PRIVACY POLICY
We at POTAMY treat your privacy and trust very seriously. This Privacy Policy is intended to describe how any personal data collected from you as a data subject or user through https://www.potamy.com (the "Website") or one of our stores will be protected, used, stored and processed by us to communicate with you and to offer you our services.
For more information on how we use cookies, please see our Cookie Policy. For any other information regarding our services, please see Terms and Conditions
The data controller is EDELFIA S.r.l., Romanian legal entity with registered office at: Bucharest, Sector 2, Calea MOȘILOR, Nr. 158, ROOM 4, MODULE 165, 4th floor, having tax registration code 47711190 and EUID ROONRC.J40/3822/2023, owner of the POTAMY trademark.
Postal address of the data controller [1]: Bucharest, sector 2, Calea Moșilor No.158, module 165, 4th floor, room 4. Email address of the data protection officer: privacy@potamy.com
DATA SUBJECTS
Depending on the data subjects’ capabilities towards the Controller:
- Persons who access the site without creating an account or placing an order;
- Persons who set up a user account on the website or other platform of the Controller.
WHAT PERSONAL DATA WE PROCESS AND WHY
We collect and process only the data that is required to provide our services to you. We collect the following data when you browse the web or make purchases from POTAMY:
- Full name, date of birth, email address, delivery address and telephone number, language of communication;
- Information about the device used to access the site (browser type, language used, operating system, cookies, IP address, URL, time spent on the POTAMY website, date and time of visit to the website);
- User preferences;
- Payment information;
- Other information related to market research or special offers.
GOALS OF DATA PROCESSING
EDELFIA S.r.l. may process personal data if those are required to achieve the following goals:
- Order processing and delivery;
- Order payment processing;
- Order status updates, issue of invoices;
- Return requests processing;
- Subscription to information about availability of the goods;
- POTAMY newsletter mailouts based on your subscription;
- Registration on the website and account management;
- Tailoring website recommendations to suit each user’s personal preferences;
- Informing about promotional offers;
- Advertising and surveys;
- Assessing the quality of POTAMY services
- Processing requests and complaints, including those incoming from the Customer Service;
- Prevention of abuse and fraud.
When you create an account using social network credentials such as Facebook or Google, EDELFIA S.r.l. will only process open data from these social networks, which is necessary to create your profile on the POTAMY website.
Your data will only be processed for other purposes with your consent or as permitted by regulations. If we process your data for purposes other than those originally intended, we will notify you prior to processing.
GROUNDS FOR PERSONAL DATA PROCESSING
- Consent of the data subject;
- Performance of the agreement entered into by the Controller and the User;
- Compliance with the legal obligations imposed on the Controller.
USER RIGHTS
Right to information. The controller is obliged to provide the data subject with at least the following information: the identity of the controller and their representative, if applicable; contact details of the data protection officer; data is processing goal; supplementary information such as data recipients or categories of data recipients.
Right to obtain confirmation from the Controller whether the applicant’s personal data is being processed and, if so, access to such data.
Right to correct any inaccurate, outdated or incomplete data.
Right to have data deleted for one of the following reasons:
1. The data is no longer required for the purposes it was collected;
2. The user withdraws their consent for data processing;
3. The user objects to data processing and there are no legal grounds that would supersede;
4. The data was processed illegally.
Right to limit data processing on the occurrence of any of the following:
1. The User disputes the accuracy of the data for a period sufficient for the Controller to verify the accuracy of the data;
2. The processing is illegal and the User objects to the deletion of personal data, demanding that their use be limited instead;
3. The Controller no longer needs the personal data for the purpose of processing, but the data subject requests those to confirm, exercise or defend a right in court;
4. The data subject objects to data processing for a period sufficient to verify that the legal rights of the Controller supersede those of the data subject.
Right to data portability.
Right to object. In this case, the Controller shall cease data processing data unless they are able to produce legitimate and compelling reasons that justify data processing and supersede the interests, rights and freedoms of the data subject, or in the event when the purpose is to establish, exercise or defend a right in court.
Right to withdraw consent if processing is carried out on the basis of such consent. Withdrawal of consent does not affect the validity of data processing carried out before the consent had been withdrawn.
Right to appeal to supervisory authorities. You can submit a request to The National Supervisory Authority for Personal Data Processing (ANSPDCP) or seek legal redress to protect the rights recognized by special legislation.
DATA STORAGE
The data obtained from you as data subject will be stored for the entire period when you are a User, i.e. when you have a valid User account. As an exception regarding payment details, the data will be stored for a period chosen by users who have the opportunity to request data deletion at any time. Such processing is performed in accordance with Article 6 (1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
DATA SAFETY
We protect your personal data using special-purpose technical and organizational security measures designed to prevent illegal or fraudulent use of your personal data.
In particular, we resort to security measures that guarantee: pseudonymization or encryption of your data; confidentiality, integrity and availability of your data, and sustainability of the systems and services that process it; data recovery possibility in case of data leakage. In addition, EDELFIA S.r.l. undertakes to test, verify and regularly evaluate the effectiveness of technical and organizational measures to ensure the continuous improvement of data processing safety.
DATA TRANSMISSION TO THIRD PARTIES
Taking into account the commercial relationship between the Controller and other legal entities, as well as the need to achieve the goals specified in this Privacy Policy, we may transfer your data to the following categories of third parties:
- Our partners in the field of marketing and advertising services;
- Payment processors;
- IT/software suppliers and administrators;
- Order handlers;
- Customer service requests handlers;
- Logistics operators.
DATA TRANSFER TO THIRD COUNTRIES
We may also transfer personal data to recipients located outside the EEA, in so-called third countries. In such cases, before the transfer, we shall ensure that the data recipient provides for an proper level of data protection (e.g., when the European Commission takes a data adequacy decision for that country, or upon agreement with the recipient based on the so-called EU Model Clauses) and that you have given your consent to such transfer.
You have the right to obtain an overview of recipients in third countries and a copy of the specific agreed provisions ensuring an adequate level of data protection; however, this will require your express written request.
AMENDMENTS TO THIS NOTIFICATION
We perform regular reviews of our Privacy Policy to reflect changes to our services and privacy practices. This Privacy Policy was last updated on (DATE).
If you do not agree to the new terms of this Privacy Policy, you should stop using the Website. If you are a registered user, you may cancel your account with us within thirty (30) days by contacting us at customerservice@potamy.com. Your account will be terminated and you will not be bound by the new terms. You can also ask us to delete your information (as stated above).
Otherwise, your use of the Website after the effective date of the amendments will be deemed as your acceptance of the new terms of this Privacy Policy.
COOKIE POLICY
We use cookie files and similar technologies to provide you with a personalized shopping experience and personalized ads, as well as to analyze our web traffic.
WHAT ARE COOKIE FILES?
Cookie files or cookies are data files that may contain small amounts of information and are stored on your device (computer, smartphone, etc.) when you first visit a website. We use cookies when you visit our site, but you can choose not to allow some types of cookies. Please be aware that blocking some cookies may impact your experience with the site and the services we offer.
WE USE THE FOLLOWING TYPES OF COOKIE FILES:
Strictly necessary cookies: These cookies are essential for you to browse the Website. Without these cookies, you will not be able to use the services offered by the Website (such as using the shopping cart or access to your order history).
Analytical cookies: These cookies are used to analyze how visitors use the Website (e.g., site traffic, total sales through the Website, the pages most often visited, and the pages displaying error messages) with the aim of ongoing improvement of the website and of the shopping experience offered through the website. All information collected through these cookies is stored in anonymous form (even if shared with third parties) and is not used to identify you.
Functionality cookies: These cookies are not essential for the functioning of the Website. However, they allow the Website to remember your choices and/or preferences (such as your username, language or the region you are in, etc.) in order to offer you some enhanced, simplified and personalized features.
Targeting and Advertising cookies: Targeting and advertising cookies may be used to provide personalized advertising that is more relevant to you and your interests. These cookies may collect detailed information about your browsing habits on the Website, for example the products you have clicked on or placed in your shopping cart. These cookies allow us to personalize any direct marketing communications (such as email), limit the number of times you see an advertisement, or help us assess the effectiveness of our advertising campaigns. They may also allow us (or our partner third-party advertising services) to track users’ online activities over time and across different websites or platforms in order to assess our marketing effort via statistics and to provide online ads that may be more relevant to individual consumers and which will improve the overall consumer experience.
Third-party cookies and social media access: Please note that if you share the Website content through any third-party websites (such as social networks), you may receive cookies from those websites. This occurs when you choose to log into our Website using your social media profile. In this case, your activity on our website will be subject to the privacy policies of other websites/social media services. EDELFIA S.r.l. does not control the setting of such cookies and recommends that you consult the websites of the relevant social media providers for more information about their cookies and how to manage them. You should also review the privacy policies of these websites and how they treat information that they access as a result of your logging into our website using your social media profile.
In our services, we use the following cookie files:
We use third-party advertising platforms, such as Facebook, TikTok, Google, YouTube, Instagram, etc. to send you messages that are targeted at you, based on your behaviour and browsing pattern, at specific times and locations of these platforms to increase the efficiency of our advertising campaigns.
In order to do this, we share your personal data with our advertising agency partners as well as social media platforms. We use third-party solutions such as Google Analytics and Facebook Business Manager tools to help us do a better job at targeting our campaigns and messages for our consumers.
Social media platforms will attempt to match your profile in their database to determine the optimal time and place (the page you are browsing) to show you an advertisement from EDELFIA S.r.l. We also need to analyze necessary information to understand the impact of our campaigns.
If you don’t accept that we track you for this purpose, you will still see EDELFIA S.r.l advertisements on social media platforms and other third-party platforms at random. Please also read the privacy notice on the social media platforms to understand how your personal data is used by them for this purpose.
You can learn more about how our advertising partners and social media platforms help us achieve this purpose by visiting their sites:
Google Personalized Advertising: https://support.google.com/adspolicy/answer/143465?hl=en
Google Advertising Policies: https://support.google.com/adspolicy/answer/6020956
Facebook Lookalike Audiences: https://www.facebook.com/business/help/164749007013531
Facebook Custom Audience Terms: https://www.facebook.com/legal/terms/customaudience
TikTok Advanced Matching Terms: https://ads.tiktok.com/i18n/official/policy/business-products-terms
Pinterest Analytics term: https://help.pinterest.com/en/business/article/pinterest-analytics
The legal basis for this is GDPR art. 6(1) f) our legitimate interests, namely in understanding customer behavior and interests and ensuring effective marketing and advertisement of EDELFIA S.r.l product and services.
Meta as a joint controller
Meta is a Joint Controller of the Joint Processing and information required by Article 13(1)(a) and (b) GDPR can be found in Meta’s Data Policy at https://www.facebook.com/about/privacy.
The information that you use Applicable Products as well as the purposes for which the collection and transmission of Personal Data that constitutes the Joint Processing takes place as set out in the Applicable Product Terms.
Further information on how Meta processes Personal Data, including the legal basis Facebook Ireland relies on and the ways to exercise Data Subject rights against Facebook Ireland, can be found in Meta’s Data Policy at https://www.facebook.com/about/privacy.
Meta and EDELFIA S.r.l has entered into a Controller Addendum to determine the respective responsibilities for compliance with the obligations under the GDPR with regard to the activities for which we are joint controllers.
Meta and EDELFIA S.r.l has agreed that EDELFIA S.r.l are responsible for providing Data Subjects as a minimum with the information required under the GDPR and which is set out in this Privacy Policy.
Meta and EDELFIA S.r.l has also agreed that between Meta and EDELFIA S.r.l, Meta is responsible for enabling Data Subjects’ rights under Articles 15-20 of the GDPR with regard to the Personal Data stored by Meta after the Joint Processing.
Tik Tok as a joint controller
We use the TikTok Pixel, provided by TikTok, to collect information about your use of our Website in order to serve targeted advertising and to measure the performance of our advertising campaigns.
The TikTok Pixel enables us to retarget you with products and services you have viewed on our Digital Property on TikTok and to measure when you have clicked through to our Digital Property after seeing one of our advertisements on TikTok.
Information about how TikTok collects, uses and protects information collected using the TikTok Pixel is available in TikTok's user privacy policy at https://www.tiktok.com/legal/privacy-policy-eea?lang=en.
Pinterest as a joint controller
Pinterest Europe is a Joint Controller of the Joint Processing and information required by Article 13(1)(a) and (b) GDPR can be found in Pinterest Europe’s Privacy Policy at: https://policy.pinterest.com/en/privacy-policy
Criteo as a joint controller
We use the Criteo tag, provided by Criteo, to collect information about the users and their activity on our website to target advertising to the user across different channels and devices.
Information about how Criteo collects, uses and protects information collected using the Criteo Pixel is available in Criteo’s privacy policy at https://www.criteo.com/privacy/.
HOW TO ACCEPT, BLOCK OR DELETE COOKIE FILES:
You can accept, block or delete cookies installed on your computer or mobile phone by adjusting the settings of the browser installed on your computer or on your mobile phone.