PRIVACY POLICY

VERSION OF: JUNE 30, 2021

1. ABOUT US

1.1. This Privacy Policy explains how we, Edenred Romania S.R.L., based in Bucharest, 133 Calea Serban Vodă, 4th District, Fiscal Code RO10696741, registered with the Trade Register under no. J40/5659/1998 (hereinafter referred to as “Edenred” or “We/Us”), process your personal data.

2. APPLICABILITY

2.1. We invite you to carefully read this privacy policy in order to be properly informed about the way We, as Data Controllers, process your data and we respect your rights as data subject.

2.2. This policy does not consider the processing carried out by the commercial partners of Edenred. For the processing of your personal data by our partners, acting as controllers, please refer to their policies regarding the processing of personal data.

3. WHAT INFORMATION DO WE COLLECT ABOUT YOU?

We collect your personal data in order to achieve the purposes of Edenred, in accordance with section 4 below.

We do not collect or intend to get in possession of your personal data relating to racial or ethnic origin, political, religious, philosophical or similar beliefs, trade union membership or personal data regarding health or sex life.

3.1. If you visit www.edenred.ro, my.edenred.ro, www.user.myedenred.ro/, econtract.edenred.ro (hereinafter collectively as „Sites”), we will process your personal data that you provide to use directly in the context of using these sites, such as data that you provide when you create an account, in the contact form, in the form for requesting an offer, order form, recommendations form, to the extent you fill in such forms. At the same time, we process the data generated by accessing and using the sites (information about the device being used - computer, phone, tablet - log information, like IP address, searches, type of browser and language used, hardware settings, date and hour of the request), including the data regarding your preferences or other data collected by means of technologies for analyzing the activities of the users on the internet pages (such as cookies; we recommend that you also read our Cookies Policy).

3.2. If you are a contact person on behalf of Partners (Clients, Trade Partners, Suppliers) or of potential Partners, we will process your contact details, like name and surname, email address and phone number, role/function, workplace address, information that you provide in the context of initiating or carrying out the contractual relationship with the Partners or Potential partners. At the same time, we can obtain your contact details within our referral programs, from the visitors of our sites mentioned at section 3.1 or from the users of the MyEdenred mobile application, while making sure that the person supplying the contact details has previously obtained your approval for such an action.

3.3. If you are the legal or conventional representative of one of our corporate clients or partners, we will process your data, such as first and last name, contact details (e-mail address, telephone numbers, etc.), role/function, workplace address, signature, information you provide in the context of starting or during the contractual relationship.

3.4. If you are a beneficiary of paper tickets issued by Edenred, regardless of their type, we will process your personal data required by the legislation in force in order to issue these tickets, respectively the name, surname, personal identification number collected from your employer, information regarding the Trade Partners where you used the tickets. Optionally, for a better communication, you can offer us also your mail or email address or phone number. We will also process any other personal data that you will directly provide (by mail, in writing or by phone).

3.5. If you are a beneficiary of the electronic tickets issued by Edenred, regardless of their type, we will process your personal data required by the legislation in force in order to issue these tickets, respectively the name, surname, personal identification number collected from your employer, information regarding your card (activation code, serial number, PAN, account number, card issuing and expiring date, card’s balance, validity of the tickets uploaded on the card), information regarding the transactions that you performed with the card with the Trade Partners, where you used the tickets, as well as any other data categories that you directly supply in the context of creating a user account or in any other manner that results from using our sites listed under point 3.1. Your employer may share with us your professional email to notify you when your ticket card was loaded. Optionally, for a better communication, you can offer us also your mail or email address or phone number. We will also process any other personal data that you will directly provide (by mail, in writing or by phone).

3.6. If you are an user of MyEdenred application (hereinafter the „Application”), in order to create the user account and enroll the card in the Edenred Pay and Apple Pay payment services, we will process your personal data, respectively first name, last name, email address and access password (the access password will be processed in encrypted form), the identification data of your Edenred card (the series formed of 10 digits on the back of the card and the last digits from the number from the front of the card), city and county of residence. The residence city and county are collected based on the legal provisions regarding fighting money laundering and terrorism financing.

Optionally, at the moment of creating the user account in the application, you can also provide us your mobile phone.

For a better quality of the services provided, within the Application, we will process the history of the transactions carried out, which we will display for a better management of the expenses, card balance, validity of the tickets uploaded on the card, as well as the PIN code, that will be provided after following the steps from a security procedure.

In order to ensure the functionality of the Application, we will process the data regarding the device used (hardware) and the operating system, journal information, as well as the IP address, the date and hour of using the Application, including data on your preferences regarding marketing communications.

3.7. If you are using our chatbot, Felicia, we will process your personal data that you provide in the chat window, to the extent that you write us on chat, such as first and last name, contact details (email address, phone number), specific details regarding your relationship with Edenred and any other data included in your message, based on the type of your request.

3.8. If you contact us through our call center, we will process your personal data such as first and last name, phone number, voice (for calls to call center that will be recorded) and other data that you voluntarily provide, including in cases when you decide to continue our discussion via email or phone messages.

3.9. If you apply as candidate to work at Edenred, by accessing the Available Careers section on the websites or in any other way, we will process your personal data that you provide in this context, such as name, surname, email address, phone number, professional experience, as well as any other data included in the documents that you choose to provide to us.

3.10. If your personal data are collected directly from you, we inform you that you are not usually obliged to provide your personal information. Exceptions are cases where their provision constitutes a legal or contractual obligation, or an obligation necessary for concluding a legal/contractual relationship, or for providing our services. Without providing such data, in certain situations, We will not be able to provide you the selected service.

4. WHAT FOR ARE PERSONAL DATA USED AND WHAT ARE THE LEGAL GROUNDS FOR PROCESSING?

In general, we collect personal data directly from you. However, if you are an employee of our corporate clients, they provide us certain data in order to provide our services.

We may process personal data collected from other sources, such as partners with whom We collaborate, various service providers in the performance of the contract, social networks etc., as well as data transmitted by the devices with which you access our application or sites (phone, laptop, etc.), according to the Cookies Policy. For the event that we do not receive the personal data from you, we shall inform you of their processing within the legal term.

We may use personal data for one or more of the purposes described in this policy. If we subsequently process your personal data for a purpose other than those on which you have already been informed and which are not compatible with the purposes for which your data was originally collected and which was brought to your attention, Edenred shall provide information on that secondary purpose and any relevant additional information.

4.1. If you are a visitor of our site or social networking pages, we process your personal data as follows:

a) for marketing activities, respectively for the transmission, via means of distance communication (e.g. email) of commercial communications regarding the products and services provided by Edenred.

Grounds: We will only send you such communications if we have your approval. You can express your consent for the data processing for this purpose, by filling in and ticking the appropriate box in the commercial communications acceptance form. Providing your data for this purpose is voluntary. Your refusal to provide your consent for the data processing for this purpose will have no consequences to you.

b) for settling claims, complaints and for monitoring traffic, keeping the platform at normal parameters and improving your experience on these sites.

Grounds: Processing your data for this purpose is based on Edenred’s legitimate interest in order to ensure the proper functioning of the sites, as well as to continuously improve the experience of visitors on these sites, including by answering various questions or complaints. In the absence of such data, we will not be able to help you solve the problem you are dealing with.

c) to take security and fraud prevention measures to protect your personal data and services, measures that involve detecting, investigating and solving security and fraud threats. Personal data may be processed as part of security monitoring at the level of applications that we use.

Grounds: The processing of your data for this purpose is based on the Edenred’s legitimate interest in ensuring the proper functioning of the sites, in defending our rights and interests.

4.2. If you are a contact person on behalf of Partners (Clients, Trade Partners, Suppliers) or of potential Partners, Edenred will process your personal data in the following manner:

a) in order to initiate or carry out the contractual relationship between Edenred and Partners or potential Partners.

Grounds: The processing of your data for this purpose is based on the need to conclude and execute a contract, as well as on the Edenred’s legitimate interest to initiate and have contractual relationships for offering the services provided by Us. Your refusal to supply the data for this purpose may have as consequences Edenred’s impossibility to carry out its activity.

b) for marketing activities, respectively in order to send, through means of distance communication (e.g., email), commercial communications regarding the products and services provided by Edenred.

Grounds: The processing of your data for this purpose is based on Edenred’s legitimate interest to send communications addressed to professionals meant to ensure the promotion and development of the Edenred business and, at the same time, to facilitate the access of its clients/partners to services offered by Edenred that could be useful/of interest for their businesses.

c) in order to send by distance communication means (emails and phone) communications regarding the improvement of our services including the functioning of our Applications, possible restrictions due to maintenance work, implementation of new features, new security measures, etc.

Grounds: Because we have a legitimate commercial interest in keeping a connection with our partners in order to improve the products and services we offer, we will send you notices regarding the satisfaction degree about our company (for example, satisfaction surveys related to the orders made) because we are in a contractual relationship with the company you represent and you are the best person for communicating a feedback on the interaction with Edenred.

d) for the marketing activities, respectively in order to send, by distance communication means (e.g., email), commercial communications regarding the products and services provided by Edenred’s partners.

Grounds: For this purpose, we will process your data based on your consent, expressed directly and based on indirect consent, collected through the contract, for the persons who, due to position held, may receive such communications.

4.3. If you are a beneficiary of tickets issued by Edenred, in paper format or on electronic support, we will process your personal data in the following manner:

a) for the contractual relationship between your employer and Edenred, namely in order to issue the tickets, vouchers or cards in accordance with your employer’s order, to send the information regarding the amount debited on your card, to send the information regarding the tickets that expire and the processing of the transactions performed by you, including the functioning of our Applications, possible restrictions due to maintenance work, implementation of new features, new security measures, etc. Also, for the processing of your requests related to accessing/using our products.

Grounds: The processing of your data for this purpose is based on our legitimate interest to provide the services according to the contract concluded between your employer and Edenred, as well as the legal provisions in force, which mention that certain types of tickets must be customized with a name, surname and personal identification number. It is necessary to provide your personal data. The refusal to provide the data may lead to the impossibility of granting the extra salary benefits negotiated with your employer. The refusal to provide contact data (email or phone) means that we will not be able to inform you about the amounts debited on your card or the tickets that expire, however, will not produce any negative consequence regarding the functionality of your products.

b) analyses and statistics regarding the use of our products.

Grounds: Constant improvement of the quality of our products and services is our concern. Based on our legitimate interest, we use the data that we collect from you or other data that we generate/derive from the data we receive from you or resulting from the use of our products for various statistics, analyses and studies. When carrying out statistical analyses on the use of our products and services, the data analyzed are strictly protected and the aggregated results are used internally or may be communicated to partner merchants on the basis of an existing contractual relationship in this respect, without allowing the identification of data subjects and by complying with the applicable legal requirements.

c) for sending messages having as purpose the improvement of services (surveys or questionnaires).

Grounds: Because we want you to have an interaction as good as possible with our products and services, based on our legitimate interest, we will use your data (email and phone), as user of our products or obtained in any other context when you made these data available to our company representatives, to ask your opinion on our products quality. We will never ask more than your feedback regarding the use of our products and we will use your answers to make our products and services easier and more efficient to use.

d) direct marketing and other commercial communications.

Grounds: We will send these communications if we have your approval. We would like to keep you informed with legislation news for Edenred’s solutions and services, regarding our products and those of our partners. We will be able to send promotional materials in order to inform you about our products and those of our partners. Additionally, we will invite you to attend events, participate at promotions or campaigns carried out by Edenred independently or in collaboration with one or several of our partners and we will communicate other similar information that we consider to be of interest to you. Providing your data for this purpose is voluntary. Your refusal to provide the data for this purpose will have no consequences for you.

e) creating profiles in order to personalize promotional offers.

Grounds: Edenred may segment its own users depending on several criteria in order to classify them in different categories for marketing and/or analysis purposes. The processing of your data for this purpose is based on our legitimate interest. These profiles do not imply exclusively automatic decision making. We want to provide products and services that are as relevant as possible, in accordance with your profile and area of interest. That is why we can analyze data and information about you from the following sources: (i) data collected following your interaction with our sites in section 3.1; (ii) data regarding the use of our products obtained from different sources: data provided by you, data obtained from the corporate customers’ orders, transactions history and behavior, data resulting from using our sites or the MyEdenred mobile application.

f) to fulfil legal obligations.

Grounds: We have certain legal obligations that involve the processing of personal data, such as:

• i) for certain products, we have specific obligations related to preventing and fighting money laundering and financing terrorism, and that is why we will carry out activities in order to get to know our clients and any other operations required by law;
• ii) taxes payment and other relevant charges, reporting to the relevant fiscal authorities and maintaining accounting books (e.g., when you participate in a competition organized by Us and you win prizes subject to taxes);
• iii) archiving the data according to the legislation in force.

g) ascertaining, exercising or defending a legal right during a procedure before a court of law, of an administrative procedure or any other formal proceedings involving Edenred, and for settling your requests, claims or complaints.

Grounds: The processing of your data for this purpose is based on our legitimate interest to defend our rights and interests.

h) creating user accounts in MyEdenred application and card enroll in Edenred Pay and Apple Pay payment services.

Grounds: Because we want to offer the most modern and easiest ways to make payments, you can pay with your card by using your mobile phone. The processing of your data is based on your consent. This may be withdrawn at any moment, without affecting the processing carried out up to that moment.

4.4. If you are a user of MyEdenred application, we will process your personal data as follows:

a)in order to carry out services for functioning of Edenred cards (user account activation, card activation, view transaction history, debiting, balance, amounts that expire, PIN remembering, card blocking in case of theft or loss, suggestions and complaints), services including the functioning of our Applications, possible restrictions due to maintenance work, implementation of new features, new security measures, etc. and to process your requests regarding accessing/using our products.

Grounds: The processing of your data for this purpose is based on the contract concluded between you and Edenred, more specifically the Terms and Conditions of the Application, and to comply with certain legal requirements provided by the legislation on granting value tickets, which mentions that we must ensure you the access to the amount available or to block the card, and providing your personal data is necessary in order to use the services within the Application.

b) analyses and statistics regarding the use of our products.

Grounds: Constant improvement of the quality of our products and services is our concern. Based on our legitimate interest, we use the data that we collect from you or other data that we generate/derive from the data we receive from you or resulting from the use of our products for various statistics, analyses and studies. When carrying out statistical analyses on the use of our products and services, the data analyzed are strictly protected and the aggregated results are used internally or may be communicated to partner merchants on the basis of an existing contractual relationship in this respect, without allowing the identification of data subjects and by complying with the applicable legal requirements.

c) advertising, marketing and publicity, promotion activities of the for products and services offered by Edenred and its partners, carrying out promotional campaigns, sending newsletters.

Grounds: The processing of your data for this purpose is based on your consent. When you create your user account, you can opt to receive commercial communications from us, to improve your shopping experience and to help you benefit from advantageous offers from our third-party. You may choose to receive news and offers by various means of communication (email, SMS or push notifications on the mobile phone), having in mind that you can change your preferences anytime in „Settings” section.

d) creating profiles in order to personalize promotional offers.

Grounds: Edenred may segment its own clients depending on several criteria in order to classify them in different categories for marketing and/or analysis purposes. The processing of your data for this purpose is based on our legitimate interest. These profiles do not imply exclusively automatic decision making. We want to offer you products and services as relevant as possible, in accordance with your profile and area of interest. That is why you may receive various personalized commercial communications from us, to improve your shopping experience and to help you benefit from advantageous offers from our third-party partners. The promotional offers from our partners presented within the Application may be general or personalized. The general promotional offers displayed within the Application do not involve personal data processing, as a result they will be displayed to all the users of the Application. The customization of the offers will be carried out depending on one or several from the following criteria: residence county/city, gender, age, shopping habits resulting from your transactions made with Edenred cards, displayed in the Application. You shall receive personalized commercial communications from us or our partners only if you have given your consent for news and offers, according to section 4.4 let. c) above.

e) to fulfil legal obligations

Grounds: We have certain legal obligations that imply the processing of personal data, such as specific obligations regarding preventing and fighting money laundering and terrorism financing, reporting to the relevant fiscal authorities and keeping accounting records.

f) ascertaining, exercising or defending a legal right during a procedure before a court of law, of an administrative procedure or any other formal proceedings involving Edenred, and for settling your requests, claims or complaints.

Grounds: The processing of your data for this purpose is based on our legitimate interest to defend our rights and interests.

g) for sending messages having as purpose the improvement of services (surveys or questionnaires).

Grounds: Because we want you to have an interaction as good as possible with our products and services, based on our legitimate interest, we will use your data (email and phone), as user of our products or obtained in any other context when you made these data available to our company representatives, to ask your opinion on our products quality. We will never ask more than your feedback regarding the use of our products and we will use your answers to make our products and services easier and more efficient to use.

4.5. If you request details through Felicia chatbot or our call center, we will process your personal data to solve your requests and complains, and to improve your experience.

Grounds: The processing of your data for this purpose is based on the Edenred’s legitimate interest to reply to your requests, as well as to constantly improve our visitors and users experience, including through answering different questions or complaints. In the absence of such data, we will not be able to help you solve the problem you are experiencing.

4.6. If you apply as candidate to work for Edenred, we will process your personal data through the “Careers” section on the sites for the purpose of recruitment.

Grounds: processing of your data for this purpose is carried out upon your request to conclude a contract. In the event in which you apply for a certain position, but you are not selected for the position for which you have applied, we will continue to process your data based on our legitimate interest to take you into account for other vacant positions similar to the ones for which you initially applied, except for the situation in which you will request for your personal data not to be processed to this regard.

The provision of your data is voluntary. Your refusal to supply the data can have as consequence Edenred’s impossibility to consider you during the recruitment process for different positions.

5. TO WHOM DO WE DISCLOSE YOUR DATA?

5.1. On a case by case basis, we can disclose your personal data, exclusively for the processing purposes to:

• a) the companies that are part of the Edenred Group;
• b) our service suppliers (acting as controllers, or as our processors) and which we contract for the administrative and processing services of our transactions, for marketing, other services suppliers (e.g., the company producing cards, suppliers of payment services, courier companies, suppliers of IT services);
• c) market research agencies carrying out market studies for Us;
• d) other companies with which we can develop joint offer programs for our products and services on the market;
• e) public authorities, if the disclosure is necessary in order to comply with an obligation provided by the applicable legislation;
• f) your employer, Edenred commercial partner, upon its request;
• g) courts or arbitral tribunals, as well as competent authorities to investigate criminal acts.

5.2. As a rule, the transmission of your personal data to the abovementioned recipients will be done only based on a commitment of confidentiality and a commitment of ensuring the adequate level of security by such recipients, guaranteeing that personal data are kept safe and that their transmission is carried out in accordance with the legislation in force.

6. PERSONAL DATA TRANSFER

6.1. The personal data provided to Us can be transferred outside of Romania, but only to European Union states.

6.2. In exceptional cases, like payments made from the mobile phone, if Edenred transfer your personal data can to a third country (outside the European Union) or an international organization, to sub-processors, we shall ensure that they are adequately protected, respectively that we transmit data to a country that provides an adequate level of protection as assessed by the European Commission, or if the respective country is considered not to have laws equivalent to EU data protection standards, we shall ask the third party to conclude a legally binding contract/agreement/instrument that reflects such standards or to provide other appropriate safeguards in this regard (such as standard contractual clauses issued by the European Commission for transferring personal data to third countries).

6.3. You may request a list of recipients from third countries, as well as a copy of the agreed provisions that ensure an adequate level of protection of personal data, by e-mailing at gdpr-ro@edenred.com.

7. DURATION OF THE PROCESSING

7.1. In general, we will process your personal data as much as it is necessary for the processing purposes mentioned above (including by applicable laws), except for the situations in which the legal provisions foresee or oblige otherwise. Therefore, personal data will be stored:

• during the contract/legal relationship between Us and your employer for the personal data necessary for its execution, when you are the representative of an employer/corporate client or potential corporate client; in certain specific cases, in accordance with Edenred’s internal policies, we may keep your data for an additional period that is reasonably necessary to exercise or protect our rights in connection with the products/services offered and the personal data processed;
• in regards to issuing electronic or paper tickets, during the contractual relationship with your employer; in certain specific cases, according to Edenred’s internal procedures, we may keep your data for an additional period that is reasonably necessary to exercise or protect some of our rights about the products/services offered and the personal data processed;
• as long as your user account is active, created on the sites indicated in section 3.6, and subsequently for the period necessary to evidence the operations carried out through the user account. If you are a beneficiary of our products or a contact person for one of the Partners (Corporate Client or Partner Merchant) and you choose to deactivate your user account, Edenred will consider such an action as your option to unsubscribe from receiving commercial communications through which we keep you updated about our products and services. Consequently, if you choose to deactivate your user account, we will not send communications of this type anymore. However, we would like to inform you that disabling your account will not automatically delete your personal data. If you want Us stop processing your personal data or if you want your data deleted, you may exercise your rights detailed under section 8 below;
• up to one year for messages where you ask for details or support through our chatbot, email, post, dedicated support forms or our call center, regardless that your request came by electoronic or mail means, in writting or audio;
• for the period while subscription to receiving commercial communications from Edenred or its partners is active; once we receive your unsubscribe request, we shall stop sending such communications to your email address or phone number;
• during the period necessary to provide answers to your messages and requests and prove the correspondence with you, for the contact form and the form to request a customized offer;
• during the period necessary to process clients’/merchants’ referral programs and prove your participation to these programs;
• regarding jobs application through our “Careers” section, in the event we will not proceed with these applications, your data will be kept in the Edenred data base in order to participate in recruitment programs that will be carried out in the future, but not more than one year since being collected;
• up to 3 years for performing analysis regarding the navigation on our sites and your interactions with our sites;
• for the duration provided for by law in situations where there are applicable legal provisions in this respect (e.g. in case of mandatory accounting books and supporting documents underlying financial accounting records, such as invoices issued by Edenred).

7.2. Any data may be retained by Us, as an exception to the previous provisions, where applicable, for the legal prescription period, where Edenred would have a legitimate interest to retain certain personal data for potential disputes that might arise between the parties, for example for the possible liability of Edenred or of the person whose data is processed.

7.3. Edenred may delete all your personal data when it considers that it is no longer necessary for the purposes for which it was collected.

7.4. In any case, if you withdraw your consent and there are no legal grounds for processing, or you oppose the processing and there are no legitimate reasons for the processing that would prevail, we will stop processing your data.

8. YOUR RIGHTS

8.1. Regarding the data processing, you have the right of access to your personal data (you have the right to obtain from Edenred the confirmation that it processes your personal data, as well as information regarding the processing), rectification (modification) or deletion of data or restricting the processing, the right to oppose to processing within the limits and conditions provided by law, as well as the right to data portability (you have the right to request us to provide the personal data in a structured, commonly used and machine-readable format that can be automatically read, for example, in Excel). Also, if you choose to give your consent, you have the right to withdrawn at any moment, without affecting the processing carried out by Edenred based on the consent provided by you before your consent withdrawal. Furthermore, you have the right to submit complaints to the National Authority for the Surveillance of Personal Data Processing: 28-30 G-ral. Gheorghe Magheru Blvd., 1st District, 010336, Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.

8.2. When we receive a request from you to exercise any of your rights, we may ask for additional information to verify your identity before acting on the request.

8.3. If you send us a request by electronic means to exercise your rights, our reply will also be provided by electronic means, where possible, unless you have requested a different format.

8.4. We will try to respond promptly to any request from you and, in any situation, within the time limits specified by the applicable legal provisions (usually 30 days after the request has been registered). In certain situations, expressly provided by the applicable law, we may charge you for the access request that will consider the administrative costs necessary to solve your request.

8.5. For any additional questions regarding this Privacy Policy or how we process your personal data, and to exercise your rights indicated above, please contact us through the dedicated form on our sites. You can also submit a customized request, signed and dated, containing your personal data that you would like us to updated or deleted, to our post addresses, to the DPO attention: Edenred Headquarters in Bucharest, 133 Calea Şerban Vodă, 4th District, 040205 Bucharest. Monitoring the compliance with the legal requirements in this area is exclusively ensured by the DPO appointed for Edenred Group.

9. UPDATING THIS POLICY

9.1. Edenred may periodically update this Policy without prior notice as the activity and services provided by Us expand or change or if Edenred is required under the law to make amendments. If Edenred proceeds as such, the latest version shall be displayed on the sites. Therefore, please check periodically if such updates exist. If Edenred makes major amendments to the practices states in this Policy, we shall notify you by using the available contact details.