.

 

This data is used on the basis of our legitimate interest in promoting our name or products and in keeping evidence of our correspondence with you. The data is retained for as long as our pages remain active. We use the data to send you direct marketing communications only if you opt in to receive them, and we provide a simple unsubscribe option at any time.

 

Purposes of data processing

We use your personal data exclusively for the purposes set out below. a. Providing the requested services

• Processing orders – receiving, validating, dispatching and invoicing them.
• Handling cancellations or any other matters relating to an order.
• Returning products in accordance with applicable law.
• Refunding the value of products in accordance with applicable law.
• Responding to customers’ requests concerning orders or the products offered, and correctly carrying out the operations required for tax and accounting purposes.

 

b. Marketing

Commercial communications relating to the products we offer, promotions and campaigns, sent to the email address/telephone number provided if you opt to receive them or if you are a member of the loyalty programme.

When sending these communications, we may use certain data relating to your purchasing behaviour (order history, products viewed, etc.). This processing is carried out while respecting your rights and freedoms.

You may request at any time that such communications stop by emailing office@heidichocolate.com.

 

c. Improving our services

• Short surveys about the shopping experience, the products we distribute, or requests for feedback.

We want your interaction with us to be a pleasant experience. To achieve this, we collect a limited amount of information about your purchasing behaviour (such as order history), on the basis of our legitimate interest in conducting business activities, while ensuring that your fundamental rights and freedoms are not affected.

• Store opening hours and general information.

 

4. From time to time, we may need to use or send information to protect our rights and business activities (for example, measures to prevent attempted fraud and manage risks).

 

5. When collecting data from representatives of suppliers or corporate customers, we collect and use personal data for the purpose of performing the contract with them. Data may be collected and used when selecting suppliers, through electronic communications, order processing, payments, correspondence, retaining contact details in our database, or video recording when you visit our stores.

 

How long we retain this personal data

 

The period for which your personal data is processed in our sales platform and related management software will generally be determined by when you exercise your right to object under Article 21 of European Regulation No. 679/2016. (Exception: for data provided through a Call Centre service, the processing period is generally 3 years or until the right to object is exercised.)

You may request the full or partial deletion or amendment of your data at any time by emailing office@heidichocolate.com, subject to retaining certain necessary information, such as data included in financial and accounting documents (national law requires such data to be retained for up to 10 years from the date they are created), for evidentiary and archiving purposes.

Personal data may also be stored for a longer period for compiling statistics, improving services, administering customer accounts, research or market studies.

 

Who we share your personal data with

 

We may provide access to certain data to:

• courier service providers;
• banking/online payment service providers;
• marketing/telemarketing service providers, media agencies and infrastructure providers (third parties that may manage newsletters, SMS marketing or other forms of marketing);
• insurance companies;
• IT service and system providers;
• other companies with which we develop joint campaigns to promote our products;
• public authorities where required by law or pursuant to a legal request, as well as accountants, auditors, lawyers and external advisers where their work requires them to know your data or where we are legally required to disclose such information.

 

Where we need to give access to your data to third-party legal entities, we ensure that contracts are in place with them in accordance with the legal requirements on data protection and confidentiality, and that data is disclosed only for the purposes specified and to the third parties listed above.

 

We may also disclose your information to third parties if you ask us to do so and give your consent, to persons who can demonstrate that they are legally entitled to act on your behalf, or where it is in our legitimate interest to do so in order to expand and develop our business, protect our rights or a person’s safety, respond to claims, or prevent illegal activity.

 

Third parties accessing your information are restricted by law and contract as to how they may use it. We always ensure that third parties are subject to confidentiality obligations, except where the sharing is not determined by us. Except in the cases described above, we will not share, sell or lend your data to a third party without informing you or obtaining your prior consent.

 

How we protect the security of your data

 

We implement appropriate technical and organisational measures to ensure the security of our customers’ data.

Your personal data is transmitted using state-of-the-art encryption algorithms and stored on secure servers, while data redundancy is also ensured.

We use NETOPIA Payments as our payment processor. All payment-related information is encrypted using HTTPS technology with TLS 1.2 encryption.

Please note that we are not responsible for vulnerabilities that arise from the transmission of information over the Internet in general or through systems outside our control, where there is a risk that data may be viewed or used by unauthorised third parties.

 

What rights do you have?

 

a. The right to access your personal data (under Article 15 of the Regulation):

• confirmation as to whether your personal data is being processed;
• provision of a copy of your data;
• information about your data: what data we hold, how we use it, with whom we share it, whether we transfer it abroad and how we protect it, how long we retain it, what rights you have, how you can lodge a complaint, and the source from which we collected it, insofar as this information has not already been provided in this notice.

 

b. The right to rectification of inaccurate data (under Article 16 of the Regulation):

rectification, amendment or completion of inaccurate or incomplete personal data. We make reasonable efforts to keep personal data complete and up to date; such changes will be made after verifying the accuracy of the new data.

 

c. The right to restriction of processing (under Article 18 of the Regulation):

• if you contest the accuracy of the data, for the period needed to verify its accuracy;
• if the processing is unlawful but you do not want the data to be erased;
• if we no longer need your data, but you need it to establish, exercise or defend legal claims;
• if you have exercised your right to object and an assessment of whether our legitimate grounds override your objection is ongoing.

Following a request to restrict processing, we may continue to use your personal data if we have your consent; to establish, exercise or defend a legal claim in court; or to protect the rights of the company or another natural or legal person.

 

d. The right to erasure of personal data (the right to be forgotten – under Article 17 of the Regulation). We must comply with your request for erasure if:

• the data is no longer necessary for the purposes for which it was collected;
• you object to its processing on personal grounds;
• the data has been processed unlawfully;
• you withdraw your consent (where processing was based on consent) – as the data controller, we have a legal obligation to act accordingly.

 

There are certain specific situations in which we cannot comply with a request for erasure:

• processing is necessary to comply with a legal obligation to which we are subject;
• to exercise the right to freedom of expression and information;
• to establish, exercise or defend legal claims in court;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes.

 

5. e. The right to object (under Article 21 of the Regulation)

You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interest if you consider that your fundamental rights and freedoms override that interest.

You may also object at any time to the processing of your data for direct marketing purposes (including profiling), without giving any reason. In that case, we will stop this processing as soon as possible.

 

6. f. Lodging complaints with the competent supervisory authority (under Article 77 of the Regulation). You have the right to lodge a complaint with the supervisory authority regarding the processing of your personal data. In Romania, the contact details of the data protection supervisory authority are:

National Supervisory Authority for Personal Data Processing

28–30 General Gheorghe Magheru Boulevard, Sector 1, postal code 010336, Bucharest, Romania

Telephone: +40.318.059.211 or +40.318.059.212

Email: anspdcp@dataprotection.ro

 

Without prejudice to your right to contact the supervisory authority at any time, we ask you to contact us first. We assure you that we will make every effort to resolve any issue amicably.

 

7. g. The right to data portability (under Article 20 of the Regulation)

You may ask us to provide your data in a structured, commonly used and machine-readable format, or request that it be transferred directly to another data controller. This right may be exercised if all of the following conditions are met:

• we process the data by automated means;
• the processing is based on your consent or on entering into or performing a contract with you;
• the data was provided by you;
• the transfer of the data does not adversely affect the rights and freedoms of other people.

 

8. h. The right not to be subject to an individual decision based solely on automated processing, including profiling (under Article 22 of the Regulation)

You may request not to be subject to a decision based solely on automated processing, but only where that decision produces legal effects concerning you or similarly significantly affects you.

This right does not apply where the decision resulting from automated decision-making is necessary for entering into or performing a contract with you, is authorised by law and subject to appropriate safeguards for your rights and freedoms, or is based on your explicit consent.

 

1. i. The right to be informed about the processing of personal data (under Articles 13 and 14 of the Regulation).

 

10. j. The right to bring legal proceedings where violations of the relevant legislation have been established (under Articles 78 and 79 of the Regulation).

 

By reading this Policy, you acknowledge that all the rights provided for in the Regulation are guaranteed to you.

 

You may object to the processing of your personal data at any time by sending HEIDI CHOCOLAT S.A. a written, dated and signed request by email to office@heidi-chocolate.com or by post to: 125–127 Biruinței Boulevard, Pantelimon, Ilfov County. Your request will be forwarded to the designated person, and you will receive confirmation that your choice has been implemented, along with any other necessary information, as applicable.