GDPR & Data Rights
Your data, your control
Under the EU General Data Protection Regulation (GDPR), you have specific rights over your personal data. TOVI STUDIO SRL is committed to honoring these rights transparently and without undue delay.
Right of Access
You have the right to obtain confirmation that your personal data is being processed and to receive a copy of that data. This includes information about the purposes, categories of data, recipients, and retention periods.
Request a full data export by emailing gdpr@mytovi.com. We will provide your data in a structured, machine-readable format (JSON) within 30 days.
Right to Data Portability
You have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format (JSON or CSV), and to transmit that data to another controller without hindrance.
This applies to data processed by automated means based on your consent or contract performance, including your email address, ownership records, and product interaction history.
Right to Erasure
You have the right to have your personal data deleted. You can exercise this right directly by deleting your account from the Account page in the app.
Upon account deletion:
- All ownership records are released
- ToviGuard™ alerts are deactivated
- Pending transfers are cancelled
- Detection events are purged
- Your authentication credentials are permanently deleted
Exceptions: we may retain data where required by law (e.g., for legal claims or compliance obligations).
Right to Restriction
You have the right to request restriction of processing in the following cases:
- You contest the accuracy of your data (restriction during verification)
- Processing is unlawful but you oppose erasure
- We no longer need the data but you require it for legal claims
- You have objected to processing (restriction during our assessment)
Right to Rectification
You have the right to have inaccurate personal data corrected without undue delay. You can update your email address directly from the Account page. For other data corrections, contact us at gdpr@mytovi.com.
Right to Object
You have the right to object to processing of your personal data based on our legitimate interest (Art. 6(1)(f)). This includes:
- Gate detection event processing (anti-theft monitoring)
- IP address logging in sighting reports
Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
How to Exercise Your Rights
Send your request to gdpr@mytovi.com with:
- Your account email address
- Which right you wish to exercise
- Any relevant details about your request
Response time: We will respond within 30 calendar days. For complex requests, this may be extended by up to 60 additional days — we will notify you of any extension within the first 30 days.
Cost: Exercising your rights is free of charge. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests (GDPR Art. 12(5)).
Identity verification: To protect your data, we may ask you to verify your identity before processing your request (e.g., by sending a confirmation to your registered email).
Supervisory Authority
If you are not satisfied with our response, you have the right to lodge a complaint with the Romanian Data Protection Authority:
ANSPDCP
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania
Phone: +40.318.059.211
Email: anspdcp@dataprotection.ro
Web: dataprotection.ro
Legal Framework
- EU Regulation 2016/679 (General Data Protection Regulation)
- Romanian Law 190/2018 (GDPR national implementation)
- Romanian Law 506/2004 (ePrivacy — electronic communications)
- EU Directive 2002/58/EC (ePrivacy Directive)