Last updated: 10.09.2026

Promedivet S.R.L. respects your privacy. This policy explains what personal data we collect through the Herba99 website and in connection with our commercial relationships, why we collect it, how long we keep it, with whom we share it, and what rights you have under Regulation (EU) 2016/679 (the GDPR) and Romanian Law no. 190/2018.

The controller of your personal data is: Promedivet S.R.L. Registered office: Str. Lungă no. 46/G, 545500 Sovata, Mureș County, Romania Headquarters and manufacturing: Str. Principală no. 99, Sovata, Mureș County, Romania Trade register no. J1999000769262 · Unique registration code 12481552 E-mail: info@herba99.eu · Telephone: +40 265 570 831

For any question about this policy or about your personal data, write to info@herba99.eu with the subject line “GDPR

This policy covers the personal data we process when you:
- visit the Herba99 website;
- submit the contact form or write to us by e-mail;
- send us a private label or distribution enquiry;
- meet us at a trade fair or professional event and give us your contact details;
- subscribe to receive commercial communications from us, where we offer this;
- act as a contact person for a customer, supplier, distributor or research partner.

It does not cover the websites of third parties to which we link.

Data you give us directly
- Contact form: your name, e-mail address, the service or subject you select, and the content of your message.
- E-mail and telephone correspondence: your name, contact details, and anything else you choose to tell us, including your professional role and the company you represent.
- Private label and distribution enquiries: company name, registered address, VAT number, the name and role of the contact person, product requirements and commercial information.
- Events: the details on a business card you give us.

Data collected automatically
- Technical and log data: IP address, date and time of access, pages viewed, referring page, browser type and version, operating system, language settings, and approximate location derived from the IP address. This data is generated by our hosting and security providers for the operation and protection of the Website.
- Cookies and similar technologies: see our Cookie Policy. The Website currently sets only strictly necessary cookies; any analytics or marketing cookies are set only with your consent.

Data we do not want
‍We do not ask for and do not wish to receive special categories of personal data (health data, political opinions, trade-union membership, and so on). Please do not include such information in a message to us. Information about an animal’s health is not personal data unless it can be linked to an identified individual.

Responding to your enquiry and corresponding with you
‍- Identification and contact data, content of the message
- Legal basis (GDPR Art. 6): Art. 6(1)(b) — steps at your request prior to a contract; or Art. 6(1)(f) — our legitimate interest in answering enquiries addressed to usArt. 6(1)(b)

Preparing quotations, samples and private label proposals‍
‍- Contact and company data, technical requirements
‍- Legal basis (GDPR Art. 6): Art. 6(1)(b)

Managing a contractual relationship (orders, deliveries, invoicing, support)
‍‍- Contact and company data, transaction dataTransaction and traceability data
‍- Legal basis (GDPR Art. 6): Art. 6(1)(b) and Art. 6(1)(c)

Complying with accounting, tax, product-safety and veterinary record-keeping obligations
‍- Transaction and traceability data
- Legal basis (GDPR Art. 6): Art. 6(1)(c) — legal obligation

Pharmacovigilance, quality complaints and product recalls‍
‍- Contact data, description of the incident
‍- Legal basis (GDPR Art. 6): Art. 6(1)(c) and Art. 6(1)(f)

Operating, securing and improving the Website; preventing spam and abuse of the contact form
‍- Technical and log data
‍- Legal basis (GDPR Art. 6): Art. 6(1)(f) — our legitimate interest in network and information security

Sending commercial communications and newsletters‍
‍- Name, e-mail, professional interests
‍- Legal basis (GDPR Art. 6): Art. 6(1)(a) — your consent; or the “soft opt-in” for our own similar products to existing customers, with an opt-out in every message

Establishing, exercising or defending legal claims‍
‍- All relevant data
‍- Legal basis (GDPR Art. 6): Art. 6(1)(f)

We do not sell personal data and we do not share it for third-party advertising. We disclose it only to:
Our website host and form provider — Webflow, Inc. (United States), which hosts the Website and processes contact-form submissions
Cloudflare — for content delivery and bot protection of the contact form (Cloudflare Turnstile);
Our e-mail and office software provider Microsoft 365IT service providers — for maintenance and support of our systems;
Professional advisers — lawyers, auditors and accountants, bound by confidentiality;
Logistics and payment partners, where a contractual relationship requires it;
Public authorities, including ANSVSA and tax authorities, where we are legally obliged to disclose.

Providers acting on our behalf are processors and act only on our documented instructions under a data processing agreement compliant with Article 28 GDPR.

Some of our providers, including Webflow and Cloudflare, are established in the United States or process data there. Such transfers take place on the basis of:
- the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with supplementary technical and organisational measures; and/or
- the provider’s certification under the EU–US Data Privacy Framework, recognised by the Commission’s adequacy decision of 10 July 2023.

You may request a copy of the safeguards in place by writing to info@herba99.eu.

Contact form and general enquiries that do not lead to a relationship
Retention period: 12 months from the last exchange

Private label and distribution enquiries
Retention period: 3 years from the last exchange, for commercial follow-up

Contractual and accounting records
Retention period: 10 years from the end of the financial year, under Romanian Accounting Law no. 82/1991

Product traceability and quality records
Retention period: For the period required by the applicable veterinary and feed legislation

Newsletter subscriptions
Retention period: Until you withdraw your consent, plus proof of consent for 3 years

Server logs and security records
Retention period: Up to 12 months

Data relevant to a dispute
Retention period: Until the claim is finally resolved and the limitation period has expired

After these periods the data is deleted or irreversibly anonymised.

We apply technical and organisational measures appropriate to the risk, including encrypted transmission (HTTPS/TLS), access control on a need-to-know basis, password policies and multi-factor authentication where available, regular backups, staff confidentiality undertakings and awareness training, and contractual safeguards with our processors. No transmission over the internet is entirely secure; if a personal data breach occurs and is likely to result in a high risk to you, we will inform you in accordance with Article 34 GDPR.

Under the GDPR you have the right to:
- access your personal data and obtain a copy of it;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”), where one of the grounds in Article 17 applies;
- restrict processing in the cases set out in Article 18;
- data portability — receive the data you provided in a structured, commonly used, machine-readable format, where processing is based on consent or contract and is carried out by automated means;
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time and - - - without giving reasons to processing for direct marketing;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- not be subject to a decision based solely on automated processing that produces legal effects concerning you — we do not take such decisions and do not carry out profiling.

To exercise any of these rights, write to info@herba99.eu. We will reply within one month; this period may be extended by a further two months for complex requests, in which case we will tell you. We may ask for additional information to confirm your identity.

If you consider that we have processed your data unlawfully, you may lodge a complaint with the Romanian supervisory authority:
‍Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul General Gheorghe Magheru no. 28–30, sector 1, 010336 Bucharest, Romania Telephone: +40 318 059 211 · E-mail: anspdcp@dataprotection.ro · www.dataprotection.ro

You may also lodge a complaint with the supervisory authority of your EU country of residence or workplace, and you have the right to an effective judicial remedy.

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

The Website is addressed to professionals and adults. We do not knowingly collect personal data from persons under 16 years of age. If you believe that a child has provided us with personal data, please contact us and we will delete it.

We may update this policy to reflect changes in our processing activities or in the law. The version in force is the one published on this page, together with the date of the last update. Where a change is material, we will bring it to your attention on the Website.

Promedivet S.R.L. — Str. Principală no. 99, Sovata, Mureș County, Romania — info@herba99.eu — +40 265 570 831.