Notification Regarding the Protection of Personal Data

Introduction

In accordance with the provisions of Law No. 133 of 8 July 2011 on the protection of personal data (Law No. 133/2011), and Regulation (EU) No. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as the "General EU Data Protection Regulation" or "GDPR"), as well as the internal normative acts approved for the implementation of the GDPR, S.R.L. "Zoofarmagro" (hereinafter referred to as the "Company"), with its registered office in Chișinău, 4a Camenița Street, registered with the State Registration Chamber on 09.06.2000, legally represented by Vasile Tașcă in the capacity of Administrator, is obliged to process the personal data you have provided to us in a secure manner, in good faith, and in compliance with the applicable legal provisions, exclusively for the specified purposes.

Personal Data Controller

S.R.L. "Zoofarmagro" is a Moldovan company established and operating in accordance with the laws of the Republic of Moldova, which, as a Data Controller, stores in good faith the personal data of its clients/legal or conventional representatives of its clients, both natural and legal persons, in compliance with applicable regulations, fully respecting the principles of personal data processing for legitimate purposes, in accordance with Law No. 133/2011 and Article 5 of the General EU Data Protection Regulation, as well as the internal normative acts approved for the implementation of the GDPR.

Personal Data
The processed data includes:

- Name and surname;
- Phone/fax;
- Email;
- Data regarding purchased services and products, such as: quantity, value, date, and place of purchase;
- Other data.

Purposes of Personal Data Processing

This data is processed by the Company for the following purposes:

1. For the purchase by you of S.R.L. "Zoofarmagro" products, such as veterinary medicines and products, phytosanitary products, parapharmaceutical products, food and additives, premixes, feed and raw materials for feed, cosmetics and hygiene products, animal accessories, aquariums, medical equipment, and other specific products, as well as for the contracting and management of contracts concluded with you as a client, in accordance with Article 6(1)(b) of the GDPR for the purpose of entering into and performing a contract with the data subject;
2. For the execution of payments, including invoicing for the services provided, in accordance with Article 6(1)(b) of the GDPR;
3. To fulfill a legal obligation of the Controller, including ensuring security services through the analysis of security incidents, goods transportation, and implementing measures to prevent money laundering offenses;
4. For the resolution of complaints and notifications in S.R.L. "Zoofarmagro" pharmacies, by phone or correspondence, in accordance with Article 6(1)(c) and (f) of the GDPR, to fulfill a legal obligation (Law No. 105/2003 on consumer protection), as well as for the legitimate interest of the Controller in analyzing and resolving reported incidents;
5. For contacting you to obtain your opinion regarding the services and products purchased from the Controller, through phone calls, email, SMS, website, social media channels, and mobile applications, in accordance with Article 6(1)(f) of the GDPR;
6. For statistical purposes, in accordance with Article 6(1)(f) and Article 89 of the GDPR;
7. For the recovery of debts owed to the Controller, amicably or through enforced execution, including for the resolution of various disputes, in accordance with the concluded contracts and the legitimate interest of the Controller to recover debts related to the existing contractual relationship with you, pursuant to Article 6(1)(b) and (f) of the GDPR, as well as for the enforced recovery of owed amounts in accordance with Article 6(1)(c) of the GDPR and applicable legal provisions;
8. For video surveillance by recording your image when visiting the Controller’s veterinary pharmacies or warehouse, carried out for the legitimate interest of the Controller in accordance with Article 6(1)(f) and (c) of the GDPR, specifically for the security of premises and persons as per Law No. 333/2003;
9. For the resolution of various requests and inquiries addressed to the Company, as well as for providing information requested by data subjects;
10. For profiling, to provide you with information about standard or personalized products and services from the entity’s portfolio, through the analysis of purchased services, transactions, and other similar information, in accordance with Article 6(1)(a) of the GDPR;
11. For marketing purposes, through the use of communication means such as email, SMS, fax, phone calls, and mobile app notifications, including for receiving newsletters and other commercial communications to promote the entity’s products and services, in accordance with Article 6(1)(a) of the GDPR;
12. For marketing purposes, through the use of communication means such as email, SMS, fax, phone calls, and mobile app notifications, for organizing internal and external events and inviting you to these events, in accordance with Article 6(1)(a) of the GDPR.

If the Company decides to process your personal data for other purposes based on Article 6(1)(a) of the GDPR and the internal normative acts approved for GDPR implementation, i.e., based on your consent, a separate information notice will be sent to you to allow you to provide your express and freely given consent.

Duration of Personal Data Processing

For purposes related to the execution of the contract concluded with you and the provision of the services and products purchased by you, your personal data will be stored for a limited period in a secure location and in accordance with legal conditions and provisions, as follows:

- Personal data for marketing purposes will be retained until the withdrawal of your consent or the termination of the contractual relationship;
- The storage duration of video recordings captured by surveillance cameras is approximately 7 days from the date of recording.

The processing of data for marketing purposes, as outlined in this Notification (in the section Purposes of Personal Data Processing), will take place during the contractual relationship with the Controller and for a period of 1 year after its termination. If you withdraw your consent for direct marketing, your data will no longer be processed for this purpose from the moment of withdrawal.

Necessity of Personal Data Processing

The data processed for the purposes outlined is necessary either for the conclusion or execution of the contract concluded with you or for complying with a legal obligation of the Controller. Therefore, your refusal to provide this data to the Controller may result in the inability to enter into a contractual relationship for certain services.

If you object to the processing of your personal data for the purpose of obtaining your opinion regarding the services and products offered or purchased, the contractual relationship between you and the Controller will not be affected in any way.

If you object to the processing of data for statistical purposes, we inform you that this option will be analyzed, and depending on your specific situation, you will receive a response in accordance with Article 21 of the GDPR. Your objection to such processing will not affect the continuation of the contractual relationship with the Controller.

If you do not agree with the processing of your personal data for direct marketing purposes or for contacting you to present standard or personalized offers or to invite you to events organized by the Controller, for which your consent is required, the contractual relationship between you and the Controller will not be affected in any way.

Authorized Persons and Data Recipients
Personal data may be transferred to:

- The data subject or their representatives;
- IT and telecommunications service providers, other contractual partners (e.g., lawyers, auditors bound by confidentiality obligations regarding the transmitted data);
- State authorities, such as the Fiscal Service (SFS), based on their competencies as provided by applicable law.

The data transferred to third parties will be adequate, relevant, and not excessive in relation to the purpose for which it was collected and which allows transmission to a specific third party.

Rights of the Data Subject
For complete information, as a data subject, you have the following rights, as provided by the Personal Data Security Policy:

(a) Right of access: You have the right to obtain confirmation from the Controller as to whether or not your personal data is being processed, and if so, you can access that data and information regarding how it is processed.

(b) Right to data portability: You have the right to receive your personal data in a standard, structured, commonly used, and machine-readable format, and the right to have your data transferred to another controller without hindrance from the Controller, where the data is processed automatically based on your consent pursuant to Article 6(1)(a) or a contract pursuant to Article 6(1)(b) of the GDPR.

(c) Right to object: You have the right to object, on grounds relating to your particular situation, to the processing of your personal data, including profiling based on such data, when the processing is carried out pursuant to Article 6(1)(e) and (f), i.e., for the legitimate interest of the Controller or for performing a task in the public interest.

(d) Right to rectification: You have the right to request the correction, without undue delay, of inaccurate personal data. You also have the right to have incomplete personal data completed, including by providing a supplementary statement. The rectified data will be communicated to each recipient who received the data, unless this proves impossible or involves disproportionate effort.

(e) Right to erasure ("right to be forgotten"): You have the right to request the erasure of your personal data without undue delay in cases where: the data is no longer necessary for the purposes for which it was collected or processed; you withdraw your consent and there is no other legal basis for processing; you object to the processing and there are no overriding legitimate grounds; the personal data has been unlawfully processed; the personal data must be erased to comply with a legal obligation; or the personal data was collected in connection with the provision of information society services. The erasure of data will be communicated to each recipient who received the data, unless this proves impossible or involves disproportionate effort.

(f) Right to restriction of processing: You have the right to request the restriction of processing in cases where: you contest the accuracy of the data, for a period allowing the Controller to verify its accuracy; the processing is unlawful, and you oppose the erasure of the data, requesting restriction instead; the Controller no longer needs the data for processing, but you require it for the establishment, exercise, or defense of legal claims; or you have objected to processing pending verification of whether the Controller’s legitimate grounds override yours.

(g) Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you, except where such processing is necessary for entering into or performing a contract with you, is authorized by applicable legal provisions, or is based on your freely given consent.

(h) Right to withdraw consent: Where the processing of personal data is based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out based on consent before its withdrawal.

Additionally, as a data subject, you have the right to lodge a complaint with the National Center for Personal Data Protection within 30 days from the detection of a violation (Chișinău, 48 Serghei Lazo Street, email: centru@datepersonale.md, phone: +373 22 811 807).

All these rights can be exercised through a written, signed, and dated request sent to the Controller’s registered office. If you have questions regarding the processing of personal data, you can contact the Data Protection Officer at the email address: zoofarmagro@mail.ru or by phone at +373 22 855 076.

If you submit a request regarding the exercise of your data protection rights, the Controller will respond to this request within the timeframe provided by Law No. 133/2011.

Controller’s Commitment

The personal data Controller guarantees that it processes your data in a lawful manner, implementing appropriate technical and organizational measures to ensure the integrity and confidentiality of the data in accordance with Articles 25 and 32 of the GDPR.