The following information is designed to inform you about the processing of your personal data and your rights regarding this processing in accordance with:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
• LAW no. 190 of 18 July 2018 on measures for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
• LAW no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector

1. General Information

We, S.C. ENIGMA TRADING 2000 S.R.L., headquartered at 121C Gheorghe Țițeica Street, 1st floor, Sector 2, Bucharest, registered under no. J40/19298/13.10.2023, having VAT number RO 6519490, (“the Company”), represent the data controller in accordance with GDPR. The contact details of the Company’s Data Protection Officer are: e-mail gdpr@epack.ro

2. Purpose of processing and categories of data processed:

We inform you that the main field of activity is the provision of household products made from polyethylene and polypropylene.
To this end, the purposes for which personal data is processed by S.C. ENIGMA TRADING 2000 SRL are as follows:

Sale of products such as:

• Bags & Ziplock
• Garbage bags
• Foils & baking paper
• Sponges & cloths
• Disposable items
• Household items
• Miscellaneous

To fulfill the purposes related to the field presented above, our company processes personal data in the following operations:

• if you sign up on the website to become our partner or to request various clarifications regarding a possible partnership or the products listed on the site;
• preparation of the necessary documents for sale-purchase contracts, at all stages: offer, negotiation, signing;
• preparation of employment contracts and other documents for our employees or for hiring in our company;
• providing information about company events;
• participation in opinion surveys regarding the Company’s offers and services in terms of customer satisfaction;

The following categories of data are processed in SC ENIGMA TRADING 2000 SRL:

• Name, surname, email address, landline and/or mobile phone numbers, fax number (where applicable), signature;
• Your contact with us, such as registration on the website, an email or letter sent, or other records of contact with us: name, surname, email address;
• Information about your account, such as payment details due or received, account numbers, or other information related to your account or included in our contract to manage the commercial relationship with each client;
• Information regarding access legitimacy – we will collect passwords, hints, and similar security information used to authenticate on our company’s website;
• Your preferences for certain products when you tell us what they are or when we infer them based on how you use SC ENIGMA TRADING 2000 SRL products, so that we can prioritize sending what interests you;
• Your marketing preferences;
• See the Cookies section for details on what we collect using cookies;
• Information we obtain from other sources, such as public or private authorities, fraud prevention agencies, and other data providers. This includes demographic data, data related to interests, as well as online browsing behavior.
• Responses to invitations and confirmations of participation in events.

The personal data we process are mainly your identification, transactional, financial, demographic, location, or other personal data that we collect directly from you or from other sources when you become our client/partner.

Sensitive personal data reveals your racial and ethnic origin, political opinions, religious and philosophical beliefs, union membership, genetic data, biometric data, health data, or data concerning your sexual life or orientation.

SC ENIGMA TRADING 2000 SRL does not intentionally collect sensitive personal data from you to store it.

3. Legal basis for processing

The legal basis for collecting and processing your data for each of the purposes mentioned above is:

• the sale-purchase contract to which you are a party or your request before entering into a contract;
• The legitimate commercial interests of the Company, for example, fraud prevention, maintaining the security of our services, direct marketing, and improving our services. Whenever we rely on this legal basis to process your data, we evaluate our commercial interests to ensure that they do not override your rights. In addition, in some cases, you have the right to object to this processing. The Company’s legitimate interest is to allow us to exercise the rights provided by law in our favor, to take legal action against any illegal activity or that harms the Company.
• Compliance with a mandatory legal requirement, for example, accounting and tax requirements, which are subject to strict internal policies (such as retention periods), procedures, and your right to restrict the use of your data, which control the subject of our services to be provided; or
• Additionally, to the extent that you have agreed, your consent. The processing of personal data based on consent represents an additional purpose for the processing of personal data in order to fulfill the contract to which you are a party and does not condition the provision of contractual services.
• The processing is necessary for the performance of a task that serves a public interest

We will collect your personal data when, for example:

• You purchase any of our products;
• You contact us to become collaborators, to request clarifications, or to provide feedback;
• You visit or browse the websites of SC ENIGMA TRADING 2000 SRL;
• You have permitted other companies, such as our business partners or our associates, as well as third-party suppliers or contractors, to exchange information with us regarding you;
• When your personal data is public;

We also collect information from certain organizations, if applicable and to the extent that we have legal grounds in this regard. These include fraud prevention agencies, business directories, verification/control agencies, billing calculation agencies, and contracted service providers.

We use cookies (small text files stored in your browser) and other techniques such as web beacons (small transparent image files used to track your movements on our site). For additional details in this regard and regarding how to opt-out of them, please consult the Cookies section on our website www.epack.ro

4. Categories of recipients to whom the collected personal data may be disclosed:

To achieve the purposes outlined above, we use the following categories of product and service providers/empowered entities:

• Suppliers/manufacturers directly/indirectly involved in the supply of products;
• state authorities (including tax authorities);
• accountants, auditors, judicial experts, lawyers, or other such external advisors of the Company or to third parties that provide products and services to the company (security service providers, IT system providers, financial consultants);
• the Company’s suppliers directly/indirectly involved in the marketing and promotion process.

5. Retention period

Your personal data will be retained by the Company for a period not exceeding the period necessary to achieve the purposes described above and/or for any other duration necessary under applicable legal obligations of the Company, using the following criteria to establish this period:

1. When you purchase products through our company, we retain your personal data for the duration of our contractual relationship, but not longer than 10 years from the last transaction;
2. If you participate in a promotional offer, we retain your personal data for the duration of the promotional offer;
3. If you have registered on our website, we retain your personal data until you request us to delete it or after a period of inactivity (without active interaction with us). In this regard, we mention that data processed for this purpose will be deleted 3 years after the last interaction;
4. If cookies are stored on your computer, we retain them for as long as necessary for them to achieve their purposes (for example, for the duration of a session for shopping cart cookies or session ID cookies) and for a defined period in accordance with local regulations and guidelines. In this regard, we mention that data processed through cookies used to provide online behavioral advertising, to personalize our services for you, and to allow sharing of our content on social media sites (sharing buttons intended for site display) will be retained for a maximum period of 10 years from their collection, based on your consent.

6. Your rights

The Regulation grants individuals whose personal data is processed a series of rights. Thus, in addition to existing rights, we find the right to data portability and the right to data deletion. In brief, the rights you have:

• The right to withdraw your consent at any time given for stopping a processing of data based on your consent. Withdrawal will not affect the legality of processing based on the consent given before the withdrawal, for the execution of a contract, to fulfill a legal obligation, or for the purpose of pursuing our legitimate interests.
• The right of access – means that you have the right to obtain confirmation from us as to whether or not we process personal data concerning you and, if so, you have access to such data and information regarding how these data are processed.
• The right to data portability – refers to the right to receive personal data in a structured, commonly used, and machine-readable format, as well as the right for such data to be transmitted directly to another operator if technically feasible.
• The right to object – concerns your right to object to the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it concerns a legitimate interest of the operator. When the processing of personal data is aimed at direct marketing or processing based on explicit consent, you have the right to object to the processing at any time.
• The right to rectification – refers to the correction, without undue delay, of inaccurate personal data. The rectification will be communicated to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort.
• The right to data deletion (“the right to be forgotten”) – means that you have the right to request the deletion of personal data, without undue delay, in case one of the following reasons applies: they are no longer necessary for the purposes for which they were collected or processed; you withdraw your consent and there is no other legal ground for processing; you object to processing and there are no other legitimate grounds that override; personal data has been processed illegally; personal data must be deleted to comply with a legal obligation; personal data have been collected in connection with the provision of information society services.
• The right to restrict processing – can be exercised when the person contests the accuracy of the data, for a period necessary to verify the accuracy of the data; processing is illegal, and you oppose the deletion of personal data, requesting instead restriction; when SC ENIGMA TRADING 2000 SRL no longer needs the personal data for the processing purpose, but the person requests them for the establishment, exercise, or defense of a right in court; when the person has objected to processing for the period of time during which it is verified whether the legitimate rights of the operator prevail over those of the person.
• The right to file a complaint – complaints regarding the processing of personal data can be addressed to the National Authority for the Supervision of Personal Data Processing at the following contact details:

1. postal address – Str. B-dul Gheorghe Magheru nr. 28 – 30, sector 1, Bucharest, Romania
2. email address – anspdcp@dataprotection.ro
3. phone: +40 318 059 211 or +40 318 059 212

To exercise these rights, as well as for any additional questions regarding this information or in connection with the Company’s use of personal data, please contact our data protection officer using any of the communication methods described below.

You can contact us:

• By email – at: gdpr@epack.ro
• In person or by sending a request by mail – to the Company’s Headquarters: str. Gheorghe Țițeica nr.121C, et.1, sector 2, Bucharest
• By phone – at the number: 021-255.90.60/61/62