🔒 Privacy Policy

📋 1. Introduction and Purpose

SC SAITOS SRL - În insolvență (hereinafter „Saitos", „we", „the company") respects your right to privacy and undertakes to protect your personal data.

🌐 Română · Magyar · English

This Privacy Policy describes:

• ✅ What personal data we collect (if any);
• ✅ How we collect and use this data;
• ✅ How we protect the security of your information;
• ✅ What rights you have in relation to your personal data;
• ✅ How you can contact us with questions or complaints;

Applicable Legislation

This policy complies with:

• 📜 Regulation (EU) 2016/679 (GDPR) – the General Data Protection Regulation;
• 📜 Legea 190/2018 – the Romanian law implementing the GDPR;
• 📜 Legea 506/2004 – the Romanian ePrivacy implementing law, on the protection of confidentiality in electronic communications;

🏢 2. Data Controller

The controller of personal data is:

Data Protection Officer (DPO)

📊 3. What Personal Data We Collect

3.1. Data Collected Voluntarily (Contact Form)

If you choose to contact us through the contact form (if available) or by email, we may collect the following data:

3.2. Data Collected Automatically by the Server (Without Consent)

Our server automatically records minimal technical information (server logs) for the technical operation and security of the website:

• 🌐 IP address – for security and the prevention of abuse;
• 🖥️ Browser type and operating system – for technical compatibility;
• ⏰ Date and time of access – for error diagnostics;
• 📄 URL of the page accessed – for technical diagnostics;

3.2.1. Data Collected through Google Analytics 4 (Only with Consent)

If you accept the analytics cookies in the banner displayed on your first visit, we use Google Analytics 4 to understand how the website is used. In this case, the following are processed:

• 📄 The pages visited and the duration of the visit;
• 🔗 The traffic source (search engine, social network, direct link);
• 📱 The device type, the browser and the screen resolution;
• 🌍 The approximate location (country / city), inferred from the IP address;
• 📞 Actions on the website: pressing the phone button, the email address or the links to the map;
• 🆔 A pseudonymous identifier stored in a cookie, which allows us to distinguish repeat visits;

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Legea 506/2004). Retention period in Google Analytics: 14 months.

3.3. What Data We Do NOT Collect

For full transparency, we state explicitly that we do NOT collect:

• ❌ Financial data (bank card, bank account) – we have no e-commerce;
• ❌ Biometric data (fingerprint, facial recognition);
• ❌ Medical or health data;
• ❌ Data on political opinions, religion, sexual orientation;
• ❌ CNP (the Romanian personal numeric code) or ID card/passport data;
• ❌ Your browsing history on other websites;
• ❌ Precise GPS location (only the approximate city from the IP address);

3.4. Data Collected through the Melina Virtual Assistant (AI)

If you choose to write in the Melina chat window, we process:

• 💬 The content of the message that you write;
• ⏰ The time of the conversation and the minimal technical data necessary for its transmission;

Key details:

• 🎯 Purpose: to answer your questions about products, locations, orders and events;
• ⚖️ Legal basis: your consent (Art. 6(1)(a) GDPR) – expressed by the fact that you choose to write in the chat;
• 🖥️ Processing: messages are transmitted to the chat server operated by Tündérkert AI Stúdió (domain: chat.tunderkert.ro), acting as data processor of Saitos;
• ⏳ Retention: a maximum of 90 days, then deletion;
• 🚫 Training: conversations are NOT used for training artificial intelligence models;
• 🍪 Cookies: the chat does not use cookies and does not store anything in your browser;

You can use the entire website without ever writing in the chat. All the information about products, locations and opening hours is available on the pages of the website.

🔍 4. How We Collect Personal Data

4.1. Voluntary Collection (with Your Consent)

Personal data is collected only when you choose to provide it to us through:

• ✉️ The contact form on the website (if available);
• 📧 Direct email sent to office@saitos.ro;
• 📞 Telephone call to 0743 165 313;
• 💬 Messages on social networks (Facebook, Instagram);

Your consent is explicit – by completing the form or sending an email, you confirm that you agree to the processing of your data in accordance with this policy.

4.2. Automatic Collection (Minimal - Server Logs)

Minimal technical data (IP, browser, timestamp) is recorded automatically by the server for:

• 🔐 Security – the detection and prevention of cyber attacks;
• 🛠️ Technical diagnostics – resolving operational errors;
• 📊 Minimal internal statistics – understanding overall traffic;

4.3. Collection through Analytics Cookies (Only with Consent)

We use Google Analytics 4, but only if you accept it in the cookie banner. Full details in section 12.

4.4. What We Do NOT Use

Unlike many websites, Saitos does NOT use:

• 📱 Facebook Pixel, Google Ads, remarketing;
• 🎯 Conversion pixels of advertising networks;
• 👁️ Eye-tracking, heatmaps, session recording;
• 🔀 Data brokers or profile enrichment platforms;
• 🤖 Automated decisions with legal effects on you;

⚖️ 5. The Legal Basis for Processing (GDPR Art. 6)

In accordance with GDPR Art. 6, the processing of personal data must have a legal basis. Saitos processes data on the following grounds:

5.1. Consent (Art. 6(1)(a) GDPR)

When you contact us through the contact form or by email, you give your explicit consent to the processing of the data provided.

Characteristics:

• ✅ Freely given – there is no coercion;
• ✅ Specific – for the stated purpose;
• ✅ Informed – you know what data we collect and why;
• ✅ Unambiguous – a clear action (submitting the form);
• ✅ Withdrawable – you can withdraw your consent at any time;

5.2. Legitimate Interest (Art. 6(1)(f) GDPR)

Server logs are collected on the basis of the legitimate interest of Saitos in:

• 🔐 Protecting the website against attacks (DDoS, hacking);
• 🛠️ Ensuring correct technical operation;
• ⚖️ Complying with legal security obligations;

Balancing of interests: Your rights are protected through data minimization (only IP, browser, timestamp) and limited retention (90 days).

🎯 6. The Purpose of Data Processing

The personal data collected by Saitos is used exclusively for the following purposes:

6.1. Responding to Requests

• 📧 Answering questions received through the contact form or by email;
• 📞 Contacting you for clarifications or additional information;
• ℹ️ Providing information about products, locations, opening hours;

6.2. Security and Technical Operation

• 🔐 Protecting the website against cyber attacks;
• 🛡️ Preventing spam and abuse;
• 🛠️ Diagnosing and resolving technical problems;
• 📊 Minimal internal statistics (aggregate figures only, without identification);

6.3. Legal Compliance

• ⚖️ Complying with legal obligations (tax, accounting);
• 📄 Retaining documents in accordance with the law;

⏰ 7. Data Retention Period

Saitos applies the principle of minimizing the storage period – we keep data only for as long as necessary for the purposes for which it was collected.

7.1. Automatic Deletion

Upon expiry of the periods mentioned above, the data is automatically deleted from our systems, without the need for a request from you.

7.2. Deletion on Request

You may request the immediate deletion of your data at any time, in accordance with the right to erasure (Art. 17 GDPR). See the section User Rights.

🤝 8. With Whom We Share Personal Data

8.1. Minimal Sharing - Only When Necessary

In certain limited situations, we may share data with:

🖥️ Technical Service Providers (Data Processors)

• The hosting provider – to keep the website operational (server in Romania/EU);
• The email provider – to send replies to your requests;
• Google Ireland Limited – for Google Analytics 4, only if you have accepted the analytics cookies. Gordon House, Barrow Street, Dublin 4, Ireland;
• Tündérkert AI Stúdió – for operating the Melina virtual assistant (chat.tunderkert.ro), only if you choose to write in the chat;

Safeguards: With all data processors we have concluded Data Processing Agreements (DPA) in accordance with Art. 28 GDPR. For transfers outside the European Union, see section 13.

⚖️ Legal Authorities

We may disclose personal data if this is legally mandatory:

• 📜 At the request of the judicial authorities (courts, prosecutor's office);
• 🚨 For the prevention or investigation of criminal offenses;
• 🛡️ For the protection of the rights and security of Saitos or of third parties;

8.2. What We Do NOT Do

• ❌ We do NOT share with Facebook, Google Ads or other advertising platforms;
• ❌ We do NOT sell email lists to data brokers;
• ❌ We do NOT allow third-party access without your consent;
• ❌ We do NOT share the data from the contact form with Google or with other analytics providers;

🔐 9. Personal Data Security

Saitos takes technical and organizational measures that are appropriate to protect your data against unauthorized access, loss, destruction or alteration.

9.1. Technical Security Measures

• 🔒 HTTPS/SSL Encryption – all communications are encrypted;
• 🛡️ Firewall and DDoS Protection – protection against attacks;
• 🔐 Restricted Access – only authorized personnel can access the data;
• 🖥️ Security Updates – server and software always up to date;
• 📊 Continuous Monitoring – the detection of and response to incidents;

9.2. Organizational Measures

• 📋 Security Policies – clear internal procedures;
• 👥 Staff Training – employees are trained in GDPR and security;
• 🔑 Access Control – the "need-to-know" principle (minimum necessary access);
• 🗑️ Secure Deletion – data permanently deleted, not merely hidden;

9.3. Notification of Security Breaches (Data Breach)

In accordance with GDPR Art. 33-34, in the event of a security breach:

• ⏰ We will notify ANSPDCP (the Romanian data protection supervisory authority) within 72 hours;
• 📧 We will inform you directly and promptly if there is a high risk to your rights;
• 🛠️ We will take immediate measures to limit the damage;

👤 10. Your Rights (GDPR Chapter III)

In accordance with GDPR and Legea 190/2018, you have the following rights in relation to your personal data:

10.1. The Right of Access (Art. 15 GDPR)

✅ You have the right to know:

• What personal data we hold about you;
• Where we obtained it from;
• For what purposes we process it;
• With whom we have shared it;
• How long we will keep it;

How to exercise it: Send a request to office@saitos.ro with the subject "Personal Data Access Request".

10.2. The Right to Rectification (Art. 16 GDPR)

✅ You may request the correction of inaccurate or incomplete data about you.

Example: If your email address or your name is incorrect, you can ask us to correct it.

10.3. The Right to Erasure / the "Right to be Forgotten" (Art. 17 GDPR)

✅ You may request the erasure of your data in the following cases:

• The data is no longer necessary for the original purposes;
• You withdraw your consent;
• You object to the processing and there are no overriding legitimate grounds;
• The data has been processed unlawfully;

Exception: We cannot delete the data if we have a legal retention obligation (e.g. tax invoices - 10 years).

10.4. The Right to Restriction of Processing (Art. 18 GDPR)

✅ You may request the "freezing" of data processing in certain situations:

• You contest the accuracy of the data (until it has been verified);
• The processing is unlawful, but you prefer restriction instead of erasure;
• You need the data for legal claims;

10.5. The Right to Data Portability (Art. 20 GDPR)

✅ You may receive your data in a structured, commonly used and machine-readable format (e.g. CSV, JSON).

Applicability at Saitos: Due to the minimal volume of data collected, this right has limited applicability.

10.6. The Right to Object (Art. 21 GDPR)

✅ You may object to the processing of data based on legitimate interest (e.g. server logs for security).

Note: If you object, we will cease processing, unless we have compelling legitimate grounds or need it for the defense of legal claims.

10.7. The Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR)

✅ You have the right not to be subject to a decision based solely on automated processing (including profiling).

Applicability at Saitos: We do NOT use automated decision-making systems or profiling, so this right is not relevant in our case.

10.8. The Right to Lodge a Complaint (Art. 77 GDPR)

✅ You may lodge a complaint with the supervisory authority (ANSPDCP) if you consider that your rights have been infringed.

10.9. How to Exercise These Rights

To exercise any of the rights mentioned above:

1. 📧 Send us an email at office@saitos.ro with the subject "GDPR - [Type of Right]";
2. 📝 Include: Your full name, email address, a description of the request;
3. 🆔 Identity verification: We will ask for proof of identity for security reasons;
4. ⏰ Response: We will reply within a maximum of 30 days (in accordance with Art. 12(3) GDPR);

👶 11. Protection of Children

The website www.saitos.ro is an informational website about pastry products and is not intended exclusively for children.

11.1. The Age of Consent in Romania

In accordance with GDPR Art. 8 and Legea 190/2018 Art. 7, in Romania:

• 🔞 Minimum age for valid consent: 16 years;
• 👨‍👩‍👧 For children under 16, the consent of the parent/legal guardian is required;

11.2. The Collection of Children's Data

If we find out that we have accidentally collected data from a child under 16 without parental consent:

• 🗑️ We will immediately delete this data from our systems;
• 📧 We will try to notify the parent/guardian (if we have contact details);

11.3. Recommendation for Parents

If you are a parent or legal guardian:

• ✅ Monitor your children's online activity;
• ✅ Teach your children not to share personal information online without your permission;
• ✅ If you discover that your child has provided us with personal data, contact us immediately at office@saitos.ro;

🍪 12. Cookies and Tracking Technologies

12.1. What Cookies Are

Cookies are small text files saved by the browser on your device. They allow the website to "recognize" you on subsequent visits. We also use similar technologies (localStorage) to remember your choice regarding cookies.

12.2. Strictly Necessary Cookies (Without Consent)

These are indispensable to the operation of the website and, in accordance with Art. 4(5) of Legea 506/2004, they do not require consent.

12.3. Analytics Cookies (Consent Required)

They are activated only if you press "Accept all" or tick the "Analytics and statistics" category in the banner.

12.4. Advertising Cookies

12.5. How to Withdraw or Change Your Consent

Withdrawing consent is just as easy as giving it, in accordance with Art. 7(3) GDPR:

• 🍪 Press Cookie settings – a link available in the footer of every page;
• 🔄 Your choice expires automatically after 180 days, when we will ask you again;
• 🌐 You can delete cookies directly from your browser: Chrome (Settings → Privacy and Security → Cookies), Firefox (Settings → Privacy & Security), Safari (Preferences → Privacy), Edge (Settings → Privacy);
• 🚫 Alternatively, you can install the Google Analytics opt-out add-on;

Note: refusing the analytics cookies does not affect in any way the operation of the website. All pages, products and information remain fully accessible.

🌍 13. International Data Transfers

13.1. Data Storage

The data from the contact form, the emails and the server logs are stored on:

• 🇷🇴 Servers in Romania or in other EU member states;
• 🇪🇺 GDPR-compliant data centers in the European Union;

13.2. Transfers Outside the EU – Google Analytics

The safeguards applicable to this transfer:

• 🛡️ The adequacy decision of the European Commission on the EU–U.S. Data Privacy Framework (adopted on 10 July 2023), under which Google LLC is a certified entity;
• 📜 Standard Contractual Clauses (SCC) approved by the European Commission, as an additional safeguard;
• 🏢 The contractual controller for users in the EEA is Google Ireland Limited (Dublin, Ireland);
• 🔒 IP address anonymization is enabled in our configuration;

13.3. The Melina Virtual Assistant

The messages written in the chat are transmitted to the server operated by Tündérkert AI Stúdió. If the artificial intelligence provider used processes data outside the European Union, the transfer is carried out on the basis of the Standard Contractual Clauses and of the data processing agreement concluded. Details in section 3.4.

You may at any time request detailed information about the recipients of the data at office@saitos.ro.

🔄 14. Changes to the Privacy Policy

SC SAITOS SRL - În insolvență reserves the right to modify, update or supplement this Privacy Policy at any time, in order to reflect:

• ⚖️ Legislative changes (GDPR, national laws);
• 🛠️ Changes in our data processing practices;
• 💻 Technological or security improvements;
• 📊 Feedback from users or supervisory authorities;

14.1. How We Notify You of Changes

In the event of significant changes, we will inform you by:

• 📅 Updating the date at the beginning of this document ("Last updated: ...");
• 🌐 Publication on the website – the updated version will be available on this page;
• 📧 Email notification (only if we have your address and the change is substantial);

14.2. Tacit Acceptance

By continuing to use the website www.saitos.ro after the changes have been published, you agree to the new version of the Privacy Policy.

🔗 15. Links to Third-Party Websites

The website www.saitos.ro may contain links to external websites, including:

• 📘 Facebook – facebook.com/Saitos.Kurtoskalacs
• 📷 Instagram – @saitos_kurtoskalacs
• 🎵 TikTok – @saitos.krtskalcs
• 📺 YouTube – @kurtoskalacssaitos986
• ⭐ Google My Business – Reviews and ratings;

15.1. Limitation of Liability

15.2. Recommendation

Before using these external platforms, we recommend that you:

• ✅ Read the privacy policies of each platform;
• ✅ Configure the privacy settings on the social networks;
• ✅ Pay attention to what information you share publicly;

Useful links:

• Facebook Privacy: facebook.com/privacy
• Instagram Privacy: help.instagram.com/privacy
• Google Privacy: policies.google.com/privacy

📧 16. Contact and Complaints

For any questions, requests or complaints relating to the protection of personal data, you can contact us:

16.1. Complaint Procedure

If you consider that your rights have been infringed:

1. 📧 Contact us first at office@saitos.ro – we will try to resolve the matter amicably;
2. ⏰ We will reply within a maximum of 30 days;
3. 🤝 If you are not satisfied with our reply, you may lodge a complaint with ANSPDCP (see below);

16.2. Lodging a Complaint with ANSPDCP

In accordance with GDPR Art. 77, you have the right to lodge a complaint directly with the supervisory authority:

16.3. Guaranteed Response

Saitos undertakes to:

• ✅ Respond to all requests within a maximum of 30 days;
• ✅ Treat seriously any complaint relating to data protection;
• ✅ Cooperate transparently with ANSPDCP in the event of investigations;
• ✅ Continuously improve its data protection practices;