1. Definitions and Interpretation

In this Policy, the following terms shall have the following meanings:

2. Information About Us

1. Our Site is owned and operated by S.C. Nupsala EU S.R.L., the Data Controller for personal data processed through this Site.
   1. CUI (Fiscal Code): RO50494326
   2. Trade Register Number: J/2024019405001
   3. Registered address (Sediul social): Str. Lupului, nr. 57, Râșnov, or. Râșnov, jud. Brașov, Romania
   4. Working address (Punct de lucru): Str. Ghimbavului, nr. 80P, Hala B4, sat Cristian, comuna Cristian, jud. Brașov, Romania
   5. Email: [email protected]
   6. Telephone: +40 (752) 218 784 2.2
2. We are authorised to distribute veterinary medicinal products by the Direcția Sanitară Veterinară și pentru Siguranța Alimentelor Brașov — ANSVSA Authorisation Nr. 11 din 21.04.2026.
3. We have assessed Our obligations under GDPR Article 37 and determined that a Data Protection Officer (DPO) is not mandatory for Our current processing activities. All data protection enquiries should be directed to [email protected]. 

3. What Does This Policy Cover?

This Privacy Policy applies to your use of Our Site and describes how We collect, use, store, and share your personal data. Our Site may contain links to other websites. We have no control over how your data is collected, stored, or used by other websites and We advise you to check the privacy policies of any such websites before providing any data to them.

4. Your Rights

As a data subject, you have the following rights under GDPR. These rights are set out in full in section 11 below, together with how to exercise each one:

If you have any concern about Our use of your personal data, please contact Us at [email protected]. If We are unable to resolve the issue, you have the right to lodge a complaint with the ANSPDCP at any time — www.dataprotection.ro. 

5. What Data Do We Collect?

Depending upon your use of Our Site, We may collect some or all of the following personal and non-personal data:

We do not collect any special category personal data (as defined by GDPR Article 9) relating to humans — such as health, racial or ethnic origin, political opinions, or biometric data. Animal health data linked to your professional account is not considered special category data under GDPR.

6. How Do We Use Your Data?

All personal data is processed lawfully, fairly, and transparently in accordance with GDPR. We will always have a lawful basis for processing. The table below sets out each purpose for which We process personal data, the data used, the lawful basis, and the retention period.

1. Where We rely on legitimate interests as Our lawful basis, We have conducted a balancing test to ensure that Our interests do not override your fundamental rights and freedoms.
2. Where We rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing emails, use the unsubscribe link in any email or contact [email protected].
3. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. 

7. How and Where Do We Store Your Data?

1. We only keep your personal data for as long as is necessary for the purposes for which it was collected, as set out in the retention periods in section 6 above.
2. Your data is stored on secure servers located within the European Economic Area (EEA). We do not store personal data outside the EEA unless adequate safeguards are in place (see section 9 on International Transfers).
3. We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
   1. Encrypted data transmission (HTTPS/TLS) across all pages of Our Site
   2. Secure hosting infrastructure with restricted access controls
   3. Password hashing — We never store passwords in plain text
   4. Access limited to authorised personnel on a need-to-know basis
   5. Regular review of our data processing activities and security measures
4. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, We will notify the ANSPDCP within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by GDPR Article 34. 

8. Do We Share Your Personal Data?

We do not sell your personal data to third parties. We may share your personal data with trusted third parties who act as data processors on Our behalf, or where required by law. The table below sets out all third parties with whom We may share your data, and the basis for doing so.

1. All third-party data processors are subject to a Data Processing Agreement (DPA) or equivalent safeguard. They are only permitted to process your data for the specific purposes We instruct and may not use it for their own purposes. 
2. We may compile anonymised, aggregate statistics about the use of Our Site (traffic, usage patterns, sales volumes). This data cannot identify you and may be shared with partners, investors, or affiliates. 
3. We may be legally required to disclose your personal data to law enforcement, regulatory authorities (including ANSVSA or ANSPDCP), or courts in accordance with applicable law. 

9. International Data Transfers

1. Some of the third-party services We use transfer personal data outside the European Economic Area (EEA) — in particular Google Analytics (USA), Cloudflare (USA), and potentially Zoho (India fallback). All such transfers are made subject to appropriate safeguards under GDPR Chapter V, specifically Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914. 
2. For Google Analytics, We have enabled IP anonymisation. The last octet of your IP address is masked before any data is stored or processed by Google. 
3. You can obtain a copy of the relevant SCCs and Data Processing Agreements from each provider’s website or by contacting Us at [email protected]. 
4. Full details of international transfers, including destinations and safeguards for each service, are set out in Our Cookie Policy (section 6). 

10. What Happens If Our Business Changes Hands?

1. We may from time to time expand or reduce Our business and this may involve the sale or transfer of all or part of Our business. Any personal data that you have provided will, where relevant to any part of Our business being transferred, be transferred along with that part. The new owner or controlling party will be permitted to use that data only for the same purposes for which it was originally collected. 
2. If any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes. 

11. How Can You Control Your Data?

1. In addition to the rights set out in section 4, when you submit personal data via Our Site, you may be given options to restrict Our use of your data. In particular, you have strong controls over Our use of your data for direct marketing, including the ability to opt out of receiving marketing emails at any time. 
2. To opt out of direct marketing, you may:
   1. Click the unsubscribe link in any marketing email;
   2. Update your preferences in your Account; or
   3. Contact Us at [email protected]. 
3. EU residents may also register with national do-not-contact registries available in their country of residence to limit unsolicited marketing approaches. Please note that such registrations do not prevent marketing you have specifically consented to receive. 
4. You may restrict Our use of Cookies at any time via Our cookie settings banner or by managing your browser settings. See Our Cookie Policy for full details. 

12. How Can You Access Your Data?

1. You have the right to request a copy of any personal data We hold about you (a Subject Access Request). Under GDPR, this is free of charge and We will respond within 30 calendar days of receiving your request. 
2. To submit a Subject Access Request, please contact Us at [email protected], clearly stating that you are making a Subject Access Request and providing sufficient information for Us to identify you and locate your data. 
3. We may ask you to verify your identity before processing your request. This is to protect your data and ensure We do not disclose it to anyone other than you. 

13. Our Use of Cookies

Our Site uses Cookies and similar technologies. First-party Cookies are placed directly by Us. Third-party Cookies are placed by external services including Google Analytics, Zoho SalesIQ, and Cloudflare. We obtain your explicit consent before placing any non-essential Cookies via Our cookie banner. For full details of all Cookies used on Our Site — including their names, purposes, providers, retention periods, and your consent options — please refer to Our Cookie Policy.

14. Contacting Us

For any questions about this Privacy Policy, to exercise any of your rights under GDPR, or to submit a Subject Access Request, please contact Us:

Email: [email protected]

Telephone: +40 (752) 218 784 

Post: S.C. Nupsala EU S.R.L., Str. Ghimbavului, nr. 80P, Hala B4, sat Cristian, comuna Cristian, jud. Brașov, Romania

We will acknowledge your request within 5 working days and respond fully within 30 calendar days. If We need additional time (up to a further 60 days for complex requests), We will inform you within the initial 30-day period.

If you are not satisfied with Our response, or if you believe We are processing your personal data unlawfully, you have the right to lodge a complaint with the Romanian supervisory authority:

Authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Address: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania

Website: www.dataprotection.ro

Email: [email protected] 

15. Changes to Our Privacy Policy

We may change this Privacy Policy from time to time, for example if the law changes or if We change the way We process personal data. Any changes will be posted on this page with an updated date at the top. Where changes are material, We will notify you by email (if We hold your email address) or by a prominent notice on Our Site. We recommend that you check this page regularly to keep up-to-date.

Your continued use of Our Site after any changes constitutes acceptance of the revised Privacy Policy. If you do not agree with any changes, you must stop using Our Site.