Privacy Policy regarding the processing of personal data

 

StarGift is committed to making every effort to process your data in accordance with Regulation (EU) 2016/679 (the ‘General Data Protection Regulation’ or ‘GDPR’) and ethical business practices.

 

The main purpose of this document is to inform you about how we collect, use, transfer and protect your personal data when you interact with us in relation to our products and services, and to help the company conduct its business in compliance with specific legal provisions and to minimise risks by preventing incidents and, in the unlikely event of such incidents, to minimise their impact on the data subject.

 

We reserve the right to update and amend this Privacy Policy from time to time to reflect any changes to the way in which we process your personal data or any changes to legal requirements. In the event of any such changes, we will post the amended version of the Privacy Policy on our website, so please check the content of this Privacy Policy from time to time.

 

 

About us and how to contact us

 

STARGIFT SRL (trading as StarGift) is a company incorporated under Romanian law, with its registered office in Bucharest, Sector 1, 6–12 Copilului Street, Section 1, ground floor, registered with the Bucharest Trade Register under no. J40/15652/2018 (hereinafter “StarGift” or “we”). For the purposes of data protection legislation, we are the data controller when we process your personal data.

For any enquiries regarding the processing of your personal data, please contact us as follows:  

• StarGift’s Data Protection Officer at e-mail[email protected] or 
• By post or courier to Copilului No. 6–12, ground floor, section 1, Sector 1, Bucharest – marked: for the attention of the StarGift Data Protection Officer.

 

Categories of personal data collected

 

StarGift may process the following categories of data provided directly by you. For example, we receive information from you in the following situations:

 

• Creating a StarGift account: you provide us with your email address, first name and surname;
• On your personal page (‘My Account’) on the StarGift platform, you can add further details, such as: mobile phone number, delivery address, etc.;
• When you use the StarGift platform, you may provide us with data such as: photographs, first names, surnames, text and any other similar information about yourself, your family members or other individuals, for the purpose of personalising the products available on the website, data in respect of which you guarantee that you hold full rights in accordance with applicable legislation;
• When you place an order, you provide us with information such as: photographs, first names, surnames, text and any other similar information about yourself, your family members or other individuals for the purpose of personalising the products available on the website, first names and surnames, delivery address, billing details, payment method, telephone number, bank card details, etc.

 

We may also collect and subsequently process certain information regarding your behaviour whilst visiting our website in order to personalise your online experience and provide you with offers tailored to your profile. Further details on this can be found in the section on the purposes of data processing.

On our website, we may store and collect information in cookies and similar technologies, in accordance with our Cookie Policy.

We do not collect or otherwise process sensitive data, as defined by the General Data Protection Regulation as special categories of personal data. Furthermore, we do not wish to collect or process data relating to minors under the age of 18.

 

Principles of the security policy

 

STARGIFT processes the personal data it comes into contact with in accordance with the following principles:

• Protection of the fundamental rights and freedoms of data subjects;
• Lawfulness, fairness and transparency – personal data are processed in good faith and in accordance with the legal provisions in force, in a fair and transparent manner towards the data subject;
• Specific, explicit and legitimate purposes – StarGift processes personal data for specific, explicit and legitimate purposes, and such data is not further processed in a manner incompatible with those purposes;
• Legal basis – StarGift will ensure that the processing of personal data has a clearly defined legal basis, such as legal provisions, the data subject’s consent, the performance of contracts, or StarGift’s legitimate interests (which shall not conflict with the data subject’s overriding interests);
• Purpose limitation – StarGift processes personal data only if it is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Time-based limitation – StarGift retains data subjects’ data for a period not exceeding that necessary to fulfil the purposes for which the data are processed and to comply with legal requirements;
• Accuracy and correctness – StarGift processes personal data accurately and takes reasonable steps to ensure that any inaccurate data of which it becomes aware is erased or rectified;
• Security – StarGift is committed to ensuring the security of all personal data it processes and takes ongoing steps to achieve this, including by training its employees, contractors and partners.

 

Purposes and legal bases for processing

 

We will use your personal data for the following purposes:

1. To provide StarGift services for your benefit.

By way of example, this purpose may include, as appropriate:

1. a) Creating and managing your account on the StarGift platform;
2. b) Processing orders, in particular personalising products using the data/information you provide (photographs, text, images, etc.), including receiving, validating, dispatching and invoicing them;
3. c) Handling cancellations or issues of any kind relating to an order, or to the goods or services purchased;
4. d) Returning products in accordance with legal provisions;
5. e) Reimbursing the value of the products in accordance with the law;
6. f) Providing support services, including responding to your enquiries regarding your orders or StarGift’s goods and services.

The processing of your data for these purposes is, in most cases, necessary for the conclusion and performance of a contract between StarGift and you. Furthermore, certain processing activities falling within these purposes are required by applicable legislation, including tax and accounting legislation.

 

2. Improving StarGift’s services

To this end, we may collect and use certain information relating to your purchasing behaviour, invite you to complete satisfaction surveys following the completion of an order, or carry out, either directly or with the help of partners, market studies and research.

We base these activities on our legitimate interest in carrying out commercial activities, whilst always ensuring that your fundamental rights and freedoms are not affected.

 

3. For marketing

We want to keep you up to date with the best offers on the products and services that interest you. To this end, we may send you any type of message (such as: email/SMS/telephone, etc.) containing general and topical information, information about products similar to or complementary to those you have purchased, information about offers or promotions, information regarding products added to the ‘Account/My Basket’ section or which you have shown an interest in purchasing, as well as other commercial communications such as market research and opinion polls, and we may display personalised recommendations on the website. In order to provide you with information that is of interest to you, we may use certain data relating to your shopping behaviour (e.g. products viewed/purchased) to create a profile for you. We always ensure that this processing is carried out in accordance with your rights and freedoms, and that decisions made on this basis do not have legal effects on you or similarly affect you to a significant extent.

In most cases, we base our marketing communications on your prior consent.

 

You may change your mind and withdraw your consent at any time by:

– Ticking the ‘Unsubscribe’ box in the ‘Newsletter Subscription Status’ section;

– Clicking the unsubscribe link displayed in the messages you receive from us; or by

– Contacting StarGift using the contact details provided above.

 

In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our business. Whenever we use information about you for a legitimate interest of ours, we take care to ensure that your fundamental rights and freedoms are not adversely affected. However, you may at any time request, via the means described above, that we cease processing your personal data for marketing purposes, and we will comply with your request.

 

4. To protect our legitimate interests

There may be situations in which we use or disclose information to protect our rights and business operations. These may include:

– Measures to protect the website and users of the StarGift platform against cyber attacks:

– Measures to prevent and detect attempts at fraud, including the disclosure of information to the relevant public authorities;

– Measures to manage various other risks.

The general legal basis for these types of processing is our legitimate interest in safeguarding our business operations, on the understanding that we ensure all measures we take strike a balance between our interests and your fundamental rights and freedoms.

Furthermore, in certain cases, we base our processing on legal provisions such as the obligation to ensure the security of goods and valuables, as provided for by the applicable legislation in this area.

 

How long we retain your personal data

 

As a general rule, we will store your personal data for as long as you have an account on the StarGift platform, with the exception of images you have uploaded to the website for the purpose of personalising products, which will be automatically deleted after a maximum period of 30 days from the date of upload. You may request at any time that we delete certain information or close your account, and we will comply with such requests, subject to the retention of certain information even after the account has been closed, where required by applicable legislation or our legitimate interests.

 

Who we share your personal data with

 

Where applicable, we may disclose or provide access to certain personal data about you to the following categories of recipients:

– companies within the same group of companies as StarGift;

– courier service providers;

– payment/banking service providers;

– marketing service providers;

– IT service providers;

– other companies with which we may develop joint programmes to market our goods and services.

Where we are under a legal obligation to do so, or where it is necessary to protect a legitimate interest, we may also disclose certain personal data to public authorities.

We ensure that access to your data by third-party private legal entities is carried out in accordance with the legal provisions on data protection and confidentiality of information, on the basis of contracts concluded with them.

 

To which countries do we transfer your personal data?

 

We currently store and process your personal data within Romania.

 

How we protect the security of your personal data

 

We are committed to ensuring the security of personal data by implementing appropriate technical and organisational measures, in line with industry standards. Given the nature of the products supplied, which involve their manual personalisation with the information you provide (e.g. photographs, images, text), in exceptional cases, there is a possibility that your data may inadvertently come into the possession of a third party (e.g. a customer), in which case StarGift will take all necessary measures to rectify the situation. Furthermore, if you find yourself in a situation where you mistakenly receive products personalised with third parties’ data (e.g. photographs, images, text), you are obliged to notify StarGift promptly (by email, by telephone) and to implement the measures indicated by the company to protect the interests of the parties involved (destruction or return of the relevant products or data that do not belong to you). In order to protect your data, StarGift constantly implements and updates its internal procedures and work processes, as well as the training of staff responsible for processing your products, with a view to minimising the occurrence of such situations.

 

STARGIFT takes all appropriate organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access, including: 

1. Data is stored electronically in files that can only be accessed by the company’s authorised users, who in turn access them via a username and password (the password is changed periodically). All users are obliged to maintain the confidentiality of the data to which they have access, and must log out of the database at the end of each session. Should one or more users have their access revoked for various reasons, their access accounts are suspended. 
2. Users may access personal data solely for the purpose of carrying out their duties. To this end, the controller shall define the types of access according to functionality (entry, processing, saving, etc.) and according to the actions performed on personal data (such as writing, reading, etc.), as well as the procedures relating to these types of access. 
3. The platform and server on which customers enter their data are secured. Computers shall be installed in lockable rooms. If personal data appears on the screen and no action is taken for a specified period, as determined by the controller, the work session will close automatically. 
4. Personal data may only be printed by users authorised to carry out this operation and only for purposes required by the laws in force. 

 

Where online payment is available and the customer opts to pay online for the value of their orders, contract and/or contracts, the processing of bank card details takes place exclusively on the servers of the card processor with whom STARGIFT has entered into a contract. 

STARGIFT does not request or store any information relating to the customer’s bank card or cards.

The payment processors with which STARGIFT collaborates are: Banca Transilvania S.A. (BT iPay) and Stripe Payments Europe Ltd. for www.stargift.fr; Barion Payment Zrt. (H-1117 Budapest, Irinyi József utca 4–20, an institution supervised by the National Bank of Hungary, licence no. H-EN-I-1064/2013) for www.stargift.hu; myPOS Ltd. and Stripe Payments Europe Ltd. for www.stargift.bg and www.stargift.com. They process the data required to make the payment (name, email address, amount, card details entered on their secure page) as independent operators, in accordance with their own privacy policies. On www.stargift.hu, Barion Payment Zrt. processes, via Barion Pixel, technical browsing data (IP address, browser identifier, pages visited) exclusively for the purpose of preventing payment fraud, on the basis of legitimate interest; details can be found in the Cookie Policy.

The card processor authorised by STARGIFT is entitled to access/view any type of data/documents generated as a result of an order placed, cancelled orders, contracts, cancelled contracts or fulfilled contracts, in order to investigate any transaction, where such a transaction exists. 

Despite the measures taken to protect your personal data, we would like to draw your attention to the fact that the transmission of information via the Internet in general, or via other public networks, is not entirely secure, as there is a risk that the data may be viewed and used by unauthorised third parties. We cannot be held responsible for such vulnerabilities in systems that are not under our control.

 

What rights do you have?

 

Under the GDPR, all individuals whose personal data we process have specific rights, including the following:

1. The right to information: the right to know what data is being processed, the purposes and legal basis for processing, the recipients of the data, the retention period, the existence of data subjects’ rights, the right to lodge a complaint with the supervisory authority, etc.;
2. The right of access: the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed and, if so, access to those data and to the information regarding the processing detailed above;
3. Right to rectification: the right to have inaccurate data corrected or missing data completed;
4. Right to erasure: the right to request the erasure of processed data, in the circumstances provided for by law; to request the erasure of your data, please contact us by email at [email protected]
5. The right to request restriction of processing, within the limits provided for by law.
6. Other rights that may be exercised within the limits set out by law: the right to data portability, the right to object to the processing of data, the right to object to automated decision-making, the right to submit requests to the competent authorities regarding the processing carried out by StarGift, etc., the right to withdraw consent at any time for the processing of personal data where the legal basis for processing is the data subject’s consent.
7. Complaints: you have the right to lodge a complaint with the supervisory authority regarding the processing of your personal data.

In Romania, the contact details of the data protection supervisory authority are as follows:

National Supervisory Authority for Personal Data Processing

28–30 General Gheorghe Magheru Boulevard, Sector 1, postcode 010336, Bucharest, Romania

Telephone: +40 318 059 211 or +40 318 059 212;

E-mail:[email protected]

Without prejudice to your right to contact the supervisory authority at any time, please contact us first, and we promise to make every effort to resolve any issue amicably.   

 

 

• Please remember that you can contact us at any time by submitting your enquiry via any of the following methods:

– by email to: [email protected] or

– by post or courier to the following address: 6–12 Copilului Street, ground floor, section 1, Sector 1, Bucharest – for the attention of the StarGift Data Protection Officer.