1. Operator Name: S.C. AGROVENA S.R.L

2. Purposes and objectives for which data is collected and processed:

According to U.E. no. 679 / 27.04.2016 regulation, the natural persons whose data are processed are guaranteed the right of access, rectification or deletion, restriction of processing, to oppose the processing, the right to data portability and the right to withdraw consent at any time.

Agrovena SRL processes personal data provided by individuals in accordance with the legal provisions on the protection of personal data in Romania, processing being in a legitimate, contractual, economic-financial and administrative management purpose.

Agrovena SRL takes all necessary steps to keep all personal information safe and confidential.

The purpose of data collection is:
- performing and executing the service contract concluded between Agrovena SRL and the CLIENT, including data collected and processed in the stages preceding the conclusion of the contract;
- Legitimate, economic-financial and administrative collection. Agrovena SRL collects only those data that are necessary for the conclusion and execution in good conditions of the service contracts.

Personal data is:
- any information that may be linked to an identified or identifiable individual,
- includes all information referring to an identification element (eg name and surname, date and place of birth, personal identification number, ID serial number, citizenship, signature, telephone, email, job, profession, etc.).

If the Agrovena site is accessed, www.agrovena.com, the internet browser does not automatically transmit data (e.g., the URL of the sending website, the date and time of access, the file accessed, the amount of data sent, browser type and version, operating system, etc.) to the Agrovena server. These data (such as IP addresses) are not collected or used for any purpose.

Certain traffic data (such as IP addresses) may, under certain circumstances, be personal data and will be regarded as such.

3. The type of processing operations are: both of legal and contractual nature.

4. Existence and nature of processing protection devices: Mixed protection systems (eg dedicated terminals, password files, etc.);

5. Period for which the data is stored (period after which it is deleted):

The company stores personal data only for the time necessary to achieve the purposes for which the data was collected and in which it will be further processed and in accordance with the legal provisions in force regarding the archiving of documents.

At the same time, personal data can be stored for a longer period of time to manage the customer portfolio.

6.If internal or external data transmissions are made and what is their purpose:

Data transfer is always allowed in the following situations:
a) When the person concerned explicitly gave his / her consent to the transfer
b) When it is necessary to execute a contract concluded between the person concerned and the Operator or to execute pre-contractual measures at the request of the person concerned
c) When it is necessary to conclude or execute a concluded contract or to be concluded in the interest of the data subject, between the Operator and the third party
d) When it is necessary for the sake of a major public interest, such as national defense, public order or national security, for the proper conduct of the criminal proceedings or for the establishment, exercise or defense of a right in law provided the data is processed in connection with this its purpose and no longer than necessary
e) When it is necessary to protect the life, physical integrity or health of the target person
f) When it follows an earlier request for access to official documents that are public or a request for information that can be obtained from registers or any other documents accessible to the public.

1. Situations in which the operation is in terms of the lawfulness of the processing

According to Article 6: Legality of processing:

(1) Processing shall be lawful only if and to the extent that at least one of the following conditions applies:
(a) the individual has consented to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the implementation of a contract to which the data subject is part of or to take steps at the request of the data subject prior to the conclusion of a contract;
(c) processing is necessary to fulfill a legal obligation incumbent upon the operator;
(d) processing is necessary to protect the vital interests of the data subject or other natural person;
(e) processing is necessary for the implementation of a task which is in the public interest or resulting from the exercise of the public authority with which the operator is entrusted
(f) processing is necessary for the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data are prevalent, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing by public authorities in the performance of their duties.

(2)Where processing for any purpose other than that for which the personal data were collected shall not be based on the consent of the data subject or on Union law or domestic law which constitutes a necessary and proportionate measure in a democratic society to protect the objectives referred to in Article 23 (1) - national security, defense, public policy, judicial procedures - the operator, in order to determine whether the processing for another purpose is compatible with the purpose for which the personal data were originally collected, take into account, inter alia:
(a) any link between the purposes for which the personal data were collected and the purposes of the subsequent processing envisaged;
(b) the context in which personal data has been collected, in particular regarding the relationship between data subjects and the operator;
(c) the nature of the personal data, in particular in the processing of special categories of personal data in accordance with Article 9, or where personal data relating to criminal convictions and offenses are processed in accordance with Article 10;
(d) the likely consequences for the data subject of the intended further processing;
(e) the existence of adequate safeguards, which may include encryption or pseudonymization.

2. Principles of processing

According to Article 5 Principles related to the processing of personal data

(1) Personal data are:
(a) processed legally, fairly and transparently against the data subject ("legality, fairness and transparency")
(b) collected for specified, explicit and legitimate purposes and not subsequently processed in an incompatible manner with those purposes; further processing for purposes of archiving in the public interest for purposes of scientific or historical research or for statistical purposes is not considered incompatible with the original purposes ("purpose limitations");
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
(d) accurate and, if necessary, up-to-date; all necessary steps must ensure that personal data which are inaccurate, in the light of the purposes for which they are processed, are erased or rectified without delay ('accuracy');
(e) kept in a form which allows the identification of the data subjects for a period not exceeding the time required for the purposes for which the data are processed; personal data may be stored for longer periods as long as they are processed solely for purposes of archiving in the public interest, for scientific or historical research purposes or for statistical purposes, subject to the application of technical measures and organizational arrangements provided for in this Regulation in order to guarantee the rights and freedom of the data subject ("storage limitations");
f) processed in a way that ensures the adequate security of personal data, including protection against unauthorized or unlawful processing and loss, destruction or accidental damage by taking appropriate technical or organizational measures ("integrity and confidentiality").
(2) The operator shall be responsible for compliance with paragraph 1 and can demonstrate such compliance ("responsibility").

3. Rights of data subjects

Art. 15.The right of access of the person concerned
(1) The data subject has the right to obtain from the operator a confirmation that personal data concerning him / her are processed or not and, if so, access to the data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the addressees or categories of recipients to whom personal data has been or is to be disclosed, in particular recipients from third countries or international organizations;
d) where possible, the period for which personal data are to be stored or, if that is not possible, the criteria used to determine that period;
e) the existence of the right to require the operator to rectify or erase personal data or to restrict the processing of personal data relating to the data subject or the right to object to processing;
f) the right to lodge a complaint with a supervisory authority;
g) where personal data are not collected from the data subject, any available information on their source;
h) the existence of an automated decision-making process including the creation of profiles referred to in Article 22 (1) and (4) and, at least in those cases, relevant information on the logic used and on the significance and expected consequences of such processing for the data subject.
(2) Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the appropriate guaranties under Article 46 relating to the transfer.
(3) An operator shall provide a copy of the personal data undergoing processing. For any other copies requested by the data subject, the operator may levy a reasonable charge, based on administrative costs. If the data subject enters the request electronically and unless the data subject requires a different format, the information will be provided in an electronic format that is currently used.
(4) The right to obtain a copy referred to in paragraph 3 shall be without prejudice to the rights and freedoms of others.
Section 3: Correction and deletion

Art. 16. Right to rectification
The data subject has the right to obtain from the operator, without undue delay, the rectification of inaccurate personal data relating to him/her. Taking into account the purposes for which the data were processed, the data subject has the right to obtain the completion of incomplete personal data, including the provision of an additional statement.

Art. 17. The right to delete data (the "right to be forgotten")
(1) The data subject shall have the right to obtain from the operator the deletion of the personal data relating to him/her without undue delay and the controller shall be required to delete the personal data without undue delay if one of the following reasons : (a) personal data are no longer required for the purposes for which they were collected or processed; (b) the data subject withdraws his/her consent on the basis of which the processing takes place in accordance with Article 6 (1) (a) or Article 9 (2) (a) and there is no other legal basis for the processing; (c) the data subject opposes processing pursuant to Article 21 (1) and there are no legitimate reasons with regard to the processing or the data subject opposes processing under Article 21 (2); d) personal data has been processed unlawfully; (e) personal data must be erased in order to comply with a legal obligation incumbent upon the operator under Union or national law under which the operator is located; (f) personal data were collected in connection with the provision of information society services referred to in Article 8 (1)
(2) Where the operator has disclosed his/her personal data and is required under paragraph 1 to delete it, the operator shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform operators who process personal data that the data subject has requested the deletion by these operators of any links to that data or of any copies or reproductions of such personal data.
(3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: ​​(a) for the exercise of the right to freedom of expression and information; (b) for compliance with a legal obligation providing for processing under Union or national law applicable to the operator or for the performance of a task performed in the public interest or in the exercise of an official authority with which the operator is entrusted; (c) on grounds of public interest in the field of public health, in accordance with Article 9 (2) (h) and (i) and Article 9 (3); (d) for purposes of archiving in the public interest for the purposes of scientific or historical research or for statistical purposes in accordance with Article 89 (1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously affect the achievement of the respective processing objectives; or e) for the establishment, exercise or defense of a right in court. (May 23, 2018, Article 17, paragraph (3) of Chapter III, Section 3 rectified by point 3 of the Corrigendum of May 23, 2018)

Art.18. The right to restrict the processing
(1) The data subject shall have the right to obtain from the operator the restriction of processing if one of the following applies: (a) the data subject contests the accuracy of the data for a period which allows the controller to verify the accuracy of the data; b) the processing is illegal and the data subject opposes the deletion of personal data, but instead calls for restriction of their use; c) the operator no longer requires personal data for processing, but the data subject requests them for the establishment, exercise or defense of a right in court; or (d) the data subject opposed to processing in accordance with Article 21 (1), for the period of time to verify that the legitimate rights of the controller prevail over those of the data subject.
(2) Where processing has been restricted pursuant to paragraph 1, such personal data may, with the exception of storage, be processed only with the consent of the data subject or for the establishment, exercise or defense of a right in court; or for the protection of the rights of another natural or legal person or of a major public interest of the Union or of a Member State.
(3) A person who has obtained restriction of processing under paragraph 1 shall be informed by the operator before the lifting of the processing restriction.

Art. 19. Obligation to notify the rectification or erasure of personal data or restriction processing
The operator communicates to each recipient to whom were disclosed personal data any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17 (1) and Article 18, unless this proves impossible or involves disproportionate efforts. The operator shall inform the data subject about the addressees concerned if the data subject so requests.

Art. 20. The right to data portability
(1) The data subject has the right to receive the personal data which concerns him/her and which he/she has supplied to the operator in a structured format, which is currently used and can be read automatically and has the right to transmit these data to another operator, unimpeded by the operator to whom they provided personal data, where: a) the processing is based on consent under Article 6 (1) (a) or Article 9 (2) (a) or a contract pursuant to Article 6 (1) (b); and (b) processing is carried out by automatic means.
(2) In exercising its right to data portability pursuant to paragraph 1, the data subject shall have the right to transmit personal data directly from one operator to another where this is technically feasible.
(3) The exercise of the right referred to in paragraph (1) of this Article does not bring prejudice to Article 17. That right does not apply to the processing required to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.
(4) The right referred to in paragraph 1 shall be without prejudice to the rights and freedoms of others. Section 4: Right to opposition and automated decision-making process.

Art. 21. The right to opposition
(1) At any time, the data subject shall have the right to oppose, on grounds relating to the particular circumstances in which he or she is processing under Article 6 (1) (e) or (f), personal data, including the creation of profiles based on those provisions. An operator shall no longer process personal data unless the operator demonstrates that they have legitimate and compelling reasons that justify the processing and which prevails over the interests, rights and freedoms of the data subject or that the purpose is to establish, exercise or defend a right in court. (May 23, 2018, Article 21, paragraph 1 of Chapter III, Section 4 rectified by point 4 of the Corrigendum of 23 May 2018)
(2) Where the processing of personal data is for the purpose of direct marketing, the data subject may at any time object to the processing of personal data relating to him/her, including profiles, in so far as he/she is related marketing.
(3) Where the data subject opposes processing for the purpose of direct marketing, personal data is no longer processed for this purpose.
(4) At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be clearly and separately disclosed by any other information.
(5) In the context of the use of information society services and notwithstanding Directive 2002/58 / EC, the data subject may exercise his/her right to oppose by automatic means using technical specifications.
(6) Where personal data are processed for the purposes of scientific or historical research or for statistical purposes in accordance with Article 89 (1), the data subject shall, for reasons connected with his or her particular situation, be entitled to opposes the processing of personal data concerning it, unless the processing is necessary for the performance of a task on grounds of public interest.

Art. 22. Automated decision-making process, including the creation of profiles
(1) The data subject shall have the right not to be the subject of a decision solely based on automatic processing, including the creation of profiles, which produces legal effects affecting the data subject or affects them to a significant extent.
(2) Paragraph 1 shall not apply where the decision: (a) is necessary for the conclusion or performance of a contract between the data subject and a data controller; (b) is authorized by the EU laws or the national law applicable to the controller and which also provides for appropriate measures to protect the legitimate rights, freedoms and interests of the data subject; or (c) is based on the explicit consent of the data subject.
(3) In the cases referred to in paragraph 2 (a) and (c), the data controller shall apply appropriate measures to protect the legitimate rights, freedom and interests of the data subject, at least the right to obtain human intervention from the operator's side, to express their point of view and to challenge the decision.
(4) The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9 (1), except where Article 9 (2) (a) or (g) applies ) and where appropriate measures have been put in place to protect the legitimate rights, freedoms and interests of the data subject.

4. How the operator works in case of an incident:

Suspends the processing operation to clarify the factual situation and implement appropriate protection measures in order to respect the rights and freedoms of the data subjects.

11. How to grant and withdraw consent:

Agrovena SRL shall not require the consent, in accordance with Article 6 1), letter b and c.
Withdrawal of consent does not affect the lawfulness of processing under consent prior to its withdrawal. Before consent is given, the data subject is informed of this. Withdrawal of consent is as simple as granting it.

12. If there is a Data Protection Officer, please note how to contact:

For any other information regarding the processing of your personal data, you can contact Agrovena SRL, Arad, No. 7A, Aurel Crisan St., office 19 and / or tel. 0741.018.622 and / or by e-mail: office@agrovena.com

The right to draft petitions, complaints and to open court action.

Interested individuals may request information and / or complain about the Privacy Policy of personal data processing by contacting the Personal Data Protection Manager at e-mail: office@agrovena.com.