Personal data protection policy
Data protection notice for this website
We are glad you are visiting this website. We are committed to protecting your personal data and to complying with the data protection law in force, in particular the EU General Data Protection Regulation („GDPR”).
In this data protection notice we explain what information (including personal data) we process in connection with your visit to, and your use of, the digital offering mentioned above („Website”).
I. Who is responsible for processing personal data?
The controller responsible for processing personal data is ASTON COM S.A., Str. Linia de Centura nr. 46, VGP Park Bucharest, Building C, Stefanestii de Jos, Ilfov County, Romania, 077175, Tel.: 0728.231.285, email: protectiadatelor@yamato.ro. Any reference to „we” or „us” in this data protection notice is a reference to the entity named above.
Our data protection officer can be contacted through the means mentioned above or at the email address protectiadatelor@yamato.ro.
II. What principles do we follow?
In order to comply with the data protection law in force, we process your personal data only on the basis of a legal authorisation or where you have given your consent. This also applies to the processing of personal data for marketing purposes.
On this website we may collect information that does not allow us to draw direct conclusions about you as a person. In certain cases – in particular when combined with other data – this information may nevertheless be regarded as „personal data” under the data protection law in force. In addition, we may also collect information about this website that does not allow us to identify you, directly or indirectly; this is the case, for example, with aggregated information about all users of this website.
III. What data do we process?
You can access our website without entering personal data (such as your name, your postal address or your email address). Even in this case, we must process certain information that allows us to make our website available to you. In addition, we use certain analysis methods on this website and we have integrated third-party functionality („social media plug-ins”).
1. Log files: When you visit this website, our web server automatically stores the domain name or the IP address of the requesting computer (usually a computer of your internet access provider), including the date, the time and the duration of your visit, the subpages/URLs you visit and information about the application(s) and the device(s) you use to view our pages.
2. Cookies: To make our website as easy to use as possible, we use – like many other website operators – cookies. Cookies are small text files that are stored in your browser. These files help us recognise certain preferences of our visitors as they browse and build our page accordingly. Most of the cookies we use are session cookies. They are deleted automatically at the end of your visit. However, we also use permanent cookies. These help us improve user guidance. Our cookies do not collect personal data and are not suitable for identifying you on third-party websites. You can set your browser to inform you when cookies are placed, so that the use of cookies becomes transparent to you. In principle, you can also refuse to accept cookies through your browser settings. However, this may mean that you are not able to use all the functions of the website.
3. Website analysis through Google Analytics: We use Google Analytics, a web analysis service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google”), on our website in order to improve it continuously. Google Analytics uses cookies that are stored on your computer and that allow an analysis of the use of the website. The information generated by the cookie about your use of this website is usually sent to a Google server in Europe (or in a member state of the European Economic Area) for the anonymisation of the IP address, so that any personal reference is excluded. Only after the IP address has been anonymised is the shortened IP address transferred to a Google server in the USA and stored there. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. This website uses Google Analytics with an extension for the anonymous collection of IP addresses (so-called IP masking). On our behalf, Google will use the information collected to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to the use of the website. The IP address transmitted by your browser in the context of Google Analytics is not combined with other Google data. You can refuse the use of cookies by selecting the appropriate settings in your browser. However, we would like to point out that in this case you may not be able to use all the functions of this website in full. You can also prevent Google from collecting the data generated by cookies and relating to your use of the website (including your IP address), and from processing this data, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
Alternatively, you can use the link below to prevent data from being sent to Google or processed by Google: To opt-out please click here.
An opt-out cookie is set, which prevents the future collection of your data when you visit this website. Further information on data protection in Google Analytics can be found here http://www.google.com/analytics/terms/de.html and here http://www.google.com/intl/de/analytics/privacyoverview.html.
4. Facebook social platform plug-in: We have integrated a button of the Facebook social network on our website. You can recognise the Facebook buttons by the Facebook logo or the „Like” button.
As the operator of this website, we have no knowledge of the content of the data transmitted or of its use by Facebook. We do not know when you have clicked a button. For more information on how Facebook uses your information, please consult the Facebook Privacy Policy at http://de-de.facebook.com/policy.php#.
5. Online contact form: We provide a variety of information and advice options through the contact form on our website. Depending on the option you choose, we process different personal data.
6. a) Contact: If you contact us through one of the channels indicated on our site, we will process any personal data contained in your message and provided by you in order to handle and respond to your request.
b) Information by post / email: If you have requested that information materials be sent to you, we will process the data you provide in the contact form, at least your first name and surname and the details of the contact channel you have chosen (post and/or email), for the one-off dispatch of the material you requested.
c) Telephone advice: If you have requested advice by telephone, we will process the data you provide in the contact form, at least your first name and surname, as well as your telephone number, in order to provide the telephone advice you requested.
d) Personal advice: If you have requested personal advice, we will process the data you provide in the contact form, at least your first name and surname, as well as your telephone number and/or email address, in order to contact you to arrange an appointment for personal advice.
e) Email newsletter: If you have signed up for our email newsletter, we will process the data you provide in the contact form, at least your first name and surname, as well as your email address, in order to send you our newsletter by email. In addition, we use the other information you provide in the contact form (such as information about your activity or your area of interest) in order to send you content tailored to your interests. We will also analyse the data generated during the sending and retrieval of these emails in aggregated form (delivery rate, open rate, click rates, conversion rate, unsubscribe rate, bounce rate) in order to analyse the success and the use of the emails. We also evaluate the data generated when you access and use these emails (time of opening, hyperlinks you clicked, documents downloaded) in order to provide you, on this basis, with personalised information in future email newsletters that takes your interests and needs into account.
IV. For what purposes and on what legal basis do we process your personal data?
1. We process the personal data that may be contained in the log files in order to allow you to use our website; this processing is based on Article 6(1)(f) GDPR, for the purpose of our legitimate interest in operating our website.
2. We process the data collected through the use of cookies and pseudonymised user profiles in order to carry out direct marketing (publishing commercial offers or links to our partners’ sites), market research, and to further develop our digital offerings on the basis of users’ needs, in accordance with Article 6(1)(f) GDPR, for the purpose of our legitimate interest in analysing the use of our website.
3. The processing of personal data in order to respond to one of your requests sent to us through one of the channels indicated on our site is carried out, in any event, for the purpose of our legitimate interest in establishing and maintaining business contacts, on the basis of Article 6(1)(f) GDPR. If your request relates to the conclusion of a contract or to pre-contractual measures, your personal data will be processed on the basis of Article 6(1)(b) GDPR.
4. We process the data provided in order to make use of our information and advice options and to give you the option you selected and, if you have chosen to sign up for our email newsletter, in order to register you and send you the newsletter by email. We process this personal data on the basis of your consent and in accordance with Article 6(1)(a) GDPR. Please note that you may withdraw your consent at any time, without giving reasons, with effect for the future, simply by contacting us through the contact channels indicated in the first section of this data protection notice. You will also find an unsubscribe link in every email.
5. We may also process the data processed in connection with your use of our website in order to comply with our legal obligations; this processing is based on Article 6(1)(c) GDPR.
6. To the extent necessary, we process personal data (in addition to processing for the purposes of the business relationship or of compliance with legal obligations) for the purposes of our legitimate interests or the legitimate interests of a third party, on the basis of Article 6(1)(f) GDPR. The legitimate interest may include:
- establishing a defence against legal claims;
- preventing fraud, misuse of services or money laundering;
- preventing and investigating criminal offences; and
- managing and further developing our business operations, including risk management.
V. Are you obliged to provide data?
The information required to sign up for our newsletter or to provide information and advice is marked as mandatory information in the relevant area of the website (for example an online form); without providing the mandatory information, we cannot allow you to use that functionality.
Where we collect additional information from you, we will inform you whether providing that information is based on a legal or contractual obligation, or is necessary for the performance of a contract. We usually indicate which information may be provided voluntarily and is neither based on a legal or contractual obligation nor necessary for the purposes of a contract.
VI. Who receives or has access to your data?
Your personal data is generally processed within our company. Depending on the categories of personal data, only dedicated departments/organisational units are granted access to your personal data, on a need-to-know basis, and our employees are bound by confidentiality obligations. On the basis of a role and rights management concept, access to personal data is limited to the functions and the extent necessary for the relevant purpose of the processing.
Where and to the extent permitted by law, we may transfer your personal data to recipients outside our company. These external recipients may include:
- affiliated companies within the Aston Com group, to which we may transfer personal data for the purposes of administering our website, technical support and reporting;
- service providers which – on the basis of separate contracts with us – provide certain services that may include the processing of personal data, as well as approved subcontractors of our service providers (such as IT and email service providers), solely to the extent necessary to serve the applicable processing purposes for which your data is collected and processed;
- public or private bodies, to the extent that we are required to transfer your personal data to them on the basis of a legal obligation.
VII. Do we use automated decision-making?
In connection with the operation of our websites, we generally do not use automated decision-making (including profiling) within the meaning of Article 22 GDPR. Should we apply such processes in the future, we will inform you separately in accordance with the applicable legal provisions.
VIII. Is data transferred to countries outside the EU / EEA?
Personal data is generally processed in the European Union or in the European Economic Area; we do not intend to transfer personal data to other countries.
Only in connection with the use of service providers for the provision of services relating to web analysis may information be transferred to recipients in so-called „third countries”. „Third countries” means countries outside the European Union or the Agreement on the European Economic Area, where a level of data protection comparable to that in the European Union cannot immediately be assumed.
If the information transferred contains personal data, then before such a transfer, of which you have been duly informed, we ensure that the required appropriate level of data protection is guaranteed in the relevant third country or with the recipient in the third country. This may result in particular from a so-called „adequacy decision” of the European Commission, which establishes an appropriate level of data protection for a particular third country as a whole. Alternatively, we may also base the data transfer on so-called „EU Standard Contractual Clauses” agreed with a recipient or – in the case of recipients in the USA – on compliance with the principles of the so-called „EU-US Privacy Shield”. In circumstances involving the transfer of data to third countries, we are willing to provide you, on request, with further information on the appropriate safeguards for maintaining an adequate level of data protection; our contact details can be found at the beginning of this data protection notice. Information on the participants in the EU-US Privacy Shield can also be found here www.privacyshield.gov/list.
IX. How long is your data stored?
In general, we store personal data for as long as we have a legitimate interest in retaining that data and the interest of the data subject in not having the data processed further does not prevail. Even without a legitimate interest, we may continue to store the data if there is a legal obligation to do so (for example compliance with statutory retention obligations). We delete personal data, even without any action on the part of the data subject, as soon as further retention is no longer necessary for the purposes for which the data was collected or otherwise processed, or if further retention is otherwise not permitted by law.
With regard to the processing mentioned above, we regularly delete log data within seven days, unless further storage is necessary for the purposes provided for by law, such as detecting misuse and detecting and rectifying technical faults; we delete data processed in the context of an online order after the statutory retention period has expired, and we delete data processed in the context of a user registration or a customer account within 30 days after the registration ends or the customer account is deleted.
If personal data must be stored in order to comply with a legal obligation, that data is kept until the end of the relevant retention period. If personal data is processed solely in order to comply with a statutory retention obligation, access to that data is usually restricted, so that the data is accessible only where it is needed for the purposes of the retention obligation.
X. What are your rights as a data subject?
As a data subject, you may:
- request access to your personal data, Article 15 GDPR;
- request the rectification of incorrect personal data, Article 16 GDPR;
- request the erasure of your personal data, Article 17 GDPR;
- request the restriction of the processing of your personal data, Article 18 GDPR;
- exercise your right to data portability, Article 20 GDPR;
- object to the processing of your personal data, Article 21 GDPR.
You can exercise the rights mentioned above by sending us a notification using the contact details given in the first section of this data protection notice, together with proof of your identity. We will ensure that appropriate measures are taken to respond to your request without undue delay and, in any event, within 30 (thirty) days of receiving the request. The information will be provided electronically where possible, unless you request in writing that another method be used.
Requests for access, rectification, restriction of processing or erasure must be made in writing and are subject to the applicable legal restrictions.
Should you have any further questions, you may also contact our Data Protection Coordinator, using the contact details specified in the first section of this data protection notice.
In addition, you have the right to lodge a complaint about the handling of your personal data with the competent supervisory authority, Article 77 GDPR.
XI. Changes
From time to time it may be necessary for us to update our privacy policies. When we do so, we will post those changes on our site, so that you always have access to details of the information we collect, how we use it and the circumstances, if any, in which we disclose it. Any such change takes effect immediately upon publication on our site.
