Privacy Policy

We are doing everything we can to ensure your personal data confidentiality protection through implementing the necessary measures referred by the current personal data norms and regulations, including the General Regulation (UE) 2016/679 for data protection (“GDPR”).

This chapter has the role to inform you about the personal data we collect from you or that you communicate to us through this website, as well as to the way we will process this data.

1. According to the current norms and regulations referring to personal data (“GDPR”) – personal data is defined as any information referring to an identified or identifiable physical person. In principle, it represents personal data that the CG Vestor Facility has in sight as well: the first and last name of the physical person, house address, email address, social security number, phone number, client codes/attributes of your registered account, etc.

1.1.1. Your personal data collected and processed by CG Vestor Facility are: the first and last name, house address (postal address for delivery), email address, phone number, identifiable client codes/online identifier, billing data, voice, bank information (in case of a return/reimbursement), social media account.

We do not collect nor process in any way sensitive data, as they are defined in the General Regulation for Data Protection (shortened GDPR) into special personal data categories. Also, we do not wish to collect or process data from underage people, who have not reached 18 years old.

1.1.2. Thus, according to “GDPR”, personal data operators (“Operators”) – (i) the CG Vestor Facility Company, Romanian company with a judicial character, with headquarters in Bucharest, Sector 5, 235 Calea 13 Septembrie, Building V3, Sc 2, 10^th Floor, Apartment 76, Room 1, with serial number at Business Register J40/9337/2020 and CUI 42878318 with the obligation according to the national norms and the EU Regulation 679/2016 (GDPR) to administer in safe conditions and only for the specified objectives, your personal data. This data has been collected/processed/etc. for the commercial relationship run in the past and/or currently run and for which you have validly expressed your consent through the current legislation at the time of the collection and processing of your personal data!

1.1.3. The company brings to your attention that the enumeration from this present policy and the following are pure explanatory and that compared to the service contracted by the client, the undersigned only collects the minimal personal data necessary to achieving the objectives/activities done by CG Vestor Facility.

2. In the operating process of this website, the CG Vestor Facility company collects some data (“personal data”) referring to identified physical persons or that they can identify physical persons, data supplied by the users of this website, through direct voluntary consent (ex. first name, last name, postal address, email address, phone number) or indirect consent (ex. IP address, UUIDS usage (unique identifiers provided by social logins).

3. The purposes of personal data processing supplied by a Member or a Client, taken into account and observed by our company are the following:

• Granting services specific to our field of activity
• Managing and administering the contractual relationship with our clients
• Respecting our legal obligations (like obligations in matters of combating money laundering and financing acts of terrorism, reporting obligations towards the fiscal authorities)
• Managing the security and access into our offices, managing the IT systems used by us (e.g. the internet page, the data management platforms, the communication systems we use), including preventing and detecting security threats, fraud or other unauthorized or malicious activities)
• For the purpose of respecting court orders and exercising and/or defending our rights and interests
• Analyzing and improving our services and communication towards you, including (as we have a legitimate interest to constantly improve our services) conducting polls among our clients regarding their satisfaction level towards our services
• For any related and/or linked goal besides the ones above, or for any other purpose for which your personal data have been directed to us, while respecting the applicable legislation

4. The CG Vestor Facility company collects, processes and manages your personal data in conformity with the “GDPR” norms and regulations for the next amounts of time: (i) in conformity with the civil code provisions regarding the judicial institution of the prescription, as well as to the contractual conditions assumed by accepting the terms and conditions, the collected personal data is archived/stored by the Company for a timespan of 3 years from the contract’s termination (for the delivery and return request lack of intervention); (ii) the collected personal data is archived/stored by the Company for a timespan of 3 years and/or the Client has expressed from the time of the last return intervention linked to the account.

It is also good to know that we can process your personal data in order to inform you about our products and services, promotional offers or for subscribing to the newsletter. As a general rule, this personal data will be processed directly for marketing purposes only with your consent and by using communication channels (email, text messages etc.) that you’ve indicated upon giving consent. In these conditions, it is important to know that we will use your expressed consent for marketing purposes until its withdrawal, as the possibility for withdrawal for this type of consent is available at any time.

The client, through transmitting personal data, declares and accepts unconditionally that its personal data will be part and archived by the owner, thus expressing an unequivocally and express consent for its personal data to be stored, used and processed for the purposes mentioned at point 3.

5. The CG Vestor Facility company informs you that processing represents: and operation/set of operations for this data (with or without using automized means), like collecting, recording, organizing, structuring, storing, adapting, modifying, extracting, consulting, using, disseminating, presenting, aligning, combining, restricting, deleting, destroying etc. (these operations are highlighted with an example title in the Regulation, the processing notion meaning any type of operation linked to personal data).
6. On a territorial level, the regulation provisions apply to the processing made by an operator or an empowered entity with the headquarters located in the EU, to the processing of personal data belonging to people that are in the EU, made by an operator on an empowered entity not established in the EU if: there are goods or services offered to people that are in the EU or it’s monitoring the behavior of people in the EU.

The CG Vestor Facility company is a personal data operator according to the norms and regulations in force, including GDPR.

7. The company informs you that depending of the activity/service chosen by the client, for the purpose of personal data collection, CG Vestor Facility can transfer your data to third parties or authorities for meeting its goals based on processing activities bases. According to “GDPR”, we inform you that we can transfer or offer access to some of your personal data to the following recipient categories:

• Commercial partners for supplying the ordered products/services
• Delivery services suppliers
• Payment/bank service suppliers
• Accounting services suppliers, for keeping tabs on accounting records through an empowered external entity
• Other companies with whom we can develop joint programs for market bidding aimed at our goods and services
• Public authorities

We assure you that we’re doing everything in our power so that the contracting empowered entity/third party offers plenty warranties in order to put in place optimal technical and organizational measures to meet the required and legal norms and regulations, including GDPR and ensures the rights of said person.

8. The ground for which we process this personal data and administer this collected data can be put with respect to the purpose of processing your personal data given with your consent, upon creating your online account and verifying it, through the request of becoming a client/member of our community. Furthermore, the ground is also legal and/or contractual, having the contact/commercial report that appeared between you the client and the company CG Vestor Facility at the base.

We will process your personal data to improve and set protection measures, for as many times we need to, for protection regarding the use of the website and its CG Vestor Facility platform users against cyberattacks, prevention and detection measures against fraud, including transmitting some information to competent public authorities, measures for managing several other risks.

9. We also want to keep you completely informed and present you the Principles established by the EU Regulation 679/2016 and the User’s Rights for personal data.

The European regulation for personal data protection governs a number of 6 principles to be respected by the operator (the CG Vestor Facility company) while processing personal data:

• The legality, equity (fairness) and transparency principle. According to this principle, the company must ensure that (1) the data processing must be done only while respecting the legal provisions, any other type of processing being illegal, (2) it only processes data in the ways the person would reasonably accept and (3) the processing must be transparent, meaning the operator must communicate to the subjects clearly and open how it intends to use the personal data
• The principle that limits the purpose for which the data is collected. Our company respects this principle by making it mandatory to collect/process personal data only for the determined and communicated purpose
• The principle of reducing data processing to a minimum. Our company respects this principle by collecting/processing only the data necessary to conduct operations, adopting norms to ensure that it will not collect useless data in report with the commercial operation
• The accuracy principle, current data. Our company will collect/process from its clients only current and precise data.
• The principle for storing data on a necessary period of time in order to accomplish the goals for which they were saved. Our company respects the principle enforced by the european regulation by archiving/keeping your data only for the period of time necessary to accomplish its goals.
• The integrity and confidentiality principle. Our company has implemented all the security measures and has enforced for its departments norms meant to ensure security against unauthorized and illegal processing of data, as well as accidental data los, distruction or damage.

The European regulation has stated that physical persons benefit from 8 (eight) such rights:

1. a) the right to informing (art. 13, art. 14). To consider that the introductive part of the document “terms and conditions”, as well as this present chapter present information about: the identity and contact details of the operator and its representative; the contact details of the data protection responsible; the purpose of the processing and its legal grounds; the recipient or the recipient categories; information about the data transfer to a third party country; adequate warranties; the storing period of time; its rights; the right to file a complaint; possible consequences of data supplying; the existence of an automated and digitalized process.
2. b) the right to access (art 15). The people’s right to access is respected by the Company and it concerns the following: the confirmation regarding data processing; the access to processed data; supplying of personal data copies, that are needed for data processing; obtaining additional information (for a reasonable tax); the remote access through a system that allows data visualization by said person; checking the identity of the person that asks for information.
3. c) the right to rectification (art 16, art 19). The right to access by the people is respected by the Company and it covers: indexed data rectification, data completion;
4. d) the right to deletion (art 17, art 19). The company respects the right to deletion exercised by physical persons only in the conditions in which this right is exercised in a motivated/based manner:
5. Reasons: the data is no longer necessary, consent withdrawal; opposition; illegal processing. Also, by creating the account, each Member or Client has given consent so CG Vestor Facility can send its personal data to its contractual partners through a legal obligation imposed by the European Union law or internal law; offering services to a child, if legal conditions are not met.
6. The right cannot be exercised and therefore respected if the processing is necessary for: the right to free speech and information; respecting a legal obligation; executing a task of public service; in the healthcare sector; archiving; scientific or historical research; statistical objectives; finding, exercising or defending a right in court.
7. e) the right to restriction (art 18, art 19). The regulation offers this right to the people and it can be exercised this way:
8. Cases: contesting the exactity of he data; illegal processing; data is no longer necessary;
9. The operator can only process data;
10. Any processing regarding restricted data required consent from said person;
11. The operator communicates the rectification, the deletion or the restriction to all recipients.
12. f) the right to portability (art 20). According to the regulation’s provisions, the Company respects the right for people to solicit porting their own data, into a simple format, easy to read and to transmit it to another operator chosen by the person exercising their right.
13. g) the right to opposition (to stop the processing activity – art 21) can be exercised only for the following purposes: direct marketing; scientific, historical, statistical research; achieving a public interest task, exercising public authority; legitimate interests of the operator or of a third party.
14. h) the right to not be evaluated through automated profiling (art 22), follows:
15. The illicit character of creating profiles no matter the purpose: evaluating the capacity and quality of the employees’ work quality; according scores -points;
16. Exception: the existence of the person’s consent.

• Exception: the existence of the person’s consent.

You have the possibility to contact the Data Protection Responsible from CG Vestor Facility via email at: [email protected]. We assure you that we are doing everything possible to promptly reply to your requests and to supply you with all the details you need!

We are also informing you of that you have the right to file a complaint at the authority for supervising personal data. In Romania, the contact details for the authority for supervising personal data are the following:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal. 28-30 General Gheorghe Magheru Boulevard, Sector 1, Postal Code 010336 Bucharest, Romania, Telephone +40.318.059.211 or +40.318.059.212; E-mail: [email protected]

For exercising the rights previously mentioned, as a client of the CG Vestor Facility company, you have the right to a written request, dated and sent to [email protected] through which you can justly and legally exercise your guaranteed right to intervene, regarding: (i) the rectification, updating, blocking or deletion of data for which processing is not in accordance to the national legislation provisions (Legea nr 190/2018 regarding measures for enforcing the Regulation (EU) 2016/679 of the European Parliament and of the Council from April 27^th 2016 regarding physical persons’ protection for personal data processing and free movement of this data and the abrogation of the 95/46/CE Directive, as well as the EU 679/2016 Regulation, being able to be exercised for all the actions mentioned before, especially with the data is incomplete or inaccurate.

(ii) The anonymization of personal data, (iii) notifying towards third parties who were presented/revealed this data, with the condition for that this notification to not request a disproportionate effort towards the legitimate interest which could be harmed, respectively for (iv) stopping its personal data processing as long as this is possible according to the processing purpose. As an Operator we are informing you that we will immediately stop the personal data processing if the purpose for which we collected it has stopped.