Privacy policy

The controller of personal data relating to the Safety Distribution online shop is the company named in the “Operator of the online shop” box above (the “controller”, “we”). For data protection questions and to exercise your rights, write to info@safety-distribution.eu / admin@safety-distribution.eu and state that your request concerns personal data. We are not required to appoint a data protection officer and have not appointed one.

This policy is based on the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the related Romanian and Hungarian legislation.

Our shop is for businesses. We mainly process personal data of contact persons of customer companies, employees using the account, parcel recipients and people who write to us via the contact form or by e-mail. Company data (name, tax number, registered office) is not, in itself, personal data.

a) Company registration and account. Data: name, business e-mail, phone, job title (if given), details of the company represented, password (stored only in encrypted – hashed – form), account language. Legal basis: steps prior to entering into a contract and performance of the contract [Art. 6(1)(b) GDPR] or – where the user is not the contracting party but an employee of the company – our legitimate interest in managing the B2B business relationship [Art. 6(1)(f)]. Retention: while the account exists, then until civil-law claims are time-barred.

b) Orders, invoicing and delivery. Data: name of the person placing the order, delivery address, recipient’s name and phone number, ordered items, the accepted version of the Terms. Legal basis: performance of the contract or legitimate interest; for invoicing, legal obligation [Art. 6(1)(c)]. Retention: for the period required by accounting and tax law, and for other data until claims are time-barred.

c) Quote requests and contact form. Data: name, company, e-mail, phone (if given), subject, message, time of sending and IP address (to prevent abuse). Legal basis: legitimate interest in answering the enquiry and developing the business relationship, or pre-contractual steps. Retention: as long as needed to close the enquiry and for any resulting business relationship.

d) Communication with the agent and e-mail correspondence. Messages sent on the “My agent” page and e-mails sent to the info@ and admin@ addresses are processed to handle the matter. Legal basis: performance of the contract or legitimate interest. Retention: until the matter is closed, then until claims are time-barred.

e) Logo personalisation and logo library. Uploaded logo files and related notes are stored to carry out the personalisation and for reuse in the company’s logo library. Files may be virus-checked on upload. Please do not upload personal data not needed for the personalisation. Legal basis: performance of the contract. Retention: until the company deletes the logo from the library; copies linked to earlier orders are kept with the order records.

f) Security and abuse prevention. Data: sign-in events, IP address, a log of important actions in the account, and for our staff the data of two-factor authentication. Legal basis: our legitimate interest in protecting the system and our customers. Retention: as long as needed for the security purpose.

g) Newsletter and marketing. We send newsletters only to people who have expressly subscribed [consent, Art. 6(1)(a)]. Consent can be withdrawn at any time without giving reasons, using the unsubscribe link in the e-mails or by e-mail; withdrawal does not affect the lawfulness of earlier processing. System messages about orders, deliveries and invoices are not newsletters.

h) Legal claims. We may keep data as long as necessary for the establishment, exercise or defence of legal claims (legitimate interest).

Without the data requested under a)–c) we cannot create the account, fulfil the order or respond to the enquiry on the merits. We do not use automated decision-making – including profiling – that produces legal effects concerning you.

Our staff access data only as far as needed for their tasks (for example, the agent assigned to a customer company accesses the data of their own customers). The following recipients or categories of recipients may receive data:

• hosting and server operation providers, and IT and software development service providers (as processors);
• e-mail service provider (as processor);
• Oblio (invoicing system) – the data needed to issue invoices (as processor);
• the courier and postal service (GLS in Romania, Magyar Posta in Hungary) – name, address and phone number needed for delivery (as independent controllers);
• banks and financial service providers for payments; accountant, auditor, legal adviser to the extent needed for their tasks;
• authorities and courts where required by law.

Our processors may process data only on our instructions, under a duty of confidentiality and under a contract complying with Art. 28 GDPR. We do not sell personal data and do not pass it to third parties for their own marketing.

If one of our providers processes data outside the European Economic Area or accesses it from there, the transfer takes place only with the safeguards of Chapter V GDPR: on the basis of an adequacy decision of the European Commission or of standard contractual clauses (SCC) adopted by the European Commission, with supplementary measures where necessary. Information on these safeguards is available on request.

We protect data with appropriate technical and organisational measures: access management, encrypted storage of passwords, two-factor authentication for staff accounts, logging of sign-ins and important actions, checking of uploaded files and regular backups. In the event of a personal data breach we act in accordance with the GDPR and, where required, notify the supervisory authority and the data subjects.

Under the GDPR you have the following rights:

• information and access to your data, including a copy (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (“right to be forgotten”) where processing is no longer necessary or unlawful (Art. 17);
• restriction of processing (Art. 18);
• data portability for automated processing based on contract or consent (Art. 20);
• objection to processing based on legitimate interest; if you object to direct marketing, we no longer use the data for that purpose (Art. 21);
• withdrawal of consent at any time (Art. 7).

You can send your request to info@safety-distribution.eu / admin@safety-distribution.eu. We respond without undue delay and within one month at the latest; this may be extended by two further months where necessary, in which case we will inform you. If we have doubts about the requester’s identity, we may ask for additional information. Company data can only be viewed in the account; changes can be requested from the agent or by e-mail.

The shop uses only cookies that are strictly necessary for its operation. Details: Cookie policy.

If you believe we have infringed your data protection rights, please contact us first so that we can resolve the matter – this is not, however, a condition for complaining to an authority. You may lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement:

• Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro;
• Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), www.naih.hu.

You may also bring proceedings before a court.

We update this policy when our services or the law change. The date and version number of the current version are shown at the top of the page; for each order we record which version was in force.