Personal Data Processing Policy

SC EXPRESS DIESEL SRL applies a strict policy for respecting customer data confidentiality. We undertake not to disclose customers’ personal data to third parties and to use it only for the purpose for which it was provided (order fulfillment, commercial communications, newsletter). SC EXPRESS DIESEL SRL does not encourage SPAM, does not provide your e-mail address to third parties (natural or legal persons), does not sell, offer, or trade e-mail addresses obtained through this website, and does not disclose your e-mail address to anyone accessing this site without your explicit consent.

SC EXPRESS DIESEL SRL, a Romanian company with its registered office in Romania, Sos. Alexandriei no. 199F, Bucharest, Sector 5, registered with the Trade Registry under no. J40/1943/2000, unique identification code 12734370, VAT attribute RO, share capital RON 1,580,000, as Personal Data Controller, processes your personal data in good faith and for the purposes set out in this Notice, in accordance with Law no. 677/2001 (as applicable historically) and Regulation (EU) 2016/679 (GDPR).

These personal data, belonging to you as a client or as a client’s representative (the data subject), are provided to our company when you create an account on our website (www.expressdiesel.eu), when placing/concluding an order and/or a service/supply contract, when you submit a request for services, and/or during the performance of the contractual relationship.

What does “processing of personal data” mean?

“Processing” means any operation performed on personal data, with or without automated means, such as: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The Controller applies appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as well as against any other unlawful form of processing. Data are processed individually, based on the applicable legal grounds. Where processing is based on consent, the Controller obtains it separately in accordance with the GDPR.

Principles of Processing

We strictly observe the GDPR principles (Art. 5):

a) Lawfulness, fairness, transparency – data are processed lawfully, fairly and transparently, and the data subject is informed of the processing and its legitimate purposes.

b) Purpose limitation – data are collected for specific, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

c) Data minimization – data are adequate, relevant and limited to what is necessary for the stated purposes.

d) Accuracy – data are accurate and, where necessary, kept up to date; inaccurate data are erased or rectified without delay.

e) Storage limitation – data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed.

f) Integrity and confidentiality – data are processed securely to prevent unauthorized/illegal processing, loss, destruction or accidental damage.

What data do we process?

Depending on the products/services purchased:

a) Identification and contact data: full name, national ID/tax ID (CNP/NIF), ID series/number/issuer, address (home/residence/delivery), phone number, e-mail, banking data (bank, IBAN).

b) Vehicle data: owner’s name/address, vehicle type/brand/model, registration number, VIN (chassis serial), engine capacity, power, year of manufacture, mileage.

If goods/services are purchased directly at our premises, please note the location is video-monitored according to law. In this case, we also process your image, the image of any companions, and the vehicle entering our premises.

Purposes of Processing

Personal data are processed for the following purposes:

a) Concluding and performing the contractual relationship with the Company at your request (e.g., account creation, order processing, delivery, returns, communicating business hours, etc.);

b) Reporting to public authorities under legal obligations and for activities related to inspections (e.g., ANAF, ANPC, RAR, ANSPDCP);

c) Debt recovery and enforcement of amounts owed to the Company in case of non-payment;

d) Monitoring, security and protection of persons, premises and assets via CCTV in accordance with legal obligations;

e) Sending newsletters/other commercial communications to promote the Company’s products/services via e-mail/SMS/phone, where you have given consent.

Legal Grounds

Processing is carried out on the following legal bases (Art. 6 GDPR):

a) Consent (e.g., newsletters/marketing communications) – Art. 6(1)(a);

b) Contract performance or steps at your request prior to a contract (e.g., supplying the requested product/service, communicating for performance, courier delivery, informing about business hours) – Art. 6(1)(b);

c) Legal obligation (e.g., reporting to competent authorities; preparing and keeping accounting documents such as invoices) – Art. 6(1)(c);

d) Legitimate interests pursued by the Company (e.g., debt recovery, ensuring security of persons and property), balanced against your fundamental rights and freedoms – Art. 6(1)(f).

Retention Periods

a) For contracts/orders: for the contract term, plus 10 years after termination for retention of accounting documents under the law, plus another 10 years for archiving under internal procedures (unless a longer period is legally required);

b) If no contract is concluded: 10 years from the date accounting documents are issued, plus another 10 years for archiving under internal procedures;

c) CCTV recordings: 21 days from recording, unless a longer period is legally justified;

d) Marketing communications: for as long as consent is valid. If you withdraw consent, processing for this purpose stops from the moment of withdrawal.

To whom do we disclose personal data?

Personal data may be disclosed to: the data subject, the data subject’s representatives, other companies within the same group, insurers, contractual partners (e.g., lawyers, consultants, accountants, auditors), Company service providers (e.g., IT, archiving, printing, couriers), all bound by confidentiality. Data may also be disclosed to state authorities within their legal competence (e.g., ANAF, RAR, ANPC, ANSPDCP).

Data shared with third parties will be adequate, relevant and not excessive relative to the purpose of collection and disclosure.

Necessity of providing data

If you refuse to provide data for the purposes at points a)–d) above, the Company may be unable to initiate legal relations with you, fulfill tax/legal requirements (e.g., issuing/archiving fiscal documents), assess your service/goods request, or conclude/perform the requested contract. Refusing marketing consent does not affect the contractual relationship.

Your Rights (GDPR)

As a data subject, you have the following rights regarding your personal data:

a) Right of access – request confirmation of processing, a copy of your data, and information about processing (where not already provided);

b) Right to rectification – request correction/completion of inaccurate or incomplete data;

c) Right to erasure (“right to be forgotten”) – request deletion when: data are no longer necessary; consent is withdrawn; you object and there are no overriding legitimate grounds; processing is unlawful; or we must comply with a legal obligation. We may refuse deletion where processing is necessary to comply with legal obligations or for establishing/exercising/defending legal claims. Deleting your data/account is irreversible and you will lose all information stored in your online account.

d) Right to restriction – request restriction where: accuracy is contested; processing is unlawful and you oppose erasure; data are no longer needed but you require them for legal claims; you have objected and a balancing test is pending. We may continue processing restricted data with your consent, for legal claims, or to protect the rights of our Company or another person.

e) Right to data portability – receive your data in a structured, commonly used, machine-readable format or have it transmitted to another controller where processing is based on consent or contract and is carried out by automated means.

f) Right to object – object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You may object at any time to processing for direct marketing (including profiling); in such case we will cease processing as soon as possible.

g) Right not to be subject to automated individual decision-making, including profiling – request not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where necessary for a contract, authorized by law with adequate safeguards, or based on your explicit consent.

h) Right to lodge a complaint – with the National Supervisory Authority for Personal Data Processing (ANSPDCP):
B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, 010336, Bucharest, Romania
Tel: +40.318.059.211 / +40.318.059.212
E-mail: anspdcp@dataprotection.ro

Under Art. 7(3) GDPR, you may withdraw consent for newsletters/marketing at any time. Under Art. 15(4) GDPR, a request for a copy of your personal data may be fulfilled only insofar as it does not adversely affect the rights and freedoms of others.

How to exercise your rights

Submit a written, dated and signed request to the Data Protection Officer (DPO) of SC EXPRESS DIESEL SRL at: Sos. Alexandriei no. 199F, Sector 5, Bucharest, 051529, or by e-mail at dpo@expressdiesel.ro.

We will respond within 30 days under the GDPR. This term may be extended by up to 2 months if necessary, considering the complexity and number of requests; we will inform you if so. We will not charge a fee unless your request is unfounded, repetitive or excessive, in which case we may charge a reasonable fee and will inform you in advance.

If any of your data are incorrect, please notify us as soon as possible at dpo@expressdiesel.ro or by post at SC EXPRESS DIESEL SRL, Sos. Alexandriei no. 199F, Sector 5, Bucharest.