Privacy Policy
What personal data we collect through this website, why, on what legal basis, and for how long we keep it.
The data controller within the meaning of Article 4(7) GDPR is MICRO DIGITAL ELECTRONICS CORP S.R.L., operating under the VENDOR.Energy™ brand. This document explains what personal data the Company collects in connection with the website and with enquiries sent through the channels published on it, why, on what legal basis and for how long it keeps that data. Processing is governed by Regulation (EU) 2016/679 (GDPR) and applicable Romanian data protection law.
Questions and requests concerning your rights: info@vendor.energy. Marking the subject line PRIVACY helps us route them. Cookies are covered by the Cookie Policy, company identification by the Legal Notice, and use of the website by the Terms of Service.
Who processes your data
The Company is the controller of the personal data described below. It decides why and how that data is processed.
- Company
- MICRO DIGITAL ELECTRONICS CORP S.R.L.
- Address
- Splaiul Unirii nr.16, etajul 10, cam 6/2
- Registration number
- RO50047468
- Data protection contact
- info@vendor.energy
No Data Protection Officer has been appointed. Data protection questions can be sent using the contact details above.
What data, why and for how long
Each row is a separate processing operation with its own purpose, legal basis and retention period.
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Enquiry through a form or by email: name, work email, telephone, organisation, role, message | Replying to the enquiry and discussing cooperation | 6(1)(b) — steps taken at your request prior to a contract; outside a contractual context, 6(1)(f) | 24 months from the last substantive contact; if joint work begins, its duration and three years afterwards |
| Acceptance of the confidentiality agreement for access to investor materials: name, contact details, organisation represented; acceptance record — IP address, client parameters, UTC timestamp, document version and hash | Granting access and evidencing acceptance of the terms | 6(1)(b) where the data subject is itself a party to the agreement; 6(1)(f) for a representative of an organisation and for the evidentiary record | Six years after the agreement ends, or from the last disclosure or access |
| Identity and address verification before investment materials are disclosed | Confirming eligibility for access | 6(1)(f) | The period stated in the KYC/AML Notice |
| Web server logs: IP address, browser identifier, requested address, response code, time | Availability and security of the website | 6(1)(f) | 14 days |
| Website statistics: pages, session duration, device type, country, referral source | Understanding how the website is used | 6(1)(a) — your consent | Up to 14 months |
| Record of your cookie choice | Keeping the settings you selected and evidencing consent where it was given | 6(1)(c) | 12 months |
| Voluntary contribution to research: name, email, identifier, amount and time of the transaction; card details do not reach the Company | Accepting the contribution and accounting for it | 6(1)(b); 6(1)(c) | The period set by Romanian accounting and tax law for the relevant documents |
Legitimate interest
Where 6(1)(f) is given as the basis, the interest is protecting the website infrastructure, being able to reply to an enquiry and defending legal claims. Processing is limited to what is necessary, and data needed for legal claims is kept until the limitation period expires. You may object to it — see section 05.
Providing data is voluntary
There is no obligation to provide it; the fields marked as required in the forms are needed in order to reply.
Special categories
The Company does not request the data listed in Article 9 GDPR through the website forms and contact channels, and asks you not to include such information in enquiries. If it is sent nonetheless, further processing will be restricted and the information deleted unless its retention is required and permitted by law. Biometric verification at access, where it is used, is carried out only with your explicit consent (Art. 6(1)(a) and 9(2)(a)) and is described in the KYC/AML Notice.
Who receives the data
Personal data is not sold and is not passed to third parties for their own commercial purposes.
- Hetzner Online GmbH (Germany) — website hosting
- Google Ireland Limited — website statistics, only with your consent
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — voluntary contributions; an independent controller under its own privacy policy
- An external identity verification provider — within the KYC/AML procedure
- Legal, tax and accounting advisers — under professional secrecy
- Public authorities and courts — where disclosure is required by EU or Romanian law
- A successor — in a reorganisation, merger or transfer of the business
Recipients acting as processors work on the Company’s documented instructions under an Article 28 GDPR agreement; independent controllers determine the purposes and means themselves, and their own terms apply to that processing.
Transfers outside the EEA
The main website infrastructure and the data the Company stores itself are located in the European Economic Area.
Individual service providers may process data outside it. In particular, if you consent to website statistics, the relevant data may be processed in the United States and other countries. Such transfers rely on a European Commission adequacy decision, where one has been adopted for the country of destination, or on other GDPR safeguards, including standard contractual clauses.
Information about the safeguards applying to a specific transfer can be requested at info@vendor.energy.
Your rights
These rights apply to your own personal data.
- Confirmation of processing and a copy of the data — Art. 15
- Rectification of inaccurate or incomplete data — Art. 16
- Erasure of data where grounds exist — Art. 17
- Restriction of processing — Art. 18
- Data portability, where Article 20 GDPR applies
- Objection to processing based on legitimate interest — Art. 21
- Withdrawal of consent at any time, which does not affect the lawfulness of processing before withdrawal — Art. 7(3)
How to exercise them
Send your request to info@vendor.energy or to the postal address in section 01. A reply will follow within one month of receipt of the request (Art. 12(3) GDPR); for complex or numerous requests that period may be extended by up to two further months, with notice within the first month. Exercising your rights is free of charge; Article 12(5) GDPR applies to manifestly unfounded or excessive requests.
Complaints
You may lodge a complaint with the supervisory authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, Romania, https://www.dataprotection.ro/ — or with the supervisory authority of the EU country where you live, where you work or where you consider the infringement to have taken place. You may also bring proceedings before a court (Art. 79 GDPR).
Cookies and similar technologies
Strictly necessary technologies are enabled automatically: without them the website does not work. All others are enabled only after your consent, which you can change or withdraw at any time through the cookie settings in the site footer. The full list of technologies with their purpose, provider and duration is set out in the Cookie Policy.
07Automated decisions
The Company does not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, including profiling (Art. 22 GDPR).
08Changes and language versions
The version in force is the one bearing the date given at the top of this document. Where new consent is required by applicable law, it will be requested before the processing concerned begins.
This document is published in English, Romanian, German, Chinese and French. In the event of a discrepancy between versions, the English version prevails for the purposes of interpretation; this does not affect mandatory rules requiring otherwise.
