We consider the right to protect the personal data as a fundamental commitment, so we will dedicate all the resources and efforts to process your data in full accordance with Regulation (EU) 2016/679 ("General Data Protection Regulation" or "GDPR"), as well as with any other applicable legislation on the territory of Romania. Since one of the essential principles of this legal framework is transparency, we have prepared this document by which we want to inform you about how we collect, use, transfer and protect your personal data when you interact with us in the products and services. ours, including through our website or by applications available on your mobile phone.

We reserve the right to update and modify this privacy policy periodically, to reflect any changes in how we process your personal data or any changes to the legal requirements. In the case of any such changes, we will display on our website the modified version of the Privacy Policy, which is why please check the content of this privacy policy periodically.

What categories of personal data we process

In general, we collect your personal data directly from you, so you have control over the type of information you provide us. With the title for example, we receive information from you as follows:

When you create a Natyshop account, you send us: e-mail address, first and last name;

When placing an order, provide us with information such as: the desired product, first and last name, delivery address, billing details, payment method, phone number, bank card data, etc.

We also offer you the opportunity to register on the Natshop platform through your Facebook or Google account. If you opt for one of these variants, you will be directed to a page administered by Facebook INC / Google LLC, where they will inform you about your data transfer to Natyshop. You can consult Facebook privacy policies, respectively Google, using the following links:

https://www.facebook.com/about/privacy

https://policies.google.com/privacy

We can also collect and process some information about your behavior while visiting our website or using your smartphone application, to customize your online experience and provide you with offers adapted to your profile. We invite you to find out more details in this regard by consulting the section regarding the purposes of the processing below.

On our website and in the smartphone app we can store and collect information in similar cookies and technologies, according to cookie policy.

We do not collect and otherwise process sensitive data, included by the General Data Protection Regulation in special categories of personal data. Also, we do not want to collect or process data from minors who have not reached the age of 16.

What are the goals and grounds of processing

We will use your personal data for the following purposes:

1. For the provision of our services for the benefit Your

This general purpose may include, as the case may be, the following:

a) creating and managing the account within our platform;

b) processing of orders, including taking over, validation, shipping and invoicing;

c) solving cancellations or problems of any kind regarding an order, to the goods or services purchased;

d) return of the products according to the legal provisions;

e) reimbursement of the value of the products according to the legal provisions;

f) providing support services, including offering your answers to your questions on your orders or Natyshop goods and services 

The processing of your data for these purposes is in most cases necessary for the conclusion and execution of a contract between Natyshop and you, certain processing subsumed by these purposes are imposed by the applicable legislation, including fiscal and accounting legislation.

2. To improve our services

We always want to offer you the best online purchase experience. For this, we can collect and use certain information about your buyer behavior, we can invite you to complete the satisfaction questionnaires subsequently to complete an order or we can carry out, directly or with the help of market partners, studies and research.

We establish these activities on our legitimate interest in carrying out commercial activities, always taking care that your fundamental rights and freedoms are not affected.

3. For marketing

We want to keep you up to date on the best offers for the products/services you are interested in. In this regard, we can send you any type of message (such as: e-mail/SMS/telephone/Mobile Push/Webpush/etc.) Containing general and thematic information, information on similar or complementary products that those that You have purchased them, information on offers or promotions, information on products added in the "Account/Cos" section or the "Account/Favorites" section or you have shown an interest in purchasing them, as well as other commercial communications such as research Of the market and opinion polls, and we can display personalized recommendations on the website and in the smartphone app. To provide you with information of interest to you, we can use certain data on your buyer behavior (eg viewed / added products in wishlist / purchased) to create a profile. We always make sure that these processing is carried out in compliance with your rights and freedoms and that the decisions made on their basis do not have legal effects on you and do not affect you similarly to a significant extent.

In most cases, we establish our marketing communications on your prior consent. You can change your mind and withdraw consent at any time.

In certain situations, we can rely on our marketing activities on our legitimate interest to promote and develop our commercial activity. In any situation where we use information about you for a legitimate interest, we take care and take all the necessary measures so that your fundamental rights and freedoms are not affected. However, you can request us at any time, by the means described above, to stop the processing of your personal data for marketing purposes, to take course of your request.

4. For the defense of our legitimate interests

There may be situations where we will use or transmit information to protect our rights and commercial activity. They may include:

-measures to protect the website and users of the Natyshop platform towards cyber attacks:

- measures to prevent and detect fraud attempts, including transmitting information to the competent public authorities;

- measures to manage the various other risks.

The general basis of these types of processing is our legitimate interest in defending our commercial activity, being understood that we make sure that all the measures we take guarantees a balance between our interests and your fundamental rights.

Also, in some cases we establish the processing on legal provisions such as the obligation to ensure the security of the goods and values ​​provided by the applicable legislation in this matter.

How long we keep your personal data

As a general rule, we will store your personal data as long as you have an account in the Natyshop platform. You can request us at any time to delete certain information or to close the account and we will respond to these requests, subject to the preservation of certain information including after the closing of the account, in situations where the applicable legislation or our legitimate interests require it.

To whom we transmit your personal data

As the case may be, we can transmit or provide access to certain personal data of you to the following categories of recipients:

- courier service providers;

- payment/bank service providers;

If we have a legal obligation or if necessary to defend a legitimate interest, we can also disclose certain personal data to public authorities.

We make sure that access to your data by third parties of private law is made in accordance with the legal provisions regarding data protection and confidentiality of information, based on contracts concluded with them.

In which countries we transfer Your personal data

Currently, we store and process your personal data on the territory of Romania.

However, it is possible to transfer certain data of you to personalized entities located in the European Union or outside the Union, including in countries to which the European Commission has not recognized an adequate level of protection of personal data.

We will always take measures to ensure that any international transfer of personal data is carefully managed in order to protect your rights and interests. Transfers to service providers and other third parties will always be protected by contractual commitments and, as the case may be, other guarantees, such as standard contractual clauses issued by the European Commission or certification schemes, such as the Privacy Shield for Personal Data Protection. transferred from within the EU to the United States.

You can contact us at any time, using the contact details above, to find out more about the countries in which we transfer your data, and the guarantees we have implemented on these transfers.

What rights do you have

The General Data Protection Regulation recognizes you a series of rights in relation to your personal data. You can request access to your data, correct any mistakes in our files and/or oppose the processing of your personal data. You can also exercise the right to complain to the competent supervisory authority or to address justice. If the case may be, you can also benefit from the right to request the deletion of your personal data, the right to restrict the processing of your data and the right to data portability.

More information about each of these rights can be obtained by consulting the table presented below.

To be able to exercise your rights, you can contact us using the contact details above. Please note the following aspects if you want to exercise these rights:

Identity. We take seriously the confidentiality of all records containing personal data. For this reason, please send us your requests regarding such records using the email address related to the Natyshop account or the phone number corresponding to the account. Otherwise, we reserve the right to verify your identity by requesting additional information that aim to confirm your identity.

Fees. We will not request a fee In order to exercise any rights to your personal data, unless your request for information is unfounded, respectively or excessive, in which case we will perceive a reasonable amount in such circumstances.  We will inform you of any fees applied before resolving your request.

The duration of response. We intend to respond to any valid requests within a maximum of one month, unless this is particularly complicated or if you have made more requests, in which case we will respond within two months. We will let you know if we will need more than a month. We may ask you if you can tell us exactly what you want to receive or what worries you. This will help us to act faster and shorten the response time to your request.

The rights of third parties. We must not comply with a request if it would negatively affect the rights and freedoms of other data subjects.