Privacy Policy

1. WHO WE ARE?

   GEOMIR CONSULTING S.R.L. (hereinafter referred to as the "the Controller") places significant importance on your personal data, consistently exercising the diligence necessary to ensure that its data processing activities comply with the legal requirements in this field. To this end, we have drawn up this commitment, whereby we undertake to respect the confidentiality of your personal data, and through which we explain to you what categories of personal data the Controller processes, how such data are used, and the purposes for which they are subject to processing operations.

   This Policy relates only to the personal data that we process through our website www.zorelia.com (hereinafter referred to as the "the Site" or "the Platform") in the context of your interaction with it by filling in the forms available, placing an order, subscribing to the newsletter, or simply browsing it, or in the event that you contact our staff by telephone, whether inbound or outbound calls.

   We want to assure you that we have taken all necessary measures to guarantee the confidentiality of your data, which is processed only by the Controller's staff, who have been previously trained on the processing of personal data, are duly authorized for this purpose, and are bound by strict confidentiality commitments.

   In order to "get to know" us virtually, we provide you with our identification details below.

   The Controller processing your personal data when you browse or interact with the online platform www.zorelia.com is GEOMIR CONSULTING S.R.L., with its registered office at Prelungirea Ghencea no. 45, Building C3, 5th Floor, Apartment 79, Bragadiru, Ilfov, registered with the Trade Registry under no. J2016003788234, having Tax ID (CUI) 36547980.

   For any questions/clarifications regarding the protection of personal data, you are invited to send a request to the postal address indicated above or to the email address hello@zorelia.com. Persons submitting such requests to the Controller are asked to mention in the subject line of the email/on the correspondence envelope information such as "data protection", "GDPR" or "personal data", so as to guarantee that requests will be handled as a priority.

   In this capacity, you will receive a response within a maximum of 30 days from the date the document is communicated to the Controller; an extension of this period may only occur in exceptional circumstances. In such cases, we assure you that you will be duly informed of this extended period.

2. DEFINITIONS

   • By "personal data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity.

   ! For the purposes of this policy, the personal data subject to processing may relate to: first name, last name, phone number, email address, order delivery and billing address, etc., as further described below.

   • By "the processing of personal data" means any operation or set of operations performed on personal data, whether by automated or non-automated means, such as: collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure to third parties by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure, or destruction.

   ! For the purposes of this policy, data processing refers to the processing carried out when you browse the website www.zorelia.com or interact with it by completing the forms available on the Platform, or in the context of placing orders for products from the Controller's portfolio.

   • "Controller" means the person who, alone or jointly with others, determines the purposes and means of processing personal data.

   ! For clarity, for the purposes of this Privacy Policy, the personal data Controller is GEOMIR CONSULTING S.R.L.

   • "Data subject" means the person whose personal data are subject to processing.

   ! For the purposes of this Policy, the data subject is the internet user who browses the website www.zorelia.com or places an order through it.

   • By "consent" of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, agree to the processing of personal data relating to them.
   • "Third party" means a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or processor, are authorized to process personal data.
   • "Processor" means the person who processes personal data on behalf of the controller. This may include the Controller's partner companies, such as companies providing courier, IT, legal, marketing, and similar services.

3. 3. WHAT TYPES OF PERSONAL DATA DO WE PROCESS?

   Your browsing of and interaction with the Site involves the processing of two categories of personal data, namely:

   1. personal data that you voluntarily disclose to the Controller (e.g., through the order form, when subscribing to the newsletter, or by making phone calls to the Controller), which is collected on an individual basis;
   2. data that you provide involuntarily, simply by browsing our website.

   Based on the voluntary provision by the data subject, the Controller collects the following personal data:

   1. When placing an order:
      • first and last name;
      • phone number;
      • email address;
      • residential/home address, for delivery of the ordered product;
      • billing address, when different from the delivery address.

      Note: For payments made by bank card, the Controller uses the services of an online payment processor. In this case, your data will not be processed by the Controller, as the payment activity falls under the requirements set out in the payment processors' privacy policy. When you choose to pay by bank card, you will be redirected to the online payment processor's payment platform, where the card transaction is carried out in complete safety. For more information regarding the specific data processing carried out by the processors, we invite you to consult their privacy policies.

      We also collect and process the data resulting from orders placed and transactions carried out in our relationship with you.

      You may provide us with additional personal data when you contact us through any means of communication (e.g., requests sent by email, through the Website interface, or by telephone).

   2. In the context of returning ordered products:
      • first and last name;
      • phone number;
      • email address;
      • residential/home address for collection of the package;
      • bank account (for refunding the amount paid, i.e., the value of the returned product]);
      • information about the order placed and to be returned (product ordered/product ID, order date, order amount, etc.), where applicable;
      • any other information you provide to the Controller in the context of the return.
   3. For contacting the Controller via email:
      • first and last name;
      • email address;
      • phone number;
      • any other information you provide to the Controller in the body of the email sent.
   4. For subscribing to the newsletter

      Subscribing to the newsletter is conditional on your giving consent for the purpose of receiving commercial and marketing messages. In this context, your email address will be processed as personal data, as well as, indirectly, your first and last name (if this can be derived from an email address in the format firstname.lastname@x.ro).

      This data contributes to the provision of the services offered, as well as to communication with the Controller or the sending of marketing communications by the Controller, but only after obtaining the user's prior consent, as detailed in the Newsletter Policy.

      The user is duly informed about the processing of personal data when providing their data to the Controller through the forms available on the site, thereby fulfilling the Controller's legal obligation to inform the user.

   5. In the context of inbound/outbound telephone calls
      • voice;
      • the phone number;
      • any other information communicated by the data subject during the call.

   The Controller also processes marketing and communication data only on the basis of users' prior consent, as well as technical data and browsing activity through cookies and similar technologies, in accordance with the Cookie Policy.

   Should you provide us with personal data that is not necessary for the purposes described below, namely for fulfilling placed orders, resolving your complaints, or providing additional information, we reserve the right to promptly remove such data from our database.

   Your personal data may be disclosed by the Controller, for processing purposes, to processors, including contractual partners, authorities and financial institutions, courts, or competent bodies, at their request and for the purpose of providing the products offered by the Controller.

   We also use cookies and similar technologies to recognize you and your devices. The way we use these technologies is described in the Cookie Policy.

   The Controller may store your personal data even after a request for erasure of such data has been registered, if the storage is carried out for one of the following purposes, as set out in Article 17 of the GDPR:

   1. performance of a contract;
   2. compliance with a legal obligation requiring processing under European Union law or under the domestic law applicable to the controller;
   3. exercising the right to freedom of expression and information;
   4. protecting the vital interests of data subjects;
   5. performing a task carried out in the public interest;
   6. archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
   7. establishing, exercising, or defending the legitimate interests of the Controller or of a third party, except where the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data prevail, in particular where the data subject is a child;
   8. the establishment, exercise, or defense of a legal claim.

4. FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS DO WE PROCESS PERSONAL DATA?

   The Controller processes your personal data for the following purposes and on the following legal grounds:

   1. the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) of Regulation (EU) 2016/679, hereinafter referred to as the "GDPR"], specifically:
      • to ensure the data subject's access to the products sold on the Platform www.zorelia.com through the creation of an account and the conclusion of a distance sale;
   2. the processing is carried out on the basis of the consent of data subjects [Article 6(1)(a) of the GDPR], in the case of:
      • sending commercial and marketing communications;
      • analyzing customer interaction with the company in order to provide personalized offers and optimize our activity (in the case of advanced marketing analyses);
      • analyses and statistics regarding the functioning of the site, cookies and similar technologies, for connecting via social networks, and for accepting cookies other than the necessary (essential) ones;
   3. the processing is necessary for the purposes of the legitimate interests pursued by the Controller [Article 6(1)(f) of the GDPR], for resolving issues of any nature regarding the content of the website www.zorelia.com or the products offered by the Controller, for managing relationships with platform users, for analyzing customer interaction with the company in order to provide personalized offers and optimize our activity, and for analyses and statistics regarding the functioning of the site, cookies, and similar technologies;
   4. the processing is necessary for the fulfillment of a legal obligation (for example, tax obligations) incumbent upon the Controller – Article 6(1)(c) of the GDPR; operations relating to invoicing of purchased products; payment of relevant taxes and contributions and reporting to the relevant tax authorities and keeping accounting records; archiving of data in accordance with applicable legislation.

   Therefore, your personal data will be processed so that the Controller may:

   1. improve the site and the services provided through it;
   2. determine the usefulness/popularity of the web content presented on the site;
   3. send technical, support, or administrative notifications;
   4. fulfill requests and resolve complaints received from users;
   5. facilitate user access to the services offered by the Controller;
   6. communicate information of interest to the site's users;
   7. protect the rights belonging to the Controller.

5. DURATION OF PERSONAL DATA PROCESSING

   We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with our internal data retention procedures, including applicable archiving rules.

   In general, Customers' data is retained for as long as they have an active Account.

   Customers may request the deactivation of their Account and the deletion of their personal data at any time.

   Certain personal data of Customers may be retained for the entire period required by law for the archiving and retention of financial-accounting documents.

   Data relating to cookies and similar technologies is retained in accordance with the specific terms set for those technologies, with the storage period ranging from the duration of the browsing session to up to 2 years.

   Personal data processed by the Controller through the website www.zorelia.com is retained for a reasonable period relative to the purpose of the data processing, in accordance with the legal provisions on data archiving.

   For example, if you are a customer of the Controller, the Controller will process your data for the entire duration of the contractual relationship and thereafter, in accordance with the legal obligations incumbent upon the Controller. For instance, in the case of supporting financial-accounting documents, these are archived by the Controller in accordance with the law for a period of 5 years from their issuance.

   With regard to the email address provided for the purpose of subscribing to the newsletter, the Controller will process this personal data only for as long as the consent given remains valid, and will remove it from its databases upon withdrawal of consent given for direct marketing.

   Finally, any other categories of personal data not mentioned above will be retained for the period necessary to fulfill the purpose for which they were processed, subject to the general 3-year limitation period for their deletion.

6. TRANSFER OF PERSONAL DATA. DATA RECIPIENTS

   Your data is processed within the territory of the European Union, through secure internal servers.

   However, through specific social network plugins (for example, Instagram), acting as third-party recipients of data, it is possible that your data processed in this context may be transferred outside the European Union/European Economic Area and stored on servers in third countries.

7. LINKS, HYPERLINKS, THIRD-PARTY SITES

   The website www.zorelia.com may contain links to third-party sites, which may in turn collect your personal data, including through cookies or other similar technologies.

   If you connect to a third-party website, the Controller's privacy policy will not apply to your browsing of that site.

8. WHAT RIGHTS DO YOU HAVE AS A DATA SUBJECT?

   Any natural person browsing our website, as a data subject, has the following rights in relation to the personal data Controller:

   • The right of access means the data subject's right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, access to that data and to information about how the data is processed;
   • The right to rectification refers to the correction, without undue delay, of inaccurate personal data being processed, or the completion of such data, where it is incomplete. This can be done by sending an email to the address: hello@zorelia.com;
   • The right to erasure of data/the right to deletion ("the right to be forgotten") from the database means the data subject's right to request the erasure of their personal data, without undue delay, where one of the following grounds applies: the data is no longer necessary for the purposes for which it was collected or processed; the data subject withdraws consent and there is no other legal ground for the processing; the data subject objects to the processing and there are no overriding legitimate grounds; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation; the personal data was collected in relation to the offer of information society services;
   • The right to restriction of processing may be exercised where the data subject requests the restriction of the processing of their personal data, in which case the data will be used strictly for the exercise of the data subject's other legal rights, including responding to any requests/complaints from them;
   • The right to data portability refers to the right to receive personal data in a structured, commonly used, machine-readable format, and to have that data transmitted directly to another controller, where the processing is based on consent or on the performance of a contract and is carried out by automated means, provided this is technically feasible;
   • The right to object concerns the data subject's right to object to the processing of their personal data where the processing is necessary for the performance of a task carried out in the public interest, or where it is based on the Controller's legitimate interest;
   • The right not to be subject to automated individual decision-making means that the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. However, this right cannot be exercised where the decision is necessary for entering into or performing a contract between the data subject and the Controller, is authorized by the law applicable to the Controller, provided adequate safeguards for the rights, freedoms, and legitimate interests of data subjects are in place, or is based on the data subject's consent obtained in accordance with applicable law;
   • The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing. If a data subject considers that the rights set out above have been infringed, they may lodge a complaint with the ANSPDCP.

    

   The contact details of the A.N.S.P.D.C.P. are as follows:

   Address: Bucharest Municipality, Sector 1, 28-30 G-ral. Gheorghe Magheru Blvd.;

   Phone: 0.318.059.211/0.318.059.212;

   Fax: 0.318.059.602;

   Email: anspdcp@dataprotection.ro;

   Website: www.dataprotection.ro.

   To exercise the rights set out above, data subjects should contact the Controller by sending a request to the postal address or email address indicated in the first section of this Policy.

   The Company may also be contacted using the contact details and mechanisms available on the Website. Customers may also exercise certain rights (right to edit, rectify, object to commercial communications, or erase data) directly on the Website through the settings in the MY ACCOUNT section.

9. FINAL PROVISIONS

   The provisions of this Privacy Policy are supplemented by the provisions of the Cookie Policy, and the Newsletter Subscription Policy, available on the website www.zorelia.com.

GEOMIR CONSULTING S.R.L