P r i v a c y & d a t a p r o c e s s i n g p o l i c y

Browsing the pages of our website is possible without any declaration of personal data. However, for certain specific situations (such as filling in a questionnaire, taking a quiz or participating in a competition), certain personal data may be collected and processed from the data subjects.

If the processing of personal data is necessary and there is no statutory basis for such processing we are obliged to obtain consent from the data subject.

The processing of personal data – such as the name, surname, address, e-mail address, telephone number of a data subject – will be carried out in accordance with the provisions of Regulation No. 679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“Regulation”) and in accordance with the data protection regulations specific to the country in which SC Podgoria Huși SA operates.

By means of this Policy our company would like to inform the general public about the nature, extent and purpose for which we collect and process personal data. In addition, data subjects are also informed of their rights, which are governed by the Regulation. As a controller, SC Podgoria Huși SA has implemented numerous technical and organizational measures to ensure complete protection of personal data.

1. Definitions

This Policy is based on the Regulation as well as any and all applicable data protection laws. The Policy must be understandable to the general public as well as to our customers and business partners. To ensure this, we will explain the terminology used. In this Policy we will use, inter alia, the following terms:

Personal data or Personal data refers to any information that makes it possible to identify a natural person (data subject);

Data subject – means an identified or identifiable natural person. An ‘identifiable’ natural person is a person who can be identified, directly or indirectly, including by reference to an identification number or to one or more factors characteristic of his physical, physiological, mental, economic, cultural or social identity;

Processing – shall mean performing any operation or set of operations on personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation, adaptation, alteration, modification, retrieval, consultation, consultation, use, disclosure (by transmission, dissemination or otherwise making available), alignment or combination, blocking, erasure or destruction;

Processing restriction – refers to the marking of processed personal data for the purpose of limiting their processing in the future;

Profiling – refers to any authorized form of processing of personal data consisting of the use of personal data to evaluate certain personal aspects characteristic of an individual, in particular to analyze or predict aspects relating to an individual’s performance at work, economic situation, health, personal preferences, interests, reliability, location or movements;

Pseudonymization – is the processing of personal data in such a way that the personal data can no longer be attributed to a data subject without the use of additional information, provided that such additional information is stored separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Controller or controller responsible for the processing – is the natural or legal person, public authority, agency or other body which, alone or with the help of third parties, determines the purposes or means of the processing of personal data; where the purposes and means of the processing are determined by the law of the European Union or of the Member States, the controller or the specific criteria for its nomination may be provided by the law of the European Union or of the Member States;

Recipient – is a natural or legal person, public authority, agency or other body, to whom the personal data is disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a private inquiry in accordance with the law of the European Union or Member States will not be seen as recipients; the processing of that data by public authorities will be in accordance with the applicable data protection rules consistent with the purposes of the processing;

Third party – is a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

Consent – the data subject’s consent is any freely given specific, informed and unambiguous indication that the data subject gives by a statement or by a clear affirmative action, signifying agreement to the processing of his or her personal data.

2. Name and address of operator SC Podgoria Huși SA

SC Podgoria Huși SA, Reg. Comertului: J37/380/2002, CUI: RO RO RO15061200, with registered office in Huși, 3, Călărași Street, Vaslui County, Phone: +40 235 484 830, email: crama@viahusi.ro, Website: https://viahusi.ro.

3. Data Protection Officer’s e-mail address

Any data subject may at any time contact us directly with any questions or suggestions regarding the protection of personal data at the following e-mail address – crama@viahusi.ro.

4. Cookies

The https://viahusi.ro websites use cookies. Cookies are text files that are stored on a computer via your internet browser. Many websites and servers use cookies. Many cookies contain a code called a cookie. A cookie ID is a unique identifier of the cookie and consists of a string of characters by which internet pages and servers can be assigned to the internet browser in which the cookie was stored. This allows visited websites and servers to differentiate the individual browser from other internet browsers that contain other cookies. A particular internet browser can be recognized and identified using a unique cookie code. Through the use of cookies, https://viahusi.ro can provide site users with more user-friendly services that would not be possible without setting cookies. With a cookie, information and offers on our website can be optimized with the user in mind. Cookies allow us, as mentioned above, to recognize users of our website. The purpose of this recognition is to make it easier for users to use our website. The website user who uses cookies, by way of example, does not have to enter access data each time the website is accessed, as this is taken over by the website and the cookie is thus stored in the user’s computer system. During use we may automatically collect information such as the IP addresses from which you access the website and the browser you are using, and you consent to the storage of certain information on your computer (“cookies”), all in order to ensure optimal access to and operation of the website by you.

Customize your consent preferences for cookies used on the viahusi.ro website can be done by clicking on the “cookies” icon at the bottom of each page or

5. Rights of the data subject

The data subject’s right of access. In order to exercise the right of access, the data subject may at any time contact SC Podgoria Huși SA with a request in this regard by which to obtain a report of personal data;

Right of rectification. Every data subject shall have the right to obtain the rectification of personal data where they are inaccurate or have undergone certain alterations or need to be completed.

Right to erasure. Each data subject has the right to request erasure of personal data as follows:

1. when the data are no longer necessary for the purpose for which they were collected or processed,
2. the data subject withdraws the consent on the basis of which the processing takes place,

• the data subject objects to the processing in accordance with Article 21(1) of the Regulation and there are no legal grounds for processing, or the data subject objects to the processing in accordance with Article 21(2) of the Regulation,

1. personal data have been processed unlawfully or a legal provision in force requires their erasure.

Right to restrict processing. Each data subject has the right to obtain restriction of processing where one of the following applies:

1. the accuracy of personal data is contested by the data subject,
2. the processing is unlawful and the data subject opposes the erasure of the personal data, but instead requests the restriction of their use,

• SC Podgoria Huși SA no longer needs personal data in order to process them, but they are required by the data subject for the establishment in order to exercise certain rights,

1. the data subject has objected to the processing in accordance with Article 21(1) of the Regulation until it has been verified whether the legitimate grounds for the data subject’s legitimate interests override those of pers SC Podgoria Huși SA.

The right to data portability. Every data subject has the right to request the transfer of personal data to a third party or to the data subject himself or herself.

Right to oppose. Every data subject shall have the right to object at any time on grounds relating to his/her particular situation to the processing of personal data relating to him/her, which is based on points (e) and (f) of Article 6(1) of the Regulation. This also applies to the creation of profiles. SC Podgoria Huși SA will no longer process personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims. If SC Podgoria Huși SA processes personal data for direct marketing purposes, where there is prior consent, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling up to the point of such direct marketing. If the data subject objects to the SC Podgoria Huși SA to the processing for direct marketing purposes, SC Podgoria Huși SA will no longer process the personal data for these purposes. In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to the processing of his or her personal data by SC Podgoria Huși SA for scientific or historical research purposes, or for statistical purposes, in accordance with Article 89(1) of the Regulation, unless the processing is necessary for the performance of a task carried out in the public interest.

Individual decision-making, including profiling. Each data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, as long as the decision is not based on the explicit consent of the data subject. SC Podgoria Huși SA will implement suitable safeguards to protect the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of SC Podgoria Huși SA, to express his or her point of view and contest the decision.

Right to withdraw consent. Each data subject has the right to withdraw his/her consent to the processing of personal data at any time.

Right to lodge a complaint to the supervisory authority – if the data subject considers that his or her legitimate rights in relation to the personal data processing operations have been violated, he or she may lodge a complaint to the National Supervisory Authority for Personal Data Processing, with headquarters at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania.

If you wish to exercise your rights or to send us a notice/request please contact us at the contact details indicated in this Policy. SC Podgoria Huși SA will respond to you as soon as possible but no later than 30 days. For any delays we will notify you and provide you with justified reasons for the delay.

6. Subscribe to our newsletter

On the website https://viahusi.ro users are offered the opportunity to subscribe to the company newsletter. SC Podgoria Huși SA regularly informs its customers and business partners through a newsletter about the company’s offers. The company newsletter can be received by the data subject only if:

(1) the data subject has a valid e-mail address and

(2) if the data subject registers to receive the newsletter.

A confirmation email will be sent to the email address registered by the data subject for the first time for sending the newsletter, for legal reasons, through the double opt-in procedure. This confirmation email is used to prove that the email address holder is authorized to receive the newsletter.

During registration for the newsletter, we store the IP address of the computer system assigned by the Internet Service Provider (ISP) and used by the data subject at the time of registration, as well as the date and time of registration. The collection of this data is necessary in order to understand possible misuses of a data subject’s email address at a later date, and therefore serves the purpose of legal protection.

Personal data collected as part of registering for a newsletter will only be used to send the newsletter. In addition, those who subscribe to the newsletter will be informed by email, as far as this is necessary for the newsletter service or for a registration in question, as this may be the case in the event of changes to the newsletter offer, or in the event of a change in technical circumstances.

There will be no transfer of personal data collected by the newsletter service to third parties. Registrations to our newsletter can be terminated by the data subject at any time. Consent to store personal data, given by the data subject to receive the newsletter, may be revoked at any time. There is an unsubscribe link in each newsletter. Upon unsubscription, the data will be deleted from the database of the controller SC Podgoria Huși SA.

As a result of registering to receive the newsletter, the data subject acknowledges that he/she may exercise, free of charge, the right to information, access, restriction, rectification, erasure, the right to data portability (if applicable), the right to object, the right not to be subject to automated individual decision-making, the right to have recourse to the courts or to lodge a complaint with the ANSPDCP by sending a written request by email to: crama@viahusi.ro. Withdrawal of consent at any time shall not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal of consent.

7. Website contact possibility

The website https://viahusi.ro contains information that allows a brief electronic contact with our company, as well as direct communication with us by including a general e-mail address.

If a data subject contacts us by email or via the contact form, the personal data voluntarily submitted by the data subject is automatically stored. Such personal data voluntarily submitted by a data subject to the controller are stored for the purpose of processing and contacting the data subject.

The data will be kept by the controller for a maximum of 3 years from the moment of contact by email or contact form. At the end of the retention period, the data will be deleted from the database of the controller and authorized persons (if applicable).

As a result of registering to receive a reply by email or via the contact form, the data subject acknowledges that he/she may exercise, free of charge, the right to information, access, restriction, rectification, erasure, the right to data portability (if applicable), the right to object, the right not to be subject to automated individual decision-making, the right to take legal action or lodge a complaint with the ANSPDCP by written request sent by email to: crama@viahusi.ro. Withdrawal of consent at any time shall not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal of consent.

8. Routine deletion and blocking of personal data

SC Podgoria Huși SA will process and store the personal data of the data subject only for the period necessary to fulfill the purpose of storage, or for the period that is prescribed by the European legislator or other applicable laws. If the purpose of storage is not applicable, or if the storage period provided for by the applicable applicable law in force expires, the personal data will be deleted in accordance with legal requests.

9. Legal basis for processing

Art. 6(1) lit. a of the Regulation serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, where the processing operations are necessary for the supply of goods or the provision of any other service, the processing is on the basis of Article 6(1)(b) of the Regulation. The same applies to processing operations that are necessary for the performance of pre-contractual measures, for example in the case of enquiries about our products or services.

Our company is subject to a legal obligation by which it is necessary to process personal data, such as the fulfillment of tax obligations, the processing is done on the basis of Art. 6 (1) lit. c Regulation. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor has been injured in our company and the name, age, health insurance data or other vital information should be passed on to a doctor, hospital or other third party. The processing will then be based on Art. 6 (1) lit. d of the Regulation. Finally, processing operations could be based on Art. 6(1)(f) of the Regulation. This legal basis is used for processing operations that are not covered by any of the legal grounds mentioned above, if the processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, unless those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data. Such processing operations are specifically allowed because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be presumed if the data subject is the customer of the controller (Recital 47 of sentence 2 of the Regulation).

10. Legitimate interests pursued by the operator or a third party

Where the processing of personal data is based on Article 6(1)(f) of the Regulation, our legitimate interest is to conduct our business for the well-being of all our employees and shareholders.

11. Period for which personal data will be stored

Personal data will be kept only for the period necessary for the purpose for which it was collected. After expiry of that period, the corresponding data shall be deleted. Only those personal data will be kept which are part of acts/documents for which the law stipulates a period of archiving and at the expiry of the legal archiving period they will be destroyed.

12. Provision of personal data as a legal or contractual requirement

The requirement necessary to conclude a contract; the obligation of the data subject to provide personal data; the possible consequences of failure to provide personal data:

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary to enter into a contract under which the data subject provides us with personal data, which we then process. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her.

13. Protecting personal data

SC Podgoria Huși SA applies an internal framework of policies and minimum standards on personal data protection. These policies and standards are regularly updated to correspond to regulations and market developments. In accordance with the legal provisions in force, we take appropriate technical and organizational measures (policies, procedures, security, etc.) precisely to ensure the confidentiality and integrity of personal data as well as to provide the necessary framework for their processing.