Privacy and Personal Data Protection Policy
TABLE OF CONTENTS:
A. General information
B. Categories of personal data processed
C. Purposes of personal data processing
D. Legal basis for personal data processing
E. Duration of personal data processing
F. Transmission/disclosure of personal data
G. Your rights
H. How we protect personal data
I. Updates to our policy
J. How to contact us
A. GENERAL INFORMATION
This Privacy and Personal Data Protection Policy (“Policy”), in accordance with the provisions of Art. 13 para. 1) and 2) of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, describes the ways in which we, MAXT INNOVISTA S.R.L., process the information brought to our attention, including personal data collected through this website (www.innovista.ro) when it is used by you.
To make the information easier to follow, we may refer to our company using the terms “INNOVISTA”, “MAXT INNOVISTA”, “the Company”, “we”, “us”, “our”, etc., and to you using the terms “user”, “client”, or “visitor” of the website.
www.innovista.ro is the online store created and developed by INNOVISTA for the purpose of offering users, through its sections, the possibility to purchase state-of-the-art electronic products and accessories, including photo-video devices, audio equipment, smart devices, accessories, and complementary products, as well as related delivery, warranty, and customer support services.
MAXT INNOVISTA S.R.L., a private legal entity with its registered office in Arad, 1 G-ral Vasile Milea Blvd., Entrance IV, Floor D, Apt. 4A-10A, Arad County, registered with the Trade Register Office attached to the Arad Tribunal under no. J2025068535000, having VAT ID: RO52479799, is a Personal Data Controller and, in this capacity, processes the personal data of visitors/users/customers of this online store, which it collects directly or from other sources, as a result of accessing and viewing the information on the site, creating customer accounts, placing orders, and using the services offered.
The Privacy Policy describes the types of personal data we collect through our online store, how we use this information, to whom the data is transmitted, as well as the rights and options you have regarding the processing of personal data.
At the same time, through this policy, we describe the measures we take to ensure the security of the information and how you can contact us regarding the implementation of data protection and to exercise your rights.
In general, our intention is to collect personal data that is voluntarily provided by visitors and customers of our online store and which is necessary to provide online sales services, order processing, product delivery, customer support, and the continuous improvement of the shopping experience.
Please read this Policy carefully to learn more about how we process the information brought to our attention, including personal data collected through this online store when it is used by you.
Our Privacy and Personal Data Protection Policy applies to any visitor and customer of the INNOVISTA online store.
INNOVISTA is committed to complying with the provisions of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data by taking appropriate technical and organizational measures, designed to effectively implement the data protection principles:
– Lawfulness, fairness, and transparency: we process your data lawfully and fairly, we are always transparent regarding the information we use, and you are properly informed.
– Control is yours: within the limits of the law, we provide you with the possibility to examine the accuracy of your personal data, update or delete the data you have shared with us, and to exercise your other rights.
– Data minimization: we collect only the data strictly necessary for the established purposes and do not process more information than is required to provide the requested services.
– Data integrity and purpose limitation: we use data only for the purposes described at the time of collection or for new purposes compatible with the original ones; our purposes comply, in all cases, with the legislation in force. We take reasonable measures to ensure that personal data is accurate, complete, and up to date.
– Security: we have implemented reasonable security and encryption measures to protect your information as effectively as possible. However, please keep in mind that no website, application, or internet connection is completely secure.
B. CATEGORIES OF PERSONAL DATA PROCESSED
1. Simple browsing as a visitor
You can use our website without revealing personal data by simply browsing as a visitor of the online store, respectively without the need to register an account or fill out any contact form. In this case, we will only collect technical navigation data through cookies (see the section on cookies below).
2. Account creation and ordering
You will decide whether you want to interact with our online store and proceed with any action that requires providing personal data. In this case, you will be asked to provide certain personal data during the customer account creation process, when placing orders, or when using contact forms.
The website www.innovista.ro currently offers interested users the possibility to:
• Create a customer account for purchasing products
• Place online orders and manage the shopping cart
• Send messages/requests via the contact forms available on the site
• Subscribe to the newsletter to receive information about new products and special offers
• Request information about specific products
For these functionalities, the following data is required:
a) For customer account creation and ordering:
– First and last name (mandatory)
– Email address (mandatory – used for login, account validation, and communication)
– Phone number (mandatory – for contact regarding the order)
– Access password (mandatory – stored in encrypted format)
– Complete delivery address: street, number, building, entrance, floor, apartment, city, county, postal code (mandatory – for order delivery)
– Billing address (if different from the delivery address)
– Tax details (optional – for legal entities): company name, VAT ID (CUI), Reg. Com. no., registered office address
– Order details: selected products, quantities, prices, date and time of the order
– Preferred payment method
– Type of card used for payment (NOT the full card number – this is processed directly and exclusively by the payment processor, Netopia)
b) For contact forms and information requests:
– First and last name
– Email address
– Phone number
– Message/content of the request/user interest (message subject/reason for contact)
– The product about which information is requested (if applicable).
c) For newsletter subscription:
– Email address (mandatory)
– First and last name (optional – for personalizing communications)
Furthermore, we will process any other personal data or information that the user voluntarily enters into the forms available on the site, in the message box.
Providing personal information marked with an * through our forms is mandatory to respond to your request or to process your order. Other personal data or information you provide when filling out the forms is at your discretion.
Failure to provide any of the mandatory personal data and information may result in the inability to process your order, contact you, or provide responses to your requests.
3. Automatically collected technical data
In addition to the personal data and collection methods described above, we collect data from other sources, as is the case for most online stores.
Thus, the website www.innovista.ro automatically collects certain technical information about you that identifies only the activity as a visitor or user of the online store, both as a result of simply accessing the site and as a result of viewing pages, products, sections, or action buttons you have “clicked” while using the website.
This technical information is collected by automated means, namely through cookies or other similar technologies (web beacons, web server logs, etc.), and identifies information such as: IP address, operating system, type and version of the internet browser used, device type (desktop, mobile, tablet), approximate geographic location (at city/region level), web pages and products you access on our website, duration of the visit on the site and on each page, traffic source (how you reached the site), products viewed, added to the cart or to the favorites list, browsing behavior, and usage patterns.
These are statistical and analytical data regarding the actions and browsing patterns of our users and do not directly identify a specific individual.
Cookies and other similar technologies help us improve the website and provide better and personalized content, relevant product recommendations, and optimize the shopping experience. For more information about the use of cookies on the website, please consult the Cookie Management Policy available on our website.
4. Data collected from third-party sources
In certain situations, we may also collect data from other legitimate sources:
• Social media platforms: if you choose to log in via your Facebook or Google account, we receive basic profile data according to the permissions granted
• Delivery service providers: information regarding delivery status
• Fraud prevention services: data to verify the validity of transactions
5. Links to other websites
On the website www.innovista.ro, you may encounter links to other websites for your information (for example: social networks such as Facebook, Instagram, LinkedIn, YouTube, payment platforms, etc.) or which we consider useful in relation to our website’s content, but which are not under our control.
These websites may operate independently of our website and may have their own notices, statements, or privacy policies. To understand how personal data may be processed in connection with these connected websites, we recommend that you read their notices, statements, or privacy policies before providing your personal data to these websites. We are not responsible for the content or opinions expressed on websites that do not belong to us or are not managed by us, or for the use or privacy practices of other data controllers.
C. PURPOSES OF PERSONAL DATA PROCESSING
INNOVISTA processes personal data collected through the online store www.innovista.ro for the following purposes:
• Processing and fulfilling orders placed in the online store, including: recording orders, validating product availability, processing payments, preparing for delivery, coordinating with courier service providers, issuing tax invoices and transport documents;
• Creating and managing customer accounts, to allow users to place orders, access purchase history, save delivery preferences, and benefit from the functionalities of the online store;
• Delivering products ordered to the address indicated by the customer, through collaboration with courier service providers;
• Managing returns, exchanges, and complaints according to consumer protection legislation and our terms and conditions;
• Providing customer support and assistance regarding various requests, product questions, technical issues, or complaints, addressed by customers via contact forms, email, phone, or chat available on the website;
• Fulfilling the company’s legal obligations, including: accounting and tax obligations in the context of product sales, issuing invoices, bookkeeping, archiving documents in both physical and electronic format, and reporting to tax authorities.
• Marketing and advertising communications (only with your explicit consent), including sending newsletters with information about new products, special offers, promotions, and announcements about the availability of products on the waiting list;
• Website administration and maintenance, improving the user experience, analyzing shopping behavior and customer preferences using cookies and other similar technologies, with the aim of providing personalized content, product recommendations tailored to user interests, improving search algorithms, and optimizing the ordering process.
• Security and fraud prevention: protection against fraud, hacking attempts, spam, and other illegal activities, monitoring suspicious transactions, and detecting platform misuse;
• Resolving disputes and investigations: for the settlement of any notifications/complaints/requests from data subjects, as well as for the establishment, exercise, or defense of a legal claim in court, resolution of disputes, or investigations (internal or initiated by authorities) in which the organization is a party.
• Diagnosing or fixing technical problems regarding the functioning of the online store, detecting and correcting errors, and improving platform performance and stability;
• Evaluating customer satisfaction by collecting feedback regarding the shopping experience and conducting optional satisfaction surveys;
• Other compatible purposes to those described above, in accordance with applicable legislation.
D. LEGAL BASIS FOR PERSONAL DATA PROCESSING
The legal basis for processing personal data by INNOVISTA according to the purposes indicated above is:
• Performance of a contract to which you, as the data subject, are party, or to take steps at your request prior to entering into a contract, according to the provisions of Art. 6 para. 1) lit. b) of EU Regulation 2016/679. This basis applies to: processing and fulfilling orders, delivering purchased products, managing the customer account, and taking pre-contractual steps at the user’s request (providing product information, generating offers).
Refusal to provide the mandatory data necessary for concluding and executing the contract will make it impossible to process the order and deliver the products.
• Compliance with a legal obligation to which the controller is subject, according to the provisions of Art. 6, para. 1, lit. c) of EU Regulation 2016/679 (compliance with financial-accounting obligations such as issuing invoices and bookkeeping, fulfilling tax obligations, submitting ANAF declarations, archiving documents according to legislation, complying with consumer protection and e-commerce legislation, providing information to competent authorities upon legal request).
• Your consent for the processing of personal data, according to the provisions of Art. 6, para. 1, lit. a) of EU Regulation 2016/679, expressed for newsletter and marketing communication purposes, if you have provided it. We will communicate with you via email through periodic information/newsletters, sending commercial messages related to our products and promotions, as well as any other transactional messages related to our products and activity (greetings, gift coupons, or other special messages). You have the possibility to withdraw your consent at any time by following the “unsubscribe” instructions in each email, changing the settings in your customer account, or sending the unsubscribe option via the contact form or email address.
• Pursuit of the legitimate interest of permanently improving your experience on the site, for security (to keep this website secure against fraud and other illegal activities), for managing disputes and investigations (internal or those initiated by authorities), and protecting the rights and interests of INNOVISTA and collaborating partners, according to the provisions of Art. 6, para. 1, lit. f) of EU Regulation 2016/679.
Providing data for this purpose is not mandatory; refusal to provide data will not have negative consequences for you. You have the right to object to processing based on legitimate interest for reasons related to your particular situation.
E. DURATION OF PERSONAL DATA PROCESSING
INNOVISTA processes your personal data only for the duration necessary to fulfill the processing purposes mentioned above, and subsequently for compliance with current legal requirements and for the protection of the legal rights and interests of the company and data subjects (users and customers of the online store).
To the extent that the data is no longer necessary for compliance with current legal requirements and for the protection of our interests, it will be deleted or anonymized.
Specifically:
–Data in the active customer account: kept for as long as the account is active and for the duration of the contractual relationship, plus a period of 3 years from the last order (for potential warranties, complaints, or disputes). After requesting account deletion, data is deleted within 30 days, except for those that must be kept for the company’s legal obligations.
–Data from orders and transactions: order and delivery data are kept for 3 years from the execution of the order. Invoices and tax documents are kept for at least 10 years, according to the Tax Code and accounting legislation. Accounting documents are archived for 10 years according to the legislation in force.
–Data from contact forms and requests: kept for the duration necessary to resolve the request and subsequently according to legal archiving obligations (at least 5 years according to tax legislation). For requests related to warranties or complaints: for the duration of the warranty term plus the duration of legal limitation periods.
–Marketing data (newsletter): kept until the withdrawal of your consent. After unsubscribing, data is deleted or anonymized within 30 days. An exception is made if you hold an active account, in which case basic contact data will continue to be processed for contractual purposes.
–Information collected through cookies: strictly necessary cookies are stored for the duration of the session or a maximum of 12 months. Analysis cookies (Google Analytics) are stored for a maximum of 26 months. Marketing cookies are stored for a maximum of 12 months. All cookies can be deleted at any time from the browser settings.
–Data for security and fraud prevention: IP addresses and access logs are kept for a maximum of 3 years. Data about fraud attempts is kept for the duration of the investigation plus the duration of limitation periods.
–Data for disputes and legal procedures: for the duration of the legal procedures and subsequently according to legal limitation periods.
After the storage periods expire, the data will be permanently deleted or irreversibly anonymized.
F. TRANSMISSION/DISCLOSURE OF PERSONAL DATA
To fulfill the processing purposes, INNOVISTA may disclose your data to partners, third parties, or entities that support the operation of our company’s business through the online store, such as:
–Courier and delivery service providers (for example: Fan Courier, Cargus, DPD, GLS, Sameday, Romanian Post) – they receive the full name, delivery address, phone number, and package details to ensure correct delivery;
–Online payment processors: Netopia (mobilPay) – main processor for card payments. Bank card data (full number, CVV, expiry date) are processed exclusively by Netopia, according to PCI-DSS standards. INNOVISTA does not have access to and does not store full card data;
–IT service providers (maintenance, software development, web hosting, backup and cloud archiving, cybersecurity solutions);
–Marketing and communication service providers: Mailchimp (or other email marketing platforms) for sending newsletters (only with your consent), Google Analytics for traffic analysis, Facebook Business Tools, and Google Ads for advertising campaigns (only with consent for marketing cookies);
-Archiving service providers, in physical/electronic format;
–Legal, audit, and consultancy service providers;
-Accounting service providers;
-Other companies with which we may develop joint projects or collaborations in connection with INNOVISTA’s activity, as well as
-Competent authorities: tax bodies (ANAF), judicial authorities (courts, prosecutor’s offices), National Authority for Consumer Protection (ANPC), National Supervisory Authority for Personal Data Processing (ANSPDCP), Romanian Police, or other competent state control authorities, based on and within the limits of legal provisions and as a result of expressly formulated requests by them.
We may also transmit data to other parties with your consent or according to your instructions.
All partners and service providers who have access to your data are contractually obligated to respect the confidentiality and security of the data and to process it exclusively for the purposes set by INNOVISTA and in accordance with GDPR.
Data transfers outside the European Economic Area (EEA):
We will ensure, within reasonable limits, that your data does not leave the European Economic Area; however, to the extent that we transfer data to states outside the EEA, we will ensure, in all cases, that the transfers are legitimate, based on your explicit consent or another legal basis according to mechanisms approved by the European Commission (standard contractual clauses, adequacy decisions, other legal transfer mechanisms according to GDPR).
G. YOUR RIGHTS
As a data subject, in accordance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you benefit from the following rights:
• Right to request access to your personal data: the right to obtain, from INNOVISTA, upon request and free of charge, confirmation that your personal data is or is not being processed by the Company and the right to be informed about such processing, including: purposes of processing, categories of data processed, recipients of data, storage period, your rights, source of data (if not collected directly from you), and the existence of automated decision-making;
• Right to rectify your personal data: the right to obtain from INNOVISTA the rectification of your incorrect/incomplete personal data without undue delay; you can update most of the data directly from your customer account.
• Right to delete your personal data: the right to obtain from INNOVISTA the deletion of your personal data, but in this case, you will no longer be able to benefit from the services offered through the online store. This right cannot be exercised to the extent that INNOVISTA is legally obligated to keep and process certain personal data (e.g., tax archiving obligations). Data can be deleted in the following situations:
– they are no longer necessary for the purposes for which they were collected or processed;
– consent is withdrawn and there is no other legal basis for processing;
– you object to the processing and there are no overriding legitimate grounds;
– personal data has been processed unlawfully;
– personal data must be deleted to comply with a legal obligation;
– personal data was collected in connection with the offer of information society services under Union law or the national law to which the controller is subject.
• Right to restrict processing: the right to obtain from INNOVISTA the restriction of processing in the following cases:
(I) the accuracy of the personal data is contested by you – processing will be restricted for the period verifying the correctness of the data;
(II) the processing is unlawful and therefore you object to the deletion of personal data, requesting restriction of processing instead;
(III) the Company no longer needs your personal data, but you request this data for the establishment, exercise, and defense of legal claims.
• Right to data portability, respectively the right to receive personal data in a structured, commonly used, and machine-readable format, as well as the right for this data to be transmitted by INNOVISTA to another data controller, to the extent that this is technically feasible and legal conditions are met;
• Right to object represents the right at any time, for reasons related to your particular situation, to object to processing based on legitimate interest, unless INNOVISTA has legitimate and compelling reasons that justify the processing and prevail over the interests, rights, and freedoms of the data subjects or when the purpose of the processing is the establishment, exercise, or defense of a legal claim.
You have the right to object at any time, free of charge and without any justification, to your personal data being processed for advertising, marketing, and publicity purposes or being disclosed to third parties for such purposes.
• Right not to be subject to an automated individual decision represents the right not to be the subject of a decision taken exclusively based on automated processing activities, including profiling, which produces legal effects or similarly affects you to a significant extent;
• Right to lodge a complaint with the supervisory authority or competent courts when you consider that personal data is being processed unlawfully by INNOVISTA.
Thus, you benefit from the right to address the National Supervisory Authority for Personal Data Processing at the address: Bucharest, 28-30 G-ral Gheorghe Magheru Blvd., sector 1, postal code 01036, web: www.dataprotection.ro, or via email at: an*****@************on.ro.
You also have the right to address the competent courts for the defense of any rights guaranteed by the legislation on the protection of personal data that have been violated.
How you can exercise your rights:
The rights mentioned above are expressly provided for in Regulation 2016/679 and can be exercised by you at any time, free of charge, by sending a request to INNOVISTA at:
• Email: of****@*******ta.ro or gd**@*******ta.ro
• Postal address: MAXT INNOVISTA S.R.L, Arad municipality, 1 G-ral Vasile Milea Blvd., entrance IV, floor D, apt. 4A-10A, Arad county
• Phone: +40 778 736 195
We will respond to your request without undue delay and within a maximum of 30 days from receiving the request. In complex cases, we may extend the term by an additional 60 days, in which case we will inform you.
H. HOW WE PROTECT PERSONAL DATA
INNOVISTA implements administrative, technical, organizational, and physical security measures to protect your personal data against accidental, illegal, or unauthorized destruction, loss, alteration, access, communication, or use for other purposes.
The security measures implemented include:
– secure protocols for communication and data transfer (such as HTTPS/SSL, TLS),
– encryption of data in transit and at rest, where possible
– encrypted passwords
– anonymization and pseudonymization of data, where applicable.
– Monitoring systems for possible vulnerabilities and attacks.
– Strict access controls and authentication for authorized personnel
– Regular data backups to prevent loss
– Firewalls and intrusion detection systems
– Periodic risk assessments and security tests.
– Internal security policies
– Confidentiality agreements
– Incident management procedures
Bank card data does not pass through INNOVISTA servers and is not stored by us. These are processed directly by Netopia (mobilPay), an authorized and certified payment processor according to international PCI-DSS standards.
However, even if we do our best, we cannot guarantee that data transmissions over the Internet can be 100% secure. Consequently, we cannot ensure or guarantee the security of the information you transmit and you understand that any information you transfer to us is done at a certain risk. Nevertheless, we use website security measures in accordance with best practices to protect the website, emails, and mailing lists.
Also, we are aware that incidents of misuse or unauthorized program incursions may occur. In these situations, our objectives are to isolate the problem as quickly as possible to ensure or restore proper functionality and to minimize inconvenience to our users. If necessary, we will inform the competent authorities about data security breaches. We will do everything reasonably possible to prevent security breaches and to assist authorities in the event that breaches occur.
We recommend that you:
• Keep your account password confidential
• Use strong passwords (at least 8 characters, combination of letters, numbers, and symbols)
• Change your password periodically
• Log out of your account after use on shared devices
• Do not access suspicious links from emails
I. UPDATING OUR POLICY
The content of this Policy may be updated periodically by republishing the revised version on the page you are currently viewing. In the case of significant changes affecting your rights, we will inform you about them through:
• easily visible information notes posted on our website,
• notification email to customers with an active account (if the change is essential)
• notification banner upon the next login
• indicating the date of the last update at the beginning of the document
The revised version comes into effect on the date of publication on the website, unless otherwise specified.
The responsibility to check the content of this page to stay informed about the latest version of this document rests entirely with you. We recommend that you periodically consult this policy to remain aware of any changes.
Continued use of the online store after the publication of changes will be considered as acceptance of the new version of the Privacy Policy.
J. HOW TO CONTACT US
If you have questions or comments about this Privacy Policy regarding the processing of personal data, if you wish to exercise your rights, or to update the personal data we hold about you, please contact us:
INNOVISTA Contact Details:
Name: MAXT INNOVISTA S.R.L.,
Company identification data: VAT RO52479799, J2025068535000
Correspondence address: Arad, 1 G-ral Vasile Milea Blvd., Entrance IV, Floor D, Apt. 4A-10A, Arad County, Romania
Email: of****@*******ta.ro
At the same time, we inform you that your right to address the supervisory authority at any time will not be affected in any way if you contact us beforehand. We assure you that we will make every necessary effort to resolve any problem with you amicably.
Data Protection Officer (DPO)
For any matters related to personal data protection, you may address the Data Protection Officer designated by INNOVISTA:
Contact details of our data processing officer:
Phone: +40 727 923 915
Email DPO: gd**@*******ta.ro .
Published on: November 18, 2025