PERSONAL DATA PROCESSING POLICY
LAST UPDATE: 08.09.2021
1. PREAMBLE
1.1. Respecting your privacy is one of our fundamental commitments and, therefore, we pay the utmost attention to the processing of your personal data, in accordance with applicable law, including without limitation the General Data Protection Regulation no. 679/2016 (“GDPR”). We are aware of the importance of maintaining the confidentiality, integrity and security of your personal data ("Personal Data") and have drafted this personal data processing policy ("Policy") to explain how your Personal Data is collected, stored, used and disclosed by Ebriza Software SRL, headquartered at Aleea Valeriu Bologa, No. 3, SC5, Cluj Napoca, Jud. Cluj tax identification code (CIF) 34933438, registration number with the Trade Register J12/2344/2017 ("Ebriza", "we"), as operator, in connection with access to and use of the website available at the URL www.ebriza.com and the content related to this website, including the Services („Platform).
1.2. Whenever we are required by applicable law or wish to use this legal basis, we will request your free, informed, specific and unequivocal consent for the processing of your Personal Data. By expressing your consent, you agree that we may collect, use, disclose, process and transfer Personal Data in accordance with this Policy.
1.3. We reserve the right to modify the provisions of this Policy from time to time. If we make changes to this Policy, we will make the updated version available on the Platform and update the date mentioned under "Last updated". We will also notify you of the changes to ensure that you are informed about how your Personal Data will be used. Any change to the Policy will apply from the date it was made, except for changes that require your prior consent and which will apply from the moment you express this consent.
1.4. For the avoidance of doubt, we are not obligated to inform you, using the contact details associated with your Platform Account, of any and all changes to this Policy.
Any capitalized term not defined in this Policy shall have the meaning given to it by the Terms and Conditions applicable to the Platform, which can be accessed here: www.ebriza.com/termsandconditions
2. APPLICABILITY
This Policy applies strictly to the processing of Personal Data carried out by Ebriza, as a Personal Data controller.
For the avoidance of doubt, this Policy does not apply to:
a. The processing of personal data stored and used by Ebriza Customers on the
Platform;
b. The processing of personal data processed by Application Developers
marketed on the Ebriza Marketplace.
For further information on how Ebriza Customers and Application Developers marketed on the Ebriza Marketplace process your Personal Data, please consult their privacy policies.
3. PERSONAL DATA PROCESSED, PURPOSES OF PROCESSING AND GROUNDS FOR PROCESSING
3.1. Platform navigation data
The computer systems and software applications used for the operation of the Platform generally obtain some Personal Data (so-called “log files”), the transmission of which is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified persons, however, due to its nature, it may allow, through processing and integration with certain data stored by third parties, the identification of users. This information includes IP addresses, the time of the request, the method used to send the request to the server, the size of the file obtained in response, as well as other parameters relating to the user's operating system.
To the extent that this information leads to the identification of a user, the provisions of this
Policy become applicable.
Purpose of processing: We use this data only to obtain anonymous statistical information on the use of the Platform and to verify its correct functioning.
Ground for processing:
● Our legitimate interest in improving our Platform and in managing server capacities and in keeping our Platform error-free (art. 6 para. 1, lit. f GDPR);
● Fulfillment of legal duties relating to the security aspects of our systems, including without limitation those resulting from the obligation of Ebriza to take appropriate technical and organizational measures for the processing of personal data (art. 6 para. 1, letter c GDPR).
3.2. Creating an account
On our Platform you have the possibility to register and create an account. In this case, we will need your first and last name, username, email address and telephone number.
Purpose of processing: The purpose of this processing is to create the account, provide our Services through the Platform and provide assistance in using the Platform.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, lit. b GDPR);
3.3. Informing users added to the account
Once the account has been created, it is possible to add new users (e.g., manager, waiter, accountant). In this case, we will use the name, surname, username to create their account and we will use their email address and phone number to inform them about the account creation.
Purpose of processing: The purpose of this processing is to create the user account and to inform the newly added user about the creation of his/her Ebriza account.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, lit. b GDPR);
● The legitimate interest of the Ebriza Customer in using our Platform (art. 6 para. 1, lit. f GDPR);
The source of this Personal Data is the Ebriza Customer.
3.4. Utilizarea Platformei
Odată creat contul, Platforma noastră poate fi folosită de mai mulți utilizatori din cadrul Clientului Ebriza (e.g., manager, ospătar, contabil). În acest caz, vom utiliza Datele cu Caracter Personal colectate la momentul creării contului și adăugării utilizatorilor. 4,875
3.4. Use of the Platform
Once the account is created, our Platform can be used by multiple users within the Ebriza Client (e.g., manager, waiter, accountant). In this case, we will use the Personal Data collected at the time of account creation and user addition. Each user can also add their image and add their CNP.
Purpose of processing: The purpose of this processing is to provide our Services through the Platform, in particular to enable the Platform to be used by multiple users on behalf of the Ebriza Client.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, lit. b GDPR);
● Your consent (art. 6 para. 1, lit. a GDPR).
3.5. Use of Intercom, Optivoice and Freshdesk services
The Platform uses the messaging and communications applications provided by Intercom R&D Unlimited Company, an Irish company, with its registered office in Dublin, St. Stephen's Green, No. 18-21, Stephen Court (“Intercom”). In this case, we process the following Personal Data: username, email address, telephone, location, operating system version, browser version, IOS App version, session number.
The Platform also uses the Optivoice services, provided by Opticom Consulting SRL, a Romanian company, with its registered office in Sibiu, Str. Gutuilor, no. 15, registered in the Trade Register with number J32/448/2012, CUI RO 30203988 („Optivoice”). In this situation we process the following Personal Data: telephone number.
The Platform also uses Freshdesk services, provided by Freshworks, Inc, a company in the United States of America, San Bruno, BayHill Drive, no. 1250 („Freshdesk”). In this situation, we process the following Personal Data: name, surname, username, e-mail address, telephone, location, operating system version, browser version, IOS App version, session number.
Purpose of processing: This information will be processed by us to ensure communication with our customers on the Platform.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, lit. b GDPR);
● Our legitimate interest in improving our Platform and ensuring communication with our customers (art. 6 para. 1, lit. f GDPR);
We are not responsible for the processing by Intercom, Optivoice and Freshdesk of your Personal Data. For further information on how Intercom, Optivoice and Freshdesk process your Personal Data, please refer to their respective privacy policies.
3.6. Contractual Notices
In the course of providing our services, we will use the address your e-mail address and your telephone number to notify you of any changes to the terms and conditions of use of the Platform and in relation to any other aspects related to the execution of the contract between Ebriza and you.
Purpose of processing: The purpose of this processing is to make contractual notifications, in accordance with the terms and conditions of use of the Platform.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to the conclusion of a contract (art. 6 para. 1, litb RGPD);
3.7. Contact
You have the possibility to contact us in different ways: by e-mail, by phone, by feedback or support form. In this case, we may process the following Personal Data: name, surname, e-mail, telephone and any other information you voluntarily provide when contacting us.
Purpose of processing: In this situation, we will use your Personal Data only to contact you in connection with the requested offer or in connection with the resolution of the indicated problem.
The basis for processing:
● The legal basis for this processing is to execute a contract or to take steps at your request before concluding a contract. (art. 6 par. 1, lit. b GDPR);
● Our legitimate interest in ensuring communication with our customers and providing the necessary support for the use of the Platform (art. 6 par. 1, lit. f GDPR);
3.8. Commercial communications
You have the option to opt-in to receive commercial communications via email, SMS messages or phone calls.
Purpose of processing: If you opt-in to receive such commercial messages, we will use your email address and phone number to send you commercial messages regarding Ebriza activities and promotions.
Ground for processing:
● The legal basis for processing your email address and phone number for this purpose is your consent. (art. 6 par. 1, lit. of the GDPR).
You can revoke your prior consent at any time and free of charge, by using the unsubscribe link indicated in each commercial communication.
3.9. Providing technical support
If you report technical problems with the functioning of the Platform, we have the possibility to access your user account to identify and remedy the problem. In this case, we will have access to and use the Personal Data collected at the time of account creation, user addition and use of the Platform
Purpose of processing: The purpose of this processing is to provide the technical support necessary for the functioning of the Platform, at the request of the data subject.
Ground for processing:
● Execution of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, litb GDPR);
3.10. Provision of Personal Data
You may refuse to provide certain Personal Data (indicated above) but, in such a case, you may not be able to benefit from certain services and functionalities of the Platform, including, but not limited to, creating a User account or
contacting you to resolve your problem and to
provide you with support.
4. AUTOMATIC PROCESSING OF PERSONAL DATA
Your Personal Data will not be processed for the purpose of generating decisions based solely on automated processing that would produce legal effects on you or significantly affect you.
5. PROCESSING DURATION
As a rule, we will process your Personal Data for the duration of your account on our Platform.
Personal Data collected for the purpose of sending commercial communications will be processed until the date of withdrawal of consent.
Personal Data collected for the purpose of providing technical support in connection with the operation of the Platform will be processed for the period necessary to resolve the issue reported by you.
In certain circumstances, we may retain Personal Data for longer periods of time, for example where we are obliged to do so in accordance with legal, regulatory, tax or accounting requirements.
We may also retain Personal Data for longer periods long term, so that we have an accurate record of your dealings with us in the event of any complaints or if we reasonably believe that there is a prospect of litigation related to the Processing of your Personal Data or transactions.
6. TRANSFER OF PERSONAL DATA
Personal Data is stored on the servers of contractual partners who help us provide our services.
We may transfer Personal Data, to the extent necessary, to the following categories of recipients:
● contractual partners;
● subcontractors;
● companies that provide courier services;
● companies that provide IT services;
● suppliers of software or hardware products;
● market research companies;
● marketing companies;
● public authorities, courts or arbitration courts, as well as authorities
competent to investigate the commission of criminal acts.
These recipients may be located in the European Union and/or the European Economic Area. If the recipients are located outside the European Union and the European Economic Area, including in countries that are not recognized as ensuring an adequate level of protection, the transfer of Personal Data is only carried out if there are appropriate safeguards in place, in accordance with applicable law. In this regard, we rely on several safeguards, such as the Privacy Shield certificate or the standard contractual clauses issued by the European Commission. You can receive from us a list of recipients in third countries, as well as a copy of the agreed provisions that ensure an adequate level of protection of Personal Data. For any request in this regard, please contact us at the contact details mentioned below.
7. SECURITY OF PERSONAL DATA
The security of your Personal Data is important to us. Therefore, your Personal Data will be processed by applying reasonable technical and organizational measures to protect the Personal Data, such as limiting access to the Personal Data, encrypting or anonymizing the Personal Data, storing it on secure media. However, despite our efforts, we cannot always guarantee the effectiveness of the security measures implemented, and therefore, we cannot guarantee the security of the Personal Data at all times.
8. YOUR RIGHTS REGARDING THE PROCESSING OF
PERSONAL DATA
8.1. Your rights
In accordance with applicable law, you have the following rights:
Right of access: You have the right to obtain confirmation from us that your Personal Data is processed by us, as well as information regarding the specifics of the processing such as: the purpose, the categories of Personal Data processed, the recipients of the Personal Data, the period for which the Personal Data is stored, whether we transfer it abroad and how we protect it, your rights, the right to file a complaint with the supervisory authority from which we obtained the Personal Data.
Right to rectification: You have the possibility to request the rectification of your Personal Data, provided that the applicable legal requirements are complied with. In the event of errors, upon notification, we will immediately correct your Personal Data.
Right to erasure: In certain cases, you have the possibility to request the erasure of Personal Data, namely: (i) they are no longer necessary for the purposes for which we collected and process them; (ii) you have withdrawn your consent for the processing of Personal Data and we can no longer process the Personal Data based on other legal grounds; (iii) the Personal Data is processed contrary to the law; (iv) you exercise a legal right to object. We are not obliged to comply with your request for erasure if the processing of Personal Data is necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims. There are also other circumstances in which we are not obliged to comply with this request to delete Personal Data.
Restriction of processing: You may request that we restrict the processing of your Personal Data in the following situations: (i) where you contest the accuracy of the Personal Data, for a period that allows us to verify the accuracy of the Personal Data in question; (ii) where the processing is unlawful, and you oppose the erasure of the Personal Data, requesting instead the restriction of its use; (iii) where we no longer need the Personal Data for the purposes of the processing, but you request it from us for legal action; (iv) where you have objected to the processing, for the period of time during which it is verified whether our legitimate rights as a controller override those of the data subject. We may continue to use Personal Data following a request for restriction, where: (i) we have your consent; (ii) to establish, exercise or defend legal claims; or (iii) to protect the rights of another natural or legal person.
Right to data portability: To the extent that Personal Data is processed based on your consent or for the performance of a contract and the processing is done by automated means, you have the right to have your Personal Data provided to you in a structured, commonly used and machine-readable format and you have the right to transmit these Personal Data to another controller. This right does not adversely affect the rights and freedoms of others.
Right to object: In certain situations, such as when we process your Personal Data based on a legitimate interest, you have the right to object to our processing of your Personal Data. In case of unjustified opposition, Ebriza is entitled to continue processing your Personal Data.
Right to object to receiving commercial messages: You can also object to processing of your Personal Data for the purpose of sending commercial messages.
Withdrawal of consent: To the extent that we process your Personal Data on the basis of your consent, you may withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.
Right not to be subject to individual decisions: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply if the decision: (i) is necessary for entering into, or the performance of, a contract between you and us; (ii) is authorised by law which also provides appropriate safeguards for your rights and freedoms; (iii) is based on your explicit consent.
Right to contact the supervisory authority: You have the right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing („ANSPDCP”) in relation to any infringement of your rights regarding the processing of your Personal Data. The contact details of the ANSPDCP are: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336 Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.
8.2. Exercising your rights
To learn more about how you can exercise the rights mentioned above, please contact us at the e-mail address office@ebriza.com.
Identity verification: We pay the utmost attention to the confidentiality of all Personal Data and reserve the right to verify your identity in case you make a request regarding Personal Data.
Fees: As a rule, you can exercise your rights free of charge. However, we reserve the right to charge a reasonable fee if your requests are manifestly unfounded or excessive, in particular because of their repetitive nature.
Response time: We make every effort to respond to your requests within one month of receipt of the request. This period may be extended by two months where necessary, taking into account the complexity and number of requests, in which case we will inform you of any such extension and the reasons for the delay.
9. CONTACT
If you have any questions or concerns regarding this Policy or its implementation, you can contact us at office@ebriza.com.