Privacy Policy

ERDA PRIVACY POLICY

Personal Data Protection and Processing

1. General Information

This Privacy Policy explains how Deneris Trade SRL, as the data controller, collects, uses, stores and protects the personal data of individuals who access the www.erdashoes.com website, place orders, create a customer account, contact ERDA or use the services available through the website.

Personal data is processed in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (“GDPR”), as well as any other applicable legal provisions.

Through this Policy, ERDA aims to provide clear and transparent information regarding:

• what personal data is collected;

• the purposes for which it is used;

• the legal bases for processing;

• who the data may be disclosed to;

• how long the data is retained;

• what rights individuals have;

• how these rights may be exercised.

This Policy applies to personal data processed in connection with the ERDA website and the services provided through it.

2. Data Controller

The data controller is:

Deneris Trade SRL
Trading brand: ERDA

Address: Str. Cetatii, Ferma 16, Hala 7, Floresti, postal code 407280, Cluj County, Romania
Email: contact@erdashoes.ro
Telephone: +4 0746 964 912

As data controller, Deneris Trade SRL determines the purposes and means of processing personal data within the limits provided by applicable legislation.

In certain circumstances, ERDA may use external service providers who process personal data on its behalf. In such cases, ERDA selects service providers in accordance with applicable legislation and takes the necessary measures to protect personal data.

3. What Is Personal Data

Personal data means any information relating to an identified or identifiable natural person.

Depending on how you interact with ERDA, the personal data processed may include, where applicable:

• first and last name;

• delivery address and, where applicable, billing address;

• telephone number;

• email address;

• information relating to orders and purchased products;

• data relating to customer accounts;

• information regarding returns, exchanges or product conformity claims;

• information provided when contacting ERDA;

• data required for payment processing, under the conditions described in this Policy;

• technical information regarding the use of the website;

• IP address and other technical data, to the extent collected;

• information collected through cookies and similar technologies, in accordance with the Cookie Policy.

ERDA does not ordinarily request special categories of personal data for the purpose of placing an order.

4. Principles of Data Processing

ERDA processes personal data in accordance with the principles established by applicable legislation, including:

• lawfulness, fairness and transparency;

• purpose limitation;

• data minimisation;

• accuracy;

• storage limitation;

• integrity and confidentiality;

• accountability of the data controller.

ERDA aims to ensure that the data collected is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

5. Sources of Personal Data

Personal data may be collected directly from the data subject, for example when the individual:

• places an order;

• creates a customer account;

• completes a form on the website;

• contacts ERDA by email, telephone or through other available communication channels;

• requests a return, exchange or resolution of a product conformity issue;

• subscribes to the newsletter or other commercial communications;

• participates in a campaign, promotion or other activity organised by ERDA.

In certain circumstances, certain data may be received indirectly from service providers involved in order processing, payment, delivery or website operation, to the extent permitted by law.

6. Data Required for Placing and Processing Orders

For the processing and delivery of an order, ERDA may request data such as:

• the recipient’s first and last name;

• delivery address;

• telephone number;

• email address;

• billing information, where applicable;

• information regarding the products ordered;

• information regarding the payment method and payment status.

Providing the data required to process and deliver an order is generally necessary for entering into and performing the sales contract.

If the required data is not provided, ERDA may be unable to process or deliver the order.

7. Customer Account Data

Where the website allows customers to create an account, ERDA may process the data required to create and administer such account.

This may include:

• first and last name;

• email address;

• telephone number;

• saved addresses;

• order history;

• preferences or other information associated with the account.

The customer account may, where applicable, allow access to order history and facilitate the purchasing process.

Creating a customer account is separate from placing an order without an account, where this option is available on the website.

8. Contacting ERDA

When a data subject contacts ERDA by email, telephone or through other available communication channels, ERDA may process the data provided as part of the communication.

Such data may be used for:

• responding to the request submitted;

• providing information regarding products and orders;

• handling complaints;

• managing returns and exchanges;

• handling product conformity claims;

• documenting and managing communications with customers;

• complying with applicable legal obligations.

ERDA will use such data only to the extent necessary for the purpose of the communication and to fulfil applicable obligations.

9. Order, Return and Warranty Data

ERDA may process data associated with orders and subsequent customer requests, including:

• information regarding products ordered;

• order date and value;

• delivery information;

• return or exchange requests;

• refund information;

• product conformity claims;

• information and documents provided as part of handling a complaint.

Such data is processed for the performance of the contract, management of the customer relationship, compliance with legal obligations and, where applicable, the establishment, exercise or defence of ERDA’s legal rights and legitimate interests.

10. Purposes and Legal Bases for Processing

ERDA processes personal data only for specific, explicit and legitimate purposes and only where there is a valid legal basis for the relevant processing.

Depending on the circumstances, the legal bases may include:

• performance of a contract or taking steps at the request of the data subject prior to entering into a contract, for example for processing and delivering an order;

• compliance with legal obligations applicable to ERDA, including accounting, tax and document-retention obligations;

• ERDA’s legitimate interests, where processing is necessary for the operation and protection of its business, provided that the rights and freedoms of the data subject are respected;

• the consent of the data subject, where consent is required under applicable law.

Where processing is based on consent, the data subject has the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Information regarding the purpose and legal basis of each processing activity is provided according to its nature and context, in accordance with GDPR requirements.

11. Processing and Fulfilment of Orders

Personal data provided during the ordering process is used for:

• registering and processing the order;

• confirming the order;

• preparing and dispatching the products;

• communicating with the customer regarding order status;

• issuing fiscal and commercial documents;

• processing payments;

• handling any returns, exchanges or refunds;

• handling complaints or product conformity claims;

• complying with applicable legal obligations.

These processing activities are primarily necessary for the performance of the contract between ERDA and the customer and for compliance with ERDA’s legal obligations.

12. Payment Processing

For online payments, certain data required to process the transaction may be transmitted to the payment service provider used by ERDA.

Bank card details are processed through the payment service provider’s infrastructure and are not stored by ERDA, to the extent described in the provider’s documentation and under the terms applicable to the relevant service.

ERDA may receive and retain information regarding the status of a transaction, such as confirmation that a payment has been completed, declined or cancelled, as well as other information required to manage the order and maintain accounting records.

For further information regarding how the payment service provider processes personal data, customers may consult the provider’s privacy policy.

13. Order Delivery and Disclosure of Data to Carriers

For the delivery of orders, ERDA may disclose to the carrier or logistics service provider the personal data necessary to complete the delivery.

This data may include, as applicable:

• recipient’s name;

• delivery address;

• telephone number;

• email address, where required for delivery notifications;

• parcel and order information.

The disclosure of such data is necessary for the performance of the contract and completion of the delivery.

ERDA may use one or more logistics service providers depending on the destination country and the delivery solution available.

14. Billing, Accounting and Legal Obligations

ERDA processes the data necessary to comply with applicable legal obligations, including those relating to:

• accounting;

• taxation;

• issuing and retaining supporting documents;

• document retention and archiving;

• recording orders and transactions;

• responding to requests from competent public authorities.

In these circumstances, processing is based on compliance with a legal obligation applicable to ERDA.

Data may be retained for the periods required by applicable law, including after the commercial relationship with the customer has ended.

15. Marketing Communications and Newsletter

ERDA may send commercial communications regarding products, collections, campaigns, promotions or other relevant information concerning the brand, in accordance with applicable law.

Where required, commercial communications by email are sent on the basis of the data subject’s consent.

Customers may unsubscribe from commercial communications at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting ERDA.

Withdrawal of consent to receive commercial communications does not affect the lawfulness of processing carried out before withdrawal.

Communications necessary for the performance of the contract, such as order confirmations, delivery information, return-related communications or other administrative communications, are not considered commercial communications and may be sent where necessary to manage the contractual relationship.

16. Marketing, Cookies and Similar Technologies

The ERDA website may use cookies and similar technologies for website functionality, improving the user experience, measuring performance and, where applicable, marketing activities.

The use of such technologies is described in greater detail in the ERDA Cookie Policy, which should be read together with this Privacy Policy.

Where applicable law requires consent for the use of certain technologies, those technologies will only be activated after the relevant consent has been provided, except where applicable law permits their use without consent.

17. Affiliate Programme

Where an individual participates in the ERDA affiliate programme, certain data may be processed as necessary to administer the programme, attribute orders or conversions and calculate commissions, in accordance with the terms of the affiliate programme and applicable legislation.

The affiliate programme is separate from B2B commercial relationships with resellers and does not alter the rules applicable to reseller accounts.

Depending on the infrastructure used for the affiliate programme, certain data may be processed through service providers or the affiliate platform used by ERDA.

18. Reseller Accounts and B2B Relationships

In the case of reseller accounts and B2B commercial relationships, ERDA may process the contact details of representatives, employees or persons designated by the business partner.

Processing may be necessary for:

• administering the reseller account;

• managing orders;

• commercial and operational communication;

• performing the cooperation agreement;

• billing and accounting;

• complying with legal obligations.

The commercial terms applicable to the relationship between ERDA and a reseller are established by the relevant cooperation agreements and are not governed by this Policy except with regard to the processing of personal data.

19. Recipients of Personal Data

For the purposes described in this Policy, ERDA may disclose personal data to certain categories of recipients, where necessary and permitted by applicable law.

These may include, as applicable:

• payment service providers;

• courier companies and logistics service providers;

• IT and hosting service providers;

• website administration service providers;

• communication and email service providers;

• marketing and newsletter service providers;

• website analytics and performance measurement service providers;

• providers involved in the affiliate programme;

• accountants, auditors, legal advisers or other professional service providers;

• public authorities and institutions, where disclosure is required by law or necessary to comply with a legal obligation.

ERDA does not sell customers’ personal data.

Where ERDA uses service providers that process data on its behalf, ERDA takes the necessary measures to ensure that processing is carried out in accordance with applicable legislation.

20. International Data Transfers

Depending on the service providers and services used by ERDA, certain personal data may be processed or transferred outside the European Economic Area.

Where such a transfer takes place, ERDA will take the necessary measures to ensure that the transfer is carried out in accordance with GDPR and the requirements applicable to international data transfers.

Depending on the circumstances, the transfer may be based on:

• an adequacy decision of the European Commission;

• Standard Contractual Clauses;

• other safeguards or transfer mechanisms recognised under applicable law.

Where relevant, information regarding the safeguards applicable to international transfers may be provided to the data subject in accordance with GDPR.

21. Data Retention Period

ERDA retains personal data only for as long as necessary to fulfil the purposes for which it was collected or for the period required by applicable law.

The retention period may vary depending on the nature of the data and the purpose of processing. When determining the applicable retention period, ERDA may take into account:

• the duration of the contractual relationship with the customer;

• legal obligations concerning the retention of accounting and tax records;

• the need to handle potential complaints or disputes;

• the need to establish, exercise or defend legal claims;

• the period for which there is a legitimate interest in retaining certain information;

• withdrawal of consent, where processing is based on consent and there is no other legal basis for continuing the processing.

After the applicable retention period expires, the data will be deleted, anonymised or otherwise processed in accordance with applicable legal requirements.

22. Data Security

ERDA implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or other forms of unauthorised processing.

Depending on the nature and risks associated with the processing, security measures may include:

• access controls;

• restricting access to personnel and contractors to the data necessary for the performance of their duties;

• the use of secure connections and systems;

• measures to protect IT infrastructure;

• internal procedures for handling personal data;

• measures for preventing and detecting unauthorised access.

However, no method of electronic transmission or storage can guarantee absolute security.

In the event of a personal data breach, ERDA will take the measures required by applicable law, including, where necessary, notifying the competent supervisory authority and informing affected individuals.

23. Rights of Data Subjects

Subject to the conditions and limitations provided by GDPR and applicable law, data subjects have the following rights:

23.1. Right to Information

The data subject has the right to receive clear and transparent information regarding how their personal data is processed.

23.2. Right of Access

The data subject may request confirmation as to whether their personal data is being processed and, where provided by law, may request access to such data and to the information required by applicable legislation.

23.3. Right to Rectification

The data subject may request the correction of inaccurate personal data or the completion of incomplete data.

23.4. Right to Erasure

In certain circumstances provided by law, the data subject may request the deletion of their personal data.

This right is not absolute. ERDA may retain certain data where it has a legal obligation to retain it or where another legal basis permits or requires continued processing.

23.5. Right to Restriction of Processing

Under the conditions provided by GDPR, the data subject may request restriction of the processing of their personal data.

23.6. Right to Data Portability

Where the legal requirements are met, the data subject may request to receive personal data provided to ERDA in a structured, commonly used and machine-readable format and may request its transmission to another data controller, under the conditions provided by law.

23.7. Right to Object

The data subject may object to the processing of their personal data in the circumstances provided by GDPR.

In particular, the data subject may object at any time to the processing of their personal data for direct marketing purposes.

23.8. Right to Withdraw Consent

Where processing is based on consent, the data subject may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

24. Exercising Data Protection Rights

To exercise the rights provided under data protection legislation, the data subject may submit a request to ERDA using the contact details provided in this Policy.

To facilitate identification and processing of the request, the request may include:

• first and last name;

• the email address associated with the relationship with ERDA;

• the right the individual wishes to exercise;

• any information necessary to identify the relevant request.

ERDA may request additional information to verify the identity of the requester where this is necessary to protect personal data and prevent disclosure to an unauthorised person.

ERDA will facilitate the exercise of data subject rights and will respond to requests within the time limits provided by applicable law.

25. Right to Lodge a Complaint

The data subject has the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data infringes applicable legislation.

For Romania, the competent supervisory authority is:

The National Supervisory Authority for Personal Data Processing (ANSPDCP).

The right to lodge a complaint with the supervisory authority does not affect the data subject’s right to pursue any other remedies available under applicable law.

26. Automated Decision-Making and Profiling

ERDA does not intend, as part of its ordinary sale of products through the website, to make decisions based solely on automated processing of personal data that produce legal effects concerning a data subject or similarly significantly affect the data subject.

If, in the future, ERDA introduces profiling or automated decision-making processes falling within the scope of the rights provided by GDPR, relevant information concerning their existence, the logic involved and the envisaged consequences will be communicated to data subjects in accordance with applicable law.

27. Children’s Data

The ERDA website is not specifically directed at children.

ERDA does not knowingly seek to collect personal data from minors for purposes that are not permitted by applicable law.

If ERDA becomes aware that it has inadvertently collected personal data relating to a minor without an appropriate legal basis, it will take reasonable measures to address the situation in accordance with applicable law.

28. Relationship with the Cookie Policy

The ERDA website uses or may use cookies and similar technologies.

Detailed information regarding the types of cookies used, their purposes, storage periods and, where applicable, how consent may be provided or withdrawn is set out in the ERDA Cookie Policy.

This Privacy Policy and the Cookie Policy should be read and interpreted together.

29. Updates to the Privacy Policy

ERDA may update this Privacy Policy to reflect:

• changes in legislation;

• changes to the operation of the website;

• the introduction or removal of services;

• changes to the service providers used;

• changes to data processing practices;

• other relevant operational or commercial changes.

The updated version will be published on the website.

Where significant changes require the data subjects to be informed under applicable law, ERDA will take the appropriate steps to notify them.

30. Contact

For questions regarding the processing of personal data or for exercising rights under applicable data protection legislation, data subjects may contact ERDA using the following details:

Deneris Trade SRL
Trading brand: ERDA

Address: Str. Cetatii, Ferma 16, Hala 7, Floresti, postal code 407280, Cluj County, Romania
Email: contact@erdashoes.ro
Telephone: +4 0746 964 912

31. Final Provisions

This ERDA Privacy Policy shall supplement and be interpreted together with:

• the ERDA Terms and Conditions;

• the ERDA Return, Refund and Product Exchange Policy;

• the ERDA Shipping, Delivery and Payment Methods Policy;

• the ERDA Warranty and Product Conformity Policy;

• the ERDA Cookie Policy.

If any provision of this Policy becomes unenforceable as a result of legislative changes, the remaining provisions shall remain valid to the extent permitted by law.

ERDA
Deneris Trade SRL