PRIVACY POLICY

The personal data controller is:

SPOT CC S.R.L.

Registered office: Dumbrăvița, 98 Petofi Șandor Street, room 1, Timiș County

Trade Register no.: J2026036556009

Tax identification number: 54824915

Website: www.spotcc.ro

Email for personal-data requests: support@spotcc.ro

Hereinafter referred to as “SPOT”, the “Company”, or the “Controller”.

The Policy applies to persons who:

• access the spotcc.ro website;
• use the SPOT CC application or platform;
• complete a contact form;
• contact SPOT by telephone, email, WhatsApp, or other channels;
• make a reservation;
• enter into a rental agreement;
• use a SPOT location;
• enter areas under video surveillance;
• interact with SPOT online advertisements or campaigns, to the extent they have given consent for the relevant technologies.

Depending on how you interact with the SPOT platform, we may process the following categories of data.

3.1. Identification data

This may include:

• first and last name;
• home address;
• identity card series and number;
• personal identification number (CNP), when necessary for entering into and performing the contract;
• other identification data necessary for the contractual relationship.

We do not request more identification information than is necessary for the purpose for which it is collected.

3.2. Contact data

This may include:

• telephone number;
• email address;
• correspondence address;
• information provided through the contact form;
• conversations necessary for administering the reservation or contract.

3.3. Reservation and contract data

This may include:

• the reserved container;
• the location;
• the reservation date;
• the service start date;
• the contract duration;
• the rent amount;
• the deposit;
• payment history;
• contract status;
• cancellations;
• notifications;
• incidents;
• support requests;
• the relevant history of the contractual relationship.

3.4. Payment and billing data

We may process:

• the name of the payment holder;
• the amount;
• the payment date;
• the transaction identifier;
• IBAN, when necessary;
• data required for issuing the invoice;
• information regarding payments, refunds, and deposits.

When payment is made through an external payment provider, such as Stripe, full bank-card details are processed by that provider and are not normally stored by SPOT.

3.5. Account and Platform usage data

If you use a SPOT account, we may process:

• the account identifier;
• authentication data in secured form;
• reservation history;
• contract information;
• account preferences;
• activities relevant to account security;
• the date and time of certain operations.

3.6. Technical data

When you use the website or application, certain technical information may be collected automatically, such as:

• IP address;
• browser type;
• device type;
• operating system;
• date and time of access;
• pages accessed;
• technical identifiers;
• information regarding errors and Platform security;
• data regarding interaction with the website.

Some of this information is collected only after consent has been obtained for cookies or similar technologies.

3.7. Location-access data

For the operation and security of the service, we may process information associated with access, such as:

• the assigned Container;
• the access code or identifier;
• the date and time of certain access operations, if the system used records this information;
• access incidents;
• resets or changes to the access system.

Access codes and access methods are treated as confidential information.

3.8. Photographs relating to handover and return of the Container

Handover and return of the Container may be documented through photographs with a date and time, including “time-stamped” photographs.

These photographs are used for:

• confirming the condition of the Container;
• identifying any damage;
• resolving complaints;
• supporting any repair or cleaning costs;
• defending the rights of SPOT or the Client.

We recommend avoiding the unnecessary inclusion in these photographs of persons or belongings containing personal information.

The SPOT premises may be under video surveillance in:

• the access area;
• common areas;
• the exterior perimeter.

No surveillance cameras are installed inside the Containers.

Video surveillance is used for:

• the security of persons;
• protecting the Premises;
• preventing and investigating incidents;
• preventing vandalism and unauthorized access;
• establishing the circumstances of incidents;
• protecting the legitimate interests of SPOT and its customers;
• providing information to authorities where there is a legal obligation or lawful request.

The main legal basis for this processing is SPOT’s legitimate interest in protecting persons, property, and the security of the Premises.

Video recordings are ordinarily retained for a maximum of 30 days.

A specific recording may be retained for a longer period when necessary to investigate an incident, exercise or defend a right, or comply with a legal obligation.

Monitored areas are appropriately signposted.

The CCTV system is a general security measure and does not constitute an individual guarding service for stored belongings.

5.1. Responding to questions and requests

Data used:

• name;
• telephone;
• email;
• message content.

Purpose:

• responding to requests;
• providing information about SPOT services;
• preparing a possible contractual relationship.

The legal basis may be the person’s consent, the legitimate interest in responding to requests, or taking the steps requested before entering into a contract, as applicable.

5.2. Reservation and entering into the contract

The data is used for:

• identifying the Client;
• making the reservation;
• entering into the contract;
• assigning the Container;
• administering access;
• communicating the information necessary for using the service.

Legal basis:

Article 6(1)(b) GDPR, processing necessary for the performance of the contract or in order to take steps requested before entering into it.

5.3. Contract administration

The data may be used for:

• subscription management;
• payments;
• refunds;
• deposits;
• notifications;
• support;
• handover and return of the Container;
• incident resolution.

Legal basis:

performance of the contract and, where applicable, SPOT’s legitimate interests.

5.4. Billing and accounting or tax obligations

The data required for invoices and financial-accounting records is processed in order to comply with SPOT’s legal obligations.

Legal basis:

Article 6(1)(c) GDPR, compliance with a legal obligation.

5.5. Platform security and fraud prevention

We may process technical data, authentication information, and other data necessary for:

• securing the website and application;
• preventing unauthorized access;
• detecting fraud;
• diagnosing technical problems;
• protecting user accounts.

The legal basis is SPOT’s legitimate interest in ensuring the security of its services.

5.6. Protecting and exercising legal rights

Data may be retained and used when necessary for:

• resolving complaints;
• recovering amounts owed;
• resolving disputes;
• establishing damage;
• defending a right before a court or authority.

The legal basis is SPOT’s legitimate interest in protecting and exercising its rights.

SPOT may use Google services to measure traffic, analyze how the website is used, and measure campaign results.

Depending on the Platform configuration, these may include technologies such as:

• Google Analytics;
• Google Tag;
• Google Tag Manager;
• Google Ads services;
• conversion-measurement tools.

These services may process information such as:

• IP address;
• device and browser information;
• pages viewed;
• visit duration;
• interactions with the website;
• the source through which the user reached the website;
• events such as accessing the reservation page or completing an action.

Analytics or advertising tags that require consent will not be activated before the user has given consent for the relevant category.

Legal basis:

Article 6(1)(a) GDPR, consent.

Consent may subsequently be withdrawn from the cookie settings.

Tags used exclusively for technical verification of domain ownership, such as Google Search Console verification tags, are not in themselves used to track user behavior.

SPOT may use technologies provided by Meta Platforms, including Meta Pixel, for:

• measuring advertising results;
• conversion attribution;
• determining whether a person who saw or accessed an advertisement subsequently performed an action on the website;
• campaign optimization;
• creating audiences, depending on the user’s choices and consent.

These technologies may transmit to Meta information about interaction with the website, browser, device, and certain events performed on the Platform.

Meta Pixel and other marketing technologies that are not strictly necessary are activated only after the appropriate consent has been given.

Legal basis:

Article 6(1)(a) GDPR, consent.

The user may subsequently withdraw consent through the website’s cookie settings.

Meta tags used exclusively to verify SPOT’s right to administer the domain are not in themselves used to track user behavior.

SPOT may use contact data to send commercial communications only where an appropriate legal basis exists.

Where marketing is based on consent, the user may withdraw that consent at any time.

Withdrawal of consent for marketing does not affect the contract and does not prevent receipt of communications necessary for its performance, such as:

• confirmations;
• invoices;
• payment notifications;
• access codes;
• information regarding the Container;
• security notifications;
• information regarding termination of the contract.

The website uses cookies and similar technologies.

These may be divided into:

• strictly necessary cookies;
• functionality cookies;
• analytics cookies;
• marketing and advertising cookies.

Strictly necessary cookies may be used without consent where they are necessary to provide the requested service.

Analytics or marketing cookies and technologies are used only after consent has been obtained where such consent is required.

Detailed information regarding cookies is available in the Cookie Policy available on the website.

SPOT does not sell users’ personal data.

Data may be disclosed only where necessary to categories such as:

• hosting and IT infrastructure providers;
• providers supporting operation of the website and application;
• payment processors, including Stripe, if that service is used;
• email, SMS, or communication service providers;
• Google, where Google services are activated;
• Meta Platforms, where Meta services are activated;
• accounting and invoicing providers;
• technical providers of access systems;
• legal advisers;
• accountants, auditors, or other professionals subject to confidentiality obligations;
• insurance companies, where applicable;
• public authorities, police, courts, or other institutions where there is a legal obligation;
• other persons where disclosure is necessary for the exercise or defense of a right.

Where a provider processes data on behalf of SPOT, that provider will be used under appropriate contractual and security terms.

Some providers used by SPOT, including international digital-service providers, may process data outside the European Economic Area.

Where such a transfer takes place, SPOT seeks to ensure that it is carried out through a mechanism permitted by the GDPR, such as:

• a valid adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• other safeguards recognized by applicable law.

Data is not retained for longer than necessary for the purpose for which it was collected, except where the law requires a longer period.

Requests without a contract

Data from general requests or messages that do not lead to a contract is ordinarily retained for a maximum of:

3 months from the date of the message.

It may be retained for longer if the request gives rise to a dispute, complaint, or other justified reason.

Contract data

Data necessary for administering the Contract is retained for the duration of the contractual relationship.

After it ends, data necessary for establishing, exercising, or defending rights may generally be retained for up to:

3 years after the end of the contractual relationship, unless a different legal period applies or a dispute is ongoing.

Financial-accounting documents

Invoices and documents forming part of the financial-accounting records are retained in accordance with the mandatory periods provided by tax and accounting legislation.

At present, supporting documents underlying accounting entries are retained for 5 years calculated from 1 July of the year following the end of the financial year in which they were prepared, unless the law requires a different period.

Handover and return photographs

Photographs associated with the contract are retained for as long as necessary to verify its performance and, where applicable, for the period necessary to resolve complaints, damage, or disputes.

CCTV recordings

Maximum:

30 days, ordinarily.

Recordings necessary for investigating an incident may be extracted and retained separately until the relevant matter is resolved.

Data used for marketing

Until consent is withdrawn or until the data is no longer necessary for the relevant purpose, in accordance with the internally established periods.

Technical data and cookies

In accordance with the periods described in the Cookie Policy and the consent-management tool.

Certain information is necessary in order to make the reservation and enter into the Contract.

If the mandatory data is not provided, SPOT may be unable to:

• identify the Client;
• enter into the Contract;
• process payment;
• issue the necessary documents;
• provide access to the Container;
• perform the requested service.

Data used exclusively for marketing or analytics is not a condition for renting a Container.

SPOT does not ordinarily use solely automated decision-making processes that produce legal effects concerning the Client or similarly significantly affect the Client.

Google and Meta tools may perform analyses or segmentation for advertising in accordance with their own services and only within the limits permitted by the consent given by the user.

SPOT applies technical and organizational measures appropriate to the risks associated with processing.

These may include, as applicable:

• control of access to data;
• authentication and management of access rights;
• use of secure connections;
• restricting access to persons who need the data;
• backups;
• system updates;
• measures against unauthorized access;
• protection of access codes and systems;
• security-incident procedures;
• confidentiality obligations for persons with access to data.

No IT system can provide an absolute guarantee against all security risks, but SPOT seeks to use measures proportionate to the nature of the data processed.

Subject to the conditions provided by the GDPR, you have the following rights.

Right of access

You may request confirmation that SPOT processes your data and may request access to it.

Right to rectification

You may request correction of inaccurate information or completion of incomplete information.

Right to erasure

In the situations provided by law, you may request erasure of the data.

This right is not absolute. SPOT may retain certain data where there is a legal obligation or another legal basis for retaining it.

Right to restriction of processing

You may request temporary limitation of the use of data in the situations provided by the GDPR.

Right to data portability

For certain processing based on consent or contract and carried out by automated means, you may request provision of the data in a structured, commonly used, and machine-readable format.

Right to object

You may object to processing based on legitimate interest, subject to the conditions provided by the GDPR.

In the case of direct marketing, you may object at any time.

Right to withdraw consent

Where processing is based on consent, that consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights concerning automated decisions

You have the rights provided by the GDPR where a decision based solely on automated processing is used and produces legal effects or similarly significantly affects you.

Right to lodge a complaint

If you believe that your data has been processed in breach of applicable law, you may submit a request to SPOT.

You also have the right to lodge a complaint with:

The Romanian National Supervisory Authority for Personal Data Processing, ANSPDCP

Website: www.dataprotection.ro

Data-protection requests may be sent to:

SPOT CC S.R.L.

Dumbrăvița, 98 Petofi Șandor Street, room 1, Timiș County

Email: support@spotcc.ro

To protect personal data, in certain situations we may request reasonable additional information to verify the identity of the person making the request.

We will respond to requests within the time limits provided by applicable law.

If you provide SPOT with another person’s data, you must ensure that you have the right to provide that information and that the person concerned is appropriately informed where necessary.

SPOT rental services are intended for persons who have the legal capacity necessary to enter into a contract.

SPOT does not seek to intentionally collect children’s personal data through the rental service.

The website may contain links to websites or services operated by third parties.

SPOT does not control how those independent services process personal data.

Users are encouraged to consult the privacy policies of the relevant providers.

SPOT may update this Policy to reflect:

• legislative changes;
• changes to the services;
• the introduction of new features;
• changes to providers;
• the introduction or removal of analytics and marketing tools;
• changes to data-processing practices.

The current version will be permanently published on www.spotcc.ro.

In the event of significant changes, users may also be informed by other reasonable methods.

For questions, requests, or the exercise of rights concerning personal data:

SPOT CC S.R.L.

Dumbrăvița, 98 Petofi Șandor Street, room 1, Timiș County

Tax identification number: 54824915

Trade Register: J2026036556009

Website: www.spotcc.ro

Email: support@spotcc.ro