1. INTRODUCTION

TRANSILVANIA NUTS SRL (hereinafter referred to as the Operator, we, or the company) respects your right to privacy and is committed to protecting the personal data you provide to us when using the website www.transilvanianuts.ro and the services it offers.

• Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data (GDPR);
• Law No. 190/2018 on measures for the implementation of Regulation (EU) 2016/679;
• Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector;
• Any other relevant regulations issued by the national supervisory authority (ANSPDCP).

2. OPERATOR IDENTITY AND CONTACT INFORMATION

Company Name: TRANSILVANIA NUTS SRL

Commercial Registry Number: J2002000657017

Unique Registration Code (CUI): RO15096888

Registered office: Drâmbar, Ciugud Commune, 36 Calea Alba Iulia Street, Alba County

Email address: office@transilvanianuts.ro

Phone: 0040 (358) 401 138

Website: www.transilvanianuts.ro

If you have any questions or concerns regarding the processing of your personal data, you can contact us using any of the methods listed above.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on how you interact with our website and services, we may collect and process the following categories of personal data:

3.1. Information provided directly by you

• Identification information: first name, last name;
• Contact information: email address, phone number;
• Shipping and/or billing address: street, house number, city, county, ZIP code, country;
• User account information: username, password (stored in encrypted form), account preferences;
• Order and transaction data: products purchased, amount, payment method (we do not store credit card information—this is processed exclusively by authorized payment service providers);
• Content of communications: messages sent via the contact form, requests, complaints, and feedback.

3.2. Automatically collected data

• Browsing data: IP address, browser type, operating system, pages viewed, time spent on the site, referring URL;
• Device information: device type, screen resolution;
• Data generated by cookies and similar technologies (detailed in Section 8 – Cookie Policy).

3.3. Data obtained from third-party sources

• Data from social media platforms (Facebook, Instagram), if you interact with our pages or log in using those accounts;
• Information provided by delivery partners regarding the shipment and delivery of orders.

4. PURPOSES AND LEGAL BASIS OF THE PROCESSING

We process your personal data on the following legal grounds and for the following purposes:

1. (a) Performance of a contract (Article 6(1)(b) of the GDPR)

• Processing and managing orders placed on the website;
• Issuing tax invoices and accounting documents;
• Arranging delivery of the ordered products;
• Handling returns, refunds, and complaints;
• User account management.

1. b) Legal obligations (Article 6(1)(c) of the GDPR)

• Compliance with the tax and accounting obligations set forth in Romanian law;
• Response to requests from the competent authorities.

1. c) The Controller’s legitimate interests (Article 6(1)(f) of the GDPR)

• Fraud prevention and detection;
• Improving the website’s functionality and user experience;
• Anonymized statistical analysis of website traffic;
• Information System Security.

1. d) Your consent (Article 6(1)(a) of the GDPR)

• Sending newsletters and marketing communications (you may withdraw your consent at any time);
• The use of non-essential cookies (analytical, marketing);
• Publishing reviews and testimonials on the website.

For existing customers, certain marketing communications regarding similar products or services may be sent based on the Controller’s legitimate interest, in compliance with the provisions of Law No. 506/2004, and with the option to unsubscribe at any time.

5. RECIPIENTS OF PERSONAL DATA

Your data may be disclosed, to the extent strictly necessary, to the following categories of recipients:

• Courier and logistics service providers – for product delivery;
• Authorized payment processors – for processing online financial transactions;
• Web hosting and IT infrastructure service providers – acting as the Controller’s processors;
• Email marketing service providers (e.g., newsletters) – based on your consent;
• Analytics service providers – statistical and pseudonymized data collected through traffic analysis services configured to minimize the impact on user privacy;
• Public authorities or government agencies – in the situations provided for by law;
• Legal advisors, accountants, or auditors—who are bound by strict confidentiality.

We do not sell, rent, or share your personal data with third parties for commercial purposes.

The operator works exclusively with suppliers that provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures for the protection of personal data, in accordance with Article 28 of the GDPR.

6. INTERNATIONAL DATA TRANSFERS

In certain situations, your personal data may be transferred to service providers located outside the European Economic Area (EEA). In such cases, these transfers are made exclusively in compliance with the provisions of Chapter V of the GDPR and based on appropriate safeguards, namely:

• Standard Contractual Clauses adopted by the European Commission;
• Equivalence decisions issued by the European Commission;
• Additional technical and organizational measures to protect the transferred data.

The operator periodically assesses the level of protection provided by third-party providers and takes reasonable measures to ensure the confidentiality and security of personal data transferred internationally.

Data subjects may request additional information regarding the applicable transfer mechanisms by sending a request to office@transilvanianuts.ro.

7. RETENTION PERIOD FOR PERSONAL DATA

Your data is stored only for as long as necessary to fulfill the purposes for which it was collected, in compliance with legal requirements:

• Data related to orders and transactions: 10 years, in accordance with applicable accounting and tax laws (Accounting Law No. 82/1991);
• User account data: for the duration of the account’s existence, plus 3 years after deletion, for the resolution of any disputes;
• Data for newsletters/marketing: until consent is withdrawn;
• Data from the contact form: up to 3 years from the date of submission;
• User account data: for the duration of the account’s existence and, thereafter, for a maximum period of 3 years following deletion, solely for the purpose of defending the Controller’s legitimate rights and interests in any disputes;
• Browsing data and cookies: in accordance with the timeframes specified in the Cookie Policy.

Once the retention period expires, the data is securely deleted or anonymized.

8. COOKIE POLICY

The website www.transilvanianuts.ro uses cookies and similar technologies to ensure the platform functions properly. Cookies are small files stored on your device when you visit the website.

8.1. Categories of cookies used

• Strictly necessary cookies: essential for the website to function (login, shopping cart). No consent required.
• Functional cookies: these cookies remember your preferences (language, currency). They require your consent.
• Analytical cookies (e.g., Google Analytics): collect information about how the website is used for statistical purposes. Consent is required.
• Marketing/advertising cookies: used to display relevant ads. Consent is required.

8.2. Cookie Management

You can manage your cookie preferences via the consent banner displayed when you first visit the site, as well as through your browser settings. Disabling certain cookies may affect the site’s functionality.

9. YOUR RIGHTS

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 of the GDPR): the right to obtain confirmation as to whether your data is being processed and to receive a copy thereof;
• Right to rectification (Art. 16 of the GDPR): the right to request the correction of inaccurate data or the completion of incomplete data;
• Right to erasure – the right to be forgotten (Art. 17 of the GDPR): the right to request the erasure of data, under the conditions provided by law;
• The right to restriction of processing (Art. 18 of the GDPR): the right to request that processing be restricted in certain situations;
• The right to data portability (Art. 20 of the GDPR): the right to receive data in a structured, commonly used, and machine-readable format;
• Right to object (Art. 21 GDPR): the right to object to the processing of your personal data, including for direct marketing purposes;
• The right not to be subject to automated decision-making (Art. 22 GDPR): the right not to be subject to decisions based solely on automated processing;
• The right to withdraw consent (Art. 7 of the GDPR): at any time, without affecting the lawfulness of previous processing.

To exercise any of your rights, please send us a written request via email to office@transilvanianuts.ro or by mail to the company’s registered office. We will respond within 30 calendar days.

10. THE RIGHT TO FILE A COMPLAINT

If you believe that the processing of your personal data violates the provisions of the GDPR or applicable national law, you have the right to file a complaint with the national supervisory authority:

Authority: National Supervisory Authority for Personal Data Processing (ANSPDCP)

Address: 28–30 General Gheorghe Magheru Boulevard , Sector 1, Bucharest

Website: www.dataprotection.ro

Email: anspdcp@dataprotection.ro

Phone: +40.318.059.211

We recommend that you contact us in advance so that we can resolve any issues amicably.

11. PERSONAL DATA SECURITY

The controller implements appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data transmitted via the HTTPS protocol (SSL/TLS);
• Storing passwords in encrypted (hashed) format;
• Restricted access to data, based on the need-to-know principle;
• Performing regular backups;
• Regular assessment and monitoring of security systems;
• Staff training in data protection.

In the event of a security incident that poses a risk to your rights and freedoms, we will notify the ANSPDCP within the legal timeframe (72 hours) and, if necessary, we will inform you directly.

12. PROCESSING OF MINORS’ DATA

The website www.transilvanianuts.ro is not intended to intentionally collect personal data from minors under the age of 16.

If we discover that personal data of a minor under the age of 16 has been collected without the consent of their legal guardian, we will take reasonable steps to delete such data as soon as possible.

Parents or legal guardians who believe that a minor in their care has provided personal information through the website may contact us at office@transilvanianuts.ro.

13. LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to third-party websites. This Privacy Policy applies exclusively to the website www.transilvanianuts.ro. We are not responsible for the privacy practices of third-party websites, and we recommend that you review their privacy policies before providing any personal data.

14. PRIVACY POLICY UPDATE

We reserve the right to update this Privacy Policy to reflect legislative, technical, or organizational changes. The updated version will be posted on the website with the date of the last update. We recommend that you review this policy periodically.

In the event of significant changes that affect your rights, we will notify you by email (if you have provided us with your email address) or by posting a prominent notice on the website.

15. FINAL PROVISIONS

This Privacy Policy is the official document of TRANSILVANIA NUTS SRL regarding the processing of personal data and takes effect on the date of its publication on the website.

Any dispute arising from the application of this policy shall be resolved, as a matter of priority, through amicable settlement. Otherwise, the matter shall be referred to the Romanian courts.

TRANSILVANIA NUTS SRL | office@transilvanianuts.ro | www.transilvanianuts.ro