Version in force as of the date of publication on the Site.
1. Who we are
The controller of your personal data is EDK CONCEPT SRL, with its registered office at Str. Duiliu Marcu no. 50, Cisnădie, Sibiu County, postal code 555300, Romania, registered with the Trade Register under no. J2018000630329, VAT RO39283859 (hereinafter “EDK” or “we”).
Data protection contact:
- E-mail: contact@edk.ro
- Phone: +40 732 855 227 / +40 785 335 335 (Monday–Friday, 08:00–17:00 EET)
- Postal address: Str. Duiliu Marcu no. 50, Cisnădie, Sibiu County, 555300, Romania
We process personal data in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.
2. What data we process
Depending on how you interact with the website www.edk.ro, we may process:
a) Identification and contact data: first and last name, e-mail address, phone number, delivery address, billing address; for legal-entity clients: company name, VAT number, Trade Register number, contact person details.
b) Order data: products ordered, order history, order value, chosen payment method, vehicle data voluntarily provided for product compatibility checks (make, model, year of manufacture, chassis number - if you share it with us).
c) Payment data: card payments are processed exclusively by authorised payment processors; EDK does not store and has no access to the full card number. For bank transfer payments, we process the data visible in the bank statement (name, IBAN, amount).
d) Account data: if you create an account on the Site - e-mail address, password (stored in encrypted form), preferences and order history associated with the account.
e) Communication data: the content of messages sent by e-mail, phone or the Site’s forms (questions, complaints, warranty claims), including photographs or recordings you submit with them.
f) Technical data: IP address, browser and device type, pages visited, data collected via cookies and similar technologies - detailed in the Cookie Policy.
We do not process special categories of data (sensitive data) and our services are not directed at minors under 18. Providing the data marked as mandatory when placing an order is necessary for concluding and performing the contract; refusal to provide them makes it impossible to process the order.
3. Purposes and legal bases of processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing, confirming and delivering orders; order-related communications | Performance of a contract - Art. 6(1)(b) |
| Issuing invoices, accounting records, tax reporting (including RO e-Invoice) | Legal obligation - Art. 6(1)(c) |
| Handling return requests, warranties and complaints | Performance of a contract and legal obligation - Art. 6(1)(b) and (c) |
| Creating and managing the customer account | Performance of a contract - Art. 6(1)(b) |
| Responding to requests sent before placing an order (e.g. compatibility checks) | Pre-contractual steps - Art. 6(1)(b) |
| Commercial communications and newsletter | Consent - Art. 6(1)(a); you may unsubscribe at any time via the link in each message or at contact@edk.ro |
| Fraud prevention; establishing, exercising or defending EDK’s legal rights; debt recovery | Legitimate interest - Art. 6(1)(f) |
| Improving the Site and services, traffic statistics | Legitimate interest or consent (for non-essential cookies) - Art. 6(1)(f) or (a) |
| Verifying the authenticity of reviews published on the Site | Legal obligation and legitimate interest - Art. 6(1)(c) and (f) |
We do not use solely automated decision-making producing legal effects concerning you, and we do not carry out profiling within the meaning of Art. 22 GDPR.
4. Who we disclose data to
Your data may be transmitted, strictly to the extent necessary for each purpose, to the following categories of recipients:
- courier and transport companies, for the delivery of orders (name, phone, delivery address);
- authorised payment processors and financial institutions/instalment financing partners, for processing payments and financing;
- accounting and audit service providers;
- IT service providers: web hosting, e-commerce platform maintenance, e-mail services;
- manufacturers and distributors, exclusively in the context of resolving a warranty claim, where technical assessment so requires;
- lawyers, consultants, enforcement officers, in the event of disputes or debt recovery;
- public authorities (tax authority ANAF, consumer authority ANPC, courts, investigative bodies), where required by law.
All providers processing data on our behalf act on the basis of processing agreements compliant with Art. 28 GDPR. We do not sell or rent your data to third parties.
Transfers outside the EEA: as a rule, data is processed within the European Economic Area. Where certain IT service providers involve transfers outside the EEA, these take place only with adequate safeguards under Chapter V GDPR (adequacy decisions or Standard Contractual Clauses approved by the European Commission).
5. How long we keep data
- Financial and accounting documents (invoices, billing data): for the period required by Romanian fiscal and accounting legislation;
- Data related to orders, warranties and returns: for the duration of the contract and subsequently for the statutory warranty and limitation periods (as a rule, 3 years from the last relevant interaction, or for the duration of the product warranty if longer);
- Customer account: until deleted at your request or after a prolonged period of inactivity, with prior notification;
- Marketing data: until consent is withdrawn;
- Correspondence and complaints: 3 years from resolution, for the defence of EDK’s rights;
- Technical data and cookies: in accordance with the durations in the Cookie Policy.
Upon expiry of these periods, the data is deleted or irreversibly anonymised.
6. Your rights
Under the GDPR, you have the following rights:
- right of access - to obtain confirmation that we process data about you and a copy of it;
- right to rectification - correction of inaccurate data or completion of incomplete data;
- right to erasure (“right to be forgotten”) - in the situations provided for in Art. 17 GDPR; erasure cannot apply to data we are legally required to keep (e.g. invoices);
- right to restriction of processing - in the situations provided for in Art. 18 GDPR;
- right to data portability - to receive the data you provided in a structured, commonly used format;
- right to object - to processing based on legitimate interest, including, at any time and unconditionally, to processing for direct marketing purposes;
- right to withdraw consent - at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): Bd. G-ral Gheorghe Magheru no. 28-30, district 1, Bucharest, Romania, www.dataprotection.ro, anspdcp@dataprotection.ro - as well as the right to bring proceedings before the courts.
To exercise any right, send a request to contact@edk.ro or by post to the registered office address. We will respond within one month of receiving the request; this period may be extended by two months in complex cases, with you being informed. For data protection purposes, we may request reasonable additional information to verify the identity of the requester.
7. Data security
EDK applies appropriate technical and organisational measures to protect data: encrypted SSL/TLS connection across the entire Site, encrypted password storage, data access limited to staff who need it to perform their duties, confidentiality agreements, backups and regular system updates. In the unlikely event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay, in accordance with Art. 34 GDPR.
8. Updates
This policy may be updated periodically to reflect legislative or operational changes. The current version, together with its effective date, is permanently published on www.edk.ro. Significant changes will be visibly signalled on the Site.
EDK CONCEPT SRL Str. Duiliu Marcu no. 50, Cisnădie, Sibiu County, 555300, Romania VAT: RO39283859 | Trade Register no.: J2018000630329