Personal data processing policy

The requirements for processing personal data are complied with within VENDING ZONE SRL (hereinafter referred to as “Vending”) in accordance with the security provisions for personal data processing indicated in Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”).

Both between the moment of establishing the means of processing and during the processing itself, Vending implements appropriate technical and organizational measures to guarantee and be able to demonstrate that the processing is carried out in compliance with the applicable legal provisions.

Vending takes all necessary measures to ensure that, by default, only personal data strictly necessary for each specific purpose of the processing are processed.

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

1. Description

Our personal data processing policy describes the way in which we will collect and process the personal data of customers, business partners, potential customers, potential employees, potential collaborators and applies to all personal data collected on our website, as well as all personal data that we collect via email or any other means of communication through which this data will be processed.

We may also collect information about your preferences through the use of the aforementioned website, when you request information from us or engage our legal or other services or as a result of the relationship you have with us or with one or more of our clients.

2. GDPR Principles

Whenever we process personal data, we will take into account the following principles:
– Lawfulness, fairness and transparency – your personal data will be processed “lawfully, fairly and transparently”;
– Purpose limitation – your data will be collected for specified, explicit and legitimate purposes, and further processing of the data will not deviate from these purposes;
– Data minimization – any collection of personal data will be very carefully analyzed before the actual request for the data to be processed, which will be relevant and strictly limited to what is absolutely necessary for the purposes for which they are processed;
– Accuracy of information – operators must take all measures to ensure the validity of the data, and those proven inaccurate must be updated without delay or deleted;
– Storage limitation – data must be kept exclusively for the period for which it is necessary for the assumed processing. Longer storage periods are exceptions associated with public archiving, research or statistical activities, which may take place under certain conditions;
– Integrity and confidentiality – personal data processing must be carried out in secure conditions, which include “protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures”.

3. Rights

Vending ensures compliance with the rights conferred on data subjects under the GDPR, including:
– right of access – will allow obtaining details relevant to the processing of personal data;
– the right to rectification – will allow the rectification of your personal data, if they have been incorrectly processed;
– the right to be forgotten – will allow the deletion of your personal data in certain cases (for example, if the data is no longernt necessary in relation to the purposes for which they were collected);
– the right to restriction of data processing – allows you to obtain restriction of the processing of your personal data in certain cases (for example, when you contest the accuracy of your personal data, for a period that allows us to verify such accuracy);
– the right to object – allows you to oppose the further processing of your personal data under the conditions and limits established by law;
– the right to data portability – allows you to receive the personal data concerning you that you have provided to us, in a structured, commonly used electronic format or to transmit these data to another data controller.

4. Processing

4.1 Purposes and processing of personal data based on consent
We process personal data for the development of our services, to provide contact persons with information about us and our range of services and facilities. Of course, we also use it to make personal data available to members of the Vending team for the purpose of providing contracted services and offering new services and facilities, as well as for the purpose of honoring promises made and (non-contractual) commitments assumed.
We also collect personal data for recruitment purposes, only on the basis of consent.

4.2 Legal basis for processing personal data
We process the personal data of contact persons based on consent, the contract concluded with us or usage, as well as for the execution of our legal obligations.

4.3 Data retention
Personal data will be retained by us only as long as necessary for the purposes of processing, as well as, of course, according to legal or contractual requirements.

4.4 Security of personal data processing
Our security measures, both technical and organizational, protect both our information and information about contacts, personal data and other important data. The concern for detecting, investigating and resolving security threats is permanent. We allocate significant logistical and financial resources in this regard.

4.5 Disclosure of personal data
As a rule, your personal data will not be disclosed to third parties. However, if it is in your interest and necessary, we will disclose relevant personal data to courts and arbitration boards or relevant authorities, in the context of providing the services you have requested.

4.6 Duration of storage of personal data
Your personal data will be stored for the period of validity of the consent, as well as thereafter, in accordance with our internal policies and legal obligations to which we are subject.

In the event that the data is not stored on the basis of a contractual relationship, these data will be kept for as long as necessary to achieve the purpose of their processing.

5. Miscellaneous

This privacy policy may be updated from time to time. On the day the update is made, a pop-up window will appear on the Vending website containing the link that will send you to the changes to the data protection policy.

We also inform you that you have the right to file a complaint with the National Data Protection Supervisory Authority of Romania, if you consider that the processing of your personal data violates applicable laws.