GDPR

PERSONAL DATA PROCESSING INFORMATION NOTICE

Applicable to www.selectbaits.com | Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR)

1. Identity of the Data Controller

SC BIG FISH ARTICOLE DE PESCUIT & NADA SRL, VAT No. RO17382878, registered address: Sos. Iancului nr. 132, bl. 121A, Sect. 2, Bucuresti, 021729, hereinafter referred to as "Select Baits", is the data controller for personal data collected through www.selectbaits.com and all forms available on the site.

Contact: contact@selectbaits.com | +40725.944.189

2. Data Collected, Purposes and Legal Basis

2.1 Collaborator / Ambassador application form

Data collected: first and last name, phone number, email, social media links, information about fishing activity and current brand collaborations

Purpose: evaluating the application for the Select Baits collaborator programme and retaining data for future collaboration programmes

Legal basis: Art. 6(1)(a) GDPR — explicit consent

Retention: maximum 24 months for unsuccessful applications; for the duration of the collaboration and 3 years after its termination for active collaborators

2.2 Contact form

Data collected: name, email, phone number (optional), message content

Purpose: responding to user enquiries

Legal basis: Art. 6(1)(f) GDPR — legitimate interest

Retention: maximum 12 months from the date of submission

2.3 Newsletter

Data collected: email address

Platform: Newsman (newsman.com) — provider based in Romania, with a Data Processing Agreement (DPA) in place

Purpose: sending newsletters, commercial offers and product updates

Legal basis: Art. 6(1)(a) GDPR — explicit consent

Retention: until withdrawal of consent; unsubscription possible at any time via the link in any email or at contact@selectbaits.com

2.4 Online orders and customer account

Data collected: first and last name, delivery and billing address, email, phone number, order history, login credentials (encrypted password)

Purpose: order processing, invoicing, delivery, returns management

Legal basis: Art. 6(1)(b) GDPR — performance of contract; Art. 6(1)(c) GDPR — legal fiscal obligations

Retention: fiscal documents — 10 years; account data — 3 years after the last transaction

2.5 Existing customer database

Origin: accumulated over more than 15 years of prior online commercial activity

Data held: name, email, address, phone number, order history

Legal basis: Art. 6(1)(b) and (c) GDPR — prior contracts and statutory archiving obligations

Marketing to existing customers: permitted on the basis of legitimate interest (Art. 6(1)(f) GDPR), with the right to object (opt-out) available in every communication

Retention: as per section 2.4 above

2.6 Cookies

Data collected: browsing data, preferences, session identifiers

Purpose: correct functioning of the site, storing preferences, usage analytics (when activated)

Legal basis: legitimate interest for strictly necessary cookies; consent for all other categories

Full details: available in the Cookies Policy on www.selectbaits.com

3. Recipients of Data

Data is not sold and is not shared for commercial purposes with third parties. It may be accessed by:

Internal Select Baits staff with relevant responsibilities

Newsman — email marketing platform, on the basis of a DPA

Courier service providers — solely delivery data

Online payment service providers

Hosting and IT service providers

Public authorities — solely when required by law

We do not transfer data to countries outside the European Union without ensuring the guarantees required under GDPR.

4. Rights of Data Subjects

You may exercise the following rights at any time, free of charge, by contacting us at contact@selectbaits.com:

Right of access (Art. 15 GDPR) — to find out what data we hold about you

Right to rectification (Art. 16 GDPR) — correction of inaccurate data

Right to erasure (Art. 17 GDPR) — deletion of data, within the limits of legal obligations

Right to restriction of processing (Art. 18 GDPR)

Right to data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR) — including against direct marketing

Right to withdraw consent — at any time, without affecting prior lawful processing

You have the right to lodge a complaint with the ANSPDCP (Romanian Data Protection Authority): www.dataprotection.ro

EU customers may also use the European ODR platform: https://ec.europa.eu/consumers/odr

We will respond to any request within a maximum of 30 calendar days.

5. Data Security

Select Baits applies appropriate technical and organisational measures including HTTPS encryption, restricted access to data and internal incident notification procedures in accordance with Art. 33-34 GDPR.