PRIVACY POLICY

VERSION OF: FEBRUARY 2025

1. WHO ARE WE

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") explains how we, Edenred Romania S.R.L., located in Bucharest, Calea Șerban Vodă 133, sector 4, CUI RO10696741, registered with the Trade Register under no. J40/5659/1998 (hereinafter referred to as "Edenred" or "We"), process your personal data. The Data Protection Officer can be contacted at the email address gdpr-ro@edenred.com. You can also send us written requests to the above postal address.

2. APPLICABILITY

2.1. We invite you to read this Policy carefully to be adequately informed about how we, as a personal data controller, collect, use, and store your data, to whom we distribute it, and to present how we respect the rights you have as a data subject

2.2. This Policy applies only to the processing activities carried out by Edenred and is supplemented by the Terms and Conditions and the Cookie Policy. This Policy does not cover the processing carried out by Edenred's business partners. For information on how your personal data is processed by our business partners, as controllers, please refer to their personal data processing policies.

3. WHAT INFORMATION DO WE COLLECT ABOUT YOU AND HOW DO WE COLLECT IT?

We collect your personal data to fulfill Edenred's purposes, as outlined in section 4 below.
Generally, we collect personal data directly from you. We may also process personal data collected from other sources, such as your employer or the authorities responsible for managing social programs under which certain cards are issued, from partners we collaborate with, various service providers in the execution of the contract, social networks, etc., as well as data transmitted by the devices you use to access our websites or application (phone, laptop, etc.), in accordance with the Cookie Policy. If we do not receive personal data directly from you, we will inform you within the legal timeframe about the processing of such data.

When personal data is collected directly from you, we inform you that, generally, you are not obliged to provide your personal information. Exceptions include cases where providing such information constitutes a legal or contractual obligation, or an obligation necessary for entering into a legal/contractual relationship, or for providing our services. Without providing this data, in certain situations, we may not be able to offer you the requested service.
If you provide us with personal data belonging to other individuals (e.g., colleagues), you are responsible for obtaining their prior consent for disclosing their data to us.

3.1. If you are a visitor to www.edenred.ro, my.edenred.ro, or our social media pages (collectively referred to as "Sites"), we will process the personal data you provide directly in the context of using these Sites, such as the data you provide when creating an account, in the contact form, the request for a quote form, the order form, the recommendations form, to the extent that you complete such forms. We also process data generated by accessing and using the Sites (information about the device used, such as: computer, phone, tablet, and log information, such as IP address, search queries, browser type, its language, hardware settings, date and time of the request), including data regarding your preferences or other data collected through user activity analysis technologies on the web pages (such as cookies; we recommend you also read the Cookie Policy).

3.2. If you are interested in our services, specifically in the pre-contractual stage, and request a demo or additional details, we will process the data you provide in the contact form or the demo request form, to the extent that you complete such forms, such as your name, surname, contact details (email address, phone number), and other data included in your message.

3.3. If you are a contact person for Partners (Clients, Merchant Partners, Suppliers) or potential Partners, we will process your contact details, such as name and surname, email address and phone number, position/job title, workplace address, and information you provide in the context of initiating or conducting the contractual relationship with Partners or potential Partners. We may also obtain your contact details through our referral programs, from visitors to our sites mentioned in section 3.1, or users of the MyEdenred mobile application; the person who provides us with your contact details is responsible for obtaining your prior consent for such an action.

3.4. If you are the legal or conventional representative of one of our clients or partners, legal entities, we will process your data, such as name and surname, email address and phone numbers, position/job title, workplace address, signature, username and password for the Eon application (the access password will be processed in encrypted form), voice (if you call us or are called through our Call Center), as well as information you provide in the context of initiating or conducting the contractual relationship.

3.5. If you are a beneficiary of vouchers issued by Edenred on paper, regardless of their type, we will process your personal data required by the current legislation for issuing these vouchers, namely your name, surname, and personal identification number collected through your employer, as well as information regarding the Merchant Partners where you used the vouchers. Additionally, for better communication, you may optionally provide us with your email address, postal address, or phone number. We will also process any other personal data you provide directly (through written or phone correspondence).

3.6. If you are a beneficiary of vouchers issued by Edenred on electronic support, regardless of their type, we will process your personal data required by the current legislation for issuing these vouchers, namely your name, surname, and personal identification number collected through your employer, information about your card (card activation code, card series, PAN, account number, card issuance and expiration date, card balance, validity of the vouchers loaded on the card), information regarding the transactions you make with the card at Merchant Partners where you used the vouchers, as well as any other categories of data you provide directly in the context of creating a user account or in any other way resulting from the use of our sites listed in section 3.1. It is possible that you or your employer provide us with your professional email address and phone number to notify you when your card has been loaded. We will also process any other personal data you provide directly (through written or telephone correspondence).

3.7. If you are a user of the MyEdenred application (hereinafter referred to as the "Application") or virtual cards, for the purpose of creating the account and enrolling the card in payment services (such as Apple Pay, Google Pay, etc.), we will process your personal data represented by your name, surname, email address and access password (the access password will be processed in encrypted form), mobile phone number, identification data of your Edenred card (the 10-digit series displayed on the back of the card and the last digits of the number displayed on the front of the card), city and county of residence. The city and county of residence are collected based on legal provisions related to combating money laundering and terrorist financing.

3.8. For better quality of the services offered, within the Application we will process the history of transactions made, which we will display to you for better expense management, card balance, validity of the vouchers loaded on the card, as well as the PIN code, which we can remind you of after following a security procedure.

3.9. To ensure the functionality of the Application, we will process your data related to the device used (hardware) and the operating system, log information such as IP address, date and time of application use, including data regarding your preferences related to marketing communications.

3.10. To ensure the security of the Application, and to implement technical security measures for your credentials and personal data, for your authentication and identification, we will process your name, surname, email address, access password (the access password will be processed in encrypted form), and mobile phone number. Refusal to provide/validate your mobile phone number will result in the inability to securely complete the correct user identification process and, therefore, will lead to the inability to authenticate and access the account, including access to virtual cards. Please note that the functionality of physical cards is not affected by the refusal to provide the data mentioned in this paragraph.

3.11. If you use our chatbot, Felicia, we will process the personal data you provide in the chat window, to the extent that you offer such data, such as name, surname, contact details, specific details regarding your relationship with Edenred, and other data included in your message, depending on the type of request.

3.12. If you contact us through our call center, we will process your personal data such as name, surname, phone number, voice (for call center calls that will be recorded), personal identification number (for the purpose of validating your identity for certain operations), and other data you voluntarily provide, including when you decide to continue our conversation via email or messages sent by phone.

3.13. If you apply for a position within Edenred, we will process the personal data you provide in this context, such as name, surname, email address, phone number, address, country of residence, information regarding professional experience, tenure in the current position, information regarding education, diplomas, certifications, profile on a professional social network, salary expectations, recruiter’s evaluation of the responses provided by the candidate during the interview, voice and image (during online interviews, for example via Teams/Zoom platforms), as well as any other data and information contained in the CV/cover letter and documents you choose to provide.

We do not collect nor intend to possess personal data regarding racial or ethnic origin, political, religious, philosophical beliefs or similar, trade union membership, personal data regarding health or sexual life, biometric data for the unique identification of a natural person, or data related to criminal convictions and offenses or related security measures, except in situations expressly provided by law. Users of Our Application can opt for access to the Application based on biometric authentication previously performed on the device on which the Application is installed (through fingerprint recognition and facial recognition), but Edenred does not collect the biometric data used for device authentication and does not process them in any way.

The websites and the Application are not intended for minors. We collect and process personal data of minors when this data is provided to us by the holder of parental responsibility for the minor during the use of our services.
If you are a beneficiary of social programs under which you receive social vouchers, we process the vulnerable category you belong to, in accordance with the regulations in force.

4. WHAT FOR ARE PERSONAL DATA USED AND WHAT ARE THE LEGAL BASES FOR PROCESSING?

We may use your personal data for one or more of the purposes described in this policy. If we subsequently process personal data for a purpose other than those you have already been informed about and which is not compatible with the purposes for which your data was initially collected and communicated to you, Edenred will provide information regarding the respective secondary purpose and any additional relevant information.

4.1. If you are a visitor to Our Websites, we process your personal data as follows:

a)    For marketing activities, specifically for sending commercial communications regarding products and services offered by Edenred and our partners through remote communication means (e.g., email, phone, or SMS). 
Legal basis: We will send these communications only if we have obtained your consent. You can express your consent for data processing for this purpose by completing and checking the appropriate box in the form for consent regarding commercial communications. Providing your data for this purpose is voluntary. Refusal to provide consent for data processing for this purpose will not have any consequences for you.
b)    For resolving complaints, claims, and for monitoring traffic and improving your experience on these Websites. 
Legal basis: The processing of your data for this purpose is based on Edenred's legitimate interest in ensuring the proper functioning of the Websites and the Application, as well as in continuously improving the experience of visitors to these Websites, the Application, and social media pages, including by resolving various questions or complaints. Without this data, we will not be able to assist you in resolving the issue you are encountering.
c)    To undertake security measures and fraud prevention, to protect your personal data, our services, and our websites, measures that involve detecting, investigating, and resolving security threats and fraud. Personal data may be processed as part of monitoring the security of the IT applications we use. 
Legal basis: The processing of your data for this purpose is based on Edenred's legitimate interest in ensuring the proper functioning of the websites and defending our rights and interests.

4.2    If you are a contact person of Partners (Clients, Merchant Partners, Suppliers) or potential Partners, we process your personal data as follows:

a)    For initiating or conducting the contractual relationship between Edenred and Partners or potential Partners. 
Legal basis: The processing of your data for this purpose is based both on the necessity of concluding and executing a contract and on Edenred's legitimate interest in initiating and conducting contractual relationships in the context of providing our services. Refusal to provide data for this purpose may result in Edenred being unable to conduct its business.
b)    For marketing activities, specifically for sending commercial communications regarding products and services offered by Edenred through remote communication means (e.g., email, phone, SMS). 
Legal basis: The processing of your data for this purpose will be based on Edenred's legitimate interest in sending communications addressed to professionals aimed at promoting and developing Edenred's business and facilitating access for its clients/partners to Edenred's services that may be useful/interesting for their businesses.
c)    For sending communications via remote communication means (email, phone, SMS) regarding the improvement of our services, including the functioning of our Applications, any restrictions due to maintenance work, the implementation of new functionalities, new security measures, etc. 
Legal basis: Because we have a legitimate commercial interest in maintaining a connection with our partners to improve the services and products we offer, we will send you communications related to your satisfaction with your relationship with our company (e.g., satisfaction surveys related to orders placed), as we are in a contractual relationship with the company you represent, and you are the most suitable person to provide us with feedback regarding your interaction with Edenred.
d)    For marketing activities, specifically for sending commercial communications regarding products and services offered by Edenred and Edenred partners through remote communication means (e.g., email, phone, SMS). 
Legal basis: For this purpose, we will process your data based on one of the following legal grounds, as applicable:
•    Your consent, expressed directly, for the purpose of promoting products and services offered by Edenred, if you are the contact person of a potential Partner;
•    Our legitimate commercial interest in sending commercial communications to our Partners to promote Edenred's products and services, if you are the contact person of an Edenred Partner to whom we offer Edenred products and services similar to those promoted through commercial communications;
•    Your consent, expressed directly, for the purpose of promoting products and services offered by Edenred Partners, if you are the contact person of an existing or potential Edenred Partner.

4.3    If you are a beneficiary of vouchers issued by Edenred, either on paper or electronic support, we will process your personal data as follows::
a)    For conducting the contractual relationship between your employer and Edenred, specifically for issuing vouchers, tickets, or cards according to your employer's order, for sending notifications regarding fund loads on your card, for sending notifications about expiring vouchers, and for processing transactions made by you, including notifications regarding the functioning of our Applications, any restrictions due to maintenance work, the implementation of new functionalities, new security measures, etc. Additionally, for processing your requests related to accessing/using our products. 
Legal basis: The processing of your data for this purpose is based on providing services according to the contract concluded with Edenred under the terms and conditions that govern access to and use of the MyEdenred application, as well as the legal provisions in force that specify that certain extra-salary services (e.g., cultural vouchers, meal vouchers, holiday vouchers, social vouchers) must be personalized with name, surname, and personal identification number. Providing your personal data is necessary for this purpose. Refusal to provide the data may result in the inability to grant the extra-salary benefit negotiated with your employer. Refusal to provide contact details (email and phone) will result in the inability to access and use the MyEdenred application and virtual cards, but it will not have any negative consequences regarding the functionality of our products in physical format.
 b) Analysis and statistics regarding the use of our products.
Legal basis: We are concerned with the continuous improvement of the quality of our products and services. Based on our legitimate interest, we use the data we collect from you or other data we generate/deduce from the data received from you or resulting from the use of our products for various statistics, analyses, and studies. When we conduct statistical analyses of the use of our products and services, the analyzed data is strictly protected, and aggregated results are used internally or may be communicated to business partners based on an existing contractual relationship in this regard, without allowing the identification of the data subjects and in compliance with applicable legal requirements.
 c) For sending messages aimed at improving services (opinion surveys or questionnaires).
Basis: Because we are concerned that you have the best possible interaction with our products and services, based on our legitimate interest, we will use your data (email and phone), as a user of our products or obtained in any other context in which you provided this data to our company representatives, to ask for your opinion regarding the quality of our products. We will never ask for more than your feedback regarding the use of our products and will use your responses to make our products and services easier and more efficient to use.
d) Direct marketing and other commercial communications.
Basis: We will send you these communications only if we have obtained your consent. We want to keep you informed about news regarding the legislation underlying Edenred's solutions and services, as well as our products and those of our partners. With your consent, we may send you promotional materials to inform you about our products or those of our partners. Additionally, we may invite you to participate in events, promotions, and campaigns conducted by Edenred independently or in collaboration with one or more partners and to communicate other similar information that we believe may be of interest to you. Providing data for this purpose is voluntary. Refusing to provide data for this purpose will not have consequences for you.
e) Creating profiles for the purpose of personalizing promotional offers.
Basis: Edenred may segment beneficiaries based on multiple criteria to classify them into various categories for marketing and/or analytical purposes. Processing your data for this purpose is based on legitimate interest. These profiles do not involve solely automated decision-making. We want to offer you the most relevant products and services, in accordance with your profile and area of interest. Therefore, we may analyze data and information about you from the following sources: (i) data collected from your interaction with our websites mentioned in point 3.1; (ii) data regarding the use of our products obtained from various sources: data provided by you, data obtained from orders placed by customers, transaction history and behavior, data resulting from the use of our websites or the MyEdenred mobile application.
f) Fulfilling legal obligations.    
Basis: We have certain legal obligations that involve the processing of personal data, such as:
• For certain products, we have specific obligations related to the prevention and combating of money laundering and terrorist financing, which is why we will carry out customer due diligence operations and any other operations required by law;
• Payment of taxes and relevant contributions, reporting to the relevant tax authorities, and maintaining accounting records (for example, when you participate in a contest organized by us and win prizes that are subject to taxation);
• Archiving data in accordance with applicable legislation.
g) For establishing, exercising, or defending a right in court in the context of a procedure before a court, an administrative procedure, or other official procedures involving Edenred, as well as for resolving your requests, complaints, or claims.
Basis: Processing your data for this purpose is based on our legitimate interest in defending our rights and interests.
h) For enrolling the card in Edenred Pay and Apple Pay payment services.
Basis: Because we want to offer you the most modern and convenient ways to make payments, you can pay with your card via your mobile phone. Processing your data in this regard is based on your consent. This can be withdrawn at any time by deleting the data from the application or by uninstalling it, without affecting the processing carried out until the withdrawal.

4.4    If you are a user of the MyEdenred application, we will process your personal data as follows::
a)    To provide services related to the operation of Edenred cards (account activation, authentication, card activation, transaction history viewing, top-ups, balance, amounts that expire, PIN reminders, card blocking in case of theft or loss, suggestions and complaints), including information regarding the operation of the application, any restrictions caused by maintenance work, implementation of new functionalities, new security measures, as well as any other information regarding the use of services and for processing your requests related to accessing/using our products.
Basis: The processing of your data for this purpose is based on the contract between you and Edenred, specifically the Terms and Conditions of the application, and compliance with legal requirements provided by the legislation regarding the issuance of value vouchers, which states that we must ensure your access to the available balance or to block the card, and providing your personal data is necessary for using the services within the application.
b)    Analyses and statistics regarding the use of our products.
Basis: We are committed to the continuous improvement of the quality of our products and services. Based on our legitimate interest, we use the data we collect from you or other data we generate/deduce from the data received from you or resulting from the use of our products for various statistics, analyses, and studies. When we conduct statistical analyses of the use of our products and services, the analyzed data is strictly protected, and aggregated results are used internally or may be communicated to business partners based on an existing contractual relationship in this regard, without allowing the identification of the data subjects and in compliance with applicable legal requirements.
c)    Advertising, marketing, and publicity, activities to promote Edenred's products and services and those of its partners, conducting promotional campaigns (via email or SMS), sending newsletters (informational bulletins).
Basis: The processing of your data for this purpose is based on your consent. When you create your account, you can choose to receive various commercial communications from us to enhance your shopping experience and help you benefit from advantageous offers from our partners. You can choose to receive news and offers through various means (email, SMS, or push notifications on your mobile device), with the clarification that you can change your option at any time in the "Settings" section.

d)    Creating profiles for the purpose of personalizing promotional offers.
Basis: Edenred may segment beneficiaries based on various criteria to classify them into different categories for marketing and/or analytical purposes. The processing of your data for this purpose is based on legitimate interest. These profiles do not involve making solely automated decisions. We want to offer you the most relevant products and services according to your profile and area of interest, which is why you may receive various personalized commercial communications from us to enhance your shopping experience and help you benefit from advantageous offers from our partners. The promotional offers from our partners presented within the application may be general or personalized. General promotional offers displayed within the application do not involve the processing of personal data, therefore they will be displayed to all users of the application. The personalization of offers will be based on one or more of the following criteria: county/city of residence, gender, age, purchasing habits resulting from your transactions made with Edenred cards, displayed in the application. You will receive such personalized commercial communications from us or from our partners only if you have given your consent to receive news and offers, as described in point 4.4 letter c).
e)      Fulfillment of legal obligations.
Basis: We have certain legal obligations that involve the processing of personal data, such as specific obligations related to the prevention and combating of money laundering and terrorist financing, reporting to relevant tax authorities, and maintaining accounting records.
f)    To ascertain, exercise, or defend a right in court in the context of a procedure before a court, an administrative procedure, or other official procedures in which Edenred is involved, as well as to resolve your requests, complaints, or claims.
Basis: The processing of your data for this purpose is based on our legitimate interest in defending our rights and interests.
g)    To send messages aimed at improving services (surveys or questionnaires).
Basis: Because we are concerned that you have the best possible interaction with our products and services, based on our legitimate interest, we will use your data (email and phone) as a user of our products or obtained in any other context in which you provided this data to our representatives, to ask for your opinion regarding the quality of our products. We will never ask for more than your feedback regarding the use of our products, and we will use your responses to make our products and services easier and more efficient to use.
h)    To improve the experience by identifying nearby merchants (geolocation).
Basis: We will return the list of nearby partners only with your consent expressed by selecting the option to activate the device's location

4.5    If you request details through the Felicia chatbot or our call center, we will process your personal data to address your requests, complaints, and to improve your experience.
Basis: The processing of your data for this purpose is based on Edenred's legitimate interest in responding to your requests, as well as in continuously improving the experience of visitors and users, including by addressing various questions or complaints. Without this data, we will not be able to assist you in resolving the issue you are facing.
    
4.6    If you apply for a job at Edenred as a candidate, we will process the personal data received through the "Careers" section of www.edenred.ro or through other dedicated platforms for recruitment purposes.
Basis: The processing of your data for this purpose is based on your consent. If you apply for a specific position but are not selected for the position you applied for, we will continue to process your data based on our legitimate interest in considering you for other similar vacant positions for which you initially applied, unless you request that your personal data no longer be processed for this purpose.
Providing your data for this purpose is voluntary. Refusing to provide the data may result in Edenred's inability to consider you in the recruitment process for various positions.

4.7    If you visit one of our premises, we will process your image through video cameras (CCTV).
Basis: The processing of your data for this purpose is based on Edenred's legitimate interest in protecting the safety of individuals within the premises (employees, visitors, collaborators, etc.), safeguarding the company's and individuals' property, as well as investigating potential disputes that may arise.

4.8    If you participate in competitions organized by Edenred, we will process the personal data specified in the participation forms, such as card serial number, phone number, and email address, to validate your registration for the competition, and, if you are declared a winner, to validate your participation and award the prize.
Basis: The processing of your data for this purpose is based on your consent. Participation in competitions is conducted in accordance with the Terms and Conditions specified in the competition regulations.

5. TO WHOM DO WE DISCLOSE YOUR DATA?

On a case-by-case basis, we may transmit/provide access/disclose your personal data, to the extent necessary, exclusively for fulfilling the processing purposes, to the following categories of persons/entities:
• Companies within the Edenred Group;
• Our service providers (acting either as operators or as authorized persons on our behalf) that we contract for administrative services and transaction processing, marketing, and other service providers (e.g., card production companies, payment service providers, courier companies, IT service providers);
• Market research agencies conducting market studies for us;
• Other companies with which we may develop joint market offering programs for our products and services;
• Public authorities, if disclosure is necessary to comply with a legal obligation under applicable law;
• Your employer, an Edenred business partner, at their request;
• Courts or arbitration bodies, as well as authorities competent to investigate criminal offenses.
5.1    As a rule, the transmission of your personal data to the aforementioned recipients will be done only based on a confidentiality commitment and assurance of an adequate level of security on their part, ensuring that personal data is kept secure and that its transmission is carried out in accordance with applicable law.

6. PERSONAL DATA TRANSFER

6.1. The personal data provided to us may be transferred outside of Romania, but only to countries within the European Union.
6.2. In exceptional cases, such as in the case of mobile electronic payments, if we transfer your personal data to a third country (outside the European Union) or to an international organization, we will ensure that it is adequately protected by implementing appropriate technical and organizational measures. Specifically, we will only transfer data to a country that provides an adequate level of protection according to the assessment by the European Commission, or if it is deemed that the country does not have laws equivalent to EU data protection standards, we will require the third party to enter into a legally binding contract/agreement/instrument that reflects these standards or to provide other adequate guarantees in this regard (such as the standard contractual clauses issued by the European Commission for the transfer of personal data to a third country).
6.3. You can request a list of recipients in third countries, as well as a copy of the agreed provisions that ensure an adequate level of protection for personal data, at the email address gdpr-ro@edenred.com.

7. RETENSION PERIOD

7.1. In general, we will process your personal data only as necessary to achieve the processing purposes mentioned above (including in accordance with applicable laws or regulations), except in cases where legal provisions provide otherwise or require us to do so. Thus, personal data will be retained:
•    for the duration of the contract/legal relationship between us and your employer for the personal data necessary for its execution, in the case where you are a representative of an employer/client or potential client; in certain specific cases, according to Edenred's internal policies, we may retain your data for an additional reasonable period necessary to exercise or defend our rights related to the products/services offered and the processed personal data;
•    regarding the issuance of tickets on electronic or paper support, for the duration of a contractual relationship with your employer; in certain specific cases, according to Edenred's internal policies, we may retain your data for an additional reasonable period necessary to exercise or defend our rights related to the products/services offered and the processed personal data;
•    for the duration of the online accounts you create on our websites mentioned in section 3.1 or in the application, and subsequently for the period necessary to prove the operations performed through the account. In the event that you are a beneficiary of our products or the contact person of a Partner (Client or Partner Merchant) and you exercise your option to deactivate the user account, Edenred will interpret this action as your choice to unsubscribe from receiving commercial communications that keep you informed about the products and services we offer. In this regard, if you choose to deactivate your user account, we will no longer send you such communications. However, we would like to inform you that deactivating the account will not automatically result in the deletion of your personal data. If you wish for your personal data to no longer be processed or if you wish to delete the data, you can exercise your rights detailed in point 8 below;
•    for up to 1 year for messages in which you request assistance or details through the chatbot, email, mail, specific support forms, or our call center, regardless of whether your request was made electronically or by mail, in writing or audio;
•    as long as your subscription to commercial communications sent by Edenred or its partners is active; after we receive your unsubscribe request, as soon as possible (without exceeding the legal deadline), we will deactivate the sending of such communications to your email address or phone number;
•    for the period necessary to provide responses to your messages and requests and to prove the correspondence conducted with you for the contact form and the request form for a personalized offer;
•    for the period necessary to carry out customer/merchant referral programs and to prove your participation in these programs;
•    regarding applications received through the form in the "Careers" section or through dedicated recruitment platforms, if we do not respond to these applications, your data will remain in Edenred's database to participate in recruitment programs that will be conducted in the future, but no longer than one year from the date of their collection;
•    for up to 3 years for conducting analyses regarding navigation on our websites and your interactions with the sites;
•    for the duration provided by law, in situations where there are applicable normative acts (e.g., in the case of mandatory accounting registers and supporting documents that underlie entries in financial accounting, such as invoices issued by Edenred).

7.2. Any data may be retained by us, as an exception to the previous provisions, if applicable, until the expiration of the statute of limitations, regarding situations in which Edenred has a legitimate interest in retaining certain personal data in connection with a potential dispute that may arise between the parties, for example, in the context of the possible liability of Edenred or the data subject of the processing.

7.3. Edenred may delete or anonymize your personal data when it deems that they are no longer necessary for the purposes for which they were collected.

7.4. In any case, if you withdraw your consent and there are no legal grounds for processing or if you object to the processing and there are no legitimate and necessary reasons for processing that prevail, we will cease processing the data.

8. WHAT RIGHTS DO YOU HAVE

8.1. Applicable laws regarding the protection of personal data grant data subjects effective and enforceable rights regarding their data. For the processing carried out by Edenred, you have the following rights regarding your personal data:
•    Right to be informed: You have the right to be informed about how we process your personal data, as we do in this Policy.
•    Right of access: You have the right to obtain confirmation as to whether or not we process your personal data, information regarding the specifics of the processing, as well as access to the respective data.
•    Right to rectification: You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes for which the data have been processed, you have the right to obtain the completion of incomplete personal data, including by providing a supplementary statement.
•    Right to erasure: You have the right to obtain from us the erasure, without undue delay, of personal data concerning you, to the extent that the legal requirements are met. Personal data will be erased when the legal requirements are fulfilled.
•    Right to restriction of processing: If the applicable legal provisions are met, you have the right to obtain the restriction of the processing of your personal data.
•    Right to data portability: If the applicable legal provisions are met, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller.
•    Right to object: In certain situations, such as when we process personal data based on our legitimate interest, you have the right to object to the processing of your personal data by us. In the case of an unjustified objection, as the controller, we are entitled to continue processing your personal data.
•    Right to object to receiving commercial messages: You can also object to the processing of your personal data for the purpose of sending commercial messages.
•    Right not to be subject to automated individual decision-making, including profiling: If the applicable legal provisions are met, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We note that we do not use artificial intelligence for processing your personal data, and all decisions that concern you and may significantly affect you involve human intervention.
•    Right to withdraw consent: To the extent that we process your personal data based on consent, you can withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.
•    Right to lodge a complaint with the Supervisory Authority: You have the right to lodge a complaint with the competent Supervisory Authority regarding any violation of your rights concerning the processing of personal data. In Romania, the competent supervisory authority is the National Authority for the Supervision of Personal Data Processing.

8.2 When we receive a request from you regarding the exercise of any of your rights, we may ask for additional information to verify your identity before acting on your request.

8.3 If you send us an electronic request to exercise your rights, the information will be provided by us also in electronic format where possible, unless you have requested another format.

8.4 We will try to respond promptly to any request from you and, in any case, within the time limits mentioned by the applicable legal provisions (usually 30 days from the registration of the request). In certain situations expressly provided by applicable legislation, we may charge a fee for an access request that will take into account the administrative costs necessary to fulfill the request.

8.5 For any further questions regarding this Personal Data Processing Policy or how personal data is processed, and to exercise your rights mentioned above, please complete the dedicated form on our websites. You can also send a personalized request, signed and dated, with your personal data that you wish to update or delete, to our address, attention to the personal data processing officer: Edenred Headquarters Bucharest, Calea Şerban Vodă 133, Sector 4, postal code 040205, Bucharest. Monitoring compliance with legal requirements in this area is also ensured by the designated data protection officer within the Edenred Group.

9. UPDATING THIS POLICY

9.1 Edenred may periodically update this Policy as its activities and services expand or change, or in situations where Edenred is required by law to make changes. If Edenred does this, it will display the most current version on its websites. Therefore, please check periodically for updates. If Edenred makes significant changes to the practices specified in this Policy, we will notify you using the available contact information