Last updated: 02.11.2025

For us, total transparency regarding the processing of your personal data has always been a priority. Starting on May 25, 2018, with the entry into force of Regulation (EU) 2016/679, we have aligned ourselves with European standards regarding the protection of natural persons with regard to the processing of personal data and their free movement.

The privacy policy provides you with information on the identity and contact details of the operator, describes the categories of your personal data that we process, the ways and purposes in which they are collected and processed, in which situations we transfer personal data, as well as the rights which you have in this regard according to Regulation (EU) 2016/679.

Your personal data are processed based on your consent, freely expressed, in order to fulfill contractual obligations (legitimate interest) and based on the legal provisions in force.

Definitions:

ANSPDCP =  The National Authority for the Supervision of the Processing of Personal Data;

“personal data” means any information regarding an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific elements, its own physical, physiological, genetic, psychological, economic, cultural or social identity;

“processing” means any operation or set of operations performed on personal data or sets of personal data with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure  by  transmission,  dissemination  or  otherwise  making  available,  alignment  or combination, restriction, erasure or destruction;

“restriction of processing” means the marking of stored personal data in order to limit their future processing;

“operator” means the natural or legal person, public authority, agency or other body that, alone or together with others, establishes the purposes and means of processing personal data; when the purposes and means of processing are established by EU law or national law, the operator or the specific criteria for its designation may be provided for in EU law or national law;

“person authorized by the operator” means the natural or legal person, public authority, agency or other body that processes personal data on behalf of the operator; “recipient/consignee” means the natural or legal person, public authority, agency or other body to whom the personal data is disclosed, whether or not it is a third party. However, public authorities to whom personal data may be communicated in the context of a certain investigation in accordance with EU law or national law are not considered recipients; the processing of this data by the respective public authorities complies with the applicable data protection rules, in accordance with the purposes of the processing;

“consent” of the data subject means any manifestation of the data subject’s free, specific, informed and unambiguous will by which he accepts, through a statement or an unequivocal action, that the personal data concerning him be processed;

The contact details of the operator of your personal data

The operator processing your personal data is MABO Way SRL, hereinafter referred to as MABOshops, registered with the Trade Register Office with J32/599/2013 and VAT Nr.:RO32092479, headquartered in Sibiu – Romania.

Categories of personal data processed by the operator MABOshops

• Contact data (Name and surname, residential address, professional address, telephone number, e-mail address, bank details, etc.);
• Additional data processed in the context of a contractual relationship with the operator MABOshops communicated voluntarily by you, regarding issues such as: instructions given, payments made, other information regarding orders or accessing offers of the MABOshops operator.

The purpose of personal data processing by the MABOshops operator.

Your personal data is processed for the following purposes:

• For the performance of contractual relations with clients in optimal conditions;
• In order to comply with the legal obligations we have (e.g. reports to the tax authorities);
• Ensuring security and access regarding the use of IT solutions made available to customers by the operator MABOshops (eg the website, the communication systems used), including the prevention and detection of security threats, fraud or other unauthorized or malicious activities;
• Obtaining feedback from you regarding the quality of the services and products we offer you, in order to increase them;
• For the purpose of complying with court decisions and exercising and/or defending our rights and interests;
• For any purpose related and/or auxiliary to any of the above or for any other purpose for which your personal data has been provided to us in compliance with applicable law;
• Based on your consent, we can send you various information through the channels you have approved to keep you informed about the latest offers and other information about the services, products, promotions offered by MABOshops.

The legal grounds for the processing of personal data

The processing operations of your personal data will be carried out on the basis of one of the following legal bases:

• The processing is necessary in order to comply with a legal obligation of the operator;
• The processing is necessary for the conclusion or execution of a contract to which you are a party;
• The processing is necessary in order to protect your interests or that of another natural person;
• The processing is carried out based on your consent;
• The processing is necessary for the legitimate interests of the operator MABOshops or of a third party (e.g. when the processing is necessary for the performance of a contract to which your organization is a party), except in cases where your interests or fundamental rights and freedoms prevail over these interests.

The transfer of your personal data abroad

The operator MABOshops may transfer your personal data to countries that are part of the European Space or to countries that have been recognized by the European Commission as ensuring an adequate level of protection of personal data, if this transfer is necessary for the processing according to the described permitted purposes above.

In special situations, if it is necessary to ensure the services of MABOshops for the permitted purposes, we may transfer your personal data to third countries that have not been recognized by the European Commission as providing an adequate level of protection.

We will ensure that these international transfers are carried out subject to appropriate safeguards (such as under Standard Contractual Clauses approved by the European Commission) as required by the General Data Protection Regulation (EU) 2016/679 or by other applicable legal provisions.

The retention period of your personal data

For alignment with the General Data Protection Regulation (EU) 2016/679, the operator MABOshops has implemented technical and organizational measures to organize the process and specific criteria for keeping your personal data (including according to internal archiving procedures).

The processing of personal data will cease when it is no longer necessary in accordance with the permitted purposes or when you withdraw your consent and:

1. there are no longer legitimate and compelling reasons that justify further processing by MABOshops (including the legal obligation of the operator MABOshops to continue storing the respective data) and which prevails over your interests, rights and freedoms or
2. if they are no longer necessary for us to establish, exercise or defend a right in court.

Your rights regarding the processing of personal data

According to the General Data Protection Regulation (EU) 2016/679 you have the following rights in relation to the processing of your personal data:

1. • The right of access means the right of the user to obtain a confirmation from the operator that it processes or not the personal data concerning him and, if so, access to the respective data and to information regarding the manner in which the data are processed;
   • The right to data portability refers to the right to receive personal data in a structured, commonly used and machine-readable format and to the right to have this data transmitted directly to another operator, if this is feasible from a technical point of view;
   • The right to opposition refers to the right of the data subject to oppose the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it considers a legitimate interest of the operator. When the processing of personal data is aimed at direct marketing, the data subject has the right to oppose the processing at any time;
   • The right to rectification refers to the correction, without undue delay of inaccurate personal data stored. The rectification must be communicated to each recipient to whom the data have been transmitted, unless this proves impossible or involves disproportionate (demonstrable) efforts;
   • The right your data to be erased (“the right to be forgotten”) means the right of the user to request the erase of his personal data, without undue delay, if one of the following reasons applies: it is no longer necessary to fulfill the purposes for which they were collected or processed; withdraws consent and there is no other legal basis for processing; objects to the processing and there are no overriding legitimate grounds; personal data were processed illegally; personal data must be deleted to comply with a legal obligation; personal data were collected in connection with the provision of information society services;

• The right to restrict processing can be exercised if the person disputes the accuracy of the data, for a period that allows verification of the correctness of the data; the processing is illegal and the person opposes the deletion of personal data, requesting the restriction instead; in case the operator no longer needs the personal data for the purpose of processing, but the person requests them for establishing, exercising or defending a right in court; if the person has objected to the processing for the period of time in which it is checked whether the legitimate rights of the operator prevail over those of the respective person.

If you wish to exercise the rights mentioned above, please contact us using the following contact details:

The registered office of the operator that processes your personal data is MABOshops with headquarters in Romania which can be contacted through the contact form listed on the website.

Information regarding the National Authority for the Supervision of the Processing of Personal Data (A.N.S.P.D.C.P.)

In the situation where you consider that your rights provided for in Regulation no. 679/2016 have been violated, please contact us.

We will consider any requests or complaints we receive and provide you with a response within the time limits provided by law. If you are not satisfied with our answer or consider that the processing is done in violation of the applicable legislation, you can file a complaint with the data supervisory authority in Romania: the National Supervisory Authority for the Processing of Personal Data.