The protection of your personal data is very important to us. This notice describes our practices regarding the collection and use of your personal data by us – for example, what data we collect, why and for what purpose, and explains the rights you have in relation to personal data.
In this document, you can find information on the following topics:
- WHO WE ARE
- HOW WE COLLECT YOUR PERSONAL DATA
- HOW WE SHARE INFORMATION
- TRANSFERS OF INFORMATION OUTSIDE THE EUROPEAN UNION
- SECURITY
- YOUR RIGHTS
- CHANGES TO THIS NOTICE
- CONTACT INFORMATION
1. WHO WE ARE
The loyaltyday.ro website is owned by Mediaposte Hit Mail, a joint-stock company with its registered office at Str. Siriului, nr. 42-46, 3rd floor, Sector 1, Bucharest, registered with the Bucharest Trade Register Office under number J40/ 8295/ 2000, tax code RO13351917. We collect and process various categories of personal data from you, which, in accordance with the European Union legislation on personal data protection, gives us the capacity of data controller for such data.
2. HOW WE COLLECT YOUR PERSONAL DATA
Personal data may be collected or accessed in several ways, including:
- directly from you (for example, by signing a contract, filling in a form on the website or calling us on the phone);
- automatically (for example, data we observe when you browse our website, mhm.ro – e.g. cookies, IP etc.);
- from third parties (for example, your employer, your representative or from public sources such as a company’s website, an internet search or social media platforms such as LinkedIn, Facebook etc.).
2.1. Data provided directly by you
We may collect data that you provide directly. This will usually happen when you:
- purchase our products or services;
- contact us through the contact forms on our website, by email, by phone, by chat or through social media platforms;
- enter into an agreement with us to provide us with products or services;
- enter into an agreement with us for us to provide you with products or services;
- attend an event organized by us;
- sign up to receive marketing communications from Mediaposte Hit Mail;
- visit us at our headquarters and offices.
2.2. Data collected automatically
We may collect data about you automatically. This will usually happen when you:
- communicate with us (for example, through social platforms);
- make public posts on the social media platforms we follow (for example, in order to respond to requests regarding Mediaposte Hit Mail products and services).
We may also automatically collect data about you through the use of cookies and similar tracking technologies. The way we use tracking technologies (such as cookies and others not based on cookies, such as web beacons) on our website is described in the Cookie Policy section.
2.3. Data provided by third parties
Where permitted by law, we may obtain data about you from third parties, for example, publicly available profile information (such as your preferences and interests) from third-party social media sites (such as Facebook).
We may also collect data in other contexts that are brought to your attention at that time.
Data about you received from other people, in connection with the Loyalty Day event
In two situations related to the Loyalty Day event we receive data about you not directly from you, but from another person. We inform you here, in accordance with Article 14 of Regulation (EU) 2016/679, and we inform you again, briefly, in the first message we send you:
- Nomination as an attendee: the person or company that bought one or more tickets sends us the first name, last name, company, role, email address and phone number of the people who will actually attend. We use this data to register you as an attendee, to send you the ticket and the practical information about the event, and to welcome you at the entrance. The legal basis is the performance of the contract concluded with the buyer and our legitimate interest in organizing the event. The source of the data is the buyer of the ticket, usually your employer or one of your colleagues.
- The approval request: a person who wants to attend can send us, together with their contact details, the email address of the person who has to approve their attendance (for example, a manager). The request reaches our team and is not automatically forwarded to anyone; a member of our team contacts you once, to present the event and your colleague’s request. We do not add your address to any commercial communications list. The legal basis is our legitimate interest in responding to the request received. The source of the data is the person who made the request.
In both situations you have all the rights described in section 6, including the right to object to the processing and to ask us to delete the data, by writing to us at the addresses in section 8. Nomination data is kept for the period needed to organize and run the event and to fulfill the obligations arising from it, in accordance with section 5.
What data do we collect about you?
- data needed to provide you with our services and products;
- data you give us in forms and contracts;
- data you give us in phone calls;
- data you give us in the emails you send us;
- data you give us in the chat requests you send us;
- data about your preferences and interests;
- data needed to respond to your requests and complaints;
- data needed to manage and administer our relationship with you;
- data needed for the purchase of products or services;
- information about what you do through your activity that relates to our clients, to our products and services, or to us.
The data we collect directly from you will be evident from the context in which you provide it. For example:
- if you request information about one of our services, using the forms on our website, you provide us with your name, contact details, company name and the services you are interested in;
- if you are a supplier, in order to manage our relationship with you or with your employer, you provide us with your name, contact details, billing details and details about products/services so that we can fulfill our contractual obligations;
- you can give us information about your preferences and interests so that we can invite you to events that might interest you.
The data we collect automatically will generally concern:
- details about your call (such as, for example, the time and duration);
- your device (such as, for example, your IP address or the unique identifier of the device, details about any cookies we have stored on your device etc.).
The data we collect from third parties will generally consist of publicly available information (such as role, preferences and interests), for example obtained from posts on social media platforms.
For what purpose do we use your data and on what legal basis?
Depending on the nature of our relationship with you, we may use information about you for the following purposes:
- To comply with legal obligations, such as archiving data in accordance with the applicable legislation or paying taxes and fiscal contributions;
- To sell you our products and services;
- To send you offers of relevant products/services, based on advanced analyses of your interests;
- To defend our rights and interests in court;
- To manage the contractual relationship with you;
- To ensure compliance with the laws in the field, such as those regarding the keeping and use of your records in connection with any anticipated litigation, for the purpose of obtaining legal advice from lawyers or other consultants;
- To purchase products or services from you;
- To respond to requests for information;
- To inform you about our products, services, promotions and events;
- For other purposes that we bring to your attention or that will be clear from the context, at the moment the information about you is first collected.
The legal basis for using data about you is one of the following:
- compliance with a legal obligation to which we are subject;
- the performance of a contract to which you are a party;
- our legitimate interest, which is not overridden by the interests you have in protecting your personal data;
- your consent, which we will request before processing the data.
The purposes for which we use information about you, together with the corresponding collection methods and the legal basis for use, are:
| Purpose | Collection method and legal basis for processing |
|---|---|
| Compliance with regulatory obligations • tax and accounting obligations • health and safety management • requests for disclosure of information under the law and regulatory rules • conflicts of interest • keeping contracts and related documents in which reference may be made to you |
This information is generally provided to us by you directly at the moment a relationship is established between us or you interact with us. We use this information because we need it to carry out our activity in accordance with the law (including company legislation and the fiscal code), to keep financial and fiscal records, to comply with trade sanctions, to comply with health and safety legislation (which may include keeping records of incidents), to prepare reports, to respond to requests for information from the competent authorities and to manage any conflicts of interest. |
| Purchasing products or services • establishing contact with you or your employer while you provide us with products or services • processing payments • relationship management |
We will generally receive this information either directly from you or through your employer (usually name, role, company address, work email address, orders, services, payment information, (where applicable, details about expenses), correspondence). We use this information to perform the contract concluded with you or your employer as a buyer of your or your employer’s products or services, or as our client or, where there is no such legal obligation, we use this information because we have a legitimate interest in carrying out our activity, in contacting you in connection with the products or services we receive from you or from your employer, or in connection with the products and services we provide to you, in processing payments and in managing the relationship with you or your employer, an interest which is not overridden by your interests, rights and freedoms to protect the information about you. |
| Selling our products and services • establishing contact with you or your employer while we provide you with products or services • fulfilling orders (including sending invoices) • processing your payments • relationship management |
This information is generally provided to us by you directly or by your employer, as the case may be (usually name, role, company address, work email address, orders, payment information, correspondence). We use this information to fulfill our contractual obligations towards you or your employer as a buyer of our products. |
| Commercial promotion and relationship management (where the law permits) • sending you information about relevant updates, promotions and events • managing our relationship |
This information is generally provided to us by you directly or by your employer, as the case may be (usually name, role, company address, work email address). We use this information because we have a legitimate commercial interest in managing the relationship between us and in informing you about our activity, products and events, an interest which is not overridden by your interests, rights and freedoms to protect the information about you. |
| Business administration • general organizational management and keeping of commercial records • administering and organizing events • correspondence related to our relationship with you or with your employer, including to handle your requests for information or your applications • developing, implementing, operating and maintaining IT systems • ensuring the security of systems, devices and buildings • operating a safe working environment • maintaining the security and safety of the staff, clients, suppliers, visitors and assets belonging to Mediaposte Hit Mail |
We will generally receive the information either directly from you or from your employer. We use this information because we have a legitimate commercial interest in carrying out our activity, in managing our relationship with you and in maintaining the security and integrity of our buildings and IT systems, an interest which is not overridden by your interests, rights and freedoms to restrict the use of the information about you. |
| Security and systems monitoring • control systems and authentication and access logs, where applicable |
This information is collected automatically through various means. We use this information because we have a legitimate commercial interest in ensuring the confidentiality, integrity and security of our physical and digital infrastructure and of our locations, an interest which is not overridden by your interests, rights and freedoms to protect the information about you. |
| Support in achieving all the purposes above • corresponding with you • improving your experiences • administration and troubleshooting |
These are generally a combination of information you give us (for example, contact details) and information we collect automatically (for example, information about your device and cookies and similar tracking technologies). We use this information on the legal bases corresponding to the purpose for which we use the information being supported. |
In some cases, we may use data about you in ways that are not described above. In that case, we will provide an additional privacy notice explaining that use.
3. HOW WE SHARE DATA
We may share data about you with:
- Third parties that provide products or services to us or to you (such as payment service providers, courier service providers, retailers, information service providers, IT security services and other outsourced service providers, such as off-site storage and cloud storage service providers;
- Third parties, if necessary or permitted by law, for example: regulatory authorities, government departments, in response to a request from law enforcement authorities or other government officials, when disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity, and in the context of organizational restructuring.
4. TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION
As a general rule, personal data will not be transferred outside the EU. However, if it is necessary to transfer personal data to countries outside the EEA, we will take the necessary measures to ensure the adequate level of protection and security in relation to the applicable laws, including by introducing standard contractual clauses in the contracts covering that transfer.
5. SECURITY
How do we protect your data?
We implement appropriate technical and organizational measures to protect the personal data we hold against unauthorized disclosure, use, alteration or destruction. Where appropriate, we use encryption technologies and other technologies that can help secure the information you provide. We also require our service providers to comply with strict data confidentiality and security requirements.
How long will the information about you be kept?
We will keep the information about you for the period necessary to fulfill the purposes for which the information was collected. After that, we will delete it. The period will vary depending on the purposes for which the information was collected. In certain circumstances, you have the right to ask us to delete the information. Also, we are sometimes legally required to keep the information, for example, for tax and accounting purposes.
We normally retain data according to the criteria described in the table below:
| Type | Explanation/typical retention criterion |
|---|---|
| • information recorded in the database | If you have provided us with services, most of the information relating to you is kept for the duration of the relationship with you; for example, as long as you continue to provide services or to respond to our communications. However, certain elements, such as the purchase history, will naturally expire after a period of time, so we will delete them automatically after defined periods of time, depending on the purpose for which we collected them. |
| • commercial and payment records | We keep records of invoices, sales, purchases, payments made and received and related documents (such as contracts and emails) in accordance with the requirements of company legislation and the fiscal code, usually for 11 years. We will also keep records of the checks carried out on suppliers for as long as necessary to comply with our legal and regulatory obligations. |
| • purchases | If you purchase services, we will retain the details of that transaction for as long as needed to perform the contract and to comply with any legal obligations (for example, for the purpose of keeping tax and accounting records). |
| • system audit logs | System audit logs are usually kept for a period of only a few months. |
6. YOUR RIGHTS
Under the law, you have the following rights with regard to the personal data we process about you:
- The right of access: you can obtain from us confirmation that we are processing your personal data, as well as information regarding the specifics of the processing. This right allows you to obtain, free of charge, a copy of the personal data processed, as well as any additional copies for a fee.
- The right to rectification: you can ask us to amend your incorrect personal data or, as the case may be, to complete data that is incomplete.
- The right to erasure: you can request the deletion of your personal data when: (i) it is no longer necessary for the purposes for which we collected and processed it; (ii) you have withdrawn your consent to the processing of the personal data and we can no longer process it on other legal grounds; (iii) the personal data is processed contrary to the law; or (iv) the personal data must be deleted in accordance with the relevant legislation.
- The right to object and the withdrawal of consent (where applicable): you can object to the processing on grounds relating to your particular situation, or you can withdraw at any time your consent regarding the processing of personal data processed on the basis of consent, without this affecting in any way the processing carried out before the withdrawal.
- The right to restriction: you can request the restriction of the processing of your personal data if: (i) you contest the accuracy of the personal data, for a period that allows us to verify the accuracy of the data in question; (ii) the processing is unlawful and you object to the deletion of the personal data, requesting instead the restriction of its use; (iii) we no longer need the data for processing, but you request it for a court action; or (iv) if you have objected to the processing, for the period of time during which it is verified whether the legitimate interests of the company as a controller prevail over your rights as a data subject.
- The right to portability (where applicable): you can ask us, under the conditions of the law, to provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format. Also, if you expressly ask us, we can transmit your personal data to another entity, if technically possible.
- The rights related to automated decisions, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them: Mediaposte Hit Mail does not carry out such profiling followed by automated decisions with legal or similarly significant effect for the data subject.
- The right to lodge a complaint with the supervisory authority: you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing if you consider that your rights have been infringed. Contact details: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, anspdcp@dataprotection.ro.
Consent may be withdrawn at any time. This withdrawal of consent does not affect the lawfulness of the processing up to that moment, but from the withdrawal of consent, Mediaposte Hit Mail will stop processing the data in question.
To exercise your rights, please contact us using the contact details mentioned in section 8 below.
7. CHANGES TO THIS NOTICE
We may update this notice (and any additional privacy notice) from time to time. We will notify you of changes when we are required to do so by law.
8. CONTACT INFORMATION
If you have any questions about this notice or wish to exercise your rights as set out above, you can contact us using the following contact details:
Correspondence address: Strada Siriului, nr. 42-46, 3rd floor, Sector 1, Bucharest.
Email: office@mhm.ro
Phone: +40212244020
Last updated: August 21, 2026