Elvan

Menu
Menu
Menu
roen
Linkedin-in Youtube Facebook-f Instagram

office@elvan.ro

Elvan Energy Platform Privacy Policy

Information regarding the processing of personal data – Within the Elvan Energy Management Platform

I. ABOUT THIS DOCUMENT

Elvan Factor Services S.R.L. is a limited liability company, with its registered office at 17 C.A. Rosetti St., 2nd floor, office BIR 201, sector 2, Bucharest, Romania, registered with the Trade Register under no. J2024012837407, having VAT No. RO34794186, hereinafter referred to as “Elvan” or “the Controller”.

Elvan offers its clients, legal entities, the Elvan Energy Management Platform, in desktop and mobile versions, for the purpose of enabling the client to manage benefit cards made available to the latter pursuant to the commercial agreement concluded between the parties.

This document is intended to transparently inform you about how Elvan processes your personal data in your capacity as an Account Administrator and Platform User, in the context of creating an account, using the Platform’s functionalities, or interacting with the available content. Elvan may also process minimal personal data that does not belong to an Account Administrator or Platform User, in the context of accessing the Platform without logging in or downloading the application without subsequent use and login.

This Privacy Policy addresses the manner in which personal data processing activities are carried out within the Platform, as a tool offered to individuals designated by a Client that has entered into a commercial agreement with Elvan, for the purpose of managing the resources provided by Elvan under the Agreement. This Privacy Policy should not be confused with the Privacy Policy applicable to the elvan.ro website, which is a presentation website and, where applicable, a website for submitting contact requests.

Elvan may periodically modify this document to reflect legislative changes or operational updates. In such cases, the revised version will be published in the dedicated section of the Platform. We recommend that you regularly review this document to stay informed about any changes.

II. MEANING OF CERTAIN TERMS USED IN THIS PRIVACY POLICY

In this Privacy Policy, we use the following terms with the meanings set out below:

  • GDPR refers to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
  • Personal Data means any information that identifies you directly or indirectly, in particular by reference to an identifier, such as your name, email address, contact details, information regarding browsing behavior on the website, and other data which, alone or in combination, may lead to your identification, etc.;
  • Data Subject – means any natural person whose data is processed by Elvan in the context of using the Platform, namely Account Administrators and Users. If you use the Platform, you are considered a data subject under data protection legislation.
  • Data Controller – is the entity that determines the purposes and means of processing personal data. In the case of the Platform, Elvan is the data controller responsible for processing the information collected through the Platform.
  • Terms defined in the Terms and Conditions of use of the Platform have the meaning set out therein and shall apply accordingly to this Privacy Policy.

III. PROCESSING DETAILS

In the context of using the Platform, we process your personal data for the following purposes:

III.1. Data Processed in the Context of Using the Platform

Depending on the context, we may process the following categories of Personal Data:

  • Identification data: such as first and last name;
  • Contact data: such as telephone number and email address;
  • Device and connectivity data: such as IP address, device identifiers (where available, including the MAC address, if collected), browser type and version, operating system, information regarding authentication and use of the Platform (for example, access date and time, session duration, functionalities used), as well as other technical information generated through the use of the Platform;

III.2. SOURCE OF PERSONAL DATA

The Controller indirectly processes the personal data of the Account Administrator through the Client, which provides the data necessary to grant access to the Platform. In addition, the Account Administrator provides the personal data of Users when a User Account is created on the Platform.

Furthermore, certain technical data is automatically generated as a result of accessing and/or using the Platform, including information regarding authentication, use of the Platform’s functionalities, and the device used to access it. Such data may also belong to data subjects who do not access the Platform under a pre-existing commercial agreement, namely in situations where the Platform is accessed or the application is downloaded without any subsequent login operation.

The Controller relies on the data provided being accurate, complete, and up to date, and on the person providing such data being authorized to do so. If there are indications that the data provided is incorrect, incomplete, or has been disclosed without authorization, the Controller reserves the right to take the necessary measures to remedy the situation, including requesting additional information, suspending access to the Platform, or taking other measures permitted by law and the applicable contractual documentation.

III.3. PURPOSE AND LEGAL BASIS FOR PROCESSING



PURPOSE OF PROCESSING

LEGAL BASIS
Creation and management of the account on the Platform
We use the personal data of persons designated by the Client/Account Administrator for the purpose of creating and maintaining an account on the Platform. Providing the requested data is not mandatory; however, without such data, you will not be able to access the Platform.		 Performance of the contract concluded between the Controller and the Client (Art. 6 (1) (b) GDPR)
Protection of interests and rights of any nature Legitimate interest (pursuing the interests / rights that Elvan has under or in connection with its relationship with you, or defending itself in the event of legal proceedings) (Art.6(1)(f) GDPR)

III.4. RECIPIENTS OF PERSONAL DATA

We may transmit or make your personal data available to:

  • Service providers involved in the technical operation and administration of the Platform, including hosting service providers, IT maintenance providers, web development service providers, digital performance analytics service providers, cybersecurity or backup service providers;
  • External consultants and contractual partners, such as auditors, accountants, lawyers, or specialized consultants, only where they need access to the data to provide the contracted services or to fulfill legal obligations;
  • Public authorities or regulatory institutions, where disclosure of the data is required by law or is necessary to defend Elvan’s legitimate rights and interests;
  • Third-party purchasers, in the context of a merger, demerger, transfer of business, or other similar corporate transactions, in compliance with confidentiality and data protection requirements.

All data transfers mentioned above are carried out by the Controller in compliance with the principles governing the processing of personal data, in particular the principle of data minimization. The Controller discloses to third parties only the personal data that is strictly necessary to achieve the purposes mentioned above.

III.5. RETENTION PERIOD FOR PERSONAL DATA

The Controller retains the personal data of Account Administrators and Users only for the period necessary to fulfill the purposes for which the data was collected, as well as thereafter, where retention is necessary to comply with applicable legal obligations or to protect the Controller’s legitimate rights and interests.

Personal data is generally retained for the duration of the contractual relationship between the Controller and the Client and for the duration of access to the Platform.

Following termination of the contractual relationship or deactivation of the Accounts, the Controller may retain certain personal data to the extent that this is necessary to comply with legal obligations regarding archiving, accounting and tax records, to resolve any potential disputes, or to exercise or defend a right in court.

Where an exact retention period cannot be established, it will be determined based on criteria such as the nature of the data processed, the purpose of the processing, applicable limitation periods, legal archiving obligations, or the existence of any disputes or investigations.

Upon expiry of the applicable retention periods and in the absence of a legal basis justifying the continued retention of the data, such data will be deleted, anonymized, or securely destroyed.

Upon request, the Controller may provide additional information regarding the applicable retention periods for each category of personal data.

IV. INTERNATIONAL TRANSFERS

In general, we retain Personal Data at our locations in Romania.

Where we disclose the information you provide to us to suppliers or other third parties in countries outside the EEA, we will take appropriate measures to ensure that adequate legal safeguards are in place in accordance with Chapter V of the GDPR (for example, the existence of an adequacy decision issued by the European Commission or the conclusion of standard contractual clauses approved by the European Commission, as applicable).

V. RIGHTS OF DATA SUBJECTS

Data subjects have the following rights in relation to the processing of their personal data:

  1. Right to rectification or updating of data: you have the right to have your Personal Data rectified, updated, or completed if it is inaccurate.
  2. Right of access: you have the right to obtain confirmation as to whether your Personal Data is being processed and information regarding the specific nature of such processing, such as the purpose, the categories of personal data processed, the recipients of the data / third parties who have access to your data, the period for which the data is retained, and your specific rights. You may also request a free copy of the data we process.
  3. Right to object: with regard to your Personal Data that we process based on our legitimate interest, you have the right to object (on grounds relating to your particular situation) to the future processing of your data. Your objection will also be assessed in relation to the specific legitimate interest applicable to the processing.
  4. Right to erasure: you may request the deletion of your personal data, and Elvan will proceed with the deletion when:
    • the personal data concerning you is no longer necessary for the purposes for which we collected and processed it;
    • you have withdrawn your consent to the continued processing of your personal data and we can no longer process such data on other legal grounds;
    • your Personal Data is processed unlawfully.
  5. Right to restriction of the use of your Personal Data: you may request that the processing of certain Personal Data concerning you be restricted, in the cases provided by law.
  6. Withdrawal of consent: you may withdraw your consent to the processing that you have given us, and you may block future processing if there is no other reason for us to believe that we may continue to process your Personal Data on other legal grounds.
  7. Right to data portability: you may ask us, where permitted by law, to transfer your data to another controller, if our system is compatible with such a system or, as applicable, to provide you with an electronically accessible copy of such data.
  8. Right to lodge a complaint: you may lodge a complaint regarding our processing with the National Supervisory Authority for Personal Data Processing (“ANSPDCP”), contact details available at www.dataprotection.ro, or, as applicable, with another competent authority at your place of domicile / residence or at the place where an infringement of your rights occurred.

PRIVACY POLICY UPDATES

Elvan reserves the right to periodically amend this Privacy Policy, particularly in the event of legislative changes, changes to the manner in which personal data is processed, or the development of the Platform’s functionalities.

In the event of significant changes, the Account Administrator and User will be informed through the Platform, by email, or through other means of communication used in the relationship with the Client.

The updated version of the Privacy Policy will be available on the Platform and will take effect from the date of publication or from the date indicated therein. Account Administrators and Users are encouraged to periodically review the Privacy Policy to stay informed about any changes.

Updated version: July 2026