Starting with 2018, Regulation no. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as “GDPR”) is applicable in all European Union Member States.
GDPR also applies to the website www.ecommercetools.io, which is operated by ECOMMERCE WEB TOOLS S.R.L., with its headquarters in Bucharest, Lacul Tei Bulevard, block 6, 3rd floor, apartment 11, district 2, Romania, registered with the Trade Registry under no. J4019142/2022, having fiscal identification code RO46908705 (hereinafter referred to as “ECOMMERCE WEB TOOLS”).
Should you have questions or requests regarding the processing of personal data, you can contact us by sending an e-mail at: dpo@ecommercetools.io
The hereby Privacy Policy contains the methods regarding how personal data are processed by ECOMMERCE WEB TOOLS. Please read the Privacy Policy carefully. Afterwards, proceed to access the website www.ecommercetools.io. We will consider that you have accepted the Privacy Policy.
What Are Personal Data
Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
How We Collect Personal Data
ECOMMERCE WEB TOOLS constantly strive to ensure the confidentiality and security of your personal data. The legality, transparency and fairness of any processing operation is a priority for us, so we invite you to read fully and carefully our Privacy Policy. ECOMMERCE WEB TOOLS, in relation to its clients, may act as a controller or as a data processor, depending on how the personal data will be provided. As a controller, ECOMMERCE WEB TOOLS will determine the purposes and means of the processing of personal data. On the other side, as data processor, ECOMMERCE WEB TOOLS will process personal data only on behalf of the controller (which is also its final client) and shall not perform any action without the express consent of the controller. Therefore, all communication of personal data, sharing and other similar processing activities shall be prohibited without the express consent of the controller/of the data processor in case that these information are first provided to a data processor by the controller and afterwards the data processor will send the information to ECOMMERCE WEB TOOLS.
Personal data are processed in the following ways:
Directly:
1) As a data processor, ECOMMERCE WEB TOOLS can process personal data:
- when the data processor conduct the relevant searches (during the contractual negotiations) in order to have an overall view of the client’s website so that a proper fee for the project can be proposed;
- when, during its actual activity, the data processor has access to all personal data contained by the client’s website, so that he can make proper use of all the relevant tools for its activity;
2) As controller, ECOMMERCE WEB TOOLS can process personal data:
- when you are using the contact form presented on the website;
- when you subscribe to the newsletter;
Indirectly:
As a controller, when you access our platform in order to use the services, ECOMMERCE WEB TOOLS can collect via cookies different kind of information in order to manage user sessions, store language selection preferences and provide you with relevant ads. “Cookies” are small text files transferred by a web server to your device hard drive. Cookies can be used to collect the date and time of your visit, your preferences and your actions. You can set your browser to refuse all or some cookies or to warn you when web pages set or access cookies. You can disable or refuse cookies, but please note that certain parts of our Services/Platform may become inaccessible or may not work properly. For more information about the cookies we use, please see the Cookies Policy.
What Kind of Personal Data Do We Process
At the moment when you complete the “contact”/”contact us” form, the following data will be processed: name, surname, email address and other information which can be provided via the message sent for the description of the project. In this last case, given the variety of personal data that can be transmitted, ECOMMERCE WEB TOOLS cannot mention an exhaustive list.
If you have requested ECOMMERCE WEB TOOLS to share relevant news with you and you have completed the newsletter section, your email address will be processed by the controller.
If you send a written review following the collaboration with ECOMMERCE WEB TOOLS, your first name, last name, and other personal data, depending on the message sent, will be processed by ECOMMERCE WEB TOOLS. Also, should you choose to send a video testimonial, these audio-video images will also be processed.
Also, we can obtain information regarding the general use of the website indirectly, by using cookies. Such personal data may be preferences regarding the use of the website or relevant ads. The entire description of cookies and the exact information processed can be found here, in the Cookies Policy.
During the actions performed by ECOMMERCE WEB TOOLS as data processor, since the nature of the personal data processed is not at any time clear, the personal data processed can be various, depending on each project in part.
To the extent that the personal data of other data subject are sent to ECOMMERCE WEB TOOLS by the controller (if ECOMMERCE WEB TOOLS acts like data processor) or by the data subject (for the situation in which ECOMMERCE WEB TOOLS is a controller), and bearing in mind that in such situations ECOMMERCE WEB TOOLS does not have a direct possibility to provide information to these categories, the person providing the data has the obligation to inform properly the data subject about the processing of personal data, according to the details presented in this section. Thus, suitable measures will be taken so that this disclosure is made according to any applicable relevant law, so that ECOMMERCE WEB TOOLS can process personal data for appropriate purposes, without fulfilling any other additional formality.
Grounds for Data Processing
ECOMMERCE WEB TOOLS can process personal data based on the following legal grounds:
- article 6 (1) letter a) from GDPR: data subject has given consent to the processing of his or her personal data;
- article 6 (1) letter b) from GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- article 6 (1) letter c) from GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject;
- article 6 (1) letter f) from GDPR: processing is necessary for the purposes of the legitimate interests of ECOMMERCE WEB TOOLS.
Personal Data Sent to Third Party
Your personal data may sometimes be transferred even outside Romania, under legal or contractual obligations. However, in such cases in which ECOMMERCE WEB TOOLS act like data processor, no such data shall be further sent to other controller/data processor without the express consent of the entity which has sent the personal data.
When we transfer your personal data to a country that is not in the EEA, we ensure that a similar degree of protection is granted by ensuring the implementation of at least one of the following protection measures:
- i) We will only transfer personal data to countries that have been deemed to provide an adequate level of protection of personal data by the European Commission. For more details please see: Adequacy of the protection of personal data in non-EU countries;
- ii) If we use certain service providers, we may use specific contracts which can guarantee an adequate level of protection;
- iii) If we use US-based service providers, we may transfer data since they are part of the EU-US Privacy Shield which requires them to provide similar protection to personal data shared between Europe and US. For more details please see: EU-US Privacy Shield.
Personal Data Storage
All the personal data processed are stored in a secure environment which protects the content from unauthorized access, disclosure, use, modification or destruction by any person/entity. ECOMMERCE WEB TOOLS takes appropriate technical and organisational measures to ensure the security of personal data, such as controlled access or transfers in strict compliance with confidentiality requirements.
Refusal of Data Processing and Its Consequences
If you do not provide ECOMMERCE WEB TOOLS with the requested personal data, you will not be able to fully benefit from the content of the website, and we will not be able to meet your requests. For the situations when ECOMMERCE WEB TOOLS acts like a data processor, the refusal of data processing should be mentioned by the data subject in front of the entity who provide ECOMMERCE WEB TOOLS with the personal data.
The Rights of the Data Subject. Means of Exercising
Any data subject has the following rights:
- The access right means the right of the data subject to obtain a confirmation from ECOMMERCE WEB TOOLS regarding the existence of the processed data and, if so, access can be obtained to the respective data and to information on the way in which the data are processed;
- Correction right refers to the correction, without undue delay, of inaccurate personal data. The rectification will be communicated to each recipient to whom the data were transmitted, unless this proves impossible or involves disproportionate efforts from ECOMMERCE WEB TOOLS;
- Data deletion (“the right to be forgotten”) means certain persons concerned by a request for any personal data, without undue delay, under conditions of care, in the case one of the following reasons can be applied: they are no longer important for fulfilling the purposes for which was collected or processed; the person concerned decides to withdraw his or her consent if there is no other legal basis for the processing; the person concerned opposes to the processing and there are no legitimate reasons to prevail; the personal data was processed illegally; personal data must be deleted in order to comply with legal obligations;
- Restricted processing right can be exercised in case the accuracy of the data processed by ECOMMERCE WEB TOOLS is contested, for a period that allows the verification of the correctness of the data; the processing is illegal, and the person in question opposes the deletion of personal data, instead requesting the restriction; if ECOMMERCE WEB TOOLS no longer needs the personal data for the purpose of processing, but the person in question requests them for the finding, exercise or defense of a right in court; if the person has objected to the processing for the period of time in which it is verified whether the legitimate rights of ECOMMERCE WEB TOOLS prevail over those belonging to the data subject;
- The data portability right refers to the right to receive personal data in a structured, commonly used and automatically readable format and to the right to have this data transmitted directly to another controller, but only if this is feasible from a technical point of view;
- Opposition right refers to the right of the data subject to oppose the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it considers a legitimate interest of the controller. When the processing of personal data is aimed at direct marketing, the data subject has the right to object to the processing at any time;
- The right to withdraw your consent means that the data subject may withdraw its prior consent for data processing. However, those data that have been processed based on the previous consent are deemed to be legally processed;
- The right to complaint with the competent supervisory authorities. If it is considered that the rights recognized by Regulation no. 679/2016 have been violated, any data subject has the possibility to address to the supervisory authority by submitting a complaint.
Any requests/complaints/notifications regarding personal data will be addressed in writing to the controller (please note that if ECOMMERCE WEB TOOLS acts like data processor, the above rights shall also be addressed to the controller), at the email address: dpo@ecommercetools.io and with the provision of a contact address to which the answer/information related can also be communicated in writing. The same procedure will be followed in the case of requests/communications related to previous requests/complaints/notifications.
When addressing any request /complaint/notification, the claimant will be properly identified, in order to prevent compromising the confidentiality of data, taking measures at the request of unjustified/unauthorized persons or endangering/violating in any way the rights and legitimate interests of persons targeted in relation to the data for which the request is made.
In the case of requests formulated by a proxy, the appropriate identification of the proxy and the verification of its quality will be carried out. Requests sent by telephone or requests in which the only available contact date is the telephone number of the data subject will not be considered until they are sent in writing, under the conditions specified above. Similarly, if the request is made in conditions that raise a suspicion of the controller regarding the identity of the applicant or regarding the legal nature of the request, the controller may suspend the solution until providing reasonable additional information/data to confirm the identity and/or the quality of the claimant.
The solution of any request will be made within 30 days from its receipt. The response to the request and/or any related communications will be sent in writing to the person concerned or to the person authorized by him, in the manner in which the controller received the request (example – for the request sent by e-mail, it will be answered by e-mail, for the request by physical correspondence, it will be answered by physical correspondence), or in another written way, expressly and reasonably requested by the person concerned/by the proxy.
The Security Incident
The security incident is a violation of the security of personal data, which involves unauthorized processing. In case of a security incident, ECOMMERCE WEB TOOLS, following a detailed internal analysis, may address the Romanian supervisory authority – ANSPDCP without undue delay and, if possible, within 72 hours from the date on which it became aware of it, except the case in which it is unlikely to pose a risk to the rights and freedoms of individuals.
If the security incident is likely to pose a high risk to the rights and freedoms of individuals, the controller shall inform adequately and in accordance with the law, including the data subject, without undue delay.
Exceptionally, informing the data subject in case of an incident will not be done if:
a) adequate technical and organizational protection measures have been adopted regarding the data covered by the incident, whereby these data have become unintelligible to any person who is not authorized to access them;
b) the controller has ensured, through appropriate subsequent measures, that the high risk to the rights and freedoms of the data subjects is no longer likely to materialize;
c) information would require a disproportionate effort. In this situation, a public information will be made – through the controller‘s website and, possibly, in another way that will be considered necessary by the authority or that would ensure an equally efficient way of informing the data subjects.
In the phase prior to solving any request/complaint/notification and dpo during its resolution, as well as in case of any possible security breach, the relations between the controller and the data subject and the supervisory authority will be characterized by transparency and openness to cooperation in order to resolve any incident.
The Duration of the Processing
We will store your personal data only for the time necessary to achieve the processing purposes set out above, while respecting the legal legislation in force. Once the purpose of the processing has ceased and the legal obligations of ECOMMERCE WEB TOOLS have been fulfilled, the data will be deleted in accordance with the legal procedures.
Data Protection Officer
We remind you that you can contact the Data Protection Officer appointed by ECOMMERCE WEB TOOLS by sending your request at dpo@ecommercetools.io and by mentioning the following email subject: In attn. of ECOMMERCE WEB TOOLS DPO.
Modification of the Privacy Policy
If a change to the present Privacy Policy rules is required, ECOMMERCE WEB TOOLS will publish those changes to ensure accurate and complete information about the data collected and the use of such data.