PRIVACY POLICY - PERSONAL DATA PROTECTION INFORMATION
Last update: February 2025
The purpose of this document is to inform you about the processing of your personal data and your rights as a data subject in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR“).
Throughout this information the notion of data subject has the following meanings: natural persons who have one of the following qualities: visitors and users of the website kharga.ro, potential and current customers of KHARGA MOBILITY SRL (“KM”), respectively natural persons and representatives of legal entities that intend to become customers or are already customers of KM in connection with the services provided by KM, as well as any other natural person whose personal data are processed by KM for/in connection with them.
- Identity and contact details of the controller
The kharga.ro platform (hereinafter referred to as the “Site” or “Platform“) is owned and managed by KHARGA MOBILITY SRL with registered office at Str. Banul Antonache nr. 40-44, cam. 2 et. 4, sector 1, Bucharest, registered with the Trade Register under no. J40/11475/2023, CUI 48368067, (“Company” or “Controller”).
- Contact details of the Data Protection Officer
The person responsible for the protection of personal data can be contacted by e-mail at __@___.ro or by post at the above-mentioned registered office.
- Personal data processed
KM processes the following personal data:
- personal identification data: name, surname, age, sex, home address, correspondence address, postal code, e-mail, telephone (e.g. landline, mobile, fax), handwritten signature and digital signature;
- financial data (bank account information)
- Internet Protocol (“IP”) address, password
- information about the device used (such as hardware model, operating system version, unique device identifiers and mobile network information, including phone number);
- Information about events on your device, such as errors, system activity, hardware settings, browser type, browser language, the date and time of your request, and the referring URL;
- cookies that can uniquely identify your browser. For more information on our cookie policy click here ( cookie policy link )
- Location information using various technologies to determine location, including IP address.
- Data processing. Purpose of processing. Legal basis
KM processes personal data through the following operations: collecting, recording, organizing, storing, modifying, modifying, retrieving, consulting, using, transmitting, combining, blocking, restricting, erasing, destroying, archiving personal data.
Data type | Purposes of processing | Legal bases | Categories of data recipients |
Name, first name, phone, e-mail, IP | Account creation, Order placement and execution; Providing assistance on messages sent to the KM, through all available channels (e.g. website), prior to placing the Order or in connection with its execution; Account Login | Article 6(1)(b) – for the performance of a contract concluded with you or to take steps at your request prior to the conclusion of a contract (e.g. providing pre-contractual information, order fulfillment, etc.); | WordPress Platform Online marketing service provider |
First name, last name, phone, email address, delivery address, IP, Order ID, transaction date , transaction completion date, transaction ID, transaction amount, IBAN/bank account | Payment for Products purchased, refund of payment in case of return or withdrawal from the contract | Article 6(1)(b) – for the performance of a contract concluded with you or to take steps at your request after the conclusion of a contract (performance of the obligation to return goods, etc.); | Payment Processor, Controller’s bank, Courier |
Email ( provided through the contact form ) | providing support services for your enquiries (e.g. dealing with customer requests, complaints and petitions) via the means of communication (e.g. e-mail, post); | Article 6, paragraph 1, point F – Legitimate Interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.” | Online marketing service provider |
analyzing the preferences, interests, history of contractual relationships and/or customer behavior for direct marketing activities (i.e., communicating by e-mail advertisements directly and specifically addressed to a certain person) if the data subject has opted in, or for any other types of promotion of KM products and services, according to the option expressed by you; | Article 6, paragraph 1, point a- on the basis of consent given by selecting communication options; “the data subject has consented to the processing of his/her personal data for one or more specific purposes;” | Online marketing service provider | |
Information about the device being used (such as hardware model, operating system version, unique device identifiers, and mobile network information including phone number); IP address; | analyzing the behavior of the data subject/any person who accesses the page related to KM on the website www.kharga.ro through the use of cookies, both of KM and of KM’s contractual partners, in order to provide content, both general and advertising, tailored to user preferences, offers tailored to user interests, child protection filters, limiting the frequency of advertisements. KM applies in this respect the Cookie Policy available on the website www.KHARGA.ro | Article 6, paragraph 1, letter a- on the basis of the consent given by selecting the cookie options – in the case of cookies that are not absolutely necessary for the functioning of KHARGA.ro; Article 6, paragraph 1, letter F- Legitimate Interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject prevail, which require the protection of personal data, in particular when the data subject is a child.” – In the case of cookies that are absolutely necessary for the operation of KHARGA.ro; | Online marketing service provider, Gooogle, WordPress, |
Information about the device used (such as hardware model, operating system version, unique device identifiers, and mobile network information including phone number); IP address; | conducting internal analysis (including statistical analysis) both on the product for improvement and development of services, as well as conducting market research and analysis on KM products and services to improve their ; maintenance and securization of the kharga.ro website | Article 6, paragraph 1, letter F- Legitimate Interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party unless the interests or fundamental rights and freedoms of the data subject override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular when the data subject is a child.” | – |
Email, information about the device used (such as hardware model, operating system version, unique device identifiers, and mobile network information including phone number); IP address, geolocation data, license plate number; | the archiving in both written and electronic format of the messages transmitted via the website regarding the relationship with the data subject; | Article 6, paragraph 1, point F – Legitimate Interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.” | – |
Information about the device being used (such as hardware model, operating system version, unique device identifiers, and mobile network information including phone number); IP address, geolocation data, license plate number; | the resolution of disputes, investigations or any other petitions/complaints to which KM is a party. | Article 6, paragraph 1, point F – Legitimate Interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.” | Lawyers, Consultants, Courts, competent public authorities, including in the field of computer fraud investigation. |
Social media browsing history | If you have accessed / liked the Facebook page of kharga.ro or if you log into your customer account with your Facebook address and password, we will receive this data without using it for any other purpose than to communicate with you and possibly to send you some personalized offers through your Facebook account based on personalized audiences. | Article 6, paragraph 1, letter a- on the basis of the consent given by selecting the cookie options – in the case of cookies that are not absolutely necessary for the functioning of KHARGA.ro; | Facebook, the digital marketing service provider |
Note on PROFILING FOR DIRECT MARKETING PURPOSES
The Controller may, in its relationship with you, use automated processing of personal data in order to evaluate or predict certain aspects related to the preferences, interests of the data subject based on the browsing history on the Platform. For profiling purposes, the Controller does not process sensitive data concerning sexual orientation, religious beliefs or political affiliations.
The customer profile is realized as follows:
- based on site browsing behavior, products viewed, products added to cart;
- based on demographic data: age, gender, city;
- based on purchase history and monetary value.
We collect personal data when profiling from sources such as: our website kharga.ro and the advertising service providers we work with.
Purpose – communication of personalized promotional offers.
The data subject may object to profiling for direct marketing purposes at any time by withdrawing consent to unsubscribe from a particular communication channel you have previously opted out of, as detailed in Section 8 – “Rights”.
- Information on the transfer of personal data to a country outside the European Economic Area
KM does not transfer personal customer data outside Romania or EU/EEA countries.
- Storing personal data
Personal data will be processed at least for the duration of the contract concluded with KM, and thereafter, for the duration necessary for the performance of the contractual obligations by either party.
Personal data will be stored for as long as necessary for the above-mentioned purposes or for the period of time prescribed by general legal provisions as well as those applicable in tax matters and in accordance with archival legislation. With the exception of data collected via cookies, the duration of which is set out in the Cookie Policy (click here), precu, and unless there is an express legal provision, personal data will be kept for a maximum of 5 (five) years from the date on which KM last interacted with you.
- How we ensure data security
- Your rights regarding your personal data processed by KM
The processing of personal data requested by the CONTROLLER in the contract concluded with you is considered mandatory for the conclusion and execution of the contract for the sale of products sold by KM. Your refusal to provide such data or exercise certain rights may make it impossible for the CONTROLLER to provide the goods and services concerned, including the transmission of information that may be particularly important to protect your legitimate and/or vital interests (e.g. recall campaigns, information on product characteristics, etc.).
(1) The right of access to personal data – you can obtain from us a confirmation as to whether or not KM processes personal data concerning you and what personal data is processed.
(2) Right to rectification – you may request that inaccurate or incomplete personal data be rectified or updated.
(3) The right to be deleted or “right to be forgotten” – you may request erasure of your personal data in certain cases, such as (i) your personal data is no longer necessary for the purposes for which it was collected or processed, (ii) your data has been processed unlawfully, (iii) the processing of your data was based on your consent and your consent has been withdrawn.
(4) Right to withdraw your consent – Consent may be withdrawn at any time where the processing of your personal data has been carried out on the basis of your consent.
(5) Right to restriction of processing – you may request restriction of the processing of personal data concerning you in certain circumstances, such as (i) you contest the accuracy of the data, for the period of time that would allow us to verify the accuracy of that data, (ii) your data has been processed unlawfully and you object to its erasure by requesting restriction of its use.
(6) The right to data portability – you may request and receive the personal data concerning you that you have provided to us, with the right to have it transmitted to another controller, where the processing of the data has been carried out either on the basis of your consent or on the basis of the contract concluded with us, and the processing of the personal data has been carried out by automated means. This right may only be exercised to the extent that the processing of the data provided has been carried out exclusively by automated means and only where the extraction of such data is feasible in terms of the technical capabilities used by KM at the time of the request.
(7) Right to object – you may object, on grounds relating to your particular situation, to the processing of personal data in certain circumstances, such as (i) the processing was carried out in our legitimate interest or (ii) the processing is for direct marketing purposes, including profiling on the basis of those provisions.
(8) The right not to be subject to a decision based solely on automated processing of your data, including profiling that produces legal effects or significantly affects you.
Where KM will take automated decisions in relation to personal data, you may (i) request and obtain human intervention in relation to that processing, (ii) express your views on that processing, and (iii) challenge the decision.
(9) The right to be notified of security breaches that have or could have an impact on personal data.
(10) The right to lodge a complaint with the KM and/or the competent data protection authority and to go to court.
You also have the following options to exercise these rights:
- customer account management: directly accessing, rectifying or deleting available data;
- deleting cookies or browsing history from the website or platform settings or from the settings of the browser used for web browsing to restrict cookie tracking of behavior on the Platform;
- managing choices on how data is processed on social media platforms and search engines (e.g. Google or Facebook).
In order to exercise your rights and for further questions regarding this information or the processing of personal data by KM, please contact our Data Protection Officer by e-mail at …………, by post or by written and signed request in holograph form to KM’s registered office. Your request will be analyzed and resolved within 30 days from the date of registration.
To submit a complaint to the National Supervisory Authority for Personal Data Processing, the contact details are:
Website: http://www.dataprotection.ro/
Email: anspdcp@dataprotection.ro
Address. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucuresti, Romania
Landline: +40.318.059.211,+40.318.059.212
Cabinet President +40.318.059.220; Fax+40.318.059.60