SC SOFT BUILD S.R.L., having its registered office in Sanmihaiu Roman, no. 179H, room 1, Timis county, registered at the National Office of the Trade Register under no. J35/1652/2006, having CUI 18705608, hereinafter referred to as the Operator, the Company or Soft Build is a personal data Operator.
Personal data will be collected and processed by Soft Build only to the extent permitted by Regulation (EU) no. 679/2016 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (RGPD or GDPR) and related Romanian legislation.
The purpose of this Policy is to inform you about how we process the personal data that we collect from you or that you communicate to us through the website https://biztoweb.co.uk.
If you need more information, and this is not found in this Policy, you can write to us at the e-mail address office@soft-build.com.
We reserve the right to periodically update this Policy. The updated version of the Policy will be displayed on the operator’s website.
Please check its content periodically.
1. REFERENCE DOCUMENTS
Regulation (EU) no. 679/2016 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC;
Law no. 190 of July 18, 2018 on measures to implement Regulation (EU) 679/2016 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/CE (General Data Protection Regulation);
Law no. 506 of 2004 regarding the processing of personal data and the protection of private life in the electronic communications sector;
Law no. 365 of 2002 regarding electronic commerce;
Secondary legislation – decisions of the National Authority for the Supervision of the Processing of Personal Data (hereinafter „A.N.S.P.D.C.P.”).
2. DEFINITIONS
Personal data – any information regarding an identified or identifiable natural person (data subject); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identification element, such as a name, an identification number, location data, an online identifier or one or more elements specific, specific to his physical, physiological, genetic, psychological, economic, cultural or social identity.
Special categories of personal data – any information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the unique identification of a natural person, health data or life data sexual or sexual orientation of a natural person.
Processing of personal data (processing) – any operation or set of operations performed on personal data or on sets of personal data, with or without the use of automated means, such as collection, registration, organization, structuring, storage , adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure or destruction.
Restriction of processing – marking stored personal data with the aim of limiting their future processing.
Creating profiles/profiling – any form of automatic processing of personal data that consists in using them to evaluate certain personal aspects regarding the natural person, in particular to analyze or predict aspects regarding personal preferences, interests, behavior, etc.
Personal data record system – any structured set of personal data accessible according to specific criteria, be they centralized, decentralized or distributed according to functional or geographical criteria.
Data operator, Soft-Build, „we” – natural or legal person, public authority, agency or other body that, alone or together with others, establishes the purposes and means of personal data processing; when the purposes and means of processing are established by Union law or domestic law, the operator or the specific criteria for its designation may be provided for in Union law or domestic law.
Person authorized by the operator (authorized) – natural or legal person, public authority, agency or other body that processes personal data on behalf of the operator.
The person authorized to process data (the authorized person) – the operator or the proxy or the persons who, under the direct authority of the operator or the proxy, are authorized to process data.
Data subject – means any natural person, identified or identifiable, whose personal data are subject to processing.
Third party – means a natural or legal person, public authority, agency or body, other than the data subject, the operator, the person authorized by the operator and the persons who, under the direct authority of the operator or the person authorized by the operator, are authorized to process data with personal character.
Recipient – natural or legal person, public authority, agency or other body to whom (to whom) personal data is disclosed, regardless of whether or not it is a third party.
Consent – any manifestation of the free will, specific, informed and unambiguous of the person concerned by which he accepts, through a statement or through an unequivocal action, that the personal data concerning him be processed.
Pseudonymization – the processing of personal data in a way that no longer allows their attribution to a specific person concerned without using additional information, provided that they are stored separately and subject to technical and organizational measures that ensure protecting this data.
3. OBJECTIVES
The objectives of the Personal Data Protection Policy are:
a. to ensure the information of the data subjects regarding the processing of personal data and the rights that the data subjects have and how to exercise them;
b. to ensure compliance with the legislation in the field of personal data protection;
c. to minimize risks by preventing personal data protection incidents and reducing their potential impact;
d. to increase clients’ confidence in the services offered by the Operator.
The operator processes the collected personal data:
– based on the conclusion and execution of contracts with clients;
– based on previous transactions, in order to realize the legitimate interests in relation to the declared purposes;
– in order to fulfill a legal obligation that belongs to the Operator;
– in other situations, based on the clients’ consent.
4. PURPOSES OF PERSONAL DATA PROCESSING
The purposes of data processing are:
• Supply and provision of services:
a. creating and managing the user account of the SaaS (software as a service) application, BizToWeb (app.biztoweb.ro);
b. informing users about the status of the account created on the platform;
c. authentication or granting access to the account
d. in the stage of making online payments: if you opt for online payment by card, placing the order implies that the persons concerned will be asked for their identity in an additional step. This additional authentication confirms that you are the right holder and user of the card whose data are entered on the payment processor’s page;
e. transmission of information/messages regarding platform updates;
f. providing technical assistance/support services regarding the use of the platform.
The processing for this purpose is also carried out when you choose to contact us directly through the „Contact” section of the site, in which case the Operator requests the following personal data: name, surname, telephone number, e-mail address, in order to solve your request . The interaction with you in this case is not conditioned by the creation of a user account, the contact data can be entered by any interested person who wants to interact with the Operator.
These types of data processing are necessary for concluding and executing service contracts and for fulfilling the requirements imposed by fiscal legislation.
• Improvement of services:
a. Within a reasonable time after the purchase of a product or service, we can use your email address to send a request for feedback/review/review regarding the purchased good or service. Users are not obliged in any way to give reviews;
b. we may invite you to complete satisfaction questionnaires after accessing a service or participating in certain marketing actions;
c. we can carry out studies or market research, directly or indirectly, perform statistics or we can track and monitor the sales and commercial behavior of users.
These types of data processing are carried out in the legitimate interest of the Operator to carry out commercial activities, respecting your rights.
Marketing:
a. Transmission of commercial communications, promotion of products and services (offers of products and services), advertising, media, development and informing users about these actions, transmission of personalized recommendations. For this purpose, we can send commercial communications through the communication channels provided by you: e-mail, SMS, phone call.
These types of communications may contain general information regarding the portfolio of products and services, current offers/promotions or specific information regarding user preferences for certain products in the portfolio. Data processing can be based on information about the user’s commercial behavior, to create a profile (products viewed or purchased frequently).
This type of data processing is based on the prior consent of the user (the person concerned), expressed through positive actions (checking the box I want to subscribe to the newsletter, available when placing the order/creating the Account. We ensure that we respect your rights, that the processing does not affects you to a significant extent.
Prior consent can be withdrawn at any time, by changing the settings in the „Newsletter subscription” section, accessing the unsubscribe link/button in the message/footer of the email or by express request to office@softbuild.com, in which case you can request that we stop data processing for this purpose, following your request. We will register your unsubscribe option but, for technical reasons related to the synchronization of internal systems and the database, it is possible to continue receiving commercial communications for 2 days from the date on which you exercised the option to unsubscribe or change subscription preferences. This time interval constitutes the normal duration of updating the databases according to your request or preferences.
b. If we have directly obtained the user’s (data subject’s) e-mail address on the occasion of selling a product or service to him, it is possible to send him information about similar products or services, accessories, complementary to those which he purchased; this type of data processing will be carried out with respect for the rights of the data subjects, with the possibility for the data subject to object to such processing through a simple and free means, with each message sent, if the data subject has not objected initially („Unsubscribe” button, or request to email office@softbuild.com). This type of data processing is carried out in the legitimate interest of the operator to maintain the commercial relationship it has with the data subject, based on previous transactions.
• In current activities based on legitimate interest:
a. In the case of evaluating the services offered / publishing reviews, the user connected to his own account will give a rating to the purchased services and will publish reviews signed with his name and surname. These identification data are processed for the purpose of validating the review, confirming the fact that it comes from a user who purchased the respective services from the Operator, used them and is able to provide feedback. For this purpose, no additional personal data will be processed/we will not request: personal data or information of the user (other than those necessary to connect to the account); data of any third party: name, phone numbers, e-mail addresses, delivery or home address, account or bank card data, as well as any information that could lead to identity theft.
b. Adoption of measures to protect the website https://biztoweb.co.uk against cyber attacks, detection of fraud attempts and transmission of data to the competent authorities, management of security breaches. The operator can process personal data in order to identify and limit abusive behavior in placing orders (multiple, abusive, speculative or placed for the purpose of obtaining undue advantages) or other risks.
c. The operator has developed an internal framework of policies, procedures and standards to maintain the security of personal data. They are reviewed periodically to comply with the applicable regulations and standards in the field of data security. This type of data processing has as its legal basis the legitimate interest of the Operator, its purpose is to maintain the balance between the interest of the Operator and the rights of the data subjects.
d. For the purpose of sending an information subsequent to the conclusion of a transaction, regarding the possibility of creating a user account in which you can find: the history of purchases, tax invoices, so that the transactional information is centralized and accessible to customers directly from the user account;
e. In the case of contacting the Customer Relations team, in order to resolve your request, evaluate and improve the assistance services, the data may be processed, and the telephone call recorded and kept for the entire period necessary to develop the commercial relationship with you. Continuing the call represents your consent to the recording of the call and the processing of the data for the previously mentioned purposes. The operator can return with an automatic call in 1-3 days from the date of the initially recorded call to evaluate the quality of the services and information provided by the operator’s consultants. These actions are undertaken in legitimate interest, for the improvement of assistance services.
• In current activities based on legal obligation:
a. fulfilling the requirements imposed by fiscal and accounting legislation.
5. CATEGORIES OF PERSONAL DATA PROCESSED
We process your personal data that you provide us, respectively: first name, last name, e-mail, telephone number, home address, billing details, bank account data.
Also, we do not want to collect or process data of minors who have not reached the age of 18. If the data provided contains information about minors, they will be deleted.
Special data and information relating to persons or groups/communities defined by gender, age, race, ethnicity, nationality, citizenship, religious beliefs, sexual orientation, education level, social category, medical conditions or physical characteristics.
On the website www.biztoweb.ro we can process information in cookies and similar technologies, in accordance with the Cookies Policy.
6. THE RIGHTS OF THE PERSONS CONCERNED
By reading this Personal Data Protection Policy on the www.biztoweb.ro website, you are aware of the fact that you are guaranteed the rights provided by the GDPR, respectively:
– the right to transparency of information, communications and ways of exercising your rights;
– the right to information and access to your personal data;
– the right to rectification;
– the right to delete data („the right to be forgotten”);
– the right to restrict processing;
– the right to data portability;
– the right to opposition;
– the right not to be subject to an automated individual decision-making process;
– the right to address the Supervisory Authority (ANSPDCP) in case of violation of your rights, guaranteed by the legislation on the protection of personal data.
To exercise the rights mentioned above or for any question related to the way your data is used or if some of them are incorrect, you can send a written, dated and signed request to:
SC Soft Build S.R.L. with headquarters in Sanmihaiu Roman, no. 179H, room 1, Timis county, or at the email address: office@softbuild.com.
In the request, please mention if you want the information to be communicated to a certain address (postal or e-mail) or through a courier service to ensure that you receive the information personally. Please keep in mind that, before complying with any such request, we reserve the right to verify your identity, to make sure that the request comes from you.
Also, you are recognized the right to go to court for any violation of your rights regarding the processing of personal data. The information you provide to us will be used and stored only for the purpose for which you provided it, to administer, support and evaluate our services, including to prevent system security breaches and to comply with the law and our contractual terms.
7. DATA RETENTION PERIOD
Your personal data will be processed and stored as long as you have an account on the site. They can be deleted subject to the retention of certain information after deleting your account if the applicable legislation or the legitimate interest requires it. In this sense, the Operator will store your data during the storage period defined according to the specifics of the operations for which they are needed. Thus, the personal data are kept for the duration of the contractual relations as well as for another 3 years from the last invoicing, this being the legal term of extinguishment of the obligations arising from the contractual commercial relations. The personal data mentioned on the tax invoices will be kept for a maximum of 10 years, according to the applicable accounting and tax legal provisions.
Moreover, the Operator ensures that the personal data are adequate, relevant and limited to what is necessary for the purposes for which they are processed and also ensures that the period for which the personal data is stored is limited, and upon completion deadlines, personal data will no longer be processed for these purposes.
8. RECIPIENTS
The operator can provide your personal data to other companies with which it is in partnership, but only on the basis of a confidentiality commitment from them, which guarantees that these data are kept safe and that the provision of this personal information is done in accordance the legislation in force, as follows: partner suppliers of products and services, courier service providers, banking service providers, mobile phone operators, collaborating private non-profit legal entities, other companies with which we can develop joint offering programs on the market of our products and services, partners of Soft-Build that act within the limits and goals established by us, according to the conditions of this Policy.
Access to your data by third-party legal entities under private law is carried out in accordance with the legal provisions on data protection and information confidentiality, based on contracts concluded with them.
9. SECURITY OF YOUR PERSONAL DATA
Soft-Build will ensure data security (for example: password protection, antivirus, encryption), will take all necessary technical and organizational measures to protect the confidentiality of your personal data, applying appropriate measures especially against the following: unauthorized access ; modification; transmission; publication; deletion or destruction; accidental destruction or deletion; and/or unavailability caused by the change of the applied technique.
In order to prevent unauthorized access to personal data, their unauthorized modification and publication or their unauthorized use, the Operator will ensure the following: the creation and operation of an adequate IT, technical environment; controlled selection, supervision of its employees, involved in providing the service; the development of procedural rules for operation, risk management and service provision.
Breach of personal data security means a breach of security that leads, accidentally or unlawfully, to the destruction, loss, modification or unauthorized disclosure of your personal data transmitted, stored or otherwise processed, or to unauthorized access to these. Possible violations: installation of malware programs; loss or theft of data storage systems; system configuration errors that can lead to information leaks; accidental publication of personal data in the public space; loss of access password to the only copy of the database, etc. If the Operator finds that the security of personal data has been violated, it will immediately take all necessary protective measures to limit this violation and notify the National Authority.
Operator,
SC SOFT-BUILD S.R.L.