AUTO TOTAL

INFORMARE PRIVIND PRELUCRAREA DATELOR CU CARACTER PERSONAL

English version

La data de 25.05.2018 intra in vigoare Regulamentul 679/2016 privind protectia persoanelor fizice in ceea ce priveste prelucrarea datelor cu caracter personal si libera circulatie a acestor date (denumit in continuare „GDPR”), act normativ care asigura protectia drepturilor si libertatilor fundamentale ale persoanelor fizice si in special a dreptului acestora la protectia datelor cu caracter personal.

 

Noi, AD AUTO TOTAL S.R.L., acordam o atentie deosebita confidentialitatii datelor cu caracter personal si protejarii drepturilor clientilor si partenerilor nostri.

 

In consecinta, dorim sa va comunicam anumite informatii relevante cu privire la prelucrarile de date cu caracter personal realizate de societatea noastra:

 

1. Intelesul unor termeni:

 

Pentru ca informatiile pe care vi le furnizam prin prezentul document sa fie cat mai clare, explicam in continuare intelesul anumitor termeni utilizati mai jos, astfel cum sunt ei definiti de legislatia aplicabila:

 

  • "date cu caracter personal" inseamna orice informatii privind o persoana fizica identificata sau identificabila ("persoana vizata"); o persoana fizica identificabila este o persoana care poate fi identificata, direct sau indirect, in special prin referire la un element de identificare, cum ar fi un nume, un numar de identificare, date de localizare, un identificator online, sau la unul sau mai multe elemente specifice, proprii identitatii sale fizice, fiziologice, genetice, psihice, economice, culturale sau sociale;
  • "prelucrare" inseamna orice operatiune sau set de operatiuni efectuate asupra datelor cu caracter personal sau asupra seturilor de date cu caracter personal, cu sau fara utilizarea de mijloace automatizate, cum ar fi colectarea, inregistrarea, organizarea, structurarea, stocarea, adaptarea sau modificarea, extragerea, consultarea, utilizarea, divulgarea prin transmitere, diseminarea sau punerea la dispozitie in orice alt mod, alinierea sau combinarea, restrictionarea, stergerea sau distrugerea;
  • "operator" inseamna persoana care stabileste scopurile si mijloacele de prelucrare a datelor cu caracter personal;
  • "persoana imputernicita de operator" inseamna persoana fizica sau juridica, autoritatea publica, agentia sau alt organism care prelucreaza datele cu caracter personal in numele operatorului;
  • "destinatar" inseamna persoana fizica sau juridica, autoritatea publica, agentia sau alt organism careia (caruia) ii sunt divulgate datele cu caracter personal.

 

2. Operatorul de date:

 

Societatea AD AUTO TOTAL S.R.L. (denumit in continuare „Operatorul”), cu sediul in Bucuresti, str. Tincani nr. 8, bl. Z18, sc. A, et. 10, ap. 66, sector 6, numar de ordine in Registrul Comertului J40/29340/1994, CUI RO 6844726, cu adresa pentru corespondenta la punctul de lucru din Bucuresti, Splaiul Unirii nr. 96, sector 4 - intrarea prin str. Verzisori nr. 16, este operator de date cu caracter personal.

 

Prelucrarea datelor personale se realizeaza in temeiul si cu respectarea prevederilor legislatiei aplicabile, si in special ale Regulamentului 679/2016 privind protectia persoanelor fizice in ceea ce priveste prelucrarea datelor cu caracter personal si libera circulatie a acestor date (GDPR).

 

3. Categorii de date prelucrate:

 

Societatea noastra desfasoara mai multe tipuri de prelucrari de date cu caracter personal. Informatiile prelucrate, modalitatea de colectare si celelalte conditii ale prelucrarilor de date variaza in functie de scopul fiecarei operatiuni de prelucrare si temeiul sau legal

 

In general noi prelucram urmatoarele categorii de date cu caracter personal:

  • numele, datele de contact, semnatura, functia si organizatia in care va desfasurati activitatea (in special in cazul reprezentantilor si angajatilor societatilor partenere - clienti, furnizori, alti parteneri de afaceri;
  • adresa, date de identificare (serie si nr. CI, CNP), inclusiv dovada acestora;
  • experienta profesionala, studii si calificari, alte date cuprinse in mod uzual in CV (in special in cazul in care aplicati pentru un post in cardul organizatiei noastre);
  • cunostinte si abilitati tehnice si profesionale, calificare profesionala, informatii despre cursurile de formare/perfectionare profesionala si concursurile organizate de Operator la care participati;
  • data nasterii (informatie solicitata in general pentru confirmarea varstei, respectiv a faptului ca ati implinit 18 ani, astfel incat puteti participa la evenimentele, activitatile si / sau concursurile organizate de noi);
  • date despre relatia contractuala dintre dvs. si societatea noastra;
  • date referitoare la sau necesare pentru indeplinirea obligatiilor legale ce ne revin - inclusiv, daca este cazul, date cu privire la veniturile realizate si/sau premiile primite de la Operator si fata de care societatii noastre ii revin obligatii fiscale (cum ar fi depunerea unor declaratii fiscale, retinerea si plata unor impozite, taxe si contributii catre bugetul de stat sau alte bugete publice, etc.);
  • date din permisul de conducere, din certificatul de inmatriculare si/sau din cartea tehnica a autovehiculelor, informatii privind problemele tehnice / defectiuni ale autovehiculelor, informatii despre politele de asigurare ale autovehiculelor tip RCA/CASCO (in special in cazul persoanelor care achizitioneaza piese de schimb si accesorii pentru autovehicule de la societatea noastra, care beneficiaza de drepturi de garantie sau de despagubiri de la societatile de asigurare cu care colaboram, precum si in alte situatii similare);
  • prelucram imaginea persoanelor care ne viziteaza locatiile supravegheate video.

 

Este posibil ca, de la caz la caz sau in situatii ocazionale, sa prelucram si alte date cu caracter personal, astfel cum vom informa persoanele vizate in fiecare situatie punctuala in parte.

 

4. Scopurile si temeiurile legale ale prelucrarilor de date:

 

In aceasta sectiune prezentam scopul in care folosim datele cu caracter personal si identificam temeiurile legale pe care ne bazam fiecare prelucrare de date personale.

 

Societatea noastra prelucreazadatele cu caracter personal in principal in urmatoarele scopuri:

  • reclama, marketing si publicitate, public relations;
  • vanzarea produselor si furnizarea serviciilor oferite de societatea noastra (inclusiv cursuri de calificare / perfectionare profesionala);
  • incheierea contractelor si urmarirea derularii contractelor cu partenerii contractuali (clienti, furnizori, etc.), inclusiv pastrarea contactului cu acestia;
  • participarea dvs. la evenimentele, activitatile si / sau concursurile organizate de noi;
  • indeplinirea obligatiilor ce ne revin, conform prevederilor legale aplicabile, ale hotararilor judecatoresti si ordinelor, deciziilor si dispozitiilor autoritatilor publice;
  • paza bunurilor Operatorului, precum si protejarea, respectarea si exercitarea drepturilor Operatorului.

 

Prelucrarile de date cu caracter personal sunt realizate numai in baza unui temei legal, in conformitate cu dispozitiile GDPR. Temeiurile legale ale operatiunilor de prelucrare a datelor cu caracter personal pot fi urmatoarele:

  • indeplinirea unor obligatii legale ale Operatorului (indeplinirea obligatiilor fiscale, de tinere a unor evidente solicitate de lege, etc.);
  • consimtamantul dvs. liber exprimat (in cazul participarii la evenimentele, activitatile si / sau concursurile organizate de noi, in situatia abonarii la newsletter-ul nostru, precum si in alte situatii punctuale, cand consimtamantul dvs. este manifestat in mod expres si lipsit de echivoc);
  • interesul legitim al Operatorului (reclama, marketing si publicitate pentru produsele si serviciile pe care le oferim, public relations si promovarea imaginii Operatorului, vanzarea produselor si furnizarea serviciilor oferite de societatea noastra catre alte persoane, paza bunurilor si protejarea, respectarea si exercitarea drepturilor noastre);
  • executarea unui contract la care sunteti parte sau realizarea demersurilor, la cererea dvs., inainte de incheierea unui contract.

 

5. Categorii de destinatari:

 

In general, utilizam datele dvs. personale in interesul nostru. Cu toate acestea, exista situatii in care datele cu caracter personal vor fi dezvaluite unor anumite categorii de destinatari, in conformitate cu scopul fiecarei prelucrari in parte.

 

Datele personale pot fi comunicate partenerilor nostri de afaceri (inclusiv banci sau alte institutii de creditare), precum si furnizorilor nostri de servicii care actioneaza ca persoane imputernicite de catre Operator. Dintre acestia, unii pot avea sediul principal in alte state membre ale Uniunii Europene.

 

Numele castigatorilor concursurilor organizate de noi sunt anuntate public in cadrul respectivului eveniment, precum si prin publicarea pe site-urile noastre, pe paginile si canalele de pe retelele de socializare, in revista si newsletter-ul nostru, precum si prin orice alte mijloace de comunicare. Datele personale ale castigatorilor vor fi de asemenea transmise catre autoritatile publice competente in vederea indeplinirii obligatiilor fiscale, in conformitate cu prevederile legale aplicabile.

 

Datele personale sunt comunicate catre autoritati publice sau alte terte parti atunci cand exista o obligatie legala in acest sens, daca a fost emis/a o decizie / un ordin administrativ cu caracter obligatoriu pentru Operator, precum si in cazul in care aceasta comunicare este necesara pentru constatarea, exercitarea sau apararea unui drept in instanta.

 

6. Perioada stocarii datelor:

 

Datele dvs. personale vor fi pastrate intr-o forma care permite identificarea persoanelor vizate pe o perioada care nu depaseste perioada necesara indeplinirii scopurilor in care sunt prelucrate datele. Prin urmare, perioada de pastrare a datelor difera in functie de scopul fiecarei prelucrari de date.

 

In cazul in care legislatia aplicabila stabileste anumite termene pentru pastrarea informatiilor, atunci datele vor fi pastrate pe intreaga perioada impusa de lege.

 

In general, datele utilizate in relatiile contractuale dintre societatea noastra si partenerii sai vor fi pastrate pe perioada derularii acestei relatii contractuale, precum si pe perioada curgerii termenului de prescriptie pentru fiecare dintre raporturile juridice desfasurate.

 

Pentru fiecare prelucrare de date in alte scopuri se vor stabili termenele de pastrare a datelor rezonabile si care sa nu depaseasca perioada necesara indeplinirii scopurilor respectivei prelucrari.

 

In anumite cazuri particulare (cum ar fi, dar fara a se limita la: accidente, aparitia unor situatii litigioase, comiterea de infractiuni sau contraventii, solicitari ale unor autoritati publice, etc.), datele vor fi pastrate pentru intreaga perioada de timp necesara lamurarii in mod definitiv a evenimentului respectiv.

 

7. Sursa datelor:

 

In general datele sunt colectate direct de la dvs. sau, in cazul in care sunteti reprezentant / angajat al unui partener al nostru, de la angajatorul dvs. sau persoana pe care o reprezentati. Datele pot fi colectate atat de noi cat si de imputerniciti ai nostri, care actioneaza in numele si pentru Operatorul de date.

 

In anumite cazuri particulare, datele pot fi primite de la parteneri contractuali ai societatii noastre, cum ar fi societatile de asigurari, unitatile reparatoare de autovehicule (service-uri auto) cu care colaboram sau proprietarii autovehiculelor pe care le utilizati.

 

Ocazional putem primi datele dvs. de la autoritati publice, din surse disponibile public (cum ar fi Registrul Comertului, Cartea Funciara, Arhiva Electronica de Garantii Reale Mobiliare, portalul instantelor de judecata, etc.), sau de la alte terte persoane, cum ar fi furnizori de servicii de selectie si recrutare.

 

8. Drepturile dvs. in calitate de persoane vizate:

 

In calitate de persoana vizata beneficiati de urmatoarele drepturi:

 

  • dreptul de informare si de acces la datele pe care ni le furnizati;

Dreptul de acces presupune dreptul de a obtine din partea noastra o confirmare ca prelucram sau nu date cu caracter personal care va privesc si, in caz afirmativ, acces la datele respective si la urmatoarele informatii:

  1. scopurile prelucrarii;
  2. categoriile de date cu caracter personal prelucrate;
  3. destinatarii sau categoriile de destinatari carora datele cu caracter personal le-au fost sau urmeaza sa le fie divulgate, in special destinatari din tari terte sau organizatii internationale;
  4. acolo unde este posibil, perioada pentru care se preconizeaza ca vor fi stocate datele cu caracter personal sau, daca acest lucru nu este posibil, criteriile utilizate pentru a stabili aceasta perioada;
  5. in cazul in care datele cu caracter personal nu sunt colectate de la dvs., orice informatii disponibile privind sursa acestora;
  6. existenta unui proces decizional automatizat incluzand crearea de profiluri, precum si, in cazurile respective, informatii pertinente privind logica utilizata si privind importanta si consecintele preconizate ale unei astfel de prelucrari pentru persoana vizata.

 

  • dreptul de a solicita rectificarea datelor dvs. personale, atunci cand sunt inexacte; acesta include si posibilitatea de a obtine completarea datelor cu caracter personal care sunt incomplete;

 

  • dreptul de a solicita stergerea datelor si/sau restrictionare prelucrarii acestor date, precum si dreptul de a va opune prelucrarii, in cazurile si conditiile stabilite de GDPR;

Avem obligatia de a sterge datele dvs. personale atunci cand:

  1. datele nu mai sunt necesare pentru indeplinirea scopurilor pentru care au fost colectate sau prelucrate;
  2. va retrageti consimtamantul pe baza caruia are loc prelucrarea si nu exista niciun alt temei juridic pentru prelucrarea;
  3. va opuneti prelucrarii realizate in temeiul interesului legitim al Operatorului si nu exista motive legitime care sa prevaleze in ceea ce priveste prelucrarea, sau atunci cand prelucrarea are drept scop marketingul direct;
  4. datele au fost prelucrate ilegal;
  5. datele trebuie sterse pentru respectarea unei obligatii legale care revine Operatorului.

Obligatia de stergere a datelor nu se aplica atunci cand prelucrarea este necesara:

  1. pentru exercitarea dreptului la libera exprimare si la informare;
  2. pentru respectarea unei obligatii legale care prevede prelucrarea;
  3. din motive de interes public in domeniul sanatatii publice;
  4. in scopuri de arhivare in interes public, in scopuri de cercetare stiintifica sau istorica ori in scopuri statistice; sau
  5. pentru constatarea, exercitarea sau apararea unui drept in instanta.

Aveti dreptul de a obtine restrictionarea prelucrarii in cazul in care se aplica unul din urmatoarele cazuri:

  1. contestati exactitatea datelor, pentru o perioada in care putem verifica exactitatea datelor;
  2. prelucrarea este ilegala, iar dvs. va opuneti stergerii datelor cu caracter personal, solicitand in schimb restrictionarea utilizarii lor;
  3. Operatorul nu mai are nevoie de datele cu caracter personal in scopul prelucrarii, dar dvs. le solicitati pentru constatarea, exercitarea sau apararea unui drept in instanta; sau
  4. v-ati opus prelucrarii, pentru intervalul de timp in care se verifica daca drepturile legitime ale operatorului prevaleaza asupra celor ale persoanei vizate.

In orice moment, aveti dreptul de a va opune, din motive legate de situatia dvs. particulara, prelucrarilor de date realizate in temeiul interesul legitim al Operatorului, inclusiv crearii de profiluri; in aceasta situatie, Operatorul nu va mai prelucra datele dvs., cu exceptia cazului in care operatorul demonstreaza ca are motive legitime si imperioase care justifica prelucrarea si care prevaleaza asupra intereselor, drepturilor si libertatilor persoanei vizate sau ca scopul este constatarea, exercitarea sau apararea unui drept in instanta.

Atunci cand prelucrarea datelor cu caracter personal are drept scop marketingul direct, aveti dreptul de a va opune in orice moment prelucrarii in acest scop a datelor dvs.personale, inclusiv crearii de profiluri, in masura in care este legata de marketingul direct respectiv. In cazul in care va opuneti prelucrarii in scopul marketingului direct, datele dvs. nu vor mai fi prelucrate in acest scop.

 

  • dreptul la portabilitatea datelor, in cazul in care temeiul prelucrarii datelor este consimtamantul dvs. sau incheierea ori executarea unui contract, iar prelucrarea este efectuata prin mijloace automatizate.

In cazul in care aceste conditii sunt intrunite cumulativ, aveti dreptul de a primi datele care va privesc si pe care ni le-ati furnizat intr-un format structurat, utilizat in mod curent si care poate fi citit automat.

Aveti de asemenea dreptul de a transmite aceste date altui operator, fara obstacole din partea noastra, precum si dreptul ca datele sa fie transmise direct de la un operator la altul acolo unde acest lucru este fezabil din punct de vedere tehnic;

 

  • in cazul prelucrarilor de date realizate in temeiul consimtamantului dvs., aveti dreptul de a va retrage consimtamantul in orice moment, fara a afecta legalitatea prelucrarii efectuate pe baza consimtamantului inainte de retragerea acestuia;

 

  • dreptul de a nu face obiectul unei decizii bazate exclusiv pe prelucrarea automata.

Acest drept consta in posibilitatea dvs. de a nu face obiectul unei decizii bazate exclusiv pe prelucrarea automata, inclusiv crearea de profiluri, care produce efecte juridice care privesc persoana vizata sau o afecteaza in mod similar intr-o masura semnificativa.

Acest dreptnu se aplica in cazul in care decizia:

  1. este necesara pentru incheierea sau executarea unui contract intre noi si dvs;
  2. este autorizata prin dreptul Uniunii sau dreptul intern si care prevede, de asemenea, masuri corespunzatoare pentru protejarea drepturilor, libertatilor si intereselor dvs. legitime; sau
  3. are la baza consimtamantul explicit al persoanei vizate.

 

Pentru exercitarea acestor drepturi, va puteti adresa cu o cerere scrisa, datata si semnata laadresa deemail: gdpr@autototal.rosau la adresa de corespondenta a Operatorului mentionata mai sus.

 

De asemenea, aveti dreptul de a depune o plangere in fata autoritatii de supraveghere - Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP).

 

9. Alte prevederi:

 

In cazul in care in viitor vom incepe noi operatiuni de prelucrare de date cu caracter personal sau vom intentiona sa prelucram datele cu caracter personal detinute de noi intr-un alt scop decat cel pentru care acestea au fost colectate, va vom furniza, inainte de aceasta prelucrare ulterioara, informatii privind noua prelucrare si noul scop (scopul secundar), precum si orice informatii suplimentare relevante.

 

Obligatia noastra de a va informa cu privire la prelucrarile de date nu se aplica in anumite cazuri prevazute expres de legislatia aplicabila, respectiv daca si in masura in care:

  • detineti deja informatiile respective;
  • furnizarea acestor informatii se dovedeste a fi imposibila sau ar implica eforturi disproportionate, sau in masura in care obligatia de informare este susceptibil sa faca imposibila sau sa afecteze in mod grav realizarea obiectivelor prelucrarii respective; in astfel de cazuri, Operatorul va lua masuri adecvate pentru a proteja drepturile, libertatile si interesele dvs. legitime, inclusiv punerea informatiilor la dispozitia publicului;
  • obtinerea sau divulgarea datelor este prevazuta in mod expres de dreptul Uniunii Europene sau de dreptul intern sub incidenta caruia intra Operatorul si care prevede masuri adecvate pentru a proteja interesele dvs. legitime; sau
  • in cazul in care datele cu caracter personal trebuie sa ramana confidentiale in temeiul unei obligatii statutare de secret profesional reglementate de dreptul Uniunii Europene sau de dreptul intern, inclusiv al unei obligatii legale de a pastra secretul.

 

In final, va asiguram ca tratam cu maxima seriozitate drepturile pe care le aveti in legatura cu prelucrarile pe care le realizam asupra datelor referitoare la dvs. si vom lua toate masurile rezonabile pentru a ne asigura ca datele dvs. personale vor fi protejate precum si ca drepturile dvs. sunt respectate.


 

PRIVACY NOTE ON THE PROCESSING OF PERSONAL DATA

 

 

Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data enters into force on 25 May 2018 (hereinafter called "GDPR”). This law ensures the protection of fundamental rights and freedoms of natural persons and especially their right to the protection of personal data.  

 

We, AD AUTO TOTAL S.R.L., are very committed to keep personal data confidential and to protect the rights of our clients and partners.

 

As a result, we hereby communicate certain relevant information about the way our company processes personal data:

 

1. Definitions:

 

In order to provide you with clear information, the meaning of certain terms used herein is explained further below, as they are defined by the applicable legislation:

 

  • "personal data" means any information related to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one of more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  • "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  • "controller” means the person which determines the purposes and means of the processing of the personal data;
  • "processor" means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
  • "recipient" means the natural or legal person, public authority, agency or other body to which the personal data are disclosed.

 

2. Data controller:

 

AD AUTO TOTAL S.R.L. (hereinafter called the „Controller”), with its registered office in Bucharest, 8 Tincani Street, bldg. Z18, entr. A, 10th floor, app. 66, 6th district, Trade Registry number J40/29340/1994, CUI RO 6844726, mailing address at the business unit in Bucharest, 96 Splaiul Unirii, 4th district - access through 16 Verzisori street,  is a data controller.

 

Personal data is processed based on and in compliance with the applicable legislation, in particular Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

 

3. Categories of processed personal data:

 

Our company processes personal data in several ways. The processed information, the collection method and the other aspects related to data processing may vary considering the purpose of each operation and its legal basis.

 

We generally process the following categories of personal data:

  • name, contact information, signature, position and entity where you work (in particular for the representatives and the employees of our partners – clients, suppliers, other business partners);
  • address, identification data (series and no of ID, CNP), including the proof thereof;
  • professional experience, training and qualifications, other information usually included in the CV (in particular if you apply for a job in our company);
  • professional and technical knowledge and abilities, professional qualifications, information on the professional training/ improvement and the contests organised by the Controller attended by you;
  • birth date (this is usually required to confirm your age, respectively that you are of age and you can attend the events, activities and/or contests that we organise);
  • information on the contractual relationship between you and our company;
  • information related to or necessary for the fulfilment of our legal obligations - including, if the case, information on your incomes and/or prizes received from the Controller and which trigger fiscal obligations for our company (such as submitting fiscal statements, withholding and payment of taxes, duties and contributions to the state budget or other public budgets, etc.);
  • information from your driver’s licence, registration certificate and/or instruction manual of motor vehicles, information technical problems/breakdowns of the motor vehicles, information on RCA/CASCO insurance policies of motor vehicles (in particular for persons that buy from our company motor vehicle spare parts and accessories, who benefit from warranty or are indemnified by our partner insurance companies, as well as other similar situations);
  • we process the image of the persons visiting our video monitored locations.

 

We may, case by case or exceptionally, process other personal data; the data subjects will be informed in each particular case.

 

4. The purposes and legal basis of data processing:

 

In this section we present the purpose for which we use the personal data and we identify the legal basis for each personal data processing operation.

 

Our company processes personal data for the following main purposes:

  • commercials, marketing and advertising, public relations;
  • sell of our products and supply of our services (including professional qualification/training courses);
  • conclusion of contracts and follow up on the development of contracts with our partners (clients, suppliers, etc.), including keeping in contact with them;
  • your attendance to the events, activities and/or contests that we organise;
  • fulfilment of our obligations, as stipulated by applicable legislation, court decisions and orders, decisions and requirements of public authorities;
  • safeguard of the Controller’s assets, as well as protection, observance and use of the Controller’s rights.

 

Personal data is processed only on a legal basis, according to GDPR. The legal basis for personal data processing may be the following:

  • fulfilment of a legal obligation of the Controller (fulfilment of fiscal obligations, keeping records as required by law, etc.);
  • your freely given consent (when attending events, activities and/or contests that we organize, subscribing to our newsletter, as well as other particular situations, when your consent is given expressly and clearly);
  • legitimate interest of the Controller (commercials, marketing and advertising for our products and services,  public relations and promoting the Controller’s image, sell of our products and supply of our services to other persons, safeguard and protection of assets, observance and use of our rights);
  • performance of a contract to which you are a party or taking steps, at your request, prior to entering into a contract.

 

5. Categories of recipients:

 

We generally use your personal data in our interest. Nevertheless, there may be situations where the personal data is disclosed to certain categories of recipients, according to the purpose of each processing operation.

 

Personal data can be communicated to our business partners (including banks or other credit institutions), as well as to our services suppliers acting as processors. Amongst them, some may have their main establishment in other EU member states.

 

The name of the winners of our contests are publicly announced during the respective event, as well as on our websites, social pages and network channels, in our magazine and our newsletter, as well as by other communication means. The personal data of the winners is also disclosed to competent public authorities in view of fulfilling fiscal obligations, according to applicable legal provisions.

 

Personal data is disclosed to public authorities or other third parties whenever required by law, if a mandatory decision/administrative order has been issued, as well as if such disclosure is necessary for the establishment, exercise or defence of legal claims.

 

6. How long do we store personal data?

 

Your personal data will be stored in a format that allows the identification of the data subjects for a period not longer than necessary to achieve the intended purposes. Hence, data storage periods may vary considering the purpose of each processing operation.

 

If the law stipulates certain data storage periods, the data will be stored for the entire legal period.

 

Generally, the data used in the contractual relations between our company and its partners are stored for the duration of this contractual relationship, as well as for the statute-barred period of each of the developed legal relationships.

 

Data processed for other purposes will be stored for reasonable periods of time, not exceeding the period necessary to achieve the intended purpose.

 

In certain cases (such as, but not limited to: accidents, litigation, crimes or misdemeanours, requests from public authorities, etc.), data will be stored for the entire duration necessary to finally clarify the respective event.

 

7. The source of the data:

 

Generally, the data is collected directly from you or, if you are a representative/employee of one of our partners, from your employer or the person that you represent.  Data can be collected by us or by our processors, acting in the name and on behalf of the Controller.

 

In certain cases, we may receive data from our contractual partners, such as insurance companies, auto service units, that we work with or the owners of the motor vehicles you use.

 

Occasionally, we may receive your data from public authorities, from publicly available sources (such as Trade Registry, Land Book Office, Electronic Archive for Real Movable Collaterals, the website of the courts, etc.), or from third parties, such as recruiting services suppliers.

 

8. Your rights as data subjects:

 

You, as data subject, have the following rights:

 

  • the right to be informed and the right to access your personal data;

The right of access means your right to obtain from us a confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to have access to the data and the following information:

  1. the purposes of the processing;
  2. the categories of personal data being processed;
  3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
  4. where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
  5. where the personal data is not collected from you, any available information as to their source;
  6. the existence of automated decision-making process, including profiling, as well as, in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

 

  • the right to ask for rectification of your personal data when they are inaccurate; this also includes your right to ask for your personal data to be completed when they are incomplete;

 

  • the right to request erasure and/or right to restriction of processing, as well as the right to object to processing, under the terms and conditions of GDPR;

We must erase your personal data when:

  1. the data is no longer necessary to achieve the purposes for which it has been collected or processed;
  2. you withdraw your consent based on which the data is processed and there is no other legal basis for the processing;
  3. you object to processing on the basis of legitimate interest of the Controller and there are no overriding legitimate grounds for the processing, or when the data is processed for direct marketing;
  4. the data has been unlawfully processed;
  5. the data must be erased for the Controller to comply with a legal obligation.

The obligation to erase the data shall not apply to the extent that processing is necessary:

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing;
  3. for reasons of public interest in the area of public health;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or
  5. for the establishment, exercise or defence of legal claims.

You have the right to obtain the restriction of processing where one of the following applies:

  1. you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
  2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  3. the Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
  4. you have objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data based on the Controller’s legitimate interest, including profiling; in this case, the Controller shall no longer process your data unless it demonstrates compelling legitimate grounds for the processing overriding the interests, right and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

When personal data is processed for direct marketing, you have the right to object at any time to processing of your personal data, including profiling to the extent it is related to such direct marketing. If you object to processing for direct marketing purpose, your data shall no longer be processed for such purpose.   

 

  • right to data portability, when data is being processed based on your consent or for the conclusion or performance of a contract and the processing is carried out by automated means.

If these conditions are cumulatively met, you have the right to receive the personal data concerning you and that you have provided to us in a structured, commonly used and machine readable format.

You also have the right to transmit this data to another controller without hindrance from us, as well as the right to have your personal data transmitted directly from one controller to another where technically feasible;

 

  • where data is being processed based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

 

  • the right not to be subject of a decision based solely on automated processing.

You have the right not to be subject of a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her.

This right shall not apply if the decision:

  1. is necessary for entering into, or performance of, a contract between you and us;
  2. is authorised by Union or domestic law and which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
  3. is based on the data subject’s explicit consent.

 

In order to exercise these rights, please send a written, dated and signed request to: gdpr@autototal.roor to the correspondence address of the Controller as mentioned above.

 

You also have the right to lodge a complaint to the supervisory authority – The National Supervisory Authority for Personal Data Processing (ANSPDCP).

 

9. Other provisions:

 

Should we begin other personal data processing operations or intend to process the detained personal data for other purposes than the ones we collected them for, before such subsequent processing, we will inform you on the new processing and the new purpose (subsequent purpose), as well as provide you with any additional relevant information.

 

Our obligation to inform you about the data processing shall not apply in certain cases expressly stipulated by the law, respectively if and to the extent that:

  • you already have the respective information;
  • the provision of such information proves impossible or would involve a disproportionate effort or if the obligation to inform is likely to render impossible or seriously impair the achievement of the objectives of the processing; in such cases, the Controller shall take appropriate measures to protect your rights, freedoms and legitimate interests, including making the information publicly available;
  • obtaining or disclosure of personal data is expressly stipulated by the European Union or domestic law to which the Controller is subject and which provides appropriate measures to protect your legitimate interests; or
  • where the personal data must remain confidential subject to a statutory obligation of professional secrecy regulated by the European Union or domestic law, including a legal obligation of secrecy.  

 

In the end, we assure you that we take very seriously your rights related to personal data processing and that we will implement all reasonable measures to make sure that your personal data is protected and your rights are observed.