logo

GDPR Statement

GDPR STATEMENT ON PRIVACY OF PERSONAL DATA

Data privacy is of particular importance to our company and we want to be prudent about the processing of your personal data (hereinafter “PII”). We therefore implement a firm policy regarding the processing and protection of PII received from you.
The data we collect from you is stored on our servers, at our headquarters and workplaces, as required on a case-by-case basis, without leaving the territory of Romania.
Your data remains exclusively with us, we do not transmit, sell or transfer your data to third parties, except where this is necessary to provide you with our services, in accordance with this Statement. You will find the categories of third parties under each specific processing described below.
In the subsections below you will find all relevant information on our processing of your data, as applicable.

By accepting this Statement you agree to the collection and use of PHI as described in this Statement.

We may need to update this Statement. The latest version is always available on our websites, in our restaurants and accommodation establishments and in our shops. We will communicate any significant changes to it.

WHO IS THE DCP OPERATOR?

SOBIS Solutions SRL (“SOBIS“) is the controller of the PII you submit to us and is responsible for it in accordance with applicable data protection legislation.
SOBIS Solutions SRL
Commercial Register number: J32/348/1999
CUI: RO12018818
Correspondence address: Calea Dumbrăvii 99A, 550399 – Sibiu, Romania
Tel: 0269-230.039
Fax: 0269-230.059, 0369-401.476, 0369-453.954
Headquarters: Arpașu de Sus 505, 557016 – Sibiu
E-mail: office@sobis.ro
Legal representative: Martin Müller

WHAT ARE YOUR RIGHTS?

RIGHT OF ACCESS:
You can contact SOBIS to provide you with the processed DCP by e-mail.

RIGHT TO PORTABILITY: You can ask us to transfer a copy of the PII you have submitted to us to you or to another party.

THE RIGHT TO RECTIFICATION: You have the right to ask us to rectify your PNR if they are incorrect. If you have an account on any of the SOBIS websites(http://www.produse-albota.ro/, http://www.albota.sobis.ro/), you can edit your DCP from your account.

RIGHT TO DELETE DATA: You have the right to delete any PII processed by SOBIS at any time, except in the following situations:

  • you have a request not yet resolved by SOBIS
  • you have an open order that has not yet been shipped or has been partially shipped
  • you have an outstanding debt to SOBIS, regardless of the method of payment
  • if you have made a purchase from us, we will keep the related PDC for you in accordance with accounting legislation.

RIGHT TO OPPOSE THE PROCESSING OF PII: You have the right to object to the processing of PII by sending an e-mail to SOBIS.

YOUR RIGHT TO OPPOSE DIRECT MARKETING: You have the right to object to direct marketing. You can unsubscribe from direct marketing by SOBIS by the following means:

  • following the instructions in each marketing email
  • by changing your account settings on the SOBIS website.

RIGHT TO RESTRICTION OF PROCESSING: You have the right to request that SOBIS restricts the processing of your PNR.

RIGHT TO COMPLAINT TO THE SUPERVISORY AUTHORITY: If you believe that SOBIS is processing your PII incorrectly, you can contact us. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing(http://www.dataprotection.ro/; B-dul G-ral. Gheorghe Magheru 28-30 Sector 1, postal code 010336, Bucharest, Romania).

HOW CAN YOU EXERCISE YOUR RIGHTS?
You can contact us at any time, in person, by phone, e-mail or fax at the addresses and numbers indicated above.

  1. ACCOMMODATION AND MEAL SERVICES

WHY DO WE USE DCP?
We will use your DCP to provide and customize the services you request and expect from SOBIS in our restaurants and accommodations, to provide you with the expected level of hospitality in your room and anywhere on our property. We also use DCP for planning events that you request or are interested in attending. We use the DCP to manage your bookings and/or purchases of our accommodation and meal services and may send you notifications of the status of your bookings, including for the purpose of completing your accommodation record. We’ll use your DCP to manage your payments. We will also use your data to deal with complaints about the services we offer you.
We want to offer you different payment alternatives and will carry out analyses to find out what payment alternatives are available to you.
We also use DCP from video surveillance at the main entrances to our accommodation units, for security reasons, to be able to track incidents, prevent and report criminal offences committed on SOBIS premises. DCP will be used to prevent and investigate abuse of our services, losses and fraud.

WHAT TYPES OF DCP DO WE PROCESS?

  • contact details such as name, address, e-mail address and telephone number
  • details of your booking, stay or visit
  • participation in competitions, sweepstakes or marketing programmes
  • data related to the purchase and receipt of goods or services
  • personal characteristics, nationality, income, identity card details
  • payment details such as your credit card number and other card details
  • the registration numbers of the vehicles you may bring onto our properties
  • packages booked at our restaurants and accommodation establishments
  • video recordings from the main entrances to our accommodation units

WHO HAS ACCESS TO THE DCP?
The PII you submit to third parties is used only to provide you with the services mentioned above (payment processors, travel agents, etc.). Many of these recipient companies have an independent right or obligation to process your PHI, either by law or under existing contractual relationships.
Incidents and fraud may be shared with insurance companies, law enforcement or judicial authorities for the purpose of completing investigations. These recipients have an independent right or obligation to process your PNR.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
The processing of PII is necessary for SOBIS to honour the services ordered by you, as well as by law or in the legitimate interest of SOBIS.

HOW LONG DO WE SAVE YOUR DATA FOR? We will keep your data for 5 years.
The video recordings will be saved in accordance with the legislation applicable in Romania, but for a maximum of 30 days.

  1. ONLINE SHOPPING

WHY DO WE USE DCP?
We will use your DCP to manage your online purchases on SOBIS websites and/or email purchases to SOBIS, process orders and returns through our online services and may send you notifications on the delivery status or in case of problems with the delivery of products ordered by you. We’ll use your DCP to manage your payments. We will also use your data to handle complaints and product warranties. We use the DCP to identify you and confirm your legal age for online purchases and to confirm your address to external partners.

WHAT TYPES OF DCP DO WE PROCESS?
We will process the following categories of FCDs:

  • contact details such as name, address, e-mail address and telephone number
  • payment data and payment history
  • ordering information

If you have a SOBIS account, we will also process your DCP submitted in connection with the account, such as:

  • account
  • order history

WHO HAS ACCESS TO THE DCP?
PDCs sent to third parties are used only to provide you with the services mentioned above, for address confirmation by external companies (such as courier companies, etc.), for sending order confirmation by communication agents, for operations performed by warehousing and distribution service providers in connection with the delivery of your order, for payment processing by payment processing service providers. Many of these recipient companies have an independent right or obligation to process your PHI, either by law or under existing contractual relationships.
Incidents and fraud may be shared with insurance companies, law enforcement or judicial authorities for the purpose of completing investigations. These recipients have an independent right or obligation to process your PNR.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
DCP processing is necessary for SOBIS to honour the service of managing and delivering your order.

HOW LONG DO WE SAVE YOUR DATA FOR?

We will keep your data until the final completion of the above mentioned services.

  1. DIRECT SHOPPING FROM SOBIS STORES

WHY DO WE USE DCP?
We will use DCP to manage your purchases of products and services from SOBIS stores, processing orders and returns through our sales agents, and we may send you notifications of delivery status or in the event of problems with the delivery of products you have ordered. We’ll use your DCP to manage your payments. We will also use your data to handle complaints and product warranties. We use the DCP to confirm your address to external partners, in case the delivery of purchased products is arranged by us at a later date.
We want to offer you different payment alternatives and will carry out analyses to find out what payment alternatives are available to you.

WHAT TYPES OF DCP DO WE PROCESS?
We will process the following categories of FCDs:

  • contact details such as name, address, e-mail address and telephone number
  • payment data and payment history
  • ordering information
  • invoicing data required by Romanian accounting legislation

WHO HAS ACCESS TO THE DCP?
PDCs sent to third parties are used only to provide you with the services mentioned above, for address confirmation by external companies (such as courier companies, etc.), for sending order confirmation by communication agents, for operations carried out by warehousing and distribution service providers in connection with the delivery of products purchased by you, for payment processing by payment processing service providers. Many of these recipient companies have an independent right or obligation to process your PHI, either by law or under existing contractual relationships.
Incidents and fraud may be shared with insurance companies, law enforcement or judicial authorities for the purpose of completing investigations. These recipients have an independent right or obligation to process your PNR.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
DCP processing is necessary for SOBIS to honour the service of managing and delivering the products purchased by you.

HOW LONG DO WE SAVE YOUR DATA FOR?
We will keep your data until the final completion of the services mentioned above.

  1. DIRECT MARKETING

WHY DO WE USE DCP?
We use DCP to send you marketing offers, information surveys and invitations via email, text messages, phone calls and mail communications.
To optimize your experience with SOBIS and our products, we will provide you with relevant information, product recommendations, notifications of products remaining in your shopping cart and send you personalized offers. All of these services are based on your previous orders, the products you clicked on and the information you submitted.

WHAT TYPES OF DCP DO WE COLLECT?
We will process the following categories of FCDs:

  • contact details such as e-mail address, telephone number and postcode
  • products and offers you clicked on

If you have an account on the SOBIS websites we will also process the DCP submitted in connection with the account, such as:

  • name
  • address
  • age
  • order history
  • how you navigated and what you clicked on.

WHO HAS ACCESS TO THE DCP?
PII submitted to third parties is only used to provide you with the services mentioned above, and PII submitted to media or travel agencies and technical suppliers is for the distribution of direct physical and digital marketing. We do not pass on, sell or give your data to third parties for marketing purposes.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
DCP processing is based on your consent when you consent to direct marketing, with the exception of postal marketing services, including catalogues, which will be sent to you on the basis of our legitimate interest, if applicable.

THE RIGHT TO WITHDRAW YOUR CONSENT:
You have the right to withdraw your consent to the processing of PII at any time.
When you do so, SOBIS will not be able to send you other direct marketing offers or information based on your consent.
You can unsubscribe from direct marketing by the following means:

  • following the instructions in each marketing message
  • by changing your account settings on the SOBIS web pages.

HOW LONG DO WE SAVE YOUR DATA FOR?
We will retain your data for direct marketing purposes until you withdraw your consent.
After this period, the DCP will be deleted.

  1. ACCOUNT SUBMITTED

WHY DO WE USE DCP?
We will use DCP to create and manage your personal account to provide you with a personalized and relevant experience on your SOBIS account. We will provide you with your order history and order details and allow you to manage your account settings (including marketing preferences). We will also provide you with ways to correct and update your information, such as contact details and payment information. We will allow you to save items in your shopping cart.
In order to provide you with relevant SOBIS product recommendations we will process your browsing on our digital platforms (including the website), your purchase history and product reviews, as well as the data you have submitted through your account.

WHAT TYPES OF DCP DO WE COLLECT?
We will always process the email address and password you send us when you register for a SOBIS account. We will also process the following categories of PDCs if you choose to provide them to us:

  • contact details such as name, address, telephone number
  • account settings
  • encrypted payment card information

We will process the following DCP categories if you make a purchase:

  • order history
  • delivery information
  • payment history

We will also process the following categories of PII related to your cookies:

  • click history
  • navigation and browsing history.

WHO HAS ACCESS TO THE DCP?
The data transmitted to third parties is used only to provide you with the services mentioned above, to optimize the web pages we may use web agencies and analytics tools to evaluate products.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
DCP processing for your account is based on your consent given when creating your SOBIS account. DCP’s processing to provide you with relevant product information is based on our legitimate interest.

HOW LONG DO WE SAVE YOUR DCP FOR?
We will keep your data as long as you have an active SOBIS account. You have the right to close your account at any time. If you choose to do so, your account will cease to exist and you will be considered inactive. We will keep the DCP if this is required by current legislation and if there is an open dispute.
After closing your account, your data will be deleted.

THE RIGHT TO OBJECT TO DCP PROCESSING:
You have the right to object to the processing of PII based on SOBIS’ legitimate interest by contacting office@sobis.ro. Your account will then be deleted and we will not be able to offer you our services.

  1. CUSTOMER SERVICE

WHY DO WE USE DCP?
We will use your DCP to handle queries, complaints and product warranties, as well as provide technical support via email, chat, phone and social media. We can also contact you if there is a problem with your orders.

WHAT TYPES OF DCP DO WE COLLECT?
We will process any data you provide to us, including the following categories of data:

  • contact details such as name, address, e-mail address and telephone number
  • date of birth
  • payment information and payment history
  • ordering information
  • all relevant correspondence

WHO HAS ACCESS TO THE DCP?
Data transmitted to third parties is used only to provide you with the services mentioned above.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
The processing of PNR is based on the legitimate interest of SOBIS.

HOW LONG DO WE KEEP YOUR DATA?
We will keep your data and related correspondence for 12 months for case management purposes. For in-store complaints, the DCP will be saved for 2 years.

THE RIGHT TO OBJECT TO DCP PROCESSING:
You have the right to object to the processing of PII on the basis of the legitimate interest of SOBIS. SOBIS will not continue to process PII unless we can demonstrate a legitimate reason for processing that overrides your interests and rights or based on legal proceedings.

  1. FULFILMENT OF LEGAL OBLIGATIONS

WHY DO WE USE DCP?
We use DCP to comply with legal obligations, court rulings and decisions of the authorities. This includes the use of DCP for the collection and verification of accounting data in accordance with the accounting records regulations.

WHAT TYPES OF DCP DO WE COLLECT?
We will process the following categories of FCDs:

  • order dates
  • name
  • postal address
  • other specific information required by law or by the authorities

WHO HAS ACCESS TO THE DCP?
Your data will be processed internally by SOBIS.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
The DCP processing is necessary for SOBIS to fulfil its legal obligations.

HOW LONG DO WE SAVE YOUR DATA FOR?
We will store your data in accordance with applicable accounting regulations.

  1. COOKIES

A cookie is a small text file that is saved on your computer or mobile device and retrieved from it during subsequent visits. If you use our services, we will assume that you consent to the use of such a cookie.

HOW DO WE USE COOKIES?
We use permanent cookies to store your homepage and details if you select “Remember me” when you log in to our websites. We will use cookies to save your favourite products.
We use cookies for a session, for example, when you use the product filter function, to check whether you are logged in or have added an item to your shopping cart.
We use proprietary and third-party cookies to collect statistics and user data in aggregate and individual form in analytics tools to optimize our websites and provide you with relevant marketing materials.
Some third-party cookies are set by services that appear on our pages and are outside our control. These are set by social media providers such as Twitter, Facebook and Vimeo, and refer to the ability of users to share content on the site, as indicated by the icon.
We may also use third-party cookies that track activity across multiple sites to provide you with marketing on other sites/channels.

WHAT TYPES OF DCP DO WE COLLECT?
We will only link your cookie ID to DCP sent and collected in connection with your SOBIS account, only if you are logged into your account.

WHO HAS ACCESS TO THE DCP?
Data transmitted to third parties is used only to provide you with the services mentioned above, an analysis tool is used to collect statistics for the purpose of optimizing our websites and to present you with relevant material.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
We will only connect your cookies to DCP if you are logged into your SOBIS account. If you are logged into your account, the legal basis is based on our legitimate interest.

  1. DEVELOPMENT

WHY DO WE USE DCP?
We use DCP to evaluate, develop and improve our services, products and systems for all SOBIS customers. For this purpose we will not analyse the DCP at individual level, all processing will be performed on pseudonymised data. This includes reviews to make our services easier to use, such as modifying the user interface to simplify information flow and improving IT systems to increase security for SOBIS visitors and customers.
The analysis is also used for the development and continuous improvement of the logistics flow of goods by forecasting purchases, stocks and deliveries, as well as our resources through delivery planning.
In addition, we use the data to improve our product range.

WHAT TYPES OF DCP DO WE COLLECT?
We will process the following categories of PNR if you have chosen to provide them to us:

  • the area from which you access our pages
  • country
  • click history
  • navigation and browsing history

WHO HAS ACCESS TO THE DCP?
Data transmitted to third parties is used only to provide you with the services mentioned above. We can use web analytics companies to analyse customer online behaviour across the board.

WHAT IS THE LEGAL BASIS FOR PROCESSING DCP?
DCP processing to develop and improve our services and products is based on our legitimate interest.

HOW LONG DO WE SAVE YOUR DATA FOR?
We will keep your data as long as you have an active SOBIS account. After closing your account, your data will be deleted.

THE RIGHT TO OBJECT TO DCP PROCESSING:
You have the right to object to the processing of PII based on SOBIS’ legitimate interest by contacting office@sobis.ro. Your account will then be deleted and we will not be able to offer you our services.