Respecting your privacy is one of our fundamental commitments and that is why we pay the utmost attention to the processing of your personal data in accordance with applicable law. We are aware of the importance of maintaining the confidentiality, integrity and security of your personal data (“Personal Data“) and have drafted this privacy policy (“Privacy Policy“) to explain how your Personal Data is collected, stored, used and disclosed by D-TOYS S.A., a company incorporated and operating under Romanian law, having its registered office at Str. Constructorilor 2, Sfântu Gheorghe 520077, Romania, tax identification code 13739316, registered with the Trade Register Office under no. J14/37/2001 (“DTOYS“,“we”, “us“, “we“, “us” or “our“), as operator, in connection with your access to and use of the website available at the URL www.roovi.com (“Platform“). Whenever we are required by applicable law, we will seek your free, informed, specific and unequivocal consent to process your Personal Data. By expressing your consent, you agree that we may collect, use, disclose, process and transfer Personal Data in accordance with this Privacy Policy.

We reserve the right to amend the provisions of this Privacy Policy from time to time. If we make changes to this Privacy Policy, we will make the updated version available on the Platform and update the date mentioned under “Last Updated”. We will also notify you of any changes to ensure that you are informed of how your Personal Data will be used. Any changes to the Privacy Policy will apply from the date they are made, except for changes that require your prior consent, which will apply from the time you give your consent.

1. PERSONAL DATA PROCESSED, PURPOSES OF PROCESSING AND GROUNDS FOR PROCESSING
   1. Navigation data on the Platform

The computer systems and software applications used to operate the Platform generally obtain some Personal Data, the transmission of which is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified persons, but, due to its nature, it may allow, through processing and integration with certain data stored by third parties, the identification of users. This information includes IP addresses, time of the request, method used to send the request to the server, size of the file obtained in response, time spent on each web page, data on the type of device, operating system and web browser used, type of screen and its resolution, geographical location of the origin of the calls to the server. as well as other parameters related to the device, operating system and browser used by the user

To the extent that this information leads to the identification of a user, the provisions of this Privacy Policy become applicable.

Purpose of processing	Basis of processing
We only use this data to obtain anonymous statistical information on the use of the Platform and to check its correct functioning.	Our legitimate interest for the improvement of our Platform and for the management of server capacities and for keeping our Platform error-free(Article 6 (1) (f) GDPR);The fulfilment of legal duties relating to security aspects of our systems(Article 6 (1) (c) GDPR).

2. Creating an account

On our Platform you have the possibility to register and create an account. In this case, we will need your e-mail address, full name (first and last name), telephone number, full physical address (country, county, city, street address, postal code). If you want to place an order as a legal entity, we will also collect the following information about the company: company name, tax code and registration number with the Trade Register.

Purpose of processing	Basis of processing
The purpose of this processing is to create your account, provide our services and process orders placed through the Platform.	The performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to the conclusion of a contract(Article 6 (1) (b) GDPR);

3. Applying for a job

On our Platform you have the possibility to apply for a job posted on the Platform. In this case, we will need your name, surname, e-mail address, CV, all the information mentioned/indicated in the submitted CV, cover letter, salary expectations and any other information you provide voluntarily when contacting us

Purpose of processing	Basis of processing
The purpose of the processing is to provide our services through the Platform.	The performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract(Article 6(1)(b) GDPR);

4. Contractual notifications

In the course of providing our services, we will use your email address to notify you of any changes to the terms and conditions of use of the Platform and in relation to any other matters relating to the performance of the contract between DTOYS and you

Purpose of processing	Basis of processing
The purpose of the processing is to provide contractual notices in accordance with the terms and conditions of use of the Platform.	The performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract(Article 6(1)(b) GDPR);

5. Contact

You have the possibility to contact us in different ways: by e-mail, by phone, by contact form. In this case, we may process the following Personal Data: name, surname, e-mail, telephone, address, company and any other information you provide voluntarily when contacting us

Purpose of processing	Basis of processing
In this situation, we will only use your Personal Data to contact you in connection with the requested offer or in connection with the resolution of the indicated problem.	The legal basis for this processing is the performance of a contract or to take steps at your request prior to the conclusion of a contract(Art. 6 (1) (b) GDPR);Our legitimate interest in ensuring communication with our customers and providing the necessary support for the use of the Platform(Art. 6 (1) (f) GDPR);

6. Commercial communications

You have the possibility to opt-in to receive commercial communications via e-mail and/or via telephone calls

Purpose of processing	Basis of processing
If you opt-in to receive such commercial messages, we will use your e-mail address and telephone number to send you commercial messages about DTOYS activities and promotions.	The legal basis for processing your e-mail address and telephone number for this purpose is your consent.(Article 6 (1) (a) GDPR).

You can revoke your prior consent at any time and free of charge by using the unsubscribe links, where present in incoming messages and communications, or by an email message to privacy@roovi.ro or an SMS or WhatsApp message to (040) 0728.330.431.

7. Provision of Personal Data

You may refuse to provide certain Personal Data (indicated above) but, in such case, you may not be able to benefit from certain services and functionalities of the Platform, including but not limited to creating a user account or contacting you for resolution of your problem and to provide support.

2. PROCESSING TIME

As a rule, we will keep and process your personal data for as long as you use our service and no longer than five years thereafter. We will endeavour to delete any personal data sooner if it is not necessary to retain it, but please be aware that we may retain personal data for a longer period if we have a legal obligation to do so or if we have a reasonable belief that it is necessary to do so for commercial or legal reasons

Personal Data collected for the purpose of sending commercial communications will be processed until the date of withdrawal of consent.

In certain circumstances, we may retain Personal Data for longer periods of time, for example where we are obliged to do so in accordance with legal, regulatory, tax or accounting requirements.

We may also retain Personal Data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or if we reasonably believe that there is a prospect of litigation relating to the Processing of your Personal Data.

3. TRANSFER OF PERSONAL DATA

Personal Data is stored on the servers of our contractual partners who help us provide our services.

We may transfer Personal Data, to the extent necessary, to the following categories of recipients

• contractual partners;
• subcontractors;
• companies providing courier services;
• companies providing IT services;
• data and voice service providers;
• suppliers of software or hardware products;
• marketing companies;
• public authorities, courts or arbitration tribunals and authorities competent to investigate criminal offences

These recipients may be located in the European Union and/or the European Economic Area. If the recipients are located outside the European Union and the European Economic Area, including in countries that are not recognised as providing an adequate level of protection, the transfer of Personal Data will only take place if there are adequate safeguards in accordance with applicable law. In this respect, we rely on several safeguards, such as the Privacy Shield certificate or standard contractual clauses issued by the European Commission. You can receive from us a list of recipients in third countries as well as a copy of the agreed provisions ensuring an adequate level of protection of Personal Data. For any request in this regard, please contact us at the contact details below.

4. SECURITY OF PERSONAL DATA

The security of your Personal Data is important to us. Therefore, your Personal Data will be processed by applying reasonable technical and organisational measures to protect Personal Data, such as limiting access to Personal Data, encrypting or anonymising Personal Data, storing on secure media. However, despite our best efforts, we cannot always guarantee the effectiveness of the security measures implemented, and therefore cannot guarantee the security of Personal Data at all times.

5. YOUR RIGHTS WITH REGARD TO THE PROCESSING OF PERSONAL DATA
   1. Your rights

In accordance with applicable law, you have the following rights:

Right of access: you have the right to obtain confirmation from us that your Personal Data is processed by us, as well as information on the specifics of the processing such as: purpose, categories of Personal Data processed, recipients of the Personal Data, period for which the Personal Data is kept, whether we transfer it abroad and how we protect it, your rights, the right to lodge a complaint with the supervisory authority, from where we obtained the Personal Data

Right to rectification: You have the opportunity to request rectification of your Personal Data, provided that the applicable legal requirements are met. In the event of errors, upon notification, we will immediately correct your Personal Data

Right to erasure: In certain cases, you may request the erasure of Personal Data: (i) it is no longer necessary for the purposes for which we collected and process it; (ii) you have withdrawn your consent to the processing of Personal Data and we can no longer process the Personal Data on other legal grounds; (iii) the Personal Data is processed unlawfully; (iv) you are exercising a legal right to object. We are not obliged to comply with your request for erasure if the processing of Personal Data is necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims. There are also other circumstances in which we are not obliged to comply with your request to delete Personal Data

Restriction of processing: You may request that we restrict the processing of your Personal Data in the following situations: (i) if you dispute the accuracy of the Personal Data, for a period that allows us to verify the accuracy of the Personal Data in question; (ii) if the processing is unlawful, and you object to the erasure of the Personal Data, requesting instead that we restrict its use; (iii) if we no longer need the Personal Data for the purpose of processing, but you request it from us for a legal claim; (iv) if you have objected to the processing, for the period of time during which it is verified whether our legitimate rights as controller prevail over those of the data subject. We may continue to use Personal Data following a restriction request if: (i) we have your consent; (ii) to establish, exercise or defend a legal claim; or (iii) to protect the rights of another natural or legal person.

Right to data portability: To the extent that Personal Data is processed on the basis of your consent or for the performance of the contract and the processing is carried out by automated means, you have the right to have your Personal Data provided to you in a structured, commonly used and machine-readable format and you have the right to transmit such Personal Data to another controller. This right does not adversely affect the rights and freedoms of others.

Right to object: In certain situations, such as when we process your Personal Data on the basis of a legitimate interest, you have the right to object to the processing of your Personal Data by us. In case of unjustified objection, DTOYS is entitled to further process the Personal Data.

Right to object to receiving commercial messages: You may also object to the processing of your Personal Data for the purpose of sending commercial messages.

Withdrawal of consent: To the extent that we process your Personal Data based on your consent, you may withdraw your consent at any time without affecting the lawfulness of the processing based on your consent prior to the withdrawal of your consent.

Right to opt-out of individual decisions: In certain circumstances you have the right to opt-out of a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly affects you to a significant extent. This right does not apply where the decision: (i) is necessary for the conclusion or performance of a contract between you and us; (ii) is authorised by law which also provides adequate safeguards for your rights and freedoms; (iii) is based on your explicit consent.

Right to complain to the supervisory authority: You have the right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing (“ANSPDCP“) about any violation of your rights concerning the processing of your Personal Data. The contact details of the ANSPDCP are: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336 Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.

2. Exercising your rights

To find out more about how you can exercise the above-mentioned rights, please contact us at privacy@roovi.ro.

Verification of identity: We take the utmost care to ensure the confidentiality of all Personal Data and reserve the right to verify your identity if you make a request regarding Personal Data.

Fees: As a rule, you can exercise your rights free of charge. However, we reserve the right to charge a reasonable fee if your requests are manifestly unfounded or excessive, in particular due to their repetitive nature.

Response time: We make every effort to respond to your requests within one month of receiving your request. This period may be extended by two months where necessary, taking into account the complexity and number of requests, in which case we will inform you of any such extension and the reasons for the delay.

6. CONTACT

If you have any questions or concerns about this Privacy Policy or its implementation, you may contact us at privacy@roovi.ro.