Privacy Policy

1. S.C. GOURMET FINE DINING S.R.L., with its registered office in Bucharest, Sector 1, Piaţa Presei Libere Street, Building A3, Mezzanine 1-2 (EST), Room 2, Office 83, registered with the Trade Registry/public administration authorities in Bucharest under No. J40/6451/2020, Tax Identification Number (C.U.I.) 42636853, acting as the Data Controller, processes personal data in accordance with the legal provisions governing the protection of personal data, as well as with the provisions of this Privacy Policy.

The company is the data controller with respect to the processing of personal data, within the meaning of Regulation (EU) No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the ”Regulation” or ”GDPR”).

Ensuring the confidentiality and security of personal data is one of the Company’s top priorities. SC GOURMET FINE DINING SRL provides professional, personalized services, while committing to comply with the provisions of the Regulation and to protect the confidentiality and security of your information through appropriate technical and organizational measures.

1. Implementation of the Privacy Policy The Privacy Policy (“Policy”) describes the types of personal data we collect, the purposes and legal basis for processing, the recipients who have access to this data, the rights and options available to data subjects regarding the processing of personal data, and how to exercise those rights.

For the purposes of this Policy and in accordance with the provisions of the Regulation, „personal data” means any information relating to an identified or identifiable natural person (“data subject”).

“Data processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

This Policy applies to personal data processed in connection with the activities and services provided by SC GOURMET FINE DINING SRL, or through other interactions in which a connection or reference governed by this Policy is made.

By using the Company's website www.medusauniverse.ro and/or by sending us your personal data, you consent to the processing of your personal data as described in this Policy.

If you do not agree with this Policy, please do not use the services and/or provide your personal data to the Company.

This Policy applies to all Company employees responsible for processing personal data and/or, as applicable, to authorized individuals.

1. Purpose and Legal Basis for Data Processing

The company processes the personal data it collects for the following purposes:

– for the performance of the contractual relationship

– to understand how the services offered by the Company are used, so that they can be improved;

– to provide customer support and resolve inquiries or complaints;

– to manage the relationship with the manufacturer, supplier, carrier, distributor, and/or courier company;

– workforce selection and hiring, human resources activities, for the purpose of fulfilling the obligations and exercising specific rights of the controller or the data subject in the field of employment, social security, and social protection; for purposes related to preventive or occupational medicine; and for the purpose of assessing an employee’s work capacity;

– economic and financial management and tax obligations;

– legal representation to defend legitimate interests;

– monitoring/security of people, premises, and/or property.

The collected data is also processed for the following purposes:

• managing the Company’s relationships with customers/data subjects, including but not limited to sending information and offers regarding the Company’s services and/or products (if customers have consented to this purpose), as well as for the development of the Company’s business and services, in accordance with applicable legal provisions (such as identifying customer needs, improving service delivery, and providing maintenance or security information);
• for statistical purposes after anonymization;
• the Company’s provision, transmission, or communication of details regarding the products it offers, promotions, or campaigns it runs (processing for marketing purposes, including direct marketing, and advertising).
• to allow suppliers and subcontractors to provide services, provided that they comply with the confidentiality obligation and do not use the information for their own benefit;
• the investigation by law enforcement authorities of any violation of laws, rules, or regulations.

The Company’s processing of personal data is based on the provisions of Regulation (EU) 2016/679, as well as on the applicable national legislation regarding the protection of personal data.

The legal basis for the processing of personal data, as it relates to each specific purpose, is as follows:

– the conclusion and performance of a preliminary contract or contract to which the data subject is a party, or to take steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) of the Regulation);

– the legitimate interests pursued by the controller or a third party (for example, to manage customer relationships and to improve the relevance of communications and services for customers) (Article 6(1)(f) of the Regulation);

– compliance with legal obligations incumbent upon the controller (Article 6(1)(c) of the Regulation);

-the freely given consent of the data subject (Article 6(1)(a) of the Regulation);

The company processes personal data for the purposes set forth in this section, and for each purpose, one or more of the processing operations described above may be used. When we collect and process personal data, our policy is to be transparent about the purpose and manner in which we process personal data.

1. Details Regarding Data Processing Based on Consent

The provision of personal data for processing by the Company for informational, promotional, marketing, and advertising purposes is voluntary, and such processing is carried out on the basis of the specific, informed, and freely given consent of the data subjects. When data processing is based on Article 6(1)(a) of the Regulation, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out on the basis of that consent. (1)(a) of the Regulation, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal. Thus, the data subject may modify or withdraw their consent at any time, and we will act immediately accordingly, unless there is a legal reason or a legitimate interest not to do so.

Refusal to provide consent to the processing of data for these purposes will have no consequences whatsoever for the data subject or for the contracts to which the data subject is a party.

1. Collection and Use of Personal Data. Categories of Individuals and Categories of Data

We will process only personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes mentioned in section (3), in accordance with legal provisions and with the establishment of appropriate safeguards for the fundamental rights and interests of the data subject.

Personal data is processed only when it is relevant to the interaction between you and us, in order to provide you with any of the agreed-upon goods or services, offered based on your preferences and/or the contract entered into with the Company.

The categories of data subjects whose data are collected and processed by S.C. GOURMET FINE DINING S.R.L.are: customers, potential customers, employees, job applicants/potential employees, former employees, representatives of contractual partners (suppliers or beneficiaries), as well as users and visitors to the website.

Depending on the purpose of the processing, we collect several types of data from and about customers/users, namely:

• personal identification information (last name, first name, billing address, shipping address, personal or work email address, phone number);
• information we collect when you browse our website, including cookies and web beacons;
• other personal data provided by the data subject or necessary to fulfill the purposes listed below (such as a username, etc.).

We collect information in the following ways:

o Information that you provide to us directly when creating a user account, making a reservation through the website, or in any other way resulting from your use of the website. .

o Information we obtain when you use the services. We collect information about the services you use and how you use them. This information includes:

Ø Device Information – We collect device information (such as the hardware model, operating system version, and mobile network information, including the phone number).

Ø Log Information – When you use our services, we automatically collect and store certain information in server logs. This includes:

• details about how you used our service
• cookies that can uniquely identify your browser or your Account.

Ø Cookies and Similar Technologies

An “Internet cookie” (also known as a “browser cookie,” “HTTP cookie,” or simply “cookie”) is a small file consisting of letters and numbers that is stored on a user’s computer, mobile device, or other equipment used to access the Internet. The cookie is installed through a request sent by a web server to a browser (e.g., Internet Explorer, Chrome) and is completely “passive” (it contains no software, viruses, or spyware, and cannot access information on the user’s hard drive).

A cookie consists of two parts: the name and the content or value of the cookie. Furthermore, a cookie has a defined lifespan; technically, only the web server that sent the cookie can access it again when a user returns to the website associated with that web server.

PRIVACY POLICY

The Purpose of Using Cookies on This Website

Cookies are used to provide website users with a better browsing experience and services tailored to the needs and interests of each individual user. Specifically, they are used to:

• Customizing certain settings, such as the language in which a website is displayed, the currency in which prices and rates are shown, and saving preferences for various products/services in the shopping cart or forms.
• To improve the user experience on our websites, including by identifying certain errors that occur when users visit or use them.
• A preview of certain goods and services that will be made available to users in the future through these web pages.

How long do cookies last?

The lifespan of a cookie can vary depending on the purpose for which it was placed and is also influenced by the category to which it belongs, as follows:

• Session cookies – these are automatically deleted when the user closes their browser.
• Persistent/fixed cookies – these remain stored on the user’s device until they reach a specific expiration date or until the user deletes them at any time through their browser settings.

How can I disable cookies?

You can set your browser to block all cookies or to notify you when we set a cookie. However, it is important to note that many of our services may not function properly if you have disabled cookies.

In accordance with legal obligations, as part of the processes of concluding and executing contracts, recruitment, the hiring process itself, human resources management, and financial and accounting activities, the scope of personal data collected and processed may include, on a case-by-case basis, the following types of data: last name, first name, date and place of birth, domicile/residence, Personal Identification Number (CNP), ID card series and number, handwritten signature, information regarding education/academic background and professional training/experience, family status, health insurance, bank information, medical status (as determined by medical examinations required under an employment contract, in accordance with applicable law), criminal record information, image/photograph, phone number, and email address.

1. Target Audience Categories

The company will use personal data only in a fair and lawful manner, in accordance with the contract entered into with the data subjects, for one or more purposes identified in the contract, and only to the extent necessary. The company will not sell, market, or rent personal data to third parties.

We are required by law to disclose personal data to the competent state authorities in cases specifically provided for by the Regulation, as well as to fulfill the obligations set forth in tax and labor laws, to perform accounting operations, conducting procurement procedures, or to enforce court rulings and/or other judgments/decisions issued by courts and/or other authorities vested by the state with decision-making power.

Depending on the purposes set forth in Section 3 of this Policy, the recipients of personal data may include: Company employees, service providers, transport operators, and persons authorized by the Company who, under the direct authority of the controller, are involved in contract management.

Any parties to whom we disclose personal data are restricted (by law and/or by contract) in their ability to use such data only for the purposes specifically identified by us, and are bound to comply with the GDPR as well as the provisions and obligations expressly stipulated in this regard in the master agreement and/or its addenda. We will always ensure that any parties to whom we disclose personal data are subject to confidentiality and security obligations, in accordance with the provisions of the Regulation and applicable specific legislation.

The company does not transfer personal data outside the European Union or to international organizations.

1. Data Processing Methods and Data Security

Personal data may be processed both manually and using computer-based methods.

The company processes personal data in a manner that ensures its adequate security. To this end, appropriate technical and organizational measures have been implemented to prevent unauthorized or unlawful processing, loss, destruction, accidental damage, or other harm to personal data. These measures include the use of firewalls, secure servers, encryption, appropriate access rights management systems and processes, the careful selection of employees responsible for data processing, confidentiality clauses, and other reasonable technical and organizational measures to ensure the appropriate protection of personal data against unauthorized use or disclosure. Where appropriate, we will create backup copies and employ other such measures to prevent the accidental loss or destruction of personal data. These measures ensure a level of security appropriate to the inherent risks associated with the processing and the nature of the personal data to be protected.

1. Storage duration

The Company retains personal data in accordance with the principles of lawfulness, proportionality, and necessity, and in any case only for a period not exceeding that necessary to fulfill the purposes for which the data is processed, and thereafter—that is, either upon termination of the business relationship or upon expiration of the Company’s legal archiving obligation under applicable law—the data will be deleted.

1. Data Controller and Responsible Employees

At S.C. GOURMET FINE DINING S.R.L. personal data is processed only by employees who have such responsibilities, who are subject to strict contractual confidentiality obligations and may be held legally liable if they fail to fulfill these obligations. These employees are responsible for processing the personal data under the control of the data controller. Personal data is considered confidential, and any unauthorized collection or processing of such data by employees is prohibited. Any processing of personal data carried out by an employee who has not been authorized to do so as part of their legitimate duties is unauthorized. Employees have access to personal data on a „need-to-know” basis, only to the extent appropriate, in accordance with the job duties and responsibilities set forth in their job descriptions. Employees are prohibited from collecting and/or using personal data obtained in the course of their employment for any other private or commercial purposes, disclosing it to unauthorized persons, or making it available in any other way. This obligation remains in effect even after the employment relationship has ended.

Compliance with the Privacy Policy and applicable data protection laws is regularly verified through data protection audits and other controls.

1. The Rights of Data Subjects and How to Exercise Them

With regard to the processing of personal data, in accordance with the conditions set forth in the GDPR, the Company guarantees that data subjects may exercise any of the following rights:

(1) The right to information and access to personal data allows the data subject to be informed about the processing of personal data, to obtain confirmation as to whether or not personal data concerning him or her is being processed, and to learn what such data is being processed.

(2) The right to rectification entails the right to request the rectification or updating of inaccurate or incomplete personal data concerning you, or the completion of such data when it is incomplete.

(3) The right to erasure, or the „right to be forgotten,” entails the right to request the erasure of personal data concerning the data subject, under certain circumstances, such as (i) the personal data is no longer necessary for the purposes for which it was collected or processed, (ii) the data was processed unlawfully, (iii) the processing of the data was based on the data subject’s consent, and that consent has been withdrawn.

(4) The right to withdraw consent. Consent may be withdrawn at any time when the processing of personal data was based on the data subject’s consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. The provision regarding withdrawal of consent does not apply in cases where the legal basis for processing is not consent.

(5) The right to restrict processing entails the right to request and obtain the restriction of the processing of personal data under certain circumstances, such as (i) the data subject contests the accuracy of the data, for the period necessary to allow the controller to verify the accuracy of that data, (ii) the data has been processed unlawfully, and the data subject opposes its erasure, requesting that its use be restricted, (iii) the controller no longer needs the personal data for the purposes of processing, but the data subject requests it for the establishment, exercise, or defense of a legal claim; or (iv) the data subject has objected to the processing in accordance with Article 21(1) (1) of the Regulation, and there are no legitimate grounds for the processing that override the data subject’s rights, for the period during which it is being determined whether the controller’s legitimate interests override those of the data subject

(6) The right to data portability. The data subject has the right to receive the personal data concerning him or her that he or she has provided to the controller in a structured, commonly used, and machine-readable format, and has the right to transmit that data to another controller, without any hindrance from the controller to whom the personal data were provided, where:

1. (a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9( (2)(a) or on a contract pursuant to Article 6(1)(b); and
2. (b) the processing is carried out by automated means.

(7) The right to object means that, at any time, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data in certain circumstances, such as (i) where the processing was carried out in the legitimate interests of the controller or (ii) where the processing is for the purposes of direct marketing, including profiling based on those provisions.

(8) The right not to be subject to a decision based solely on the automated processing of the data subject’s personal data, including profiling that produces legal effects or significantly affects the data subject. This implies that the data subject has the right to request human intervention from the Controller, to express their point of view, and to contest the decision.

To exercise these rights and for additional information, the data subject may contact us by email at office.medusauniverse@gmail.com.Orice. The data subject has the right to ask questions regarding their rights and to receive a response within the timeframe provided by law, free of charge.

The data subject also has the right to file a complaint with the National Supervisory Authority for Personal Data Processing, located at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, and the right to seek judicial remedy regarding a personal data breach likely to pose a high risk to the rights and freedoms of data subjects.

1. Consequences of Refusing to Provide Personal Data

To the extent that you have chosen to purchase a specific product and/or service, the provision of personal data is necessary from the perspective of legal requirements and/or the contractual legal relationship, as this information is required, and without this data, we will not be able to fulfill our obligations to you.

Refusal to provide the Company with personal data and/or to allow the Company to process personal data will make it impossible to provide services or goods related to the Company’s core business, as well as other related services, including the use of online applications and services.

The provision of your personal data for the purpose of sending commercial communications related to the Company’s activities is voluntary. Your failure to provide consent for this purpose will have absolutely no impact on the conclusion of the contract. We will specify whether consent is mandatory or optional at the time of data collection. You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

In certain cases, especially when you request that we delete your personal data or stop processing it, this may also mean that we will no longer be able to continue providing services to you.

In the case of employment under an individual employment contract, the provision of personal data is necessary to comply with legal requirements and/or to establish a legal relationship with the Company, because if the Company does not have this data, we will not be able to fulfill our legal obligations and, consequently, will not be able to proceed with the hiring process.

1. Privacy Regarding Minors

The website www.medusauniverse.ro is intended for use by individuals over the age of 18. We do not seek to collect information about minors.

If a minor submits personal information through our website, we will delete that information as soon as we are informed of the minor’s age, and from that point on, we will not use it for any purpose.

Privacy Policy Update

This policy may be subject to periodic updates, which we will communicate to data subjects whenever necessary. To stay informed about any significant changes that may affect the processing of your personal data, please check this webpage periodically. As the Data Controller, we process personal data in accordance with the legal provisions governing the protection of personal data, as well as with the provisions of this Privacy Policy