Personal data protection

Informative translation. In case of any discrepancy, the Romanian version prevails. Read the official version

Personal data protection

Privacy Policy regarding the processing of personal data

Accessing this Site implies your explicit agreement to the Terms and Conditions and to the Privacy Policy regarding the processing of personal data.

INOVUM S.R.L., as author/owner/administrator of the websites:

undertakes to respect the privacy and security of the information you provide, including personal data, whatever the way in which you use or access this website, and to this end has created and applies this Privacy Policy regarding the processing of personal data.

We consider ensuring the right to the protection of personal data a fundamental commitment of INOVUM, and we will therefore dedicate all the resources and efforts needed to process your data in full accordance with the provisions of Regulation (EU) No 2016/679 (“the General Data Protection Regulation” or “GDPR”), as well as with any other legislation applicable in Romania.

We reserve the right to update and amend this Privacy Policy periodically, to reflect any changes in the way we process your personal data or any changes in legal requirements. In the event of any such change, we will display the amended version of the Privacy Policy on our website, which is why we ask you to check the content of this Privacy Policy regarding the processing of personal data periodically.

Who we are and how you can contact us

1.1. INOVUM is the trade name of the sales platform owned and coordinated by the company INOVUM SRL, a Romanian legal person with its registered office in Sântion 171D, Borș commune, Bihor county, Trade Register number J2011000660055 and unique tax registration code RO28310745 (hereinafter “INOVUM” or “the company”).

1.2. Under the legislation in force on the protection of personal data, our company is a personal data controller, because it processes your personal data in the course of its commercial activities with natural persons and representatives of legal persons.

1.3. For questions or complaints, please contact INOVUM's Data Protection Officer at the e-mail address: gdpr@inovum.ro or by post or courier at Sântion 171D, Borș commune, Bihor county – marked: for the attention of INOVUM's Data Protection Officer.

What categories of personal data we process

2.1. In general, we collect your personal data directly from you, so that you have control over the type of information you give us. By way of example, we receive information from you as follows:

2.1.1. When you create an INOVUM account, you give us: your e-mail address, surname and first name;

2.1.2. In the My account section of the INOVUM platform you can add further information, such as: photo, gender, nickname, mobile telephone number, landline telephone number, date of birth, level of education, delivery addresses, alternative e-mail address, bank card details, etc.;

2.1.3. When you place an order, you provide information such as: surname and first name, delivery address, billing details, payment method, telephone number, bank card details, etc.

2.2. You can register on the INOVUM platform directly through your Facebook account or your Google account. If you choose one of these options, you will be directed to a page administered by Facebook Inc / Google LLC, where they will inform you about the transfer of your data to INOVUM. You can consult the Facebook and Google privacy policies using the following links:

– Link to the Facebook privacy policy: https://www.facebook.com/about/privacy

– Link to the Google privacy policy: https://policies.google.com/privacy

2.3. We may also collect and subsequently process certain information about your behaviour while visiting our website or using the smartphone app, in order to personalise your online experience and offer you deals tailored to your profile. We invite you to find out more about this in the section on the purposes of processing below.

2.4. On our website and in the smartphone app we may store and collect information in cookies and similar technologies, in accordance with the Cookie Policy.

2.5. We do not collect or otherwise process sensitive data, included by the General Data Protection Regulation in the special categories of personal data. Nor do we wish to collect or process data of minors under the age of 18.

What the purposes and grounds of processing are

3.1. We will use your personal data for the following purposes:

3.1.1. To provide INOVUM's services for your benefit, namely:

Creating and administering the account on the INOVUM platform;
Processing orders, including receiving, validating, shipping and invoicing them;
Resolving cancellations or problems of any kind relating to an order or to the goods or services purchased;
Returning products in accordance with the legal provisions;
Refunding the value of products in accordance with the legal provisions;
Providing support services, including answering your questions about your orders or the goods sold on the Site;

Processing your data for these purposes is in most cases necessary to conclude and perform a contract between INOVUM and the Customer/Buyer, and some processing is required by the applicable legislation, including tax and accounting legislation.

3.1.2. To improve our services

To give you the best online shopping experience, we may collect and use certain information about your behaviour as a Customer/Buyer, so that we can invite you to fill in satisfaction questionnaires after an order is completed or carry out market studies and research, without prejudice to your fundamental rights and freedoms.

3.1.3. For marketing

To keep you up to date with the best offers for the products that interest you, we may send you any type of message (such as e-mail/SMS/telephone/mobile, etc.) containing information about products similar or complementary to those you have bought, information about offers or promotions, information about products added to the “Account/My cart” or “Account/Favourites” section, and other commercial communications such as market research and opinion polls, and we may display personalised recommendations on the website and in the smartphone app.
To provide you with information of interest to you, we may use certain data about your behaviour as a buyer (e.g. products viewed / added to the wishlist / purchased) to create a profile of you. We always make sure that this processing respects your rights and freedoms and that the decisions taken on its basis have no legal effects on you and do not similarly affect you to a significant degree.

In most cases, we base our marketing communications on your prior consent, but you can change your mind and withdraw your consent at any time by:

– Changing the settings in your customer account;

– Clicking the unsubscribe link shown in the messages you receive from us;

– Contacting INOVUM at the e-mail address: sesizari@inovum.ro

Sometimes our marketing activities are based on our legitimate interest in promoting and developing our business on the Site, but we take care to take all the measures needed so that your fundamental rights and freedoms are not affected. Nevertheless, you can ask us at any time, by the means described above, to stop processing your personal data for marketing purposes.

3.1.4. To defend our legitimate interests

– There may be situations in which we use or transmit information to protect our rights and our business, such as: measures to protect the website and the users of the INOVUM platform against cyber attacks, to prevent and detect attempted fraud, the transmission of information to the competent public authorities, and other types of measures to manage/avoid various risks.

The general ground for these types of processing is our legitimate interest in defending our business;
In certain cases we base the processing on legal provisions, such as the obligation to ensure the guarding of goods and valuables laid down by the legislation applicable in this field.

How long we keep your personal data

4.1. As a general rule, we will store your personal data for as long as you have an account on the INOVUM platform. You can request at any time the deletion of certain information or the closure of your account, and we will act on these requests, subject to keeping certain information even after the account is closed, where the applicable legislation or our legitimate interests require it.

Who we send your personal data to

5.1. As the case may be, we may transmit, or give access to, certain of your personal data to the following categories of recipients:

courier service providers;
payment/banking service providers;
collaborating partners;
accounting service providers;
marketing / telemarketing service providers;
market research service providers;
IT service providers;
other companies with which we may develop joint programmes for offering goods on the market;

5.2. Where we have a legal obligation or where it is necessary to defend a legitimate interest, we may also disclose certain personal data to public authorities.

5.3. We make sure that access to your data by third parties that are private-law legal persons takes place in accordance with the legal provisions on data protection and the confidentiality of information, on the basis of contracts concluded with them.

To which countries we transfer your personal data

6.1. We store and process your personal data in Romania.

6.2. Nevertheless, we may transfer certain of your personal data to entities located in the European Union or outside the Union, including to countries that the European Commission has not recognised as having an adequate level of personal data protection.

6.3. We will always take steps to ensure that any international transfer of personal data is managed carefully in order to protect your rights and interests. Transfers to service providers and other third parties will always be protected by contractual commitments and, where applicable, by other safeguards, such as the standard contractual clauses issued by the European Commission or, for personal data transferred from within the EU to the United States of America, the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework.

6.4. To find out more about the countries to which we transfer your data, and about the safeguards we have put in place for these transfers, you can contact us at any time using the contact details shown on the Site.

How we protect the security of your personal data

7.1. We undertake to ensure the security of personal data by implementing appropriate technical and organisational measures, in accordance with European standards.

7.2. Your personal data are transmitted using encryption algorithms, and we store them on secure servers.

7.3. For payments we use the services of the payment processors EuPlatesc and Netopia, and payment information is encrypted.

7.4. Despite the measures taken to protect your personal data, please note that transmitting information over the Internet in general, or through other public networks, is not completely secure, and there is sometimes a risk that data will be seen and used by unauthorised third parties. We cannot be responsible for such vulnerabilities in systems that are not under our control.

What rights Regulation (EU) No 2016/679 (“the General Data Protection Regulation” or “GDPR”) gives you

8.1. The General Data Protection Regulation grants you a number of rights in relation to your personal data, including: you can request access to your data and the correction of errors in our files, you can object to the processing of your personal data, you can request the erasure of your personal data, you have the right to restriction of the processing of your data and the right to the portability of your data, and you can exercise the right to lodge a complaint with the competent supervisory authority or to go to court.

8.2. To find out more about each of these rights, we provide a short overview of the rights conferred by “the General Data Protection Regulation” or “GDPR”:

(a) THE RIGHT OF ACCESS TO PERSONAL DATA:

Gives you the right to ask:

that we confirm whether we process your personal data;
that we provide you with a copy of these data;
that we give you other information about your personal data, such as what data we hold, what we use them for, to whom we disclose them, whether we transfer them abroad and how we protect them, how long we keep them, what rights you have, how you can make a complaint, etc.

(b) THE RIGHT TO RECTIFICATION OF PERSONAL DATA:

You can ask us to rectify or complete inaccurate or incomplete personal data about you.

(c) THE RIGHT TO REQUEST ERASURE OF PERSONAL DATA:

You have the right to request the erasure of personal data, but only where:

they are no longer necessary for the purposes for which they were collected;
you have withdrawn your consent (where the processing of the data was based on consent);
you are exercising a legal right to object;
they have been processed unlawfully;
we have a legal obligation to do so.

We are not obliged to comply with your request to erase your personal data where the processing of your personal data is necessary:

to comply with a legal obligation;
to establish, exercise or defend legal claims.

There may also be other circumstances in which we are not obliged to comply with your request to erase data, although these two are the most likely circumstances in which we may refuse such a request.

Before exercising this right, please download from your INOVUM account all the documents relating to the orders placed with INOVUM, whether the invoice was issued to you or to another natural or legal person (such as invoices, warranty certificates, etc.). If you do not do so before exercising your right to erasure, you will lose all these documents, and INOVUM will be unable to make them available to you, as the case may be, because the process of deleting the data, and the account created on the INOVUM platform with all its related data and documents, is irreversible.

(d) THE RIGHT TO REQUEST RESTRICTION OF THE PROCESSING OF PERSONAL DATA:

You have the right to request restriction of the processing of personal data, but only where:

their accuracy is contested, to allow us to verify their accuracy;
the processing is unlawful, but you do not want the data to be erased;
they are no longer necessary for the purposes for which they were collected, but you need them to establish, exercise or defend legal claims;
you have exercised your right to object and the verification of whether our rights override yours is in progress.

We may continue to use your personal data following a request for restriction where:

we have your consent to do so;
to establish, exercise or defend legal claims;
to protect the rights of INOVUM or of another natural or legal person.

(e) THE RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA:

You may object at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of our legitimate interest, where you consider that your fundamental rights and freedoms override that interest.
You may object at any time to the processing of your data for direct marketing purposes (including profiling), without giving any reason, in which case we will stop this processing as soon as possible.

(f) THE RIGHT TO PORTABILITY OF PERSONAL DATA:

You have the right to request that your personal data be provided in a structured, commonly used and machine-readable format, or you can request that they be “ported” directly to another data controller, but in each case only if:

the processing is based on your consent or on the conclusion or performance of a contract with you;
the processing is carried out by automated means.

(g) THE RIGHT NOT TO BE SUBJECT TO AN AUTOMATED DECISION:

You have the right to request not to be subject to a decision based solely on automated processing, but only where that decision:

produces legal effects concerning you;
similarly affects you in another way and to a significant degree.

This right does not apply where the decision reached through automated decision-making:

is necessary for us to conclude or perform a contract with you;
is authorised by law and there are appropriate safeguards for your rights and freedoms;
is based on your explicit consent.

(h) THE RIGHT TO MAKE COMPLAINTS:

You have the right to lodge a complaint with the Supervisory Authority about the processing of your personal data.

In Romania, the contact details of the data protection supervisory authority are as follows:

National Supervisory Authority for Personal Data Processing (ANSPDCP)

B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania

Telephone: +40 318 059 211 or +40 318 059 212;

E-mail: anspdcp@dataprotection.ro

Without affecting your right to contact the Supervisory Authority at any time, please contact us first, and we promise to make every effort to resolve any problem amicably.

To this end, please get in touch with INOVUM's Data Protection Officer by sending your request in any of the following ways:

by e-mail to: gdpr@inovum.ro, or
by post or courier to the address: given in point 1.1 – marked for the attention of INOVUM's Data Protection Officer.

To exercise the rights set out above, you can contact us using the contact details given above. Please bear the following in mind if you wish to exercise these rights:

Identity. To keep all records containing personal data confidential, please send us your requests concerning such records from the e-mail address associated with your INOVUM account. Otherwise, we reserve the right to verify your identity by asking for additional information intended to confirm your identity.

Fees. We will not charge a fee for exercising any right regarding your personal data, unless your request for access to information is unfounded, or repetitive or excessive, in which case we will charge a reasonable amount in such circumstances. We will inform you of any fees applied before dealing with your request.

Response time. We will respond to all valid requests within one month at most, unless this is particularly complicated or you have made several requests, in which case the time limit for dealing with the request is extended by a further month.

Third-party rights. We reserve the right not to act on requests that could adversely affect the rights and freedoms of other data subjects.

The forms and services of the inovum.ro site

9.1. The site has three forms. The data sent reach INOVUM by e-mail; the site does not keep a database of the messages.

The request for a quote (Contact page): surname and first name, institution/company (optional), e-mail address, telephone number and the details of the request (technical and quantity details, place of delivery, type of procedure, source of funding, budget, deadline, further details). Purpose: preparing and sending the quote. Ground: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and the consent ticked in the form.
The application (Careers page): surname and first name, e-mail address, telephone number, position applied for, CV and an optional message. The processing follows the Information notice on the processing of candidates' personal data. The application may also be recorded in INOVUM's internal recruitment system.
The message (the short form at the end of the pages): surname and first name, e-mail address, telephone (optional) and the message. Purpose: replying to the message. Ground: the consent ticked in the form.

9.2. Requests for quotes and messages are kept for as long as is necessary to reply to them; if a business relationship follows, the data are processed in accordance with the Information notice on the processing of personal data of legal entities' representatives. Applications are kept in accordance with the information notice for candidates.

9.3. To limit automated submissions, the server uses a fingerprint of the IP address (not the address in clear), held only in the server's memory for the duration of the limiting interval (10 minutes) and not saved. The forms also have a hidden field, filled in only by automated programs.

9.4. Recipients: INOVUM's e-mail service provider and the provider that hosts the site, Vercel Inc. (USA), as processors. The forms are processed on servers in Frankfurt (Germany); the transfer to Vercel in the USA is protected by the standard contractual clauses approved by the European Commission (Decision 2021/914).

9.5. The site does not use cookies. The film on the About us page (Vimeo) loads only after you press play, with the “Do Not Track” option; until then, no data reach Vimeo. Details in the Cookie policy.

9.6. Visit statistics. To know how many people visit the site and which pages are read, we use Vercel Web Analytics. The tool does not use cookies and writes nothing to your browser. For each page visited it records: the date and time, the page address, the page you came from, the approximate location (country, region, city), the operating system, the browser and the device type. Visitors are not identified: a visit is recognised only by a code computed from the browser's request, which changes daily, so you cannot be followed from one day to the next or across other sites. The data are processed by Vercel Inc., as a processor (section 9.4); the reports, with aggregated figures, are available to INOVUM for 12 months. Ground: INOVUM's legitimate interest in knowing its audience and improving the site (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR), in the way described in this policy.

Updated on

29.10.2025; section 9 added on 30.10.2026; point 9.4 updated and point 9.6 added on 03.11.2026