2. Data Protection Policy (GDPR)

Effective as of May 25, 2018

1. Identity of the data controller

TIP TOP FOOD INDUSTRY S.R.L. (hereinafter referred to as “Tip-Top” or “we”) is a company headquartered in Bucharest, at 94 Timișoara Blvd., Sector 6, Postal Code 61334, registered with the Trade Register under no. J1993009219401, with the unique registration code 3900317.

We collect and process various categories of personal data from you as a user of the website www.tiptop.ro; therefore, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, we act as the data controller for this information.

The protection of your personal data is of great importance to us. This notice regarding the processing of personal data aims to inform you about how we collect, process, and protect personal data when you visit our website, as well as your rights regarding the processing of such data and how applicable legislation protects you.

This website is not intended for persons under the age of 18, and we do not intentionally collect data concerning children.

It is important that the personal data you provide to our company be accurate and up-to-date. Please notify us immediately of any changes to this data during the course of our relationship. This site may contain links to third parties, plugins, and applications. Accessing these external links, enabling certain features, or using the applications or plugins may allow third parties to collect or store your personal data. We do not control these third-party sites and are not responsible for their privacy notices, statements, or policies. We recommend that you read the privacy policy of each site you visit after leaving our site.

Please read this notice carefully to understand how we process your personal data.

2. Personal data processed

By “personal data,” we mean information that can be used to identify an individual.

We may collect, use, store, and transfer various types of personal data about you, as follows:
– Data entered by you in the “Contact” section – specifically, your identification details (name, email address, phone number);
– Technical data (IP address – Internet Protocol, browser type and version, time zone, operating system, platform type, and other technologies or devices used to access the website). The website automatically collects certain information and stores it in log files; this information includes your IP address, the general location of your computer or device (at the city level), browser type, operating system, access time, the link to the accessed page, and your browsing history on our site.
– Usage data (information about how you use the website).

We do not collect special categories of personal data about you (regarding race or ethnicity, religion or beliefs, sexual orientation, political opinions, or other sensitive information). We also do not collect information regarding criminal convictions or offenses.

The data is not transferred outside the European Union.

You can visit our website without providing personal data. However, if you wish to contact us via the contact form, you must fill in the relevant fields with the requested data. Without providing this data, you will not be able to use the contact form’s functionalities. We have configured the mandatory fields to request only the minimum amount of information needed to identify and contact you, if necessary. Furthermore, we do not make this contact method conditional upon your consent to marketing activities.

In all cases, we provide a simple option to unsubscribe at any time, either within the communication itself or by contacting us. Once you unsubscribe, commercial communication ceases.

3. Methods of processing personal data and purposes of processing

We use various methods to collect data from and about you, including through direct interactions, such as when you fill out forms or engage in other direct interactions. These interactions involve personal data that you provide when:

  • Requesting information about our company’s marketing campaigns;
  • Filling out the contact form;
  • Accessing the website.

When you use our website, we may automatically collect technical data regarding the devices used, your actions, and browsing patterns. We collect this personal data using cookies, server sessions, or similar technologies. We may also receive technical data about you if you visit other websites that use our cookies. For further details, please consult our Cookie Policy.

We may also receive personal data about you from third parties (as well as from public sources), as follows:
Analytics/data service providers (Google Analytics, Google Analytics Ecommerce, StatCounter, and other monitoring systems);
Promotional networks and channels (Google AdWords, Google Remarketing, affiliate systems, social media networks – Facebook, Instagram, Twitter, YouTube, and other social media networks used).

We will use your personal data only within the limits permitted by law. In most cases, we will use your personal data in the following situations:
When personal data is necessary for our legitimate interests (or those of third parties), and your interests and fundamental rights do not override our legitimate interests; and in situations where we must comply with legal obligations and provisions.

We will use your personal data for the following purposes:
(i) Managing and protecting this website and serving our company’s legitimate business interests (including resolving technical issues, data analysis, testing, system maintenance, support, reporting and hosting, identifying products and services of interest to customers as well as issues reported by them regarding company products, identifying requests for new products, etc.), so that our company operates optimally, products remain competitive and attractive, we can monitor food product quality and safety and prevent contamination, and ensure IT network security—to prevent unauthorized access and fraud and to properly provide administrative and IT services—which requires identification data, contact details, technical data, usage data, and profile data;
(ii) Marketing activities (responding to contact forms, launching new product ranges or products, newsletters). You will receive marketing communications from us if you have requested information and provided us with your data in any of the aforementioned situations and have not opted out of receiving marketing communications from our company;
(iii) Other legitimate purposes.

4. Your rights regarding personal data

As a data subject, you have certain legal rights regarding the personal data we collect from you and process. Our Company respects your rights and will address your requests appropriately.

(a) Right to withdraw consent: If you have given your consent for the processing of your personal data, you may withdraw this consent at any time. In the case of commercial communications, this withdrawal can be effected through the communications themselves or via account functionalities, in addition to the contact method specified below.
(b) Right of access: You may request information regarding the personal data we hold about you, including information on the categories of data we hold or control, the purposes for which they are used, the source from which we collected them (if obtained indirectly), and the recipients to whom such data are disclosed, as applicable.

We will provide you with a copy of your personal data upon request. If you request additional copies of your personal data, we may charge a reasonable fee based on administrative costs.
You have the right to be informed about the safeguards put in place for the transfer of your personal data to a country outside the European Union and the European Economic Area, should you ask us to confirm whether or not we are processing your personal data and whether we are transferring such data to a country outside the European Union and the European Economic Area.
(c) Right to rectification: You have the right to obtain from us the rectification of personal data concerning you. You may use the account features for this purpose, and you may also contact us in the manner set out in Section 6 below.
(d) Right to restriction of processing: You may obtain from us the restriction of the processing of your personal data if:
– you contest the accuracy of your personal data, for the period necessary for us to verify its accuracy,
– the processing is unlawful, but you oppose the erasure of the personal data and request the restriction of its use instead,
– we no longer need your personal data, but you require it for the establishment, exercise, or defense of legal claims, or
– you object to the processing, for the period during which we verify whether our legitimate interests override your interests. (e) Right to portability: You have the right to receive the personal data you have provided to us and, where technically feasible, to request the transmission of your personal data (which you have provided to us) to another organization.

You have these two rights if the following conditions are met cumulatively:
– We process your personal data using automated means;
– We rely on your consent to process your personal data, or the processing of your personal data is necessary for the conclusion or performance of a contract to which you are a party;
– You have provided your personal data to us; and
– The transmission of your personal data does not adversely affect the rights and freedoms of others.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Your right to receive your personal data must not adversely affect the rights and freedoms of others. This could occur if transmitting your personal data to another organization also involves transmitting the personal data of other individuals (who do not consent to this transfer).

You have the right to have your personal data transmitted by us to another organization, provided that such transmission is technically feasible.
(f) Right to erasure: You have the right to request the erasure of personal data concerning you that we process. We are obliged to comply with this request if we process your personal data and if:
(i) The personal data are no longer necessary for the purposes for which they were collected;
(ii) The data subject objects to the processing on grounds relating to their particular situation;
(iii) The personal data have been processed unlawfully;
(iv) The personal data must be erased to comply with a legal obligation incumbent upon the Controller, unless the data are necessary:
– for exercising the right of freedom of expression and information;
– for compliance with a legal obligation incumbent upon us;
– for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or
– for the establishment, exercise, or defense of legal claims.
(g) Right to object: Where processing is not based on your consent but on our legitimate interests or those of a third party, you may object at any time to the processing of your personal data on grounds relating to your particular situation. In such a case, we will no longer process your personal data unless (i) we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or (ii) the processing is for the establishment, exercise, or defense of legal claims. If you object to the processing, please specify whether you also wish for your personal data to be erased; otherwise, we will only restrict the processing thereof.
You may object at any time to the processing of your personal data for marketing purposes based on our legitimate interest, regardless of the reason. If the processing for marketing purposes was based on your consent, you may withdraw that consent.

We also wish to inform you of the following:
– Timeframe: We will make every effort to address your request within one month; however, this period may be extended due to specific reasons related to the right invoked or the complexity of your request. In any event, should this period be extended, we will inform you of the duration of the extension (up to a maximum of two months) and the reasons for it.
– Access restrictions: In certain situations, we may be unable to provide you with access to all or part of your personal data due to legal restrictions. If we refuse your access request, we will inform you of the reason for the refusal.
– Inability to identify: In certain cases, we may be unable to identify your personal data based on the identifying information provided in the request. In such situations, if we cannot identify you as the data subject, we cannot process your request under this section unless you provide additional information enabling us to identify you. We will inform you of this and give you the opportunity to provide the relevant additional details.
– Exercising your rights: To exercise your rights, please contact us in writing (including by electronic means) using the contact details provided below.

5. Right to lodge a complaint

Any person dissatisfied with the way we process personal data may notify us directly so that we can resolve the issue raised. However, you may also contact the National Supervisory Authority for Personal Data Processing via its website (www.dataprotection.ro) or lodge a complaint with: National Supervisory Authority for Personal Data Processing; Address: 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Postal Code 010336, Bucharest, Romania; Telephone: 0318.059.211, 0318.059.212; Fax: 0318.059.602; E-mail: anspdcp@dataprotection.ro.

6. Information sharing

We will not disclose your personal data, except in the cases and to the recipients (third parties) described below. We will take appropriate measures to ensure that your personal data is processed, secured, and transferred in accordance with legal requirements.

We will share only the necessary portion of your personal data, and only to the extent required, with the following categories of third parties:
(a) Companies providing services relevant to the website, such as traffic analytics, social media integrations, marketing service providers (e.g., for newsletters), website advertising service providers, IT system providers, and maintenance service providers. A list of these entities is available upon request.
(b) Other entities, such as public authorities and institutions, accountants, auditors, lawyers, and other internal and external professional consultants, as well as banking and insurance institutions, in situations where their activities require access to such data or where we are legally obliged to disclose it.

We will also disclose your personal data to third parties:
(a) if you request us to do so or provide your consent to that effect;
(b) to persons who can demonstrate that they have the legal authority to act on your behalf;
(c) if doing so serves our legitimate interest in managing, expanding, or developing our business—for example, in the event that our Company (or a substantial part of its assets) is acquired by a third party, in which case the personal data held by TIP TOP FOOD INDUSTRY S.R.L. will constitute one of the transferred assets;
(d) if we are required to disclose your personal data in order to comply with a legal obligation or a legitimate request from government or executive authorities, as well as to the extent necessary to meet national security or law enforcement requirements or to prevent illegal activities;
(e) to respond to potential claims, to protect our rights or the rights of a third party, to protect the safety of any person, or to prevent any illegal activity.

7. Personal data retention period

Your personal data will be stored only for the period strictly necessary to fulfill the purposes for which it was collected, in accordance with our internal retention policies and applicable legal obligations:

    • Contact form data: Retained for a period of 12 months from the date of the last interaction, for the purpose of resolving your requests and ensuring communication traceability, unless the request results in an order or a commercial contract.
    • Marketing activity data (newsletter): Stored for the entire duration of the blog/platform’s existence or until you choose to withdraw your consent by using the “Unsubscribe” button. Following unsubscription, your data will be permanently removed from our marketing database within a maximum of 30 days.
    • Technical and usage data (Cookies and Analytics): Data collected automatically via log files and cookies is stored for a specific period corresponding to its purpose (ranging from the duration of the browsing session to a maximum of 26 months for statistical analysis tools, such as Google Analytics) before being deleted or fully anonymized.

Upon the expiration of these periods or following a legitimate deletion request made by the data subject, the data will be securely destroyed or converted into anonymous data that no longer allows for the identification of the user.

8. Securing Personal Data

We have implemented appropriate measures to prevent the accidental loss of personal data, as well as its unauthorized use, access, alteration, or disclosure. Furthermore, we limit access to your data to specific individuals within the company—such as employees, agents, and other parties (third parties). These individuals will process personal data solely in accordance with our instructions and are subject to a confidentiality obligation.

9. Contact information

Please direct any inquiries regarding data protection and any requests to exercise your rights to our Data Protection Officer using the following contact details:

In attention to: Data Protection Officer,
Email: ofiterprotectiadatelor@tiptop.ro;
Address: 94 Timisoara Blvd., Sector 6, Postal Code 61334, Bucharest
Phone no: 021.301.15.50.

In cuprinsul prezentelor conditii, societatea Tip Top Food Industry S.R.L. este denumita si “Tip Top” sau “Tip Top Food Industry”.
Navigarea pe Site implica acceptarea expresa si neconditionata a acestor Termeni si Conditii, in versiunea publicata pe Site la momentul accesarii. Vanzatorul isi rezerva dreptul de a modifica unilateral aceste prevederi pentru a reflecta schimbarile legislative sau de ordin comercial de la momentul actualizarii, noua versiune devenind opozabila utilizatorilor de la data publicarii ei pe Site.