Privacy Policy

User identification and authentication

1. By user it is meant any person acting under the authority of the Operator or a person authorized by the Operator, with a recognized right to access personal data.

2. To gain access to personal data, users need to identify themselves.

3. In the case of automated processing, the identification is done by authentication in the IT systems of the Operator. Authentication is done by entering unique login data, consisting of a username and a password. 

4. Passwords are security strings that are appropriate in terms of length, composition and operational behaviour, in accordance with DIHK in-force security procedures. 

5. Any user that receives access to the personal information database is informed that he / she must maintain the confidentiality of the authentication data and hold accountability to the Operator in this regard.  

6. User access to manually managed personal information databases is done strictly based on a list approved by the Operator 's management.

Type of access:

1. Users can only access the personal data required to fulfil the tasks assigned by the Operator. 

2. Developers of personal data processing systems have access to personal data under a strict privacy agreement signed with the Operator, exclusively where required, each transaction being documented.

3. The technical support department may have access to personal data in order to resolve incidents and problems encountered in the use of IT systems. 

4. Computers and servers containing databases with personal information are located in controlled access rooms. Documents containing personal data of the type considered as special categories of data are kept in restricted access rooms.

5. The Operator has established strict ways to destroy personal data.

Data collection 

1. The Operator designates authorized users for the collection, input and processing of personal data in a computer system or in a manual system. 

2. Any changes to personal data may only be made by authorized users designated by the Operator.

3. The Operator has taken steps to ensure that the information system records who has made the change, the date and time of the change. For better management, the Operator has implemented measures so that the information system maintains deleted or modified data.

Backup execution

1. The computer system automatically performs back-up of the databases on a daily basis for an eventual data recovery in case of loss, destruction or malfunction.

2. The Operator sets the timeframe for the backups of personal information databases as well as the programs used for automated processing. The users executing these backups are designated by the Operator in a limited number. Backups are stored in locations with restricted access, situated in a different room from where the backup is made.

Computers and access terminals

1. Computers and other access terminals are installed in lockable, restricted access rooms. If the computers are on without any input for a certain period of time, set by the Operator, the session closes automatically. 

2. Users are trained so that personal information databases are closed when unauthorized persons are nearby. 

3. Servers hosting databases can only be accessed in a controlled manner based on access rights

Access files

1. The Operator takes steps to ensure that any access to the personal information database is recorded in an access file (called a log, for automated processing) or in a register in case of manual personal data processing, that is set by the Operator.  

2. For automated processing, this information will be stored in a general access file or in separate files for each user. 

3. The Operator is required to keep access files for at least 2 years in order to be used as evidence for investigations. If the investigations are prolonged, these files will be kept until investigations and any actions related to them are completed.  

4. Access logs must provide information to identify persons who have accessed personal data and the respective performed operations.

Telecommunication systems

1. The Operator, through authorized users, periodically checks authentication and access types to detect malfunctions in the use of telecommunication systems. Only personal data strictly necessary will be transmitted through the telecommunication systems.

Staff training

1. Users who have access to personal information databases are trained on the national and European legal provisions, regarding the provisions of the IT security policy of the Operator, as well as the importance of maintaining their confidentiality and the risks involved in the processing of personal data.

2. Users who have access to personal data will be notified by messages that will appear on monitors. Users are forced to close their work session when they leave the workplace.

Computer use: to maintain security of the processing of personal data (especially against 

1. Computer viruses), the following measures are mandatory

2. Use of software from unsafe sources has been forbidden;

3. Users do not have administrative privileges on computers; 

4. Only licensed software is being used; 

5. Computers are protected through antivirus software; 

6. The user's activity may be monitored in limited cases, when justified by a legitimate interest of the Operator according to the provision of this policy.

Data Printing

1. Personal data shall only be printed by the designated users and only for the purposes specified in these Rules.

2. User access to printers is restricted.

The rights of persons whose personal data are being collected and/or processed

1. The right to information: any individual has the right to be provided by the Operator, at least the following information

• The identity of the Operator and its representative; 

• The purpose of personal data being processed; 

1. Additional information, such as: recipients or categories of data recipients; whether the provision of all required data is mandatory and the consequences of the refusal to provide them; 

2. Any other information of which disclosure is required by authorities.

The right of access to data: the individuals have the right to obtain from the Operator, according to the law, upon request, confirmation as to whether or not personal data concerning him or her are being processed and to receive, free of charge a copy of the personal data undergoing processing and access to the following information:

• the purposes of processing; 

• the categories of personal data concerned; 

• the recipients or categories of recipients to whom the personal data have been or will be disclosed, including, in case of transfer to a third country or to an international organization, a description of the appropriate safeguards in place; 

• the envisaged storage period or the criteria used to determine this period, as 

• possible; 

• the right to request from the Operator rectification, erasure, restriction of processing of personal data or to object such processing; 

• the right to lodge a complaint with the National Supervising Authority (ANSPDCP); 

• any available information regarding the source of the personal data, if it was not collected directly from the data subject.

For any further copies requested by the data subject, the Operator may charge a fee to cover the administrative costs.

1. The right to rectification: the individuals have the right to obtain from the Operator the rectification of inaccurate personal data concerning him or her.

2. The right to erasure: the individuals have the right to obtain from the Operator the erasure of personal data concerning him or her in any of the following cases:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 

• the individual withdraws consent on which the processing is based and there is no other legal ground for the processing; 

• the individual objects to the processing and there are no overriding legitimate grounds for the processing; 

• the personal data have been unlawfully processed; 

• the personal data have to be erased for compliance with a legal obligation in 

• EU or Romanian law to which the Operator is subject.  

The right to restriction of processing: the individuals have the right to obtain from the Operator restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the individual, for a period 

• enabling the Operator to verify the accuracy of the personal data; 

• the processing is unlawful and the individual opposes the erasure of the personal data and requests the restriction of their use instead; 

• the Operator no longer needs the personal data for the purposes of the processing, but they are required by the individual for the establishment, exercise or defence of legal claims; 

• the individual has objected to processing pending verification whether the legitimate grounds of the Operator override those of the data subject.  

When one of the cases of processing restriction is applicable, with the exception of storage, the personal data shall only be processed with the individual’s consent or for limited purposes listed by GDPR.    

1. The right to data portability: the individuals have the right to receive the personal data concerning him or her, which he or she has provided to the Operator, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Operator in the following cases:

• the processing is based on the consent given by the individual for one or more specific purposes or the processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract; and the processing is carried out by automated means.

Where technically feasible, at the request of the individual, the Operator shall transmit the personal data directly to another controller.

1. The right to object: the individuals have the right to oppose at any time to the processing of personal data concerning them by the Operator which is necessary for the purposes of the legitimate interests pursued by the Operator. In this case, the Operator shall no longer process personal data unless the Operator demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual or for the establishment, exercise or defence of legal claims.

2. The right to object to processing for direct marketing purposes: the individuals have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. If the individual objects to processing, the Operator shall no longer process the personal data for such purposes.

3. The right not to be subject to an individual decision: the individuals are entitled to request and obtain the withdrawal / annulment / re-evaluation of any decision having legal effect on them, adopted solely on the basis of a personal data processing carried out by automated means intended to produce legal effects concerning him or her or similarly significantly affects him or her (i.e. to evaluate some aspects of their personality, such as professional competence, credibility, behaviour or other such issues).

4. The right to appeal to justice: the individuals have the right to appeal to the courts for the defence of any rights guaranteed by law.

5. In order to exercise these rights, the individuals may address the Operator with a written, dated and signed request transmitted using the public contact details of the organization.

​