1. Applicable Legal Framework:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC;
Law no. 190/2018 on measures for the implementation of Regulation (EU) 2016/679;
The Civil Code (Law no. 287/2009).

2. Identification details of the operator and its representatives:
Company INOVO TIM LC S.R.L. (CUI 48341738), headquartered at Strada Romanilor no. 4, Bl. A, Floor 3, Ap. 22, Giroc, Timiș, legally represented by Mrs. Loredana Iscrulescu.
Email: contact@inovoplay.ro
Website: www.inovoplay.ro
Phone: 0758 324 921
Data Protection Officer (DPO): contract@inovoplay.ro

3. Categories of personal data processed:
Images/videos captured by the video surveillance system of the InovoPlay playground;
Identification data (name, surname, personal ID number, ID/passport series and number);
Home/residence address;
Contact details including phone number, email address, correspondence;
Payment details (banking information, IBAN, credit card details, billing address);
Any documents containing such data.

4. Purpose of processing personal data:
The operator will process personal data such as name, surname, email address, and phone number for the purpose of making reservations and responding to inquiries submitted via the contact form on www.inovoplay.ro. The data subject will be contacted via phone/email by representatives of INOVO TIM LC S.R.L.

Personal data such as name, surname, address, personal ID number, ID series and number, and bank account details will be processed for the purpose of issuing invoices related to the rental of the playground under the commercial name InovoPlay and will be stored in accordance with accounting laws.
InovoPlay expressly undertakes to manage all data securely, confidentially, and solely for declared purposes. Personal data will not be made available to any third party, except public authorities and only in legally permitted circumstances.

5. Legal basis for processing:

• Art. 6(1)(a) GDPR – Consent freely given for the purposes declared in this information notice.

• Art. 6(1)(b) GDPR – Necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract.

• Art. 6(1)(c) GDPR – Compliance with legal obligations under accounting and tax legislation (e.g., issuing fiscal invoices, receipts).

6. Storage and processing period:
Personal data will be stored and retained by the operator for 10 (ten) years, in accordance with applicable accounting laws, and then deleted.
If the retention period is modified due to legislative changes, the operator will comply with the new legal requirements.

The operator may process certain data such as name, surname, email address, and phone number for 12 (twelve) months after contract termination if they wish to send marketing communications (e.g., personalized offers, email/SMS messages on special occasions like birthdays, promotions, or recommendations).

7. Data subject rights:
This notice clearly informs the data subject of the following rights:

• Right of access to their personal data

• Right to rectification

• Right to erasure (“right to be forgotten”)

• Right to restriction of processing

• Right to object to processing

• Right to data portability

• Right not to be subject to automated decision-making, including profiling

• Right to notify recipients of rectification, erasure, or restriction of data

• Right to withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal

The data subject has the right to withdraw consent at any time. Withdrawal is as easy as giving consent and does not affect prior processing.
Data subjects also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) at B-dul G-ral Gh. Magheru 28-30, Sector 1, Postal Code 010336, Bucharest.