Privacy Policy

We consider ensuring the right to personal data protection as a fundamental commitment of Ecoapa Design. Therefore, we will dedicate all necessary resources and efforts to process your data in full compliance with Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR“) and any other applicable legislation within Romania. As transparency is one of the essential principles of this legal framework, we have prepared this document to inform you about how we collect, use, transfer, and protect your personal data when you interact with us regarding our products and services, including through our website or mobile applications.

We reserve the right to periodically update and modify this Privacy Policy to reflect any changes in how we process your personal data or any changes to legal requirements. In the event of such modifications, we will display the updated version of the Privacy Policy on our website, and we encourage you to review its content regularly.

Ecoapa Design is the trade name of Ecoapa Design SRL, a Romanian legal entity headquartered in Bucharest, Strada Brăilița No. 88, registered with the Trade Registry under number J40/12958/2015, and holding VAT identification number RO35157017 (hereinafter referred to as “Ecoapa Design” or “we”). Under data protection legislation, we are a data controller when processing your personal data.

Since we are always open to hearing your feedback and providing any additional information you may need regarding the processing of your data, we encourage you to contact the Ecoapa Design data protection officer at the email address office@ecoapa.ro or by phone at +40746 397 023.

In general, we collect your personal data directly from you, so you have control over the type of information you provide us. For example, we receive information from you as follows:

• When you use the contact forms on our website, you provide us with: your email address, phone number, first name, and last name;
• When you subscribe to our newsletter: your email address, phone number, first name, and last name;
• We may also collect and process certain information regarding your behavior while visiting our website or using the smartphone app to personalize your online experience and provide you with offers tailored to your profile. We invite you to learn more about this by consulting the section on processing purposes below.

On our website and in the smartphone app, we may store and collect information using cookies and similar technologies, in accordance with our Cookie Policy.

We do not collect or otherwise process sensitive data, as defined under the General Data Protection Regulation, in the special categories of personal data. Furthermore, we do not intend to collect or process data from minors under the age of 18.

1. Your information will be used by Ecoapa Design for scheduling patient appointments, receiving and identifying patients when they arrive for appointments, and establishing medical recommendations by the specialist doctor.
2. To improve our services. We continuously strive to provide you with the best experience on our website. For this purpose, we may collect and use certain information regarding your behavior, invite you to complete satisfaction surveys, or conduct, directly or with the help of partners, market research and studies, always ensuring that your fundamental rights and freedoms are not affected.
3. For marketing. We want to keep you informed about the best offers for products/services that interest you. To this end, we may send you messages (such as: email/SMS/phone/mobile push/web push/etc.) containing general and thematic information, information about similar or complementary services to those you have used, details about offers or promotions, etc.

In most cases, we base our marketing communications on your prior consent. You can change your mind and withdraw your consent at any time by:

• Accessing the unsubscribe link displayed in the messages you receive from us; or
• Contacting Ecoapa Design using the contact details described above.

In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our business. In any situation where we use information about you for our legitimate interest, we take all necessary measures to ensure that your fundamental rights and freedoms are not affected. However, you can request at any time, using the methods described above, that we stop processing your personal data for marketing purposes, and we will comply with your request.

As a general rule, customer data will be retained for at least 10 years to demonstrate the fiscal record of payment for the services provided. You can request the deletion of certain information at any time, and we will comply with these requests, subject to retaining certain information even after the account is closed, in situations where applicable legislation or our legitimate interests require it.

Where applicable, we may transmit or provide access to certain personal data of yours to the following categories of recipients:

• companies within the same group of companies as Ecoapa Design;
• Ecoapa Design partners;
• courier service providers;
• payment/banking service providers;
• marketing/telemarketing service providers;
• market research service providers;
• insurance companies;
• IT service providers;
• other companies with which we may develop joint programs for marketing our goods and services.

If we have a legal obligation or if it is necessary to defend a legitimate interest, we may also disclose certain personal data to public authorities.
We ensure that access to your data by third-party private legal entities is carried out in accordance with legal provisions regarding data protection and information confidentiality, based on contracts concluded with these entities.

We are committed to ensuring the security of personal data by implementing appropriate technical and organizational measures, in line with industry standards.

The transmission of your personal data is carried out using state-of-the-art encryption algorithms, and the data is stored on secure servers, while also ensuring data redundancy.

Despite the measures taken to protect your personal data, please be aware that transmitting information over the Internet or through other public networks is not entirely secure, and there is a risk that the data may be accessed and used by unauthorized third parties. We cannot be held responsible for such vulnerabilities in systems that are beyond our control.

The General Data Protection Regulation (GDPR) grants you several rights regarding your personal data. You can request access to your data, correction of any errors in our records, and/or object to the processing of your personal data. You may also exercise your right to file a complaint with the competent supervisory authority or take legal action. In certain cases, you may also have the right to request the deletion of your personal data, the right to restrict its processing, and the right to data portability.

More information about each of these rights can be found in the table below.

To exercise your rights, you can contact us using the contact details provided above. Please note the following when exercising these rights:

Identity: We take the confidentiality of all records containing personal data seriously. For this reason, please submit your requests concerning such records using the email address associated with your Ecoapa Design account. Otherwise, we reserve the right to verify your identity by requesting additional information to confirm it.

Fees: We will not charge a fee to exercise any of your rights regarding your personal data unless your access request is unfounded, repetitive, or excessive. In such cases, we will charge a reasonable amount. We will inform you of any applicable fees before processing your request.

Response Time: We aim to respond to all valid requests within one month unless the request is particularly complex or you have made multiple requests, in which case we will respond within two months. We will notify you if we need more than one month. We may ask you to clarify what you would like to receive or what concerns you to expedite our response.

Third-party rights: We are not required to comply with a request if it would adversely affect the rights and freedoms of other individuals.

You can ask us to:

• Confirm whether we process your personal data;
• Provide you with a copy of these data;
• Provide other information about your personal data, such as the data we have, what we use it for, who we disclose it to, whether we transfer it abroad, how we protect it, how long we retain it, what rights you have, how to lodge a complaint, and where we obtained your data, as long as this information has not already been provided through this notice.

You can ask us to correct or complete inaccurate or incomplete personal data.

We may attempt to verify the accuracy of the data before correcting it.

You can ask us to delete your personal data, but only if:

• It is no longer necessary for the purposes for which it was collected; or
• You have withdrawn your consent (if data processing was based on consent); or
• You are exercising a legal right to object; or
• It has been processed unlawfully; or
• We have a legal obligation to do so.

We are not required to comply with your request to delete personal data if its processing is necessary for:

• Compliance with a legal obligation; or
• The establishment, exercise, or defense of legal claims.

There are other circumstances in which we may not be obligated to comply with your deletion request, but these two are the most likely scenarios in which we may deny your request.

You can ask us to restrict the processing of your personal data, but only if:

• Its accuracy is contested (see correction section) so that we can verify its accuracy; or
• The processing is unlawful, but you do not want the data to be deleted; or
• It is no longer necessary for the purposes for which it was collected, but you need it to establish, exercise, or defend a legal claim; or
• You have exercised your right to object, and the verification of whether our rights override yours is ongoing.

We may continue to use your personal data after a restriction request