Privacy Policy

ELVO TECHNOLOGY S.R.L. (hereinafter referred to as “ELVO”), headquartered in Bucharest, Sector 1, Șoseaua București-Ploiești, No. 1A, Building C, 4th Floor, postal code 013681, responsible for managing the platform www.elvo.io and in accordance with Article 4 para. (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of individuals concerning the processing of personal data and the free movement of such data (“GDPR”), informs you through this Data Protection Statement whether and to what extent your personal data will be processed when you visit the website(s) under this domain on the internet.

This notice is addressed to you as a customer or potential customer of ELVO and explains how ELVO TECHNOLOGY S.R.L. uses and protects the personal data you provide during your use of the website, including the online contracting portal on the website. We process your personal data in line with legal provisions, especially by aligning with GDPR requirements, as detailed below.

Interaction on the Website

We process your data when you interact with us through the website via the contact form.

We process the following data:

1. Identification data (such as your first and last name)
2. Contact details (such as home address, email address, phone number)
3. Account data (any other information you request/provide through the contact form)

Legal Grounds:

1. Our legitimate interests in ensuring optimal and easy communication with customers, providing a convenient communication channel, ensuring efficient customer management, and improving ELVO TECHNOLOGY S.R.L.’s performance indicators.
2. Your consent expressed by submitting documents/information to us.

Failure to provide the requested information through the contact form or our colleagues may prevent us from addressing your request or responding fully to it.

In addition to the aforementioned data, so-called `cookies` are stored on your computer when you visit our website. Cookies are small text files stored on your hard drive by your browser, transmitting certain information to the requester that installed the cookie (in this case, us). Cookies cannot run programs or transmit viruses to your computer. Their function is to make our website more user-friendly and efficient.

You will be informed about the use of cookies the first time you visit our website or when a cookie is missing from your device. To continue using cookies, we obtain your consent for their installation or for processing the personal data used in this context. When this initial cookie notification is issued, we direct users to this privacy policy.

The data collected through the website may be used for any of the purposes listed below, depending on their relevance (e.g., data provided for requesting offers may be used for service provision, data submitted through other requests/complaints for managing requests and informing you according to the law, checkboxes for being contacted for promotional purposes, studies, market surveys, usage data for compliance with industry performance standards, communication personalization, improving our relationship with you, etc.).

Retention Period: See details under the purposes listed below.

Interaction via Social Media

We process your data when you use your registered profile on a social network, such as Facebook, Instagram, LinkedIn, or other similar platforms (“Social Media”), to interact with our professional pages on these networks.

We use these Social Media pages and the tools provided by the platform operators for the following purposes: customer support and relations, measuring the performance of Social Media pages, promoting our company’s image, personalizing content and advertising in Social Media, and protecting our rights and interests.

Changes to this Notice

We may modify this notice. In such cases, the changes will take effect from the moment the new version of the notice is posted on our website www.elvo.io in the dedicated data protection section.

Promoting Our Image and Services. Improving Customer Relations

We want to keep you informed about our services and the events we organize. In this context, we may send you offers, promotions, event invitations, or, as appropriate, information about ELVO TECHNOLOGY S.R.L.’s activities and services.

Depending on your preference, we may contact you via email, phone, automated calls, online channels (including Social Media), and/or mail (postal or courier services), either directly or through our partners who assist us in promotional activities.

We process the following categories of data:

1. Identification data: name, surname;

2. Contact details: email address, phone number, postal address;

3. Your job position;

4. Data related to the services you are interested in (such as the type of services, consumer needs);

5. Data related to your opinion on our services;

6. Data regarding your marketing preferences.

Legal Grounds:

Regardless of the type of contracted service, we use:

1. Calls (human or automated), emails, and online channels – based on your consent to receive such communications;

2. Correspondence address for promoting our services and activities (postal/courier, face-to-face interactions, or door-to-door sales) – based on our legitimate interest in keeping you informed about services that may interest you. If you no longer wish to receive such communications, please send us your objection via the contact details provided at the end of this Policy.

3. Your marketing preferences and proof of acknowledgment of this privacy policy – based on our legitimate interest in maintaining records of compliance with our specific obligations and protecting our rights and interests, if necessary.

You can unsubscribe from these communications at any time by:

1. Clicking the “Unsubscribe” link in email communications;

2. Calling the phone number 0752.145.491;

3. Changing permissions in your User Account, when this option becomes available on the website;

4. Contacting us using any other available contact details on the ELVO website or at the end of this notice.

If you withdraw your given consent, you will no longer receive commercial communications from us via email, phone (including automated calls), or online channels.

Personalizing Marketing Communications

We aim to provide you with the most relevant services, tailored to your profile and areas of interest. Therefore, we personalize commercial communications based on the services you have purchased from us or intended to purchase, as well as your interactions with our website, our Social Media pages, or other basic information derived from your contract with ELVO or received from other partners.

For example, we may consider: 1. contract and customer account data (contract number, contract type, payment code, consumption site code, meter series, customer type – residential, non-residential, prosumer), 2. consumption data (such as consumption index, consumption volume), 3. general payment history (amount of issued consumption invoices, account balance, payment method), 4. demographic data, 5. expressed interest in certain offers, 6. your profile provided by other partners/resulting from the website.

Legal Grounds:

1. ELVO’s legitimate interest in sending you only relevant communications and offers.

2. Your consent, with a dual purpose: 1. to send you commercial communications of interest to you, and 2. to improve our marketing efficiency.

We may obtain the above data from:

(i) our partners, when you have given your consent in relation to them to receive commercial communications from other entities – minimal identification data, contact details, your profile;

(ii) acquaintances who have recommended you in the context of participating in promotions – Social Media profile, name, surname, contact details;

(iii) social network providers/technologies/tracking cookies for your behavior/preferences;

(iv) individuals authorized by you in your relationship with ELVO TECHNOLOGY S.R.L.

Processing Duration:

We will process your data for sending commercial communications and personalizing marketing communications for the duration of our contractual relationship, as well as afterward, unless you withdraw your consent to receive commercial messages from us.

We will retain proof of your consent for a period of 3 years from the date of withdrawal. The generated profiles will be periodically deleted as updated profiles are created based on new information.

Surveys, Market Studies, and Other Internal Analyses

We are constantly striving to improve the quality of our services. We conduct studies, surveys, market research activities, as well as internal analyses on how you use our services, including your level of satisfaction. In this context, we may use the services of market research agencies.

We ensure that we use personal data only when necessary to achieve our intended objectives. As a rule, the results of internal analyses and studies are in anonymized format.

We process the following categories of data: 1. identification data (name, surname, signature); 2. contact data (email address, phone number); 3. data related to the services you are interested in/benefit from (such as service type, utility, consumption needs, installed capacities); 4. data regarding your opinion on our services and your expectations from a service provider; 5. your feedback regarding events, communication with you, and other aspects related to the relationship with ELVO or other similar providers.

Legal Grounds: 1. Our legitimate interest in understanding customers’ opinions and preferences regarding our services or those of another provider, as well as optimizing our activity and identifying new opportunities and promotions of services and activities in general; 2. Your consent expressed in the context of surveys/market studies we conduct.

We may obtain the above data from: generally, we use data either 1. received from you (directly or through our partners – such as marketing, advertising, and market research agencies) or 2. generated or inferred based on information we hold about you.

Retention Period: For data used in studies, surveys, and analyses with anonymized results – for the duration necessary to transform them into anonymized statistics, but no longer than 6 months from the survey/market study or internal analysis/study. If not anonymized, the results of studies, surveys, and analyses will be retained for 1 year from their generation and will not be made public.

If you do not wish to participate in our surveys or studies or provide certain information for this purpose, we may not be able to implement or consider certain suggestions or aspects of interest to you. In any case, your refusal to participate will not affect your relationship with ELVO TECHNOLOGY S.R.L.

Defending ELVO’s Rights and Interests and Those of ELVO Customers & Compliance with Legal Obligations

Data: Any categories of data in ELVO’s systems mentioned above, suitable for the type of procedure/investigation/litigation/official audit.

Legal Grounds:

1. Our legitimate interests in defending our rights and interests in situations where ELVO’s image and interests are exposed or affected, as well as maintaining evidence regarding our rights and interests and compliance with specific legal obligations (e.g., resolving complaints within legally imposed deadlines in the energy or data protection sectors, manner of resolution, suspension/interruption of services only when permitted by law, retaining powers of attorney when a client is represented by another person/entity, identifying and proving client identity before making contract changes/providing account information, etc.).

2. Our legal obligations, such as compliance with requests from public authorities/courts/other competent institutions that may impose certain processing operations on us; the obligation to archive certain documents/information according to archiving rules, ANRE orders, or other applicable regulations for ELVO TECHNOLOGY S.R.L; the obligation to notify confidentiality/security incidents to competent authorities, etc.

We may obtain the above data from any of the sources mentioned for the purposes above, as well as from authorities, institutions, or involved courts.

Retention Period: For the period required by specific legal provisions; where no rules exist, for the duration of the procedure/audit/investigation/litigation and for 3 years from its completion, considering the applicable statute of limitations; for the period imposed by the competent authority/institution/court under legal provisions; for the period requested by you to defend your rights and interests or those of a third party with a legitimate interest.

In certain situations, refusing to provide data may result in contractual or civil liability in your relationship with ELVO TECHNOLOGY S.R.L. or other parties whose rights/interests may be affected.

When we receive data directly from you, we assume that it is real, accurate, complete, and pertains to you. We will make reasonable efforts to ensure the data is accurate and belongs to you. If we suspect that you are providing incorrect or incomplete data or using another person’s data without authorization, we will take measures to clarify and remedy the situation.

These measures may include updating, completing, or deleting data, restricting access to unlawfully used data – including deleting accounts associated with data that does not belong to you. Additionally, we will consider that data collected directly from you is current unless you request its modification through the specified communication channels or personally update the data. Furthermore, we may periodically conduct data update campaigns, such as phone calls or upon resigning a service contract with ELVO TECHNOLOGY S.R.L.

Please notify us of any changes to your data using the contact details indicated in your contract with us, on ELVO TECHNOLOGY S.R.L.’s website, or in this notice.

Who Do We Transfer Your Data To?

We may transfer your data to:

1. Your potential service providers, at the moment you decide to stop using our services – we may transmit any data at your request, including information about previously billed consumption, if available;
2. Other individuals who may receive data according to your request or when acting as your representatives in the relationship with ELVO TECHNOLOGY S.R.L.;
3. Our IT, Software, and security service providers, for managing ELVO TECHNOLOGY S.R.L.’s systems and applications, ensuring the security and confidentiality of your data;
4. Our marketing, PR, and research service providers, for understanding customer preferences, organizing events, and promoting the image and services of ELVO TECHNOLOGY S.R.L.;
5. Partners involved in delivering the services you order from us or use, such as courier companies or mailing and delivery services;
6. Billing service providers, payment management, and tax reporting services;
7. Debt collection agencies;
8. Contracted economic operators for verification/revision services, partners providing technical services, or other involved partners;
9. ELVO suppliers in various fields, including: database and document storage service providers, including cloud storage; archiving service providers; web administration and website/social media page management providers; email service providers; legal and tax consulting service providers; accounting and financial audit service providers; electronic communications service providers (e.g., email, SMS, etc.); payment service providers involved in processing and/or executing payments related to your purchases of our services; providers of new technologies used on our website; cookie providers (access will be anonymized only);
10. Notarial, translation, and enforcement service providers;
11. Partners with whom we collaborate to sell our services. If you have purchased our services through a partner entity, we may share your data with them for the proper management of the partnership relationship and your account – for example, to identify your order and process commission payments to the respective partner.
12. In the event of a merger, acquisition, or other type of reorganization. If ELVO undergoes a reorganization or sale, we will provide your information to the respective organization.
13. Public institutions and authorities or courts, such as:

• The National Regulatory Authority for Energy (ANRE);
• The National Agency for Fiscal Administration (ANAF);
• The Competition Council;
• Court instances and other judicial bodies (such as police authorities, Prosecutor’s Offices, the National Anticorruption Directorate – DNA, etc.);
• Competent authorities (e.g., ANPC, ANAF, ANSPDCP), or information requested by them, within their legal competencies.

Your Rights

In short, your rights are as follows:

1. The right to access data. You have the right to obtain access to your data that we process or control, or copies of it; you also have the right to obtain information from us regarding the nature, processing, and disclosure of this data.
2. The right to rectification. You have the right to obtain the correction of inaccuracies in your data that we process or control.
3. The right to data deletion (`right to be forgotten`). You have the right to request the deletion of your data that we process or control, under the conditions provided by law.
4. The right to restrict data processing. You have the right to restrict the processing of your data that we process or control when necessary.
5. The right to object. You have the right to object to the processing of your data by us or on our behalf, under the conditions provided by law.
6. The right to withdraw consent. If we process your data based on your consent, you have the right to withdraw it at any time, at least as easily as you initially granted it. Withdrawing consent will not affect the legality of data processing performed before withdrawal.
7. The right to file a complaint with the supervisory authority. You have the right to file a complaint with the supervisory authority for the processing of personal data regarding the processing of your data by us or on our behalf.

You can obtain more information about your rights by consulting Annex No. 1 of this Privacy Notice. You will notice that, according to the law, you may exercise these rights under certain conditions. In any case, we will make every effort required by law to facilitate their exercise.

How You Can Exercise Your Rights

To exercise one or more of these rights (including the right to withdraw your consent if we process your data based on it) or to ask any questions about any of these rights, any provision of this Privacy Notice, or any other aspects of our data processing, please use the contact details in the section OUR CONTACT DETAILS below. We will try to respond as quickly and thoroughly as possible to all your inquiries and concerns and to facilitate the exercise of your rights.

Annex No.1: YOUR RIGHTS IN DETAIL

You can find separate information regarding your right to object in the next annex (Annex No. 2).

The Right to Be Informed

As a data controller, we take appropriate measures to ensure that the information provided and communications regarding processing are concise, transparent, intelligible, and easily accessible, using clear and simple language. Information may be provided in writing or by other means (including electronic format, where appropriate).

You will be informed both when your personal data is collected directly from you and when it has been obtained from a third party.

The Right of Access

To be informed about the processing and to verify its legality, you have the right to access the personal data we process about you.

You also have the right to obtain confirmation from us regarding whether or not we are processing your personal data. If we process your personal data, you have the right to access that data; in such cases, you are also entitled to access the following information:

• The purposes of processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the data has been or will be disclosed, especially recipients in third countries or international organizations;
• The period for which the data is intended to be stored or, if not possible, the criteria used to determine the storage period;
• The right to request rectification, deletion, or restriction of processing of personal data, as well as the right to object to processing;
• The right to lodge a complaint with the data protection supervisory authority;
• If the data is not collected from you, any available information about its source;
• The existence of automated decision-making (including profiling) and meaningful information about the logic used, as well as the significance and anticipated consequences of such processing.

The Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it rectified by us without undue delay. Depending on the purpose of processing, you have the right to have incomplete personal data completed, including by providing supplementary statements.

The Right to Erasure (`Right to Be Forgotten`)

You may request that your personal data be deleted without undue delay if it is no longer necessary for us to process it. You have the right to request data deletion in the following cases:

• Your personal data is no longer necessary for the purposes for which we collected or processed it;
• You withdraw the consent on which processing is based, and there is no other legal ground for processing your data;
• You object to processing (under your right to object), and there are no overriding legitimate grounds for processing;
• We have processed your data unlawfully;
• There is a legal obligation requiring us to delete the data;
• The data was collected in relation to the offer of information society services to a minor.

At the same time, we may refuse your request to delete personal data if processing is necessary:

• For exercising the right to freedom of expression and information;
• To comply with a legal processing obligation, to perform a task carried out in the public interest, or in the exercise of official authority vested in us;
• For public health interests;
• For archiving in the public interest, for scientific or historical research purposes, or for statistical purposes, in accordance with data protection laws, where the right to deletion is likely to render impossible or seriously impair the objectives of processing;
• For the establishment, exercise, or defense of legal claims.

The Right to Restriction of Processing

You have the right to request that we restrict the processing of your data if at least one of the following conditions is met:

• You contest the accuracy of the data – in this case, we will stop processing until we verify the accuracy of the data;
• Processing is unlawful – in this case, although you have the right to request data deletion (`right to be forgotten`), you object to deletion and instead request that we restrict the use of your data;
• We no longer need the data, but you require it for the establishment, exercise, or defense of legal claims;
• You have objected to processing necessary for performing a task in the public interest or resulting from our legitimate interests or those of a third party – in all these cases, we will stop processing your data during the period in which we verify whether our legitimate grounds override your rights.

However, we will continue processing (beyond mere storage) the data for which you requested restriction only if and to the extent that:

• You consent to processing;
• Processing is necessary for the establishment, exercise, or defense of legal claims;
• Processing is necessary for protecting the rights of another natural or legal person;
• Processing is necessary for important public interest reasons of the European Union or a member state.

We will inform you before lifting the restriction on processing.

For example, depending on how we process the data in question, to comply with a request for restriction, we may temporarily transfer the restricted data to another processing system, block user access to that data, or adopt similar measures.

The Right to Data Portability

You have the right to obtain from us the personal data we process about you so that you can use it for your purposes and transfer it from one environment to another securely and easily. You have the right to portability only for data that we process based on your consent, for the execution of a contract in which you are a party, or to take steps at your request before entering into a contract.

The Right Not to Be Subject to Automated Decision-Making (Including Profiling)

At the time we present this privacy notice, we do not process your data using automated decision-making.

If we process your data automatically in the future:

• You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you or significantly affect you in a similar way;
• However, you will not benefit from this right when the decision (i) is necessary for entering into or executing a contract between you and ELVO TECHNOLOGY S.R.L., (ii) is authorized by law, or (iii) is based on your explicit consent;
• If the decision is necessary for entering into or executing a contract between you and ELVO or is based on your explicit consent, you have the following rights: (i) the right to obtain human intervention in decision-making, (ii) the right to express your viewpoint, and (iii) the right to contest the decision;
• Our decisions based on automated processing, when permitted, will not involve special categories of personal data about you unless you have given explicit consent or processing is necessary for significant public interest reasons, based on the law.

The Right to Withdraw Your Consent

Where we process your data based on your consent, you have the right to withdraw your consent, at least as easily as it was given. You may do so at any time through the methods indicated in the section on how you can exercise your rights – the section WHAT ARE YOUR RIGHTS AND HOW TO EXERCISE THEM. If you withdraw your consent, this will not affect the legality of processing conducted before withdrawal.

The Right to Lodge a Complaint with the Supervisory Authority

In addition to any other rights regarding legal claims before courts or other authorities, you have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your data violates legal provisions. You may lodge a complaint with the supervisory authority in the EU member state where: (i) you have your habitual residence; (ii) your workplace is located; or (iii) the alleged infringement occurred. In Romania, the supervisory authority for data processing is the National Authority for the Supervision of Personal Data Processing (ANSPDCP). Their contact details are as follows:

Address: Bulevardul General Gheorghe Magheru no. 28-30, Sector 1, Bucharest, Romania, postal code 010336

Phone number (landline): 031 805 92 11

Fax number: 031 805 96 02

Email address: anspdcp@dataprotection.ro

Website: http://www.dataprotection.ro/

Annex No. 2

Your Right to Object

You have the right to object to the processing of your personal data when such processing is necessary for performing a task that serves the public interest, results from the exercise of public authority vested in us, or is necessary for our legitimate interests or those of a third party.

You also have the right to object to processing for direct marketing purposes.

Additionally, you have the right to object to processing for scientific or historical research purposes or for statistical purposes, except where such processing is necessary for fulfilling a task carried out for reasons of public interest.

You can exercise this right using the methods indicated in the section above on how you can exercise your rights – the section WHAT ARE YOUR RIGHTS AND HOW TO EXERCISE THEM.

To exercise the above-mentioned rights or for any additional information, you can contact us via:

i. Email, at: contact@elvo.io;

ii. Mail, at: Strada București-Ploiești, no. 1A, Bucharest Business Park, Building C, 4th Floor, Sector 1, Bucharest;

iii. Through your customer account, when this functionality becomes available on our website.