Privacy Notice
This Notice explains what personal data is processed in connection with this website, for what purposes, upon what legal basis, and for how long. It is given pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 and Romanian Law no. 190/2018.
1. Identity of the controller
1.1 The controller is Ars Amorata International SRL, a company incorporated under the laws of Romania, having its registered office at Calea Moșilor 88, Bucharest, Romania, registered with the Trade Register under number J2023024518405, sole registration code (CUI) 49314839 (the "Controller").
1.2 Enquiries may be addressed to info@arsamorata.com.
1.3 Mr Sorin Dinca has been appointed as representative pursuant to Article 27 of Regulation (EU) 2016/679 and may be contacted at Calea Moșilor 88, Sector 3, Bucharest or info@arsamorata.com. Data subjects may address the representative on all matters relating to the processing of their personal data, in addition to or instead of the Controller.
2. Scope
2.1 This Notice applies to personal data processed in connection with the website at arsamorata.com, the course known as The Way of the Amorati, correspondence with the Controller, and the mailing list operated from this site.
2.2 The private programmes offered at zanperrion.com are the subject of a separate notice published upon that site.
3. Categories of data, purposes and legal bases
3.1 Purchasers of the course
Name, electronic mail address, country, and payment reference are processed for the purposes of supplying the course, providing access, and meeting accounting obligations. The legal bases are Article 6(1)(b), performance of a contract, and Article 6(1)(c), compliance with a legal obligation. Card details are handled by the payment processor and are not retained by the Controller.
Retention: for the duration of access, and thereafter for the period required by Romanian accounting legislation, being ten years from the end of the financial year to which the transaction relates.
3.2 Subscribers to the mailing list
Electronic mail address only. The legal basis is Article 6(1)(a), consent, which may be withdrawn at any time by the unsubscribe link at the foot of every message or by writing to the Controller. Withdrawal does not affect the lawfulness of processing carried out before it.
Retention: until consent is withdrawn, or after 2 years without engagement, whichever occurs first.
3.3 Correspondence
Messages sent to the Controller, and the addresses from which they are sent, are processed for the purpose of responding and of maintaining a record. The legal basis is Article 6(1)(f), the legitimate interests of the Controller in answering enquiries and keeping accurate records.
Retention: 3 years from the conclusion of the correspondence.
3.4 Members of the Amorati
Where a person holds a subscription to the Amorati, the Controller processes contact details, subscription and payment records, and any material that person contributes to the members' platform, for the purposes of providing the membership and meeting accounting obligations. The legal bases are Article 6(1)(b) and Article 6(1)(c).
Retention: for the duration of the membership and thereafter as set out at clause 3.1
3.5 Technical data
The Site and its hosting provider record internet protocol addresses, browser characteristics, and pages accessed. The legal basis is Article 6(1)(f), the legitimate interests of the Controller in the security and proper functioning of the Site. Cookies are addressed in the Cookie Notice.
4. Provision of data
4.1 The provision of personal data is not a statutory requirement. It is a requirement necessary in order to purchase the course or to receive the mailing list, and neither can be supplied without it.
4.2 No decision producing legal effects concerning a data subject, or similarly significantly affecting him, is taken by automated means.
5. Recipients
5.1 Personal data are not sold, let, traded or otherwise transferred to third parties for those parties' own marketing.
5.2 Personal data may be disclosed to the following categories of recipient, each acting as a processor upon the documented instructions of the Controller pursuant to Article 28:
- Zumedia.ro, providing hosting and related infrastructure;
- Brevo, providing electronic communication services;
- Amorati.me, providing delivery of the course;
- Stripe, providing payment processing;
- professional advisers, including accountants and legal counsel, where necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
5.3 Personal data may further be disclosed to competent public authorities where required by law.
6. Transfers to third countries
6.1 Certain recipients identified at clause 5.2 are established outside the European Economic Area. Where personal data are transferred to a third country, such transfer is effected on the basis of an adequacy decision pursuant to Article 45, or on the basis of standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c), together with such supplementary measures as may be appropriate.
6.2 A copy of the safeguards relied upon may be obtained by written request.
7. Rights of the data subject
7.1 Subject to the conditions and exceptions provided by Regulation (EU) 2016/679, a data subject has the right:
- to obtain confirmation as to whether personal data concerning him are processed and, where so, access to those data and to the information specified in Article 15;
- to obtain rectification of inaccurate data and completion of incomplete data, pursuant to Article 16;
- to obtain erasure, pursuant to Article 17;
- to obtain restriction of processing, pursuant to Article 18;
- to receive data provided by him in a structured, commonly used and machine-readable format, pursuant to Article 20;
- to object at any time to processing carried out on the basis of Article 6(1)(f), pursuant to Article 21;
- to withdraw consent at any time where processing rests upon Article 6(1)(a).
7.2 Requests may be addressed to info@arsamorata.com or to the representative identified at clause 1.3. The Controller shall respond without undue delay and in any event within one month of receipt, which period may be extended by two further months where necessary.
7.3 A data subject who considers that processing infringes the Regulation has the right to lodge a complaint with a supervisory authority. The competent authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, dataprotection.ro. A complaint may also be lodged with the authority of the data subject's own country of residence.
8. Security
8.1 The Controller implements appropriate technical and organisational measures pursuant to Article 32, including encryption of data in transit and restriction of access to those requiring it for the purposes identified at clause 3.
8.2 No method of transmission or storage is entirely secure, and no warranty of absolute security is given.
9. Minors
9.1 The Site and the course are directed exclusively to persons aged eighteen years or over. The Controller does not knowingly process the personal data of any person below that age, and shall erase such data without undue delay upon becoming aware of it.
10. Amendment
10.1 This Notice may be amended from time to time. The version in force is that published upon this page, bearing the version number and effective date above. Where an amendment materially affects the rights of subscribers to the mailing list, notice shall be given by electronic mail.