RA DELIVERY legal

Privacy Policy

This policy explains how RA DELIVERY (PEROMA HUMAN RESOURCES SRL) processes the personal data of customers, visitors, merchants, couriers, fleets and Business users: data categories, purposes and legal bases, retention, security and data subject rights.

Operator details

Operator: PEROMA HUMAN RESOURCES SRL
CUI: 45080395
Trade Register No.: J2021001969330
EUID: ROONRC.J2021001969330
Registered office: Str. Mihail Sebastian 31 Bl. S8 Sc. 1 Ap. 27, Sector 5, Bucharest
Postal code as provided: 05077

Preamble

Processing of the data of Customers, visitors, Merchants, Couriers, Fleets and Business users

RA DELIVERY processes only the data necessary for the account, orders, delivery, payment, safety, support, legal obligations and the development of the service. Full payment data are processed by authorised providers and are not stored by RA DELIVERY when the technical integration uses tokenisation.

Public document prepared for use on the RA DELIVERY website and in the RA DELIVERY applications. Mandatory rights provided by law prevail over any contrary contractual provision.

1. Controller and scope — 12. Recipients
2. Data subjects — 13. Roles of partners
3. Sources of data — 14. International transfers
4. Categories of data — 15. Retention
5. Purposes and legal bases — 16. Security
6. Geolocation — 17. Rights
7. Payments and anti-fraud — 18. Marketing
8. Sensitive orders — 19. Minors
9. Ultra and Business — 20. Changes
10. Reviews and support — 21. Contact and complaints
11. Automated decisions

1. Controller and scope

1.1. PEROMA HUMAN RESOURCES SRL is the main controller for radelivery.com and the RA DELIVERY functions. In certain operations, the Merchant, the Fleet, the Business Organisation or the payment provider may be an independent controller or a processor, according to the role described below.

Privacy: [email protected]

Data Protection Officer: [email protected]

2. Data subjects

Customers, recipients of orders and visitors of the website;
representatives, staff and users of Merchants and Fleets;
Couriers, activation applicants and persons who deliver through a Fleet;
administrators, users and recipients of Business and Drive organisations;
persons who contact support, report content or take part in promotions;
job applicants, to whom the dedicated candidate notice also applies.

3. Sources of data

3.1. The data come directly from the data subject, from the Organisation or the Fleet that authorises them, from the use of the Platform, from the Merchant and the Courier for the execution of the order, from payment and verification providers, from public registers and from authorities, within the limits of the law.

4. Categories of data

Category: Identification and account — Examples: name, telephone, e-mail, encrypted password, address, language, preferences, account identifiers — Data subjects: Customers, Couriers, partners, Business
Category: Order and delivery — Examples: products, quantities, instructions, address, geolocation, time, status, Merchant, Courier, proof of handover — Data subjects: Customers, recipients, Couriers, Merchants
Category: Payment and fiscal — Examples: tokenised method, last digits, authorisations, transactions, refunds, invoices, IBAN, earnings, tax code — Data subjects: Customers, Merchants, Couriers, Fleets, Business
Category: Professional identity — Examples: documents, right to work, contract with the Fleet, driving licence, vehicle, insurance, authorisations, representation — Data subjects: Couriers, Fleets, Merchants
Category: Technical and usage — Examples: IP, device, operating system, version, logs, sessions, cookies, errors, interactions — Data subjects: all digital users
Category: Communications and content — Examples: chat, e-mail, calls recorded after notice, support photographs, reviews, disputes — Data subjects: Customers, Couriers, partners
Category: Safety and compliance — Examples: incidents, fraud, chargebacks, warnings, suspensions, DSA reports, investigations — Data subjects: all relevant categories
Category: Marketing — Examples: consents, preferences, campaigns, opens, interactions and audiences, if activated — Data subjects: persons who receive marketing

5. Purposes and legal bases

Purpose: Creation and administration of the account — Main legal basis: performance of the contract; legitimate interest in security — Usual data: identification, contact, device
Purpose: Placing, preparing and delivering the order — Main legal basis: performance of the contract; pre-contractual steps — Usual data: order, address, location, contact, payment
Purpose: Payments, refunds, invoices and settlements — Main legal basis: contract; legal obligation; legitimate interest — Usual data: transactions, fiscal, IBAN, earnings
Purpose: Support, complaints and incidents — Main legal basis: contract; legitimate interest; legal obligation — Usual data: communications, order, evidence, suspensions
Purpose: Fraud prevention and security — Main legal basis: legitimate interest; legal obligation — Usual data: account, device, payment, location, usage
Purpose: Compliance with the law, the DSA and requests from authorities — Main legal basis: legal obligation; defence of rights — Usual data: data relevant to the request
Purpose: Improvement, analysis and testing — Main legal basis: legitimate interest; consent for optional technologies — Usual data: usage, errors, aggregates, feedback
Purpose: Marketing and commercial personalisation — Main legal basis: consent or legitimate interest, depending on the channel and the law — Usual data: contact, preferences, orders, interactions

6. Geolocation

6.1. The Customer may allow location for selecting the address and displaying the local offer. The address may also be entered manually. The Courier's exact location may be processed while the Courier is online and for the duration of the order, for offering, routing, estimated time, tracking, safety, payment and anti-fraud.

6.2. The Customer sees the Courier's operational location only in connection with an active order. After completion, the location is not displayed to the Customer and is retained only in accordance with the periods necessary for legitimate and legal purposes.

7. Payments and anti-fraud

7.1. Authorised providers process the full card data. RA DELIVERY receives tokens, statuses, last digits and the information necessary for the transaction. Anti-fraud systems may analyse the account, the device, the location, the history and unusual patterns.

7.2. A block with significant effect is subject to human review upon request. The person may contest it, provide explanations and obtain intelligible information about the main factors, within the limits of fraud prevention and the rights of third parties.

8. Sensitive orders

8.1. An order may indirectly reveal health, religion or other sensitive information. RA DELIVERY does not intentionally infer such categories for marketing. The data are used for the execution of the order, with additional safeguards and, where necessary, explicit consent.

9. Ultra and Business

9.1. For Ultra we process activation, tariff, renewal, eligibility, use of benefits and cancellation. For Business, the Organisation may receive reports about the orders it pays for, in accordance with the policies communicated to the user.

10. Reviews and support

10.1. Reviews are internally linked to a completed order for verification purposes and may be published in a limited form. Support messages, photographs and calls are processed for resolution, quality, safety and the defence of rights. Calls are recorded only after notice.

11. Automated decisions

11.1. Algorithms may support classification, offering, routing, fraud detection, support and moderation. Where an exclusively automated decision produces legal or similarly significant effects, RA DELIVERY applies the safeguards provided by the GDPR: information, human intervention, expression of the person's point of view and contestation.

12. Recipients

the Merchant that prepares and sells the order;
the Courier or the Fleet that performs the delivery;
the Business Organisation that authorises or pays for the order;
providers of payments, cloud, maps, messaging, support, security, analytics and verification;
legal advisers, accountants, auditors and insurers;
authorities, courts and competent bodies where a legal basis exists;
acquirers or successors in the event of a reorganisation, with confidentiality safeguards.

13. Roles of partners

13.1. The Merchant is an independent controller for sale, invoicing, safety and complaints. The Courier or the Fleet processes the data for delivery and for its own obligations. For Drive, the commercial annex establishes whether RA DELIVERY acts as a controller or as a processor for the recipient's data.

14. International transfers

14.1. The data are kept primarily within the European Economic Area. If a provider processes them in a third country, RA DELIVERY uses an adequacy decision, standard contractual clauses, additional measures or a legal derogation, and provides information upon request.

15. Retention

15.2. The periods are adjusted according to purpose, legal obligation, limitation period, litigation, security and the need for minimisation. Upon expiry, the data are deleted, anonymised or archived with restricted access.

Category: Active account — Indicative period: for the duration of the account and thereafter as long as necessary for requests and obligations
Category: Orders, invoices and fiscal records — Indicative period: in accordance with the applicable fiscal and accounting terms
Category: Tokenised payment data and refunds — Indicative period: for the duration necessary for the transaction, the chargeback and the defence of rights
Category: Security and anti-fraud logs — Indicative period: ordinarily up to 24 months, longer if there is an incident or litigation
Category: Communications and complaints — Indicative period: up to 3 years after resolution, or as long as the litigation requires
Category: Courier and Merchant data — Indicative period: for the duration of the collaboration and thereafter in accordance with fiscal, contractual and legal obligations
Category: Consent and marketing — Indicative period: until withdrawal and thereafter proof of the preference for the legal term

16. Security

16.1. The measures include access control, encryption in transit and, where appropriate, at rest, tokenisation, backups, logging, segregation of roles, vulnerability testing, incident response and confidentiality obligations.

17. Rights

17.2. Requests are sent to [email protected] or [email protected]. RA DELIVERY may request proportionate information to verify identity and responds within the period provided by the GDPR.

access to and a copy of the data;
rectification of inaccurate data;
erasure, where there is no reason for retention;
restriction of processing;
portability of the data provided, under the conditions of the law;
objection to legitimate interest and, at any time, to direct marketing;
withdrawal of consent without affecting prior processing;
human intervention and contestation of significant automated decisions;
complaint to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (the Romanian National Supervisory Authority for Personal Data Processing).

18. Marketing

18.1. Electronic marketing is sent under the conditions of the law and can be stopped from the settings, by unsubscribing or by contacting us. Messages about orders, security, contractual changes and the requested service are transactional and continue for as long as they are necessary.

19. Minors

19.1. Customer accounts are intended for persons of at least 18 years of age. RA DELIVERY does not seek to intentionally collect children's data for ordering accounts and does not use the profiling of minors for advertising.

20. Changes

20.1. The policy may be updated for changes to the service or to the law. Significant changes are communicated through the Platform, by e-mail or through another appropriate channel before their entry into force, where necessary.

21. Contact and complaints

Controller: PEROMA HUMAN RESOURCES SRL

Registered office: Str. Mihail Sebastian 31, Bl. S8, Sc. 1, Ap. 27, Sectorul 5, București, postal code 05077