Privacy policy

Internal Regulation on Data Management The objective of this internal regulation regarding personal data management is to provide the employees and collaborators of TEO LUNCH S.R.L., a Romanian legal entity, headquartered in Brașov Municipality, 49 Iuliu Maniu Street, Brașov County, registered with the Trade Register Office attached to the Brașov Tribunal under no. J8/145/1992, Sole Registration Code 1090311, European Unique Identifier ROONRC. J8/145/1992 (hereinafter referred to as Teo Lunch or the company), with a summary of the most important information related to the data management activities carried out by TEO LUNCH S.R.L. At the same time, this document does not constitute individual consultation and does not replace a data protection audit. The purpose of this document is internal regulation and the provision of general assistance and guidance to Teo Lunch staff and collaborators, in order to ensure compliance with data protection requirements. Throughout the course of its activity, Teo Lunch manages various personal data belonging to different groups of natural persons, such as: Job applicants Its employees Former employees Delegates of suppliers with whom Teo Lunch conducts economic activities, other than persons with statutory representation rights Clients who participate in certain promotions organized by the company Individual clients who use Teo Lunch services through retail sales and/or the company's web-shop/website Shareholders/investors/representatives of shareholders/investors. Regarding the collection and management of data from these individuals, European and national legislation on personal data protection must be respected. At the same time, the company must take into account its own business interests, operational conditions, technical and organizational opportunities, as well as the interests of its employees and clients. The objective of this regulation is to briefly present the applicable legislation and the measures taken by the Company to comply with the law. Teo Lunch's goal is to always ensure that the GDPR is complied with in a clear and verifiable manner. This regulation applies to all systems, people, and processes that constitute the Teo Lunch information system, including management, employees, suppliers, and other third parties who have access to the Company's system. 1. General Data Protection Regulation The General Data Protection Regulation No. 2016/679/EU (GDPR) is the most important legislative rule affecting our data management activities. The EU regulation produces direct effects in all member states of the European Union and therefore applies in Romania without the need for national transposition. 1.1 Data Management and Processing Given the activity of the company, the data protection regulation applies to it. As demonstrated by the following GDPR concepts, the company and its personnel carry out data management and processing activities. a. Definition of "Personal Data": Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Therefore, personal data represents any information that Teo Lunch records about a person identified through various personal attributes (for example: telephone number, email address, date of birth, etc.), and not just data that directly enables their identification. Given that Teo Lunch is a company, in its daily operations it deals with personal data, mainly through direct sales (retail and online), as well as indirectly, as delegates and representatives of legal entity partners. b. Definition of "Personal Data Management / Processing": Data management means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, modification, retrieval, consultation, use, disclosure by transmission to third parties, restriction, or erasure. Consequently, throughout the course of its activity, Teo Lunch manages personal data. c. Definition of "Data Controller": A data controller refers to any natural or legal person that determines the purposes and means of processing personal data. Teo Lunch determines the purpose and means of managing the data of employees and other individuals and is therefore considered a data controller. The company's employed personnel act on behalf of the data controller in exercising their duties within the company's activities. d. Definition of "Data Processor": A data processor is a natural or legal person that processes personal data on behalf of the data controller. 1.2 Principles Relating to Data Management The legislation establishes mandatory principles regarding the management and processing of data, applicable erga omnes. When managing personal data, the following principles shall be considered and complied with: Personal data shall be: Processed lawfully, fairly, and in a transparent manner in relation to the data subject ("lawfulness, fairness, and transparency"); Collected only for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for statistical purposes shall not be considered incompatible ("purpose limitation"); Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization"); Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate are erased or rectified without delay ("accuracy"); Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest or statistical purposes, subject to implementation of the appropriate technical and organizational measures required by the regulation to safeguard the rights and freedoms of the data subject ("storage limitation"); Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ("integrity and confidentiality"). The data controller shall be responsible for, and be able to demonstrate compliance with these principles ("accountability"). 1.3 Processing Special Categories of Personal Data In accordance with the legal grounds outlined in Article 9 of the GDPR, the company sometimes manages special categories of personal data (for example, health-related data). The management of these data categories is carried out for reasons of preventive or occupational medicine (for example, managing fitness-for-work assessment results or granting benefits to individuals with disabilities). If the need arises to process a special category of data other than those mentioned above, a prior examination of the legal basis is required. 1.4 Rights of Data Subjects Regarding the personal data managed by the company, the GDPR grants data subjects a series of rights that correspond to legal obligations for the company: Right to Information – The data subject has the right to be informed regarding the source of personal data, purpose, storage duration, legal basis for processing, identity of the processor, nature of legitimate interest, data transfers to third countries, recipients, and categories of recipients in the case of legitimate interests. Right of Access – The data subject has the right to obtain full confirmation and information from the data controller regarding the purpose and manner of processing their personal data and, where applicable, to access their personal data and related administrative information. Right to Rectification – The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement. Right to Erasure ("Right to be Forgotten") – The data subject has the right to request the controller to erase personal data concerning them without undue delay, and the controller is obliged to erase such data (in specific cases under Article 17 GDPR) if the purpose or legal basis for processing has ceased, or if the processing occurred without a legal basis. Right to Restriction of Processing – In specific cases outlined in Article 18 GDPR, the data subject may request the restriction of data processing. Restriction means the controller will continue to store the data, but may only process it with the data subject's consent or for the establishment, exercise, or defense of legal claims. Notification Obligation Regarding Rectification, Erasure, or Restriction – The controller shall communicate any rectification, erasure, or restriction of processing carried out in accordance with Articles 16, 17(1), and 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if requested. Right to Data Portability – The data subject has the right to receive their personal data from the Controller in a structured, commonly used, and machine-readable format for the purpose of transmitting those data to another controller without hindrance, provided that the rights and freedoms of third parties are not adversely affected. Right to Object – The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them, including profiling. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. The right to object and the conditions of processing must be explicitly brought to the attention of the data subject at the latest at the time of the first communication. Right Relating to Profiling and Automated Decision-Making – The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The GDPR establishes specific deadlines for the Company's obligations arising from the data subject rights listed above. Responsible collaborators within the company must observe these deadlines during all procedure executions. The Company must take all reasonable measures to verify the identity of any data subject requesting access or exercising their rights. 1.5 Legal Bases Applied in Teo Lunch's Data Management Activities In managing personal data according to operational needs, the most frequent legal bases are consent, performance of a contract, compliance with legal obligations, and legitimate interests. The legal basis must be identified prior to conducting any data processing activity. Consent Required for online sales and marketing activities (newsletters, phone campaigns, SMS notifications, etc.). For children under 16, permission from a legal representative is required. Transparent information regarding data management, rights, and the right to withdraw consent must be provided beforehand in accessible, plain language and free of charge. If personal data is not collected directly from the data subject, required information must be provided within a reasonable period after obtaining the data, but no later than one month. Consent details—including data subject information, location, and timestamp—must always be recorded and retained according to data retention policies. Performance of a Contract Personal data provided at contract conclusion is necessary for contract execution. This legal basis remains valid until legitimate interests related to contract execution expire (5 years following contract execution under the Civil Code). Only personal data strictly necessary for contract execution (e.g., phone number, email) should be retained, after which it must be deleted from company registers. Compliance with Legal Obligations Legal requirements imposed on the data controller may mandate processing (e.g., managing employee details such as name, address, tax ID, and personal numerical code [CNP] for tax filings, payroll, and statutory reporting). Legitimate Interests Processing may be based on the necessity to pursue the legitimate interests of the Company or a third party, provided a legitimate interest assessment (LIA) determines these interests override the rights and freedoms of data subjects. Examples include video surveillance in premises to prevent theft or fraud (requiring clear signage, privacy safeguards, and notice regarding camera locations and storage) and accessing work email accounts under justified suspicion of duty breach (ensuring employees have the right to be present during audits of their email, internet, or phone usage). Data Protection by Design and by Default (Data Protection Integrated) Under GDPR regulations, the data processing framework must embed core principles and technical safeguards directly into the system architecture. Beyond setting up proper processing conditions, these measures undergo periodic reviews to adapt to operational needs, evolving technologies, and updated processing activities. Considering technological developments, implementation costs, processing context, and risks to individual rights, the controller implements suitable technical and organizational measures (such as pseudonymization). These measures ensure data minimization, enforce security guarantees, and restrict default access so that personal data is not made accessible to an indefinite number of persons without human intervention. To comply with these requirements, Teo Lunch ensures that: All personnel handling personal data understand their responsibility regarding data protection best practices. Employees receive dedicated data protection training. Data subjects have accessible contact channels to exercise their rights, with efficient request management in place. Data Protection Impact Assessments (DPIAs) and reviews are performed prior to upgrading or deploying new data collection and storage systems. 1.6 Personal Data Transfers Transfers of personal data outside the European Union / European Economic Area must be thoroughly verified beforehand to guarantee compliance with GDPR provisions (e.g., assessing adequacy decisions by the European Commission or implementing standard contractual clauses). 1.7 Data Processors The company engages only those data processors that offer sufficient guarantees to implement appropriate technical and organizational measures under GDPR standards. When working with processors outside the European Economic Area (such as third-party cloud storage providers), contracts must incorporate standard Data Processing Agreements (DPAs) and general terms alignment with company data management rules to ensure full traceability and data security. 1.8 Personal Data Breach Notification The company is required to establish procedures based on fairness and proportionality to inform data subjects in the event of a personal data breach. Supervisory Authority Notification: If a personal data breach occurs that presents a risk to the rights and freedoms of natural persons, the competent supervisory authority must be notified within 72 hours. Incident Management: Investigations and remediation follow the company's Incident Management Rules for handling information security events. Penalties: Non-compliance with data protection rules carries administrative fines under the GDPR of up to €20 million or 4% of the total global annual turnover, whichever is higher. 1.9 Retention Period Limitations Teo Lunch maintains dedicated internal procedures governing data retention and deletion schedules for all personal data collected and processed. These timelines follow core GDPR principles—specifically lawfulness, purpose limitation, and data minimization—and are detailed in the Data Retention and Deletion Regulation. 1.10 Record-Keeping Obligations In compliance with the GDPR, the company maintains formal Records of Processing Activities (ROPA). The records serve as proof of compliance with core principles, ensuring that: The legal basis for processing is explicit and clear. The purpose is well-defined and processing is restricted to necessary data. Data subjects receive transparent notices. Retention and erasure schedules are enforced. Storage meets technical security standards. Data transfers feature adequate safeguards. Designated personnel are assigned data oversight responsibilities. 2. Data Management Responsibilities Personal data security is a key operational priority for Teo Lunch. To guarantee oversight and assess internal controls, the company routinely audits data reception channels, screening, storage, purpose alignment, retention periods, and deletion processes. This regulation operates alongside the company's broader data governance framework, including: Internal Data Management Regulations Personal Data Breach Notification Procedures Data Subject Request Management Procedures Defining clear roles and operational tasks helps prevent data security incidents and enables rapid, effective response measures if an incident occurs. 2.1 Rules Regarding Data Protection To comply with applicable legal rules and standards, Teo Lunch will store and process the necessary data to achieve its objectives lawfully and fairly. Employees involved in these procedures will act under the following assigned roles: Data Controller Information Security Manager Compliance Officer The specific responsibilities for each role are detailed below. All employees and partners of the Company who carry out data processing activities are required to fulfill these tasks and obligations to ensure the proper application of general GDPR principles, including lawful, fair, and transparent processing, purpose limitation, data minimization and accuracy, as well as integrity and confidentiality. This Regulation establishes the responsibilities for each role within the GDPR procedures of the organization, without affecting the employee's general job duties, non-GDPR responsibilities, or authority, and is not considered a complete job description. 2.1.1 Data Controller Under the GDPR, a data controller is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data. The Data Controller has the following main responsibilities: Compliance & Accountability: Ensures compliance with the principles in Article 5 of the GDPR, maintaining the ability to demonstrate and verify that personal data is: Processed lawfully, fairly, and transparently; Collected for specified, explicit, and legitimate purposes; Limited to what is adequate, relevant, and necessary; Accurate and kept up to date where necessary; Stored in a form that permits identification of data subjects for no longer than necessary; Processed with appropriate security measures. Consent Management: Obtains valid consent from data subjects for processing, including parental consent where children are involved. Transparency: Provides data subjects with all required GDPR information in a concise, transparent, intelligible, and easily accessible format, using clear and plain language. Data Subject Rights: Facilitates the exercise of data subject rights under the GDPR and updates them on request statuses. Data subjects must be able to access collected data, verify lawfulness, and receive details on storage duration, processing logic, and profiling consequences. Vendor Diligence: Ensures engagement only with data processors providing sufficient guarantees that appropriate technical and organizational measures meet GDPR requirements and protect personal data. Record Keeping: Maintains formal records of data processing activities. Regulatory Cooperation: Cooperates with the supervisory authority upon request in performing its tasks. Authority Control: Ensures anyone acting under the authority of the data controller who has access to personal data processes it solely on instructions from the controller. Breach Notification: Notifies the supervisory authority without undue delay of any personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Breach Documentation: Formally documents all personal data breaches, including facts, consequences, and corrective actions taken. Individual Breach Notice: Informs data subjects without undue delay when a data breach is likely to result in a high risk to their rights and freedoms. Impact Assessments: Conducts Data Protection Impact Assessments (DPIAs) where required by internal procedures and regulations. Role Support: Works alongside the Compliance Officer, who provides professional guidance, resources, and administrative support to facilitate data access and processing tasks. International Transfers: Ensures transfers of personal data to third countries or international organizations occur only where appropriate safeguards, enforceable rights, and effective legal remedies exist. 2.1.2 Information Security Manager The main task of the Information Security Manager is to develop and maintain information security. The responsibilities of the Information Security Manager are as follows: Develops and presents to management the measures required to ensure information security; Leads the implementation of decisions made by management to ensure information security; Supervises the operation of the information security system; Identifies, quantifies, and monitors the types, scale, and impact of operational incidents and errors, taking necessary measures to prevent and resolve them; Prepares regular reports and, as needed, ad hoc reports for management regarding all safety and security management aspects; Collaborates with the Compliance Officer and follows their instructions; Informs data subjects about the information security regulation; Executes the provisions of the information security regulation; Manages risks related to access to systems or services; Ensures the implementation and documentation of security controls; Sets development plans and objectives for the financial year; Monitors the execution of development plans. 2.1.3 Data Protection Officer (DPO) The responsibilities of the Data Protection Officer are as follows: Provides professional information and advice to the data controller, data processor, and employees handling personal data regarding their obligations under applicable data protection law; Supervises compliance with data protection legislation and internal personal data protection regulations by the data controller or processor; Drafts and maintains internal and external data protection policies, information security regulations, objectives, and plans; Assigns responsibilities, raises staff awareness regarding data management operations, conducts staff training, and carries out related audits; Provides professional advice on Data Protection Impact Assessments (DPIAs) upon request and monitors their execution; Cooperates with the competent data protection supervisory authority; Acts as the primary point of contact for the supervisory authority on data management issues and consults with it whenever necessary; Ensures legal and information security requirements are established and met to minimize risk and deploy effective controls across company activities affecting clients; Allocates resources for planning, implementing, supervising, reviewing, and developing legal compliance and information security, taking action to secure necessary resources (e.g., hiring qualified personnel and managing turnover); Oversees risk management processes affecting the organization and its services; Periodically reviews information security regarding suitability, compliance, and effectiveness; Investigates major information security incidents; Ensures external organization access to IT systems is based on formal agreements setting out all necessary legal and security requirements. The Company will continuously assess the necessity and timeliness of designating a Data Protection Officer, deciding whether or not to formally appoint one based on these evaluations. 2.1.4 Employees The primary responsibilities of employees are as follows: Understand and comply with all organizational data protection regulations relevant to their specific role; Report any actual or potential data protection incidents immediately; Contribute to Data Protection Impact Assessments (DPIAs) when required. TEO LUNCH S.R.L.