Privacy Policy (GDPR)

Version: 1.0
Publication date: 29.07.2026
Effective date: 29.07.2026

Chapter 1. Introduction and information about the data controller

1.1. Purpose of this Policy

This Privacy Policy describes how REGIONAL AIR SUPORT S.R.L., acting as personal data controller, collects, uses, stores, discloses and protects personal data processed through the online shop www.pilotshop.ro.

This document has been prepared in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”);
• Law No. 190/2018 on measures implementing the GDPR;
• Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, to the extent applicable;
• the other applicable legislation in the field of personal data protection.

This Policy supplements the Terms and Conditions, the Cookie Policy and the other documents published on the Website.

1.2. Data controller

The personal data controller is: REGIONAL AIR SUPORT S.R.L.

• registered office: No. 14-22 Bucuresti-Ploiesti Road, Block XIII/2, Ground Floor, Apartment ROOM 1, Bucharest, Sector 1, Romania;
• business premises/showroom: No. 24-28 Bucharest-Ploiesti Road, Sector 1, postal code 013694, Bucharest, Romania;
• unique registration code: RO12020346;
• Trade Register registration number: J1999006863409;
• e-mail: [email protected];
• telephone: +40 770 951 700.

For questions concerning data protection or for exercising the rights provided by the GDPR, data subjects may use the above e-mail address and indicate “Data Protection” in the subject line.

For the purposes of this Policy, “PilotShop”, “we”, “the company” or “the controller” means REGIONAL AIR SUPORT S.R.L.

1.3. Scope

This Policy applies to all persons whose data are processed through www.pilotshop.ro, including:

• Website visitors;
• individual customers;
• representatives of legal entities;
• persons who use the contact form;
• persons who create a customer account;
• persons who submit after-sales requests;
• newsletter subscribers;
• participants in promotional campaigns, where applicable.

1.4. Definitions

For the purposes of this Policy:

Personal data means any information relating to an identified or identifiable natural person.

Processing means any operation performed on personal data, including collection, recording, organisation, storage, consultation, use, transmission, restriction or deletion.

Data subject means the natural person whose data are processed.

Controller means REGIONAL AIR SUPORT S.R.L.

Processor means any third party that processes personal data on behalf of the controller under the conditions laid down by the GDPR.

1.5. Processing principles

PilotShop processes personal data in accordance with the principles set out in Article 5 GDPR.

The data are:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date;
• retained only for as long as necessary for the purposes for which they were collected;
• protected by appropriate technical and organisational measures.

1.6. PilotShop’s commitment

The protection of personal data is an ongoing concern for PilotShop.

We process only the data necessary for carrying out our commercial activities and complying with legal obligations, and we adopt appropriate technical and organisational measures to protect them against unauthorised access, loss, alteration, disclosure, or accidental or unlawful destruction.

We do not sell or rent our customers’ personal data to third parties for marketing purposes.

Personal data may be processed and disclosed only for the purposes and on the legal grounds described in this Policy, including performance of a contract, compliance with legal obligations, protection of the legitimate interests of PilotShop or third parties and, where necessary, on the basis of the data subject’s consent.

1.7. Sources of personal data

PilotShop collects personal data:

• directly from the data subject, when that person creates an account, places an order, subscribes to the newsletter, submits a review or makes a request;
• automatically, through the device and browser used to access the Website;
• from payment processors, exclusively in connection with the confirmation, refusal, refund or identification of a transaction;
• from courier operators and logistics partners, in connection with delivery or transport incidents;
• from manufacturers, distributors or service centres, where necessary to handle a warranty, complaint or technical request;
• from representatives, employers or other persons who place orders or submit data on behalf of a data subject;
• from public authorities, financial institutions or other legitimate sources, where processing is necessary to comply with a legal obligation, prevent fraud or defend a legal right.

Where a person provides PilotShop with another person’s data, that person must ensure that they are entitled to disclose the data and that the data subject has been properly informed.

Chapter 2. Personal data we process

PilotShop applies the data minimisation principle, which means that only the data necessary for carrying out commercial activities, performing contracts, complying with legal obligations and providing the services requested by users are collected and processed.

The data actually processed may vary depending on how you use the Website and which services you access.

2.1. Data collected when visiting the Website

When the online shop is merely accessed, certain technical information may be collected automatically through the IT infrastructure used to operate the Website. This information may include:

• IP address;
• date and time of access;
• browser type;
• operating system;
• browser language;
• device resolution;
• pages accessed;
• duration of the visit;
• traffic source, such as a search engine or external link;
• technical identifiers generated by cookies or similar technologies, under the conditions described in the Cookie Policy.

As a rule, this information does not directly identify a person and is used for the operation, security and improvement of the services provided through the Website.

Even where this information does not directly contain the person’s name, IP addresses, cookie identifiers, session identifiers and other online identifiers may constitute personal data where they enable the direct or indirect identification or singling out of a user or device.

2.2. Data collected when creating a customer account

When an account is registered on www.pilotshop.ro, the following categories of data may be processed:

• first name and surname;
• e-mail address;
• password stored as a cryptographic hash that cannot be read or recovered in its original form;
• telephone number;
• delivery addresses;
• billing addresses;
• country;
• county;
• city/locality;
• postal code;
• order history;
• preferences saved in the account.

The account password is not accessible to PilotShop staff and cannot be recovered in the form in which it was entered by the user.

2.3. Data collected when placing an order

To perform the sales contract, we process the data required to handle the order, including:

• the customer’s first name and surname;
• company name, where applicable;
• tax identification code, for legal entities;
• billing address;
• delivery address;
• telephone number;
• e-mail address;
• products ordered;
• payment method;
• delivery method;
• comments entered by the customer in the order;
• order history.

2.4. Payment data

PilotShop does not collect or store the complete data of bank cards used for online payments.

Payments are processed through specialised payment service providers, which process the data required for the transaction as independent controllers or processors, as applicable.

PilotShop may receive only the information needed to confirm the payment, such as:

• transaction status;
• transaction identifier;
• amount paid;
• date of payment;
• other information strictly necessary for financial reconciliation.

2.5. Data used for order delivery

For product dispatch, the data required to carry out delivery are processed, including:

• first name and surname;
• full delivery address;
• telephone number;
• e-mail address, where this is necessary for delivery notifications.

These data are disclosed exclusively to the logistics operators involved in performing the contract.

2.6. Data collected through contact forms

When the contact form is used or a request is sent by e-mail, PilotShop may process:

• name;
• e-mail address;
• telephone number, if provided;
• message content;
• attached documents;
• correspondence history.

These data are used exclusively to handle the request submitted.

2.7. Data collected through the electronic after-sales request system

When the customer uses the electronic system intended for after-sales requests, the following may be processed:

• order identifier;
• products concerned;
• reason for the request;
• supporting documents;
• photographs;
• correspondence between the customer and PilotShop;
• request history;
• information concerning how the request was resolved.

These data are used exclusively to manage the contractual relationship and comply with legal obligations concerning consumer rights.

2.8. Data collected for issuing tax documents

To comply with tax and accounting obligations, PilotShop processes the data necessary to issue invoices and maintain accounting records.

These data may include:

• first name and surname;
• name of the legal entity;
• tax identification code;
• billing address;
• information about the products purchased;
• transaction value;
• tax documents issued.

2.9. Newsletter and commercial communications

Where the user consents to receive commercial communications, PilotShop may process:

• name;
• e-mail address;
• consent history;
• communication preferences;
• information necessary to manage the subscription.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

2.10. Consent data and privacy preferences

When the user interacts with the consent management platform, PilotShop may process:

• the categories of cookies and technologies accepted or rejected;
• the date and time when the choice was made or changed;
• the version of the notice and consent configuration applicable at that time;
• the language used;
• technical identifiers necessary to associate and demonstrate the choice;
• consent signals transmitted to integrated services, where applicable.

These data are used to apply the user’s choices, prevent activation of technologies that have not been accepted and demonstrate compliance with legal obligations concerning consent.

2.11. Data concerning Website analytics and e-commerce measurement

With the user’s consent for the relevant cookie category, PilotShop may collect and transmit to analytics providers information such as:

• IP address and approximate location derived from it;
• browser, device, client and session identifiers;
• device type, browser, operating system and language;
• page viewed, referring page and session duration;
• interactions with the Website;
• searches carried out;
• e-commerce events such as viewing a product, adding it to the basket, starting checkout and completing a purchase;
• product identifier, name, category, quantity and value;
• signals concerning the user’s consent.

PilotShop does not intend to transmit to analytics services the customer’s name, e-mail address, telephone number, postal address or other data that directly identify the customer.

Google Tag Manager is used to manage and trigger technical tags. The actual processing is carried out by the services activated through it, depending on the consent choices made by the user.

PilotShop uses Google Consent Mode in its Basic configuration. Google Analytics tags and, where applicable, advertising service tags are blocked and are not loaded before the user makes a choice through the consent management platform.

Where consent for the relevant category has not been given or has been rejected, the relevant tags remain blocked and PilotShop does not transmit data to Google through those tags. After consent is given, only the services corresponding to the categories accepted by the user are activated.

The user may change or withdraw their choices at any time using the cookie preference management function. A change or withdrawal of consent applies to future processing and does not affect the lawfulness of processing previously carried out on the basis of valid consent.

2.12. Data concerning favourites, alerts and reviews

Where the user uses the functions available on the Website, PilotShop may process:

• products added to the favourites list;
• products for which an availability alert was requested;
• the e-mail address used to send the alert;
• the public name or pseudonym chosen for a review;
• the rating given, the review text and publication date;
• the technical link between the review and an order, where purchase verification is used;
• information concerning moderation and the resolution of any reports relating to the review.

These data are used to provide the requested function, publish and moderate reviews and prevent false or abusive reviews.

2.13. Data we do not request

PilotShop does not intentionally request or seek to collect special categories of personal data under Article 9 GDPR, such as:

• health data;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data used for uniquely identifying a person;
• information concerning a person’s sex life or sexual orientation.

If such information is voluntarily disclosed by the data subject without being necessary to handle the request, PilotShop will limit its processing to what is strictly necessary or delete it where permitted by law.

2.14. Accuracy of data

The data subject is required to provide complete, accurate and up-to-date data.

If the data change, the user is encouraged to update the information in the customer account or notify PilotShop without undue delay.

PilotShop is not liable for consequences resulting from inaccurate, incomplete or outdated data supplied by the user, to the extent that such data affect performance of the contract or compliance with legal obligations.

Chapter 3. Processing purposes, legal grounds and retention periods

PilotShop processes personal data only for specified, explicit and legitimate purposes, in accordance with the principles laid down by Regulation (EU) 2016/679 (GDPR).

Each processing activity has a distinct legal basis and a retention period established according to legal obligations or the need to perform the contract.

3.1. Overview of the main processing activities

User-level and event-level data in Google Analytics are retained for 14 months, in accordance with the Analytics property configuration. Aggregated statistical reports may be retained for longer periods without enabling individual users to be identified.

3.2. Performance of the contract

Most personal data are processed because they are necessary to enter into and perform the distance sales contract.

Without these data, PilotShop cannot:

• identify the customer;
• process the order;
• issue the invoice;
• collect payment;
• dispatch the products;
• communicate information concerning performance of the contract;
• handle after-sales requests.

The legal basis for these processing activities is Article 6(1)(b) GDPR.

3.3. Compliance with legal obligations

Certain data are processed because the law requires PilotShop to collect and retain them.

These obligations arise, among other things, from:

• tax legislation;
• accounting legislation;
• consumer protection legislation;
• legislation governing guarantees;
• other applicable legislation.

The legal basis is Article 6(1)(c) GDPR.

3.4. Legitimate interests

In certain situations, PilotShop may process personal data to protect its legitimate interests, while respecting the fundamental rights and freedoms of data subjects.

Such situations may include:

• fraud prevention;
• securing the IT platform;
• administering IT infrastructure;
• defending rights in the event of disputes;
• handling complaints;
• improving the operation of the online shop;
• producing aggregated and anonymised internal statistics.

Before relying on legitimate interests as a legal basis, PilotShop assesses whether the rights and interests of the data subject override the interest pursued.

The legal basis is Article 6(1)(f) GDPR.

3.5. Consent

Where the law requires consent, personal data are processed only after the data subject has given freely given, specific, informed and unambiguous consent.

Consent may be requested, for example, for:

• sending the newsletter;
• using certain categories of cookies;
• other activities for which the law requires this legal basis.

The data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

The legal basis is Article 6(1)(a) GDPR.

3.6. Provision of data

Depending on the purpose of processing, providing certain data may be:

• mandatory by law;
• necessary for entering into or performing the contract;
• optional.

If mandatory data are not provided, PilotShop may be unable to process the order, provide the requested services or comply with its legal obligations.

3.7. Changes to processing purposes

If PilotShop intends to use personal data for a purpose other than the one for which they were collected, the data subject will be informed in advance and, where required by law, a new legal basis or new consent will be obtained.

3.8. Storage limitation principle

Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected or for the period required by applicable legal obligations.

At the end of the retention periods, the data are deleted, anonymised or archived, as appropriate, in accordance with legal requirements and internal retention policies.

Chapter 4. Recipients of personal data

PilotShop treats personal data as confidential and restricts access to those persons and entities for whom access is necessary to carry out commercial activities, perform contracts or comply with legal obligations.

The data are not sold, rented or disclosed to third parties for their own independent commercial purposes.

4.1. Authorised personnel

PilotShop personnel may access data only to the extent necessary to perform their duties.

Access is limited according to each person’s responsibilities and is subject to confidentiality obligations.

4.2. Service providers

To conduct its activities, PilotShop uses specialised providers that may process personal data on behalf of the controller as processors, in accordance with Article 28 GDPR.

These categories may include:

• hosting providers;
• providers of the e-commerce platform and modules used to operate the online shop;
• IT and maintenance service providers;
• cybersecurity service providers;
• backup and data recovery service providers;
• transactional e-mail service providers;
• newsletter and marketing service providers, where the user has given consent;
• analytics and Website performance monitoring service providers, under the conditions set out in the Cookie Policy.

Where necessary, PilotShop enters into personal data processing agreements with these providers and ensures that they offer sufficient guarantees concerning data protection.

Role of providers in the processing of data

Depending on the service provided and the purposes for which they use the data, recipients may act:

• as processors for PilotShop, processing data solely on its instructions;
• as independent controllers, where they determine their own purposes and means of processing or fulfil their own legal obligations;
• where applicable, as joint controllers, if the purposes and means of processing are jointly determined.

The legal role of each provider is determined according to the specific service and the applicable contracts.

4.3. Payment processors

When online payments are made, the data required to process the transaction are transmitted to payment service providers.

PilotShop does not receive or store complete bank card data.

Payments are processed in accordance with applicable security standards and the payment service provider’s own policies.

4.4. Logistics operators

For order delivery, certain data are disclosed to logistics operators and courier companies.

These data may include:

• the recipient’s name;
• delivery address;
• telephone number;
• e-mail address, where necessary for dispatch notifications;
• information required to identify the parcel.

The data are used exclusively to carry out the delivery and manage any incidents occurring during transport.

4.5. Accounting and tax service providers

Data required to comply with tax and accounting obligations may be disclosed to accounting, audit or tax consultancy service providers, to the extent necessary for PilotShop to comply with its legal obligations.

4.6. Legal service providers

Where necessary to defend PilotShop’s legitimate rights and interests, certain data may be disclosed to lawyers, legal advisers, enforcement officers or other professionals involved in resolving disputes or recovering claims.

Disclosure is limited to the data strictly necessary for the purpose pursued.

4.7. Public authorities

PilotShop may disclose personal data to public authorities, state institutions or other competent bodies where:

• disclosure is required by law;
• there is a legal reporting obligation;
• the data are requested in judicial or administrative proceedings;
• disclosure is necessary to prevent or investigate fraud or other unlawful acts.

Data are disclosed only within the limits laid down by applicable law.

4.8. Commercial partners

In specific situations, certain data may be disclosed to manufacturers or distributors of the products sold where this is necessary for:

• handling a warranty;
• identifying a product;
• verifying authenticity;
• providing technical support;
• resolving a complaint.

PilotShop transmits only the data strictly necessary to achieve the relevant purpose.

4.9. Disclosure in the context of a corporate reorganisation

In the event of a merger, demerger, reorganisation, transfer of the business or assets or another corporate transaction, personal data may be transferred to the legal successor or entity taking over the business, in compliance with the GDPR and while ensuring continuity of data subjects’ rights.

4.10. Confidentiality in relations with third parties

PilotShop carefully selects providers that may have access to personal data and seeks to ensure that they implement appropriate technical and organisational measures to protect the data.

Access to data is limited to what is necessary to perform the contracted services and does not give providers the right to use the data for their own purposes that are incompatible with the instructions received or applicable law.

Chapter 5. Transfers of personal data

5.1. General principle

PilotShop seeks, as far as possible, to have personal data processed within the European Economic Area (EEA).

In carrying out its activities, PilotShop selects providers that offer appropriate safeguards concerning data protection and compliance with Regulation (EU) 2016/679 (GDPR).

5.2. Situations in which international transfers may occur

In certain situations, the use of IT services or specialised providers may involve the transfer of or access to personal data from outside the European Economic Area.

Such situations may arise, for example, when services are used for:

• hosting and cloud infrastructure;
• e-mail;
• cybersecurity;
• traffic analytics and monitoring;
• electronic communications;
• newsletters;
• technical support;
• other digital services used to operate the online shop.

5.3. Safeguards used for international transfers

Where data are transferred outside the European Economic Area, PilotShop ensures that the transfer is based on one of the mechanisms provided for in Chapter V GDPR, including:

• an adequacy decision adopted by the European Commission;
• the EU-US Data Privacy Framework, where the recipient in the United States is certified and the transfer is covered by that certification;
• standard contractual clauses adopted by the European Commission;
• binding corporate rules;
• the derogations provided by the GDPR, only where they are applicable;
• other safeguards recognised under European law.

Where the transfer is based on standard contractual clauses, PilotShop or the relevant provider may assess whether supplementary technical, contractual or organisational measures are necessary.

5.4. Information about safeguards

The data subject may request information about the countries to which data are transferred, the relevant recipients and the safeguards used. On request, PilotShop will provide a copy or summary of the applicable safeguards, with confidential information that is not necessary to understand the protection afforded to the data being removed where appropriate.

5.5. Access to data by providers

In certain situations, service providers may have limited access to personal data exclusively for:

• administering IT infrastructure;
• maintaining systems;
• remedying technical incidents;
• providing contractual support.

Access is limited to what is necessary to perform the services and is governed by contractual confidentiality and security obligations.

5.6. Requests for additional information

Data subjects may request additional information about the safeguards used for international transfers, to the extent that the information can be disclosed without adversely affecting PilotShop’s legitimate rights and interests or confidentiality obligations owed to service providers.

Chapter 6. Data retention periods

6.1. Storage limitation principle

PilotShop retains personal data only for the period necessary to fulfil the purposes for which they were collected or for the period required by applicable legal obligations.

At the end of the retention periods, the data are deleted, anonymised or archived, as appropriate.

6.2. Criteria used

The retention period is determined according to:

• the nature of the data;
• the purpose of processing;
• applicable legal obligations;
• limitation periods;
• tax and accounting obligations;
• the need to defend PilotShop’s rights in possible disputes.

6.3. Customer accounts

Data necessary for the operation of a customer account are retained for as long as the account remains active.

Accounts for which no login, order or active request has been recorded for three consecutive years are periodically reviewed with a view to deletion or anonymisation. Where possible and where the contact details remain valid, PilotShop may inform the user before closing the account.

Where deletion of the account is requested, data required exclusively to administer the account are deleted or anonymised without undue delay. However, deleting the account does not result in deletion of data that must be retained to comply with a legal obligation, perform an ongoing contract, or establish, exercise or defend a legal claim.

Data concerning orders, invoices, warranties, returns and complaints are retained separately in accordance with the following Sections, even if access to the customer account has been disabled.

6.4. Orders, invoices and commercial documents

Commercial data necessary to perform and prove the contract are retained for the duration of the order and, as a rule, for three years after the contractual relationship has ended.

Invoices, accounting registers, supporting documents and data necessary to link them to the transaction are retained for five years, calculated from 1 July of the year following the end of the financial year in which they were prepared, unless a special legal provision requires a different period.

If the data are subject to an inspection, dispute, investigation, debt recovery procedure or other legal proceedings, they may be retained until the matter has been finally resolved and the applicable statutory periods have expired.

6.5. Warranties, returns and after-sales requests

Data and documents relating to a warranty, return, withdrawal, complaint or non-conformity request are retained throughout the handling of the request and for three years after it has been finally closed.

If the product is covered by a statutory or commercial guarantee extending beyond this period, documents necessary to prove and administer the guarantee may be retained for the duration of the guarantee and for three years after it ends.

Invoices and documents with tax or accounting relevance included in such a file are retained in accordance with Section 6.4.

Where the request is subject to a dispute, inspection or investigation, the data may be retained until the matter has been finally resolved and the applicable statutory periods have expired.

6.6. Newsletter and commercial communications

Data used to send the newsletter and commercial communications are retained until consent is withdrawn, the person unsubscribes or the service ends.

After consent is withdrawn, PilotShop may retain, for up to three years, minimal information such as the e-mail address, the date consent was given, its source, the withdrawal date and the version of the applicable notice.

This information is no longer used to send commercial communications, but exclusively to:

• demonstrate compliance with legal obligations;
• prevent accidental resubscription;
• resolve any complaints.

At the end of the period, the data are deleted or anonymised, unless they must be retained in connection with ongoing legal proceedings.

6.7. Correspondence and general requests

Messages and documents sent through the contact form or by e-mail that do not lead to the conclusion of a contract and do not concern an order, warranty or complaint are retained for no more than 12 months after the request has been resolved.

Correspondence relating to an order, payment, delivery, return, warranty, complaint or other contractual relationship is retained for three years after the matter has been finally resolved or for the retention period applicable to the file of which it forms part.

Messages that form part of tax, accounting or contractual documentation follow the retention period set out in Section 6.4.

Unsolicited messages, spam and communications with no contractual or legal relevance may be deleted sooner.

6.8. Technical logs and security data

Ordinary technical logs concerning access to and operation of IT systems, including IP addresses, session identifiers, technical errors and data necessary to prevent unauthorised access, are generally retained for no more than six months from recording.

Data associated with a security incident, attempted fraud, unauthorised access or technical investigation may be retained for the duration of the incident analysis and, if necessary to defend rights or comply with a legal obligation, for up to three years after the incident has been closed.

The periods may be extended where the data are required in an investigation, judicial proceedings or a request made by a competent authority.

6.9. Cookie preferences and proof of consent

Data necessary to apply cookie preferences are retained for the operating period of the cookie or identifier used by the consent management platform, as indicated in the Cookie Policy.

To the extent that the platform generates and retains proof of the user’s choice, information concerning the giving, refusal, amendment or withdrawal of consent may be retained for up to three years from the last expression or change of the choice.

After this period, the data are deleted or anonymised unless they are necessary to resolve a complaint or comply with a legal obligation.

6.10. Google Analytics

User-level and event-level data collected through Google Analytics are retained for 14 months, according to the configuration of the Google Analytics property used by PilotShop.

At the end of this period, the data covered by the retention setting are automatically deleted by the service provider in accordance with the platform’s operation.

Aggregated statistical reports that do not allow individual users to be directly identified may be retained for longer periods.

Google Analytics is activated only after consent has been given for the Analytics category, in accordance with the Basic Consent Mode configuration described in Section 2.11.

6.11. Deletion, anonymisation and backups

At the end of the retention periods, PilotShop takes one or more of the following measures, as appropriate:

• permanent deletion of the data;
• irreversible anonymisation;
• archiving where there is a legal obligation;
• restriction of processing where immediate deletion is not possible or permitted.

Data deleted from active systems may remain for a limited period in backup copies until they are overwritten in accordance with the normal backup cycle. During this period, access is restricted and the data are not used for purposes other than system recovery in the event of an incident.

If a backup copy is restored, PilotShop will reapply the deletion requests and rules that were valid before restoration.

Chapter 7. Rights of data subjects

PilotShop respects the rights granted to data subjects by Regulation (EU) 2016/679 (GDPR) and facilitates their exercise in accordance with the law.

The exercise of a right may be limited only in the situations expressly provided by applicable law.

7.1. Right to information

The data subject has the right to receive clear, transparent and easily understandable information about how their personal data are processed.

This Privacy Policy is the main instrument through which PilotShop fulfils this information obligation.

7.2. Right of access

The data subject may request confirmation as to whether or not PilotShop processes personal data concerning them.

Where data are processed, the data subject has the right to obtain information about:

• the categories of data processed;
• the purposes of processing;
• the recipients of the data;
• the estimated retention period;
• the existence of the rights provided by the GDPR;
• the source of the data, where they were not collected directly;
• the existence of automated decision-making processes, where applicable.

The data subject may also request a copy of the data processed, under the conditions laid down in Article 15 GDPR.

7.3. Right to rectification

The data subject may request correction of inaccurate data or completion of incomplete data.

PilotShop may request supporting documents where these are necessary to verify the accuracy of the information provided.

7.4. Right to erasure (“right to be forgotten”)

The data subject may request deletion of personal data where the conditions laid down in Article 17 GDPR are met.

This right may be exercised, for example, where:

• the data are no longer necessary for the purposes for which they were collected;
• consent has been withdrawn and there is no other legal basis for processing;
• the data subject objects to processing and there are no overriding legitimate grounds;
• the processing is unlawful;
• erasure is required by a legal obligation.

A request for erasure may be refused to the extent that processing is necessary for:

• compliance with a legal obligation;
• the establishment, exercise or defence of legal claims;
• other situations provided by the GDPR.

7.5. Right to restriction of processing

The data subject may request restriction of processing in the situations provided for in Article 18 GDPR.

During the restriction period, the data will, in principle, only be stored, except where the law permits other operations.

7.6. Right to data portability

Under the conditions laid down in Article 20 GDPR, the data subject may request that personal data be provided in a structured, commonly used and machine-readable format.

This right applies only to processing:

• based on consent or performance of a contract; and
• carried out by automated means.

Where technically feasible, the data subject may request direct transmission of the data to another controller.

7.7. Right to object

The data subject has the right to object, on grounds relating to their particular situation, to processing based on PilotShop’s legitimate interests.

Where data are processed for direct marketing purposes, the right to object may be exercised at any time without the need to give reasons.

7.8. Right to withdraw consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7.9. Right not to be subject to a solely automated decision

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning them or similarly significantly affects them, except in the situations provided for in Article 22 GDPR.

As at the date of this Policy, PilotShop does not make decisions producing legal effects on customers exclusively by automated means.

7.10. Right to lodge a complaint

If the data subject considers that the processing of their data infringes applicable law, they have the right to lodge a complaint with the competent data protection authority.

Exercising this right does not limit the possibility of using other administrative or judicial remedies provided by law.

PilotShop nevertheless recommends that, before contacting the competent authority, the data subject contact the company to clarify the situation, as many requests can be resolved quickly and amicably.

The data subject may lodge a complaint with:

National Supervisory Authority for Personal Data Processing

• address: 28-30 General Gheorghe Magheru Boulevard, Sector 1, postal code 010336, Bucharest, Romania;
• e-mail: [email protected];
• telephone: +40 318 059 211 / +40 318 059 212;
• Website: www.dataprotection.ro.

Prior contact with PilotShop is recommended for a prompt resolution, but is not a condition for exercising the right to lodge a complaint.

Chapter 8. Exercising your rights

8.1. Methods of submitting requests

Requests to exercise the rights provided by the GDPR may be submitted through:

• the e-mail address specified in the Contact Section;
• the contact form available on the Website;
• the electronic request system, where applicable;
• post or courier to the controller’s registered office.

8.2. Identity verification

To protect personal data, PilotShop may request additional information necessary to verify the identity of the person making the request.

This information will be limited to what is strictly necessary to prevent unauthorised access to personal data.

A copy of an identity document will not be requested automatically. It may be requested only where there are reasonable doubts about the requester’s identity and verification cannot be carried out by a less intrusive means. Data not necessary for verification may be masked.

8.3. Response time

PilotShop will provide information on the action taken without undue delay and, in any event, within one month of receiving the request.
In the situations provided for in Article 12(3) GDPR, this period may be extended by up to two months, taking into account the complexity and number of requests.

Where an extension is required, the data subject will be informed within the initial one-month period of the reasons for the delay.

If PilotShop does not take action on the request, it will inform the data subject within no more than one month of the reasons for not acting and of the possibility of lodging a complaint with the supervisory authority and seeking a judicial remedy.

8.4. Costs of exercising rights

Exercising rights is, in principle, free of charge.

In the situations provided for in Article 12(5) GDPR, PilotShop may:

• charge a reasonable fee reflecting administrative costs; or
• refuse to act on the request,

where the request is manifestly unfounded, excessive or repetitive.

PilotShop bears the burden of demonstrating the manifestly unfounded or excessive character of the request before charging a fee or refusing to act.

8.5. Inability to identify the person

Where PilotShop cannot identify the person making the request and that person does not provide the information necessary for identification, the controller may refuse to act on the request under Article 11 GDPR.

Chapter 9. Security of personal data

9.1. Security commitment

PilotShop implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• accidental or unlawful alteration;
• destruction;
• loss;
• misuse;
• other forms of unauthorised processing.

These measures are adapted to the nature of the data processed, the risks identified and technological developments.

9.2. Technical and organisational measures

Depending on the nature of its activities, PilotShop may implement measures such as:

• use of secure connections (HTTPS/TLS);
• user authentication and access control;
• cryptographic hashing of user passwords;
• backups;
• monitoring of IT infrastructure;
• regular updating of applications and systems used;
• limiting personnel access to data strictly necessary for their duties;
• measures designed to prevent unauthorised access.

The list of measures is not exhaustive and may be changed according to technological developments and security risks.

9.3. User obligations

Protecting personal data also requires cooperation from users.

Users are responsible for:

• keeping their account password confidential;
• using sufficiently complex passwords;
• not disclosing login credentials to third parties;
• updating contact details when they change;
• notifying PilotShop if they suspect unauthorised use of the account.

Failure by a user to take reasonable measures to protect the account may contribute to an incident and will be taken into account when assessing the specific circumstances. This provision does not remove PilotShop’s obligations concerning processing security, data protection and incident management under the GDPR.

9.4. Security incidents

If a security incident affecting personal data occurs, PilotShop will act in accordance with the obligations laid down by the GDPR and applicable law.
Where the law requires notification of the competent authority or information to data subjects, these obligations will be fulfilled within the periods and under the conditions laid down by applicable legislation.

In the event of a personal data breach, PilotShop will assess without undue delay the nature of the incident, the categories of data and persons affected, the possible consequences and the measures necessary to limit its effects.

Where the breach is likely to result in a risk to the rights and freedoms of natural persons, it will be notified to the supervisory authority, where feasible, no later than 72 hours after PilotShop becomes aware of the breach.

Where the breach is likely to result in a high risk, the data subjects will be informed without undue delay under the conditions laid down by the GDPR.

Chapter 10. Processing children’s data

10.1. Use of the Website by minors

The Website and online shop are not specifically intended for children. Orders involving the conclusion of a contract must be placed by a person with the necessary legal capacity or by the minor’s legal representative.

PilotShop does not seek to intentionally collect children’s data for marketing, personalised advertising or profiling.

Where a processing activity is based on consent and falls within the special rules concerning information society services offered directly to a child, consent will be obtained or authorised in accordance with Article 8 GDPR and applicable national law.

PilotShop will not request identity documents to verify age unless this measure is necessary, proportionate and no less intrusive means is available.

10.2. Accidental collection of data

If PilotShop establishes that personal data relating to a minor have been collected in breach of applicable legal provisions, it will take reasonable measures to stop the processing and, where appropriate, delete the data, except where retention is required by law.

10.3. Responsibility of legal representatives

Parents or legal representatives are encouraged to supervise minors’ online activity and inform them about responsible use of the internet and the protection of personal data.

Chapter 11. Amendments to the Privacy Policy

11.1. Right to update

PilotShop may amend this Privacy Policy whenever necessary, including as a result of:

• changes in legislation;
• changes in processing activities;
• the introduction of new services or functions;
• changes in service providers;
• the implementation of additional data protection measures.

11.2. Publication of amendments

The updated version will be published on www.pilotshop.ro and will take effect on the publication date or on the date specified in the document.

Where amendments significantly affect data subjects’ rights or where required by law, PilotShop will take reasonable steps to inform users.

If an amendment introduces a new purpose, a new significant recipient, a new international transfer or significantly changes the way data are processed, the persons affected will be informed by an appropriate means before the amendment affects them. Where the new processing requires consent, it will not begin before valid consent has been obtained.

11.3. Periodic review

Users are encouraged to review this Privacy Policy periodically to remain informed about how their personal data are processed.

Chapter 12. Contact

For any questions concerning the processing of personal data or for exercising the rights provided by the GDPR, data subjects may use the contact details below:

• REGIONAL AIR SUPORT S.R.L.;
• registered office: No. 14-22 Bucuresti-Ploiesti Road, Block XIII/2, Ground Floor, Apartment ROOM 1, Bucharest, Sector 1, Romania;
• business premises/showroom: 24-28 Bucharest-Ploiesti Road, Sector 1, postal code 013694, Bucharest, Romania;
• e-mail: [email protected];
• telephone: +40 770 951 700.

Requests will be reviewed and handled in accordance with Regulation (EU) 2016/679 and applicable law.

Chapter 13. Final provisions

This Privacy Policy supplements the Terms and Conditions, the Cookie Policy and the other informational and contractual documents published on www.pilotshop.ro.

If any provision of this Policy is declared null, unlawful or unenforceable, the remaining provisions will remain valid and continue to have effect.

This Policy is governed by Romanian law and the applicable provisions of European Union law concerning personal data protection.

The Romanian-language version is the reference version. PilotShop uses reasonable efforts to maintain consistency between translations. In the event of a discrepancy, the Romanian-language version will prevail to the extent permitted by law, without affecting the rights of the data subject and the information effectively communicated to that person in another language.

This Privacy Policy enters into force on the date it is published on www.pilotshop.ro.