- INTRODUCTION
1.1 The purpose of this Policy
This policy (the “Policy”) is issued by SC Chimcomplex SA Borzeşti (“SC Chimcomplex SA Borzești „or “The Company”) in connection with its processing of personal data of customers, employees, suppliers, and other natural persons with whom the company comes into contact in the conduct of its activity (“Data Subjects”) (respectively, Personal Data, as defined below). SC Chimcomplex SA Borzești respects the fundamental rights of the persons who entrust their Personal Data to the Company, including the right to privacy and to the protection of personal data, and undertakes to comply with the regulations that protect these personal data.
This procedure describes the way in which SC Chimcomplex SA Borzești collects, manages, and retains personal data in order to comply with the applicable legal provisions and to meet the standards of SC Chimcomplex SA Borzești and of the Romanian Commercial Services group of companies, (“SCR Group”) in terms of the protection of personal data, as well as the way in which SC Chimcomplex SA Borzești understands to protect Personal Data in case of personal data breach.
1.2 Applicability of the Policy. Responsibilities
This Policy will apply regardless of the way in which Personal Data is collected, processed, or retained by the Company and regardless of the form or medium of storage of Personal Data, respectively in electronic form, on paper or on other media.
The responsibility for protecting the Personal Data of SC Chimcomplex SA Borzești belongs to SC Chimcomplex SA Borzești, its employees and collaborators, as well as to other third parties (e.g., agencies, service providers, etc.) who process Personal Data in the name and on behalf of SC Chimcomplex SA Borzești or who establish together with SC Chimcomplex SA Borzești the method of processing Personal Data (“Service Providers”). SC Chimcomplex SA Borzești will take the necessary measures to ensure compliance with all its employees and collaborators.
This Policy must be read, interpreted, and applied in conjunction with other relevant Company policies in relation to the processing of personal data. In situations where other policies set out rules other than those in this Policy, which provide for a more restrictive level of protection for personal data than that provided for in this Policy, they will apply accordingly. SC Chimcomplex SA Borzești will make available to the Service Providers any relevant information on the processing of personal data that is relevant in relation to the activity carried out by the Service Providers. This Policy will be reviewed periodically, as often as necessary, considering the compliance with the protection of personal data and the specific legislation in force. The General Director has the responsibility to ensure the proper implementation and compliance with the provisions of this Policy.
1.3 Definitions „Supervisory Authority„ means the National Supervisory Authority for Personal Data Processing.
“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Personal Data” means the personal data of the Data Subjects processed by SC Chimcomplex SA Borzești and its Service Providers, in the name and on behalf of SC Chimcomplex SA Borzești or independently of SC Chimcomplex SA Borzești, when such data are collected and/or made available to the Service Providers by or on behalf of SC Chimcomplex SA Borzești.
“Special personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the sole identification of a natural person, health data or data on the sex life or sexual orientation of a natural person.
“Sensitive Personal Data” means the special personal data of the Data Subjects.
“Service Providers” means persons who process personal data in the name of and on behalf of SC Chimcomplex SA Borzești.
“SC Chimcomplex SA Borzești” or “the Company” means all and any of the companies of the SCR Group in Romania.
“Information Note” means the information note that SC Chimcomplex SA Borzești sends to the Data Subjects according to the Regulation.
“Data Subjects” means customers, employees, suppliers and any other persons who come into contact with SC Chimcomplex SA Borzești, either directly or through the Service Providers acting on behalf of and on behalf of SC Chimcomplex SA Borzești, whose personal data are processed by SC Chimcomplex SA Borzești.
“Policy” means this Policy on the Processing of Personal Data.
“Processing „means any operation or set of operations carried out on personal data or on sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ‘processed’ or ‘processed’ shall be interpreted in accordance with this definition.
“Regulation” means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”).
“Hierarchical superior” means a person with management duties of a department within SC Chimcomplex SA Borzești.
“Third-party”, “Third parties” means a person other than SC Chimcomplex SA Borzești, employees and collaborators of SC Chimcomplex SA Borzești, or Service Providers, with whom SC Chimcomplex SA Borzești interacts.
“Transfer“, “to transfer“, “transferred” means, in relation to personal data, any transmission, making available, disclosure or any other way of making such data known to another person than the person in whose possession the data is located, regardless of the way in which it is carried out (e.g., physically or by electronic means).
- RESPONSIBILITY FOR THE PROCESSING OF PERSONAL DATA
2.1 The risks associated with the processing of personal data by SC Chimcomplex SA Borzești
This Policy aims to protect SC Chimcomplex SA Borzești, its employees, collaborators and Service Providers against the risks that may arise during or as a result of the processing of personal data in the name and/or on behalf of SC Chimcomplex SA Borzești. These risks may include, but are not limited to:
- Sanctions (remedial measures and fines) in case of non-compliance with the personal data protection regime.
- Breach of the security of personal data processed by, or on behalf of, SC Chimcomplex SA Borzești.
- Reputational violations of SC Chimcomplex SA Borzești in case of personal data breaches processed by, or on behalf of, SC Chimcomplex SA Borzești;
- Lack of implementation of sufficient protection and security standards for personal data processed by, or on behalf of, SC Chimcomplex SA Borzești.
- Violation of confidentiality obligations by transmitting information including personal data without authorization.
2.2 The general rules for the processing of personal data by SC Chimcomplex SA Borzești
The processing of Personal Data is subject to several general rules and principles, the understanding and practical application of which will allow the employees, collaborators and Service Providers of SC Chimcomplex SA Borzești to fulfill their responsibilities related to the protection of the Personal Data that SC Chimcomplex SA Borzești processes.
2.2.1 Personal Data must be processed lawfully and fairly
In order to process the personal data of data subjects, SC Chimcomplex SA Borzești always needs a legal justification. The Consent of the Data Subjects is one of the grounds that SC Chimcomplex SA Borzești can use for the processing of Personal Data. The consent of the Data Subjects must always be obtained in accordance with the policies and procedures of SC Chimcomplex SA Borzești and with the applicable legislation on the protection of personal data. The SCR Group has established strict rules on obtaining the consent of data subjects, for example the option to give consent or the option to withdraw consent. We also draw your attention to the fact that, in connection with the processing of children’s Personal Data on the basis of agreement, when SC Chimcomplex SA Borzești offers online services, SC Chimcomplex SA Borzești must obtain the consent of the parents or legal representatives of the children. Other grounds for processing Personal Data that SC Chimcomplex SA Borzești may use include:
- the conclusion or fulfillment of a contract with the Person concerned. This basis of personal data processing is typically used in relations with customers who purchase products directly from SC Chimcomplex SA Borzești, or in connection with some aspects regarding the fulfillment of employment or service contracts of SC Chimcomplex SA Borzești. •fulfillment of a legal obligation of SC Chimcomplex SA Borzești. This basis of processing personal data is used by SC Chimcomplex SA Borzești mainly in connection with the request of certain information from its customers or employees or the retention for certain periods of time of personal data of its customers or employees (respectively, the legal archiving requirements), when the applicable legislation requires the fulfillment of certain actions involving the processing of personal data. • Legitimate interest of SC Chimcomplex SA Borzeşti. The legitimate interest of SC Chimcomplex SA Borzești must always be balanced with the interests, rights and fundamental freedoms of the Data Subjects in connection with which it is used, to the extent possible, and on a case-by-case basis by the employees, collaborators and Service Providers of SC Chimcomplex SA Borzești, especially when it is apparent that certain Data Subjects may have fundamental interests, rights and freedoms that can be harmed by the processing of personal data. If you consider, at any time, that the violations of the interests, rights and fundamental freedoms of the Data Subjects are material, it is possible that they will prevail over the legitimate interest of SC Chimcomplex SA Borzești, and it is necessary that any activity of processing the Personal Data based on the legitimate interest of SC Chimcomplex SA Borzești will cease.
If you have any questions about the grounds for processing personal data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.2 Sensitive Personal Data may be processed under special conditions
In general, the processing of Sensitive Personal Data is prohibited. SC Chimcomplex SA Borzești will be able to process the Sensitive Personal Data of the Data Subjects only in exceptional situations, provided for by the Regulation and the applicable legislation. In particular, SC Chimcomplex SA Borzești processes the Sensitive Personal Data of its employees according to the applicable legal provisions on employment, which is an exception to this prohibition. For more details, feel free to refer to the information note on the processing of employee data. Another exception regarding the processing of Sensitive Personal Data is the situation in which the Data Subjects give their specific and explicit consent to the processing of this data by SC Chimcomplex SA Borzești. As a general rule, the provisions of this Policy regarding the processing of Personal Data shall also apply in connection with the processing of Sensitive Personal Data, with the exceptions, limitations and special provisions indicated in this Policy when applicable.
If you have any questions about the processing of Sensitive Personal Data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.3 SC Chimcomplex SA Borzești must inform the Data Subjects about the processing of their Personal Data by sending the Information Note. The information must be made at the time when SC Chimcomplex SA Borzești collects the Personal Data from the Data Subjects. If SC Chimcomplex SA Borzești obtains the Personal Data from persons other than the Data Subjects, it will have to transmit the Information Note to the Data Subjects within a maximum of one month from the obtaining of the personal data, or before if SC Chimcomplex SA Borzești processes the Personal Data obtained or transmits them to a Third Party. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that the relevant Information Notes have been transmitted to the Data Subjects.
2.2.4 Personal Data must be processed for limited purposes. SC Chimcomplex SA Borzești must process personal data only for specific, well-defined purposes, which must be brought to the attention of the Data Subjects through the Information Note. Each employee, collaborator, and Service Provider of SC Chimcomplex SA Borzești must ensure that they use personal data only for the purposes indicated in the Information Note. If you need to process your Personal Data for purposes other than those indicated in the Information Note, it will be necessary to identify the appropriate processing basis (including the consent of the Data Subjects) and also to send an Updated Information Note to the Data Subjects for the new processing purpose.
If you have any questions about the purposes for which certain Personal Data are processed, or about the processing of Personal Data for purposes other than those included in the Information Note, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.5 The Personal Data processed must be adequate, relevant and limited to the processing purposes
The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to reduce the personal data they process. When SC Chimcomplex SA Borzești collects Personal Data, it will have to collect only those personal data that are absolutely necessary for the processing purposes of SC Chimcomplex SA Borzești, not personal data that are not essential for the processing that SC Chimcomplex SA Borzești has to do. The collection and processing of Personal Data must follow the internal procedures and models of SC Chimcomplex SA Borzești that are applicable for each type of operation performed. The collection and processing of data other than those provided for by these internal procedures and models can only be carried out with the approval of the Legal Department.
2.2.6 The Personal Data processed by SC Chimcomplex SA Borzești must be accurate and “up-to-date”
The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that the Personal Data they process are always accurate and up-to-date. The Data Subjects must understand that the provision of the services of SC Chimcomplex SA Borzești promptly and at the quality level of SC Chimcomplex SA Borzești depends on the provision of accurate data and their updating. In some cases, SC Chimcomplex SA Borzești will not be able to fulfill its obligations under orders or according to contracts if the Personal Data of the Data subjects are not up-to-date or accurate. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to monitor the quality of the data they process, as well as to identify ways to update them. At the same time, the efforts to update the Personal Data must not become excessive in relation to the Data Subjects, nor should they take over all the time affected by the work of the employees and collaborators of SC Chimcomplex SA Borzești or of the Service Providers of SC Chimcomplex SA Borzești.
If you have any questions about updating the Personal Data you process, including how to update it, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.7 Personal Data must be kept only for the period necessary for their processing
SC Chimcomplex SA Borzești may keep the Personal Data of the Data Subjects only for the period of time necessary for their processing according to the established purposes and communicated to the Data Subjects through the Information Note. Personal Data that is not necessary for the fulfillment of a particular purpose must be deleted; this obligation applies to any type of Personal Data. From an operational perspective, SC Chimcomplex SA Borzești will seek to delete documents or files that include large volumes of personal data as soon as these data are no longer necessary for the processing purposes. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that personal data that are no longer necessary for the purposes set and communicated to the Data Subjects are deleted in accordance with the policies and procedures of SC Chimcomplex SA Borzești.
If you have any questions about the deletion of Personal Data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.8 Personal Data must be processed in accordance with the rights of the Data Subjects. The Data Subjects have several rights in relation to the Personal Data processed by SC Chimcomplex SA Borzești, including the right of access to the Personal Data, the right to withdraw the consent for certain processing of personal data, the right to object to profiling operations of the Data Subjects, etc. SC Chimcomplex SA Borzești must respond to any requests of the Data Subjects regarding their rights within short periods of time. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to respect the rights of the Data Subjects in connection with the processing of the Personal Data of the Data subjects. When the employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești receive requests from the Data Subjects regarding their rights, it is necessary to contact the Legal Department and / or the Personal Data Protection Officer of SC Chimcomplex SA Borzești in order to be able to respond to these requests within the legal deadlines and according to the procedures of SC Chimcomplex SA Borzești. SC Chimcomplex SA Borzești must consider the rights of the Data Subjects to the development of new products, services, campaigns, websites, systems, etc., ensuring that the rules for the protection of the personal data of the Data Subjects are reflected from the moment of designing these products, services, campaigns, websites or systems.
If you have any questions about the rights of Data Subjects, or if you receive a request that concerns or may concern one or more rights of data subjects, please contact the Legal Department, which can provide you with the necessary explanations and directions.
2.2.9 The processing of Personal Data must be carried out under security conditions.
The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești may have access only to the Personal Data necessary for them to carry out their activities. SC Chimcomplex SA Borzești will ensure that it will restrict the access of the employees and collaborators of SC Chimcomplex SA Borzești and of the Service Providers of SC Chimcomplex SA Borzești to the Personal Data minimum necessary for the performance of their activities, as well as the minimum number of persons necessary to carry out the processing of Personal Data. Also, SC Chimcomplex SA Borzești will ensure that the access rights of the employees and collaborators of SC Chimcomplex SA Borzești and of the Service Providers of SC Chimcomplex SA Borzești are updated. It is important that each employee and collaborator of SC Chimcomplex SA Borzești to comply with the policies of keeping the offices in order so that there is no loss of Personal Data or unauthorized accesses. It is also important that each employee and collaborator of SC Chimcomplex SA Borzești uses only the approved systems of SC Chimcomplex SA Borzești in connection with the operations of processing the Personal Data of the Data Subjects.
If you have any questions about the security requirements regarding the processing of the Personal Data of data subjects, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.10 Personal Data may be transferred only under special conditions The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești will be able to transfer the Personal Data of the Data Subjects only in accordance with the policies and procedures of SC Chimcomplex SA Borzești. SC Chimcomplex SA Borzești does not transfer large volumes of personal data. However, there may be situations in which, exceptionally, such transfers will be necessary. Please contact the Legal Department to discuss such exceptional situations and obtain express permission to carry out the transfer of data. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești will not be able to send the service correspondence and documents or files that include Personal Data only to the persons who have duties in the process of processing personal data. It is not allowed to use the work email address to transmit personal information. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești cannot include Personal Data in the body of the emails. If documents or extracts are to be included in the body of the emails, the Personal Data included in them must be deleted.
If you have any questions about the transmission or transfer of Personal Data to colleagues in other departments or other entities in the SCR Group or to external entities, in the European Union or outside the European Union, please contact the Legal Department, which can provide you with the necessary explanations and indications.
2.2.11 The acceptance of the Service Providers of SC Chimcomplex SA Borzești is subject to specific requirements to comply with the standards of SC Chimcomplex SA Borzești for the processing of personal data. The Service providers of SC Chimcomplex SA Borzești and, in general, of the SCR Group, to the extent that they process the Personal Data of the Data Subjects for SC Chimcomplex SA Borzești or other entities of the SCR Group, must meet the requirements and standards of SC Chimcomplex SA Borzești in connection with the processing of personal data. This involves going through a specific procedure for knowing the Service Providers in order to be able to determine whether they can properly implement the personal data processing standards of SC Chimcomplex SA Borzești. SC Chimcomplex SA Borzești will always conclude contracts with the Service Providers of SC Chimcomplex SA Borzești that will include specific provisions regarding the processing of personal data by them. SC Chimcomplex SA Borzești will implement specific means of verification and control of the way in which the Service Providers of SC Chimcomplex SA Borzești fulfill their specific obligations in the field of personal data processing.
2.2.12 SC Chimcomplex SA Borzești must always be able to demonstrate that it has fulfilled its obligations in terms of the protection of personal data. According to the
Regulation, SC Chimcomplex SA Borzești has the responsibility to comply with the requirements for the protection of personal data, as well as to demonstrate that it has complied with the requirements for the protection of personal data. This may be achieved, inter alia, by documenting in writing, on electronic or paper, correspondence with the Data Subjects regarding or involving the use of personal data; keeping the documents by which customers have given their consent to certain processing of their data; proper archiving of the employment contracts of the employees of SC Chimcomplex SA Borzești and of the contracts with the Service Providers of SC Chimcomplex SA Borzești; the creation and storage of electronic reports on the exercise of customers’ options in relation to certain processing of personal data, etc. Compliance with the requirements regarding the protection of personal data is automatically considered, from the moment of conception, in the policies, procedures and systems used by the SCR Group. Employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to comply exactly with these policies and procedures and to always use the authorized systems of SC Chimcomplex SA Borzești or its own systems complying with the standards of SC Chimcomplex SA Borzești in order to carry out your tasks.
If you have any questions about fulfilling your obligations regarding the protection of personal data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
- INSTRUCTIONS ON THE PROCESSING OF PERSONAL DATA
3.1 General instructions on the protection of personal data SC Chimcomplex SA Borzești expects that each employee and collaborator of SC Chimcomplex SA Borzești and each Service Provider will be able to establish, based on the data available to it and its content, that (i) the data it has at its disposal are personal data and that (ii) they carry out the processing of personal data, whether it is collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, simple use, disclosure by transfer, transmission, dissemination or otherwise making available, restriction, erasure or destruction. These clarifications are useful in order to be able to apply correctly and in accordance with the personal data protection regime provided by this Policy and by the other policies and procedures of SC Chimcomplex SA Borzești, as well as by the applicable legislation in general. Also, the recognition as such of personal data and of the performance of personal data processing allows all departments of SC Chimcomplex SA Borzești involved in the processing of personal data of data subjects to act in a consistent manner, with the same expectations and interpretations regarding the processed data and the purposes of the data processing carried out. The products, services, campaigns, websites, systems, and all other forms through which SC Chimcomplex SA Borzești carries out its activity have a standardized content that considers the personal data protection requirements processed from the perspective of the applicable legislation. The exact observance of the requirements associated with each such product, service, campaign, website, system, etc. is the premise of the correct use by SC Chimcomplex SA Borzești of personal data and allows the performance of quality controls of data processing by SC Chimcomplex SA Borzești. SC Chimcomplex SA Borzești has the responsibility to ensure that the Personal Data it processes is accurate and up to date. In this regard, SC Chimcomplex SA Borzești will implement various activities and campaigns to update the Personal Data it processes, which may include, without limitation, campaigns to centralize the lists of emails or delivery addresses that are not valid, identifying duplicate accounts, identifying inaccurate data, establishing the accuracy of the data subjects’ agreement, examining the comments received from the Data Subjects, examining requests to exercise the rights of data subjects.
If you have any questions or concerns about the qualification of information as Personal Data, or if you would like to discuss the quality of certain data or sets of personal data, or about certain activities regarding the updating of the Personal Data that you are processing, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.2 Transparency of Personal Data processing When customers or consumers, employees, collaborators or potential employees, or representatives of the Service Providers transmit their personal data to SC Chimcomplex SA Borzești or to the Service Providers of SC Chimcomplex SA Borzești, it is the responsibility of SC Chimcomplex SA Borzești to ensure that they understand why they have to transmit their personal data, what SC Chimcomplex SA Borzești will do with the transmitted data, how, to whom and why SC Chimcomplex SA Borzești will make them available, and what are the rights of these persons in relation to this data. If the personal data are obtained directly from the Data Subject, SC Chimcomplex SA Borzești will make available to the Data Subjects, through an Information Note specific to each category of Data Subjects, the following information, unless the person concerned is already in possession of this information:– the type(s) of personal data that is intended to be processed;– the identity and the data contact details of SC Chimcomplex SA Borzești and its legal representative;– contact details of the Data Protection Officer, as the case may be;– the purposes for which the personal data are collected and processed, as well as the legal bases of the processing;– if the processing is done on the basis of a legitimate interest, the legitimate interests pursued by SC Chimcomplex SA Borzești or by a third party;– the recipients or categories of recipients of the data;– if applicable, the intention of SC Chimcomplex SA Borzești to transfer personal data to a third country or an international organization and the existence or absence of a European Commission adequacy decision or, a reference to the appropriate or appropriate safeguards and means to obtain a copy thereof;– the period for which the data will be stored personal or, if this is not possible, the criteria used to establish this period;– the existence of the right to request SC Chimcomplex SA Borzești, in respect of personal data relating to the data subject, access to them, rectification or erasure or restriction of processing or the right to object to processing, as well as the right to data portability;– the existence of the right to withdraw consent given for processing at any time, without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal;– the right to lodge a complaint with a supervisory authority;– whether the provision of personal data represents a legal or contractual obligation or an obligation necessary for the conclusion of a contract, as well as whether the data subject is obliged to provide such personal data and what are the possible consequences of failure to comply with this obligation;– the existence of an automated decision-making process including profiling, as well as relevant information on the logic used and on the importance and the envisaged consequences of such processing for the data subject, if any. If the personal data are not obtained directly from the data subject, SC Chimcomplex SA Borzești, at the time of data collection or, if it is planned to disclose the data to third parties, at the latest at the time when the first such disclosure takes place, will make available to the data subject, by means of an Information Note, in addition to the information provided above, information on the categories of data collected and details of the source from which the personal data originate and, where appropriate, whether they come from publicly available sources. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that the Information Notes are made available to the Data Subjects at the time of collecting their Personal Data. The Data Subjects will confirm that they are aware of the content of the Information Notes either by signing them or by ticking a box in this regard on the website, at the time of transmitting their data to SC Chimcomplex SA Borzești. Each process, product, service, campaign, website, system, or any other form of activity of SC Chimcomplex SA Borzești involving the processing of personal data is designed to be able to transmit to the Data Subjects the relevant Information Notes. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to strictly follow the requirements associated with each such process, product, service, campaign, website, system or other relevant form of activity of SC Chimcomplex SA Borzești. To the extent that it will be necessary for the Information Notes to be updated or retransmitted to the Data Subjects, you will be contacted by the Legal Department and/or the Hierarchical Superior with more details and instructions.
If you have any questions about informing your Data Subjects, please contact the Legal Department, which can provide you with the necessary explanations and guidance.
3.3 Protection of personal data in interactions with customers/consumers SC Chimcomplex SA Borzești
3.3.1. The documentation used in the relationship with the customers/consumers
of SC Chimcomplex SA Borzești uses in its relationship with customers and/or consumers standard information documentation and personal data collection. SC Chimcomplex SA Borzești has the obligation to update these documents, and the employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to transmit these documents to customers and consumers. SC Chimcomplex SA Borzești will send in connection with each process, product, service, campaign, website, system, or other form of carrying out its activity specific instructions on the associated documentation on the protection of personal data. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to strictly follow the standard forms made available by SC Chimcomplex SA Borzești, as well as to transmit to the Legal Department and to the Personal Data Protection Officer of SC Chimcomplex SA Borzești information on any incidents or problems that may arise from the use of these standard forms. If you have any questions about the documentation used in the relationship with customers or consumers, please contact the Legal Department, which can provide you with the necessary explanations and indications. The consent of the clients of SC Chimcomplex SA Borzești is generally necessary for the performance of marketing communications using certain communication channels, or for the operation of cookies on the websites of SC Chimcomplex SA Borzești, or for other activities that involve the processing of personal data of the clients of SC Chimcomplex SA Borzești. The process for obtaining the agreement of the clients of SC Chimcomplex SA Borzești is important, because any error can invalidate the customers’ agreement, to eliminate the possibility that SC Chimcomplex SA Borzești can make communications to that client or to attract violations of the requirements for the protection of personal data. SC Chimcomplex SA Borzești obtains the consent of its customers either through electronic (online) means of communication or through physical contact with the customer (offline). It is always necessary that the customer agreement can be documented by SC Chimcomplex SA Borzești. This is done by keeping forms written and signed by customers, including scanned form, or recordings of conversations with customers, or by creating log files that show access to a particular website from a specific IP address. it is important that SC Chimcomplex SA Borzești can have at any time a clear record of the activities for which it obtained the consent of its customers, of the moment at which this agreement was obtained, of the person who obtained it, if applicable, and of the version of the Information Note that was transmitted to the client when obtaining his consent. The consent of the Data Subjects is not required if/when:– the processing is necessary for the performance of a contract to which the Data Subject is a party or for the purpose of taking the necessary measures at the request of the Data Subject, prior to the signing of the contract or the pre-contract;– the processing is necessary to protect the vital interests of the data subject or of another natural person;– the processing is necessary for the fulfillment of a legal obligation of SC Chimcomplex SA Borzești;– the processing is necessary for the realization of a legitimate interest of SC Chimcomplex SA Borzești, provided that these interests do not affect the interests or fundamental rights and freedoms of the data subject; Data subjects will give their consent separately, for each purpose of the processing that requires their consent. In this regard, the data subjects will tick a box for each purpose in the agreement form that SC Chimcomplex SA Borzești will make available. In the case of consent obtained for the transmission of promotional messages and newsletters, the Data Subject will have the option to unsubscribe, and such an option will be contained in each message, in a visible, clear, and easily accessible manner. All processes, products, services, campaigns, websites, systems, or other forms of activity of SC Chimcomplex SA Borzești that use personal data include specific requirements designed to ensure that SC Chimcomplex SA Borzești complies with the applicable legal requirements in connection with obtaining customer consent. Please strictly comply with these requirements. To the extent that it will be considered necessary, SC Chimcomplex SA Borzești will carry out campaigns to update the customer agreement expressed before May 25, 2018, the date of entry into force of the Regulation. In any case, when you interact with the customers of SC Chimcomplex SA Borzești after May 25, 2018, it is important to remind them about their right to withdraw their consent for the personal data processing carried out by SC Chimcomplex SA Borzești.
If you have any questions about obtaining the consent of the clients of SC Chimcomplex SA Borzești, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.3.2. Interaction through social networks SC Chimcomplex SA Borzești generally uses social networks (e.g. Facebook, etc.) as a channel for communicating with customers and consumers or promoting its products, services or campaigns. If you have any questions about using social media for customer/consumer interaction, please contact the Legal Department, which can provide you with the necessary explanations and indications. It is important to note that any interaction with customers or consumers through social networks may represent a processing of their personal data, which entails the obligation of SC Chimcomplex SA Borzești to justify a legal basis for processing and to provide the customer or the consumer with the necessary information on the processing of personal data carried out. The Customer and Consumer Information Notes must include at any time details about the processing of personal data carried out through social networks, in particular, but not limited to, the purposes of the processing carried out, the legal grounds for such processing, as well as any other details specific to such interactions. Any activity that involves the use of personal data of customers / consumers through social networks must be done only for the purposes that have been communicated to these persons through the relevant Information Notes. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that the relevant Information Notes have been transmitted to customers/ consumers who use social networks for interactions with SC Chimcomplex SA Borzești. This information will be carried out in the specific ways that each type of social network or interaction with customers/consumers allows. If you have any doubts about the coverage through an Information Note of all the situations that may be relevant for the interaction with customers or consumers through social networks, or the way in which you will provide the Information Note to customers and consumers who use social networks for interaction with SC Chimcomplex SA Borzești, please contact the Legal Department to ask for clarifications and directions to follow. As with any other form of personal data processing, the transmission of personal data via social networks must be done in compliance with the security requirements for the processing of personal data and those associated with the transfer of personal data to third parties followed by SC Chimcomplex SA Borzești. If you have any questions about the security requirements associated with the transmission of personal data via social networks, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.3.3. The creation of profiles and automatic processing. SC Chimcomplex SA Borzești uses various techniques and technologies through which it creates profiles or automatically processes personal data of some of its employees. We accept, in accordance with the applicable legislation, that the use of these techniques and technologies can have a significant impact on the employees of SC Chimcomplex SA Borzești, especially if the use of these techniques and technologies results in automated decisions or leads to other important effects in relation to employees. SC Chimcomplex SA Borzești will use these techniques and technologies in compliance with strict requirements regarding the processing of personal data. Creation of a profile means any form of processing of personal data, inter alia for the purpose of assessing, analyzing, or estimating the economic situation, health status, preferences, interests, behavior, location, or movements of a natural person. In simple terms, creating a profile refers to the use of a person’s personal information in order to build an image of the type of person he or she is and how he or she behaves. As a form of data processing, all general requirements will apply in accordance with the Regulation (e.g., data protection principles, legal bases, etc.). It does not matter if the data comes from the data subject or from a third party. The automatic processing of personal data is different from the creation of profiles, with which it may overlap. Automated processing of personal data is generally the ability to make decisions by technological means, without human intervention. These decisions can be taken on the basis of any type of data, including, without limitation, data collected directly from the data subjects (e.g., replies to the questionnaires), data observed in relation to the data subjects (e.g., location data collected through an application), data obtained from public, or third sources or data generated by SC Chimcomplex SA Borzești in relation to a data subject. Automated processing or profiling those results in automated decisions about data subjects is permitted under restrictive conditions. It is also important to note that automatic data processing or profiling are processing of personal data that must be subject to information for the employees and, possibly, consumers of SC Chimcomplex SA Borzești and therefore must be included in the relevant Information Notes.
If you have any questions about the processing of personal data through profiling or automated processing, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.3.4. Performing e-commerce through the websites of SC Chimcomplex SA Borzești
SC Chimcomplex SA Borzești carries out e-commerce activities through its website and, for this purpose, collects and processes certain personal data about its customers. This may include data such as name, delivery address and various contact details of the customer (e.g., phone number, email address); in some cases, SC Chimcomplex SA Borzești also requests other types of data regarding its customers, which may also be some Sensitive Personal Data, which allow it to establish certain features or characteristics of its customers. SC Chimcomplex SA Borzești intends to always use only those personal data that are strictly necessary for purposes related to e-commerce activities. For this reason, SC Chimcomplex SA Borzești typically uses this personal data to carry out the orders placed by its customers. If SC Chimcomplex SA
Borzești needs this data for other purposes, which may include marketing, fraud prevention or keeping of documents for specific periods of time, according to the provisions of the applicable legislation, SC Chimcomplex SA Borzești will request, as the case may be, the consent of customers for the use of the data for the respective purposes or will seek to rely on other legal justifications for the processing of those categories data (e.g. compliance with legal obligations or the legitimate interest of SC Chimcomplex SA Borzești). All processes, products, services, campaigns, websites, systems, or other forms of e-commerce activity carried out by SC Chimcomplex SA Borzești include specific requirements designed to ensure that SC Chimcomplex SA Borzești complies with the applicable legal requirements. Please strictly comply with these requirements.
If you have any questions about the processing of personal data carried out in the context of e-commerce operations, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.3.5. Processing of personal data of minors The processing of personal data of minors may be necessary in connection with certain products or services of SC Chimcomplex SA Borzești. The applicable legislation on the protection of personal data provides that, when the personal data of minors under 16 years of age are processed in connection with information society services (e.g., through electronic websites or applications), and this processing is based on consent, SC Chimcomplex SA Borzești has an obligation to ensure that this agreement comes from the legal representative of the minor concerned. In all situations where the personal data of persons under the age of 18 are expected to be processed, please contact the Legal Department before collecting and processing.
3.3.6. Marketing campaigns SC Chimcomplex SA Borzești runs marketing campaigns using different communication media based on a pre-existing agreement of customers / consumers or according to another legal justification. In particular, the use of electronic communication media for the transmission of electronic communications requires the consent of customers. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that they carry out marketing communications only if they have a pre-existing legal justification for it. Also, the employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești involved in the marketing campaigns of SC Chimcomplex SA Borzești must strictly respect the preferences of the Data Subjects regarding the performance of communications to them. Persons who have expressed the option of no longer receiving marketing communications from SC Chimcomplex SA Borzești can no longer be contacted with communications that could be interpreted as promoting in any way the SCR Group, on SC Chimcomplex SA Borzești, their brands, products, services or activities, with the sole exception of the situations in which communication with those persons is necessary for the delivery of SC Chimcomplex SA Borzești products, according to the orders placed by that person. Also, no person can be contacted by or on behalf of SC Chimcomplex SA Borzești to be asked to reconsider their contact preferences. All processes, campaigns, or other forms of transmission by SC Chimcomplex SA Borzești of marketing communications include specific requirements designed to ensure that SC Chimcomplex SA Borzești complies with the applicable legal requirements. Please strictly comply with these requirements.
If you have any questions about personal data protection aspects when making marketing communications, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.3.7. Promotional campaigns carried out by SC Chimcomplex SA Borzești
SC Chimcomplex SA Borzești carry out promotional campaigns based on campaign regulations and related documentation, which include specific requirements regarding the processing of personal data carried out. SC Chimcomplex SA Borzești will ensure that, during these promotional campaigns, the personal data that will be requested from the participants in the campaigns will be reduced to the minimum necessary for the smooth running of the respective campaign. If SC Chimcomplex SA Borzești will need to request the consent of the participants in the campaign for purposes other than those related to the campaign itself (e.g., making marketing communications), SC Chimcomplex SA Borzești will request the consent of the campaign participants specifically, separately from the agreement forms on participation in the campaign. SC Chimcomplex SA Borzești will not publish the Personal Data of the participants in the campaigns, except for the name and the locality of residence of the winners and the prizes won, which can be made public. SC Chimcomplex SA Borzești will make available to the employees and collaborators of SC Chimcomplex SA Borzești and of the Service Providers of SC Chimcomplex SA Borzești the specific requirements from the perspective of the protection of personal data that must be respected during the preparation and conduct of promotional campaigns. Please strictly comply with these requirements.
If you have any questions about personal data protection aspects when conducting promotional campaigns, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.8 Breach of the security of personal data processing Any employee or collaborator of SC Chimcomplex SA Borzești and any Service Provider who is aware of, or suspects the occurrence of, an incident of personal data breach has the obligation to report such an incident as soon as possible to the Legal Department or to the Personal Data Protection Officer, so that the security breach can be notified to the National Supervisory Authority for Personal Data Processing (“ANSPDCP”) without undue delay, but not later than 72 hours after the incident was established. All data security incidents will be highlighted in a registry. This register will include all personal data security incidents, regardless of whether they have been resolved or are being resolved, and regardless of whether or not their notification to ANSPDCP or the data subjects is required.
If you have any questions about the personal data breach notification process, please contact the Legal Department, which can provide you with the necessary explanations and guidance.
3.9 The monitoring and control of access in the premises of SC Chimcomplex SA Borzești
SC Chimcomplex SA Borzești uses a surveillance system of the premises of SC Chimcomplex SA Borzești through video monitoring and access cards. The purpose of this monitoring is to manage, ensure and monitor the security, security and protection of the employees of SC Chimcomplex SA Borzești, of the visitors present in the office spaces and in the production spaces belonging to SC Chimcomplex SA Borzești, as well as of the goods, values and information located or stored in the Company’s premises. Visitors will be registered in a register of visitors, located at the receptions of the premises of SC Chimcomplex SA Borzești. The CCTV (Closed Circuit Video Monitoring) system is used exclusively for the prevention, deterrence and, if applicable, investigation of unauthorized physical access inside the premises belonging to SC Chimcomplex SA Borzești, not being used for any other purpose. Any use of surveillance equipment will be strictly limited to this purpose and will be maintained for the minimum time required. The images collected by using the surveillance systems of SC Chimcomplex SA Borzești are usually kept for 30 days, being then automatically deleted in the order in which they were recorded. In the event of a security incident, the retention time of the relevant footage may exceed the normal range depending on the time required to further investigate the security incident in question. SC Chimcomplex SA Borzești processes the Personal Data of the Data Subjects in accordance with the internal rules related to the access to the premises of SC Chimcomplex SA Borzești, with the security policy SC Chimcomplex SA Borzești, with the CCTV security policy of SC Chimcomplex SA Borzești, with the procedure for the use of video surveillance means and access cards, as well as in accordance with the relevant Information Notes. None of the monitoring systems used by SC Chimcomplex SA Borzești according to this paragraph and the policies and procedures indicated above will be used for the supervision of employees, collaborators, or visitors of SC Chimcomplex SA Borzești.
If you have any questions about personal data protection issues in connection with the activity of monitoring and control of access in the premises of SC Chimcomplex SA Borzești, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.10 The retention of personal data SC Chimcomplex SA Borzești processes a large amount of personal data collected from customers, consumers, employees, collaborators, suppliers, and other persons. The retention in accordance with the applicable law of these personal data is fundamental for the proper conduct of the activity of SC Chimcomplex SA Borzești. SC Chimcomplex SA Borzești has the interest to ensure that the Personal Data necessary for its activity are stored, processed, protected, and kept properly, in electronic / digital format or on paper, in accordance with the applicable legislation in force. Personal Data will be kept by SC Chimcomplex SA Borzești only for as long as it is necessary for the purpose for which they were collected. SC Chimcomplex SA Borzești has the interest to ensure that personal data that are no longer necessary for its activity or that are no longer relevant or whose processing purpose has been fulfilled, together with the documents highlighting them, are deleted or anonymized. Personal Data processed by or on behalf of and on behalf of SC Chimcomplex SA Borzești include registers and documents in physical or electronic form, which contain personal data of natural persons, such as employees (held in accordance with the legal provisions in force governing the employment relationship), of consumers, service providers, or of the customers of SC Chimcomplex SA Borzești. The personal data of legal entity clients and Service Providers are the personal data of their representatives, agents and employees who are natural persons. Personal data received by SC Chimcomplex SA Borzești unintentionally, for an error or for similar reasons, SC Chimcomplex SA Borzești will treat this information as confidential information belonging to the person who communicated it, in which case any analysis, dissemination, distribution or copying of this information will be strictly prohibited and, therefore, it will be deleted as soon as possible from the company’s systems SC Chimcomplex SA Borzeşti. SC Chimcomplex SA Borzești will keep, in physical or electronic form, all documents that refer to the performance of personal data processing by SC Chimcomplex SA Borzești, including, without limitation, the following:– the documents by which SC Chimcomplex SA Borzești has collected the Personal Data of the Data Subjects;– the documents certifying the provision by the Data Subjects of their consent regarding the performance by SC Chimcomplex SA Borzești of data processing, if applicable;– the Information Notes transmitted to the Data Subjects, together with the corresponding evidence of their transmission;– the requests for exercising the rights of the Data Subjects according to the legislation on data protection staff; The records and documents of SC Chimcomplex SA Borzești (including, without limitation, accounting and financial, fiscal and corporate records, etc.) are subject to specific policies on the management of the company’s documents, depending on the type of documents containing such data. This Section 3.10 will apply to any of these documents and records to the extent that they contain personal data. The various documents containing personal data will be kept for the periods of time provided in Annex no. 1 to this Policy. They shall be supplemented by the retention periods indicated below. Staff registers on employees Electronic records of payroll (including salaries/bonuses) – if they exist only in electronic format, will be kept for 50 (fifty) years from the end of the financial year during which the register was created. Records of sick leave and other types of leave are considered to be supporting documents for payrolls, thus being archived for 50 (fifty) years, if they exist only in electronic format. Staff files in electronic format of employees (which include individual employment contracts, individual attendance sheets, application forms, records of changes in the position or staff status, performance evaluations, documents on termination of employment, disciplinary/complaint records, garnishment records, as well as those on professional training and qualification), if they exist only in electronic format, will be kept for a period of 75 (seventy-five) years. The personnel files in electronic format will be kept in appropriate conditions and will be accessible at the offices of SC Chimcomplex SA Borzești together with the Employees’ Register – ReviSal, ensuring the security of the data and the fact that they are easily accessible at the request of the authorities in case of inspections. In all situations, if the above-mentioned files exist both in printed and electronic format, the electronic files will be kept for 6 (six) years after the termination of the employment contract.
If you have any questions about the retention by SC Chimcomplex SA Borzești of personal data on the employees of SC Chimcomplex SA Borzești, please contact the Legal Department, which can provide you with the necessary explanations and indications.
Customers, Consumers, Collaborators and Service Providers Data All personal data of consumers, customers, collaborators or Service Providers should be kept, stored and processed strictly only if they are adequate, relevant and limited only to what is necessary for the purposes for which they are processed. The personal data of customers, collaborators or Service Providers relates only to data relating to natural persons. The period for which such personal data is stored must be strictly limited to the minimum necessary. As a rule, the personal data of customers, consumers, collaborators and Service Providers will be processed during the performance of the contracts concluded between these Data Subjects and SC Chimcomplex SA Borzești, in order to fulfill the contractual obligations assumed, as well as until the expiry of the term in which the parties may bring actions or claims in connection with these contracts. To cover any situations of interruption of the extinctive prescription it is advisable to keep for 4 years. Personal data processed for direct marketing purposes, respectively to send promotional messages related to the products of SC Chimcomplex SA Borzești, will be processed:– as long as there is a valid consent of the data subjects; in this regard, SC Chimcomplex SA Borzești will be able to resume the consent of the Data Subjects periodically.– until the withdrawal of the data subject’s consent; if there is no other purpose of processing the data subject’s consent; if there is no other purpose of processing the data subject such data, they will be deleted or anonymized as soon as the Data Subject has withdrawn his or her consent.
If you have any questions about the retention of the personal data of the customers, consumers, and Service Providers of SC Chimcomplex SA Borzești, please contact the Legal Department, which can provide you with the necessary explanations and indications.
Candidates The applications received for the various vacancies within SC Chimcomplex SA Borzești, which contain data of the candidates who were not employed on the respective positions, will be kept until the expiry of the term in which these candidates can make actions or claims in connection with the recruitment process, namely 4 years. SC Chimcomplex SA Borzești can keep the applications of the rejected candidates, in view of future employment possibilities, with their consent, for 2 years.
If you have any questions about keeping documents, please contact the Legal Department, which can provide you with the necessary explanations and indications. Personal data collected in marketing campaigns The personal data collected and processed within the various promotional campaigns carried out by SC Chimcomplex SA Borzești will be kept exclusively for the period necessary for the performance of the respective campaign, until the awarding of the campaign prizes to the winners and until the expiry of the term in which the persons may formulate objections / requests regarding the development / result of the campaign (3 years).
3.11 Deletion of personal data All departments of SC Chimcomplex SA Borzești have the responsibility to ensure that all personal data for which they are responsible are effectively deleted or anonymized in accordance with this Policy. This also applies to children, when they exist, including back-up copies. Each department of SC Chimcomplex SA Borzești keeps inventories of the Personal Data collected, which are updated on the basis of periodical checks to ensure that the data continues to follow the legal requirements and standards. Upon expiry of the processing periods of the personal data indicated in the Information Notes sent to the Data Subjects and in accordance with the registers of records of the processing of personal data of SC Chimcomplex SA Borzești, the Personal Data must be deleted or anonymized. It is the responsibility of each Head of Department of SC Chimcomplex SA Borzești to ensure that the Personal Data for which that department is responsible are deleted or, respectively, anonymized. The Legal Department and the Data Protection Officer will communicate to the employees and collaborators of SC Chimcomplex SA Borzești and, respectively, to the Service Providers of SC Chimcomplex SA Borzești instructions on the deletion of Personal Data following a request from the Data Subjects. The effective deletion of personal data is done by means that ensure their safe and permanent deletion, thus ensuring that: – the data are not lost or disclosed to other unauthorized third parties; – the data cannot be recovered or reconstituted later;– all copies are destroyed so that the data cannot be recovered or reconstituted later. The deletion of personal data by SC Chimcomplex SA Borzești will be carried out by appropriate means, corresponding to the storage medium applicable to the respective Personal Data:– physical documents that include Personal Data will be destroyed securely, using specific equipment;– electronic files that include Personal Data, including documents, video or audio recordings, will be deleted using the available technical means;– video or audio recordings on magnetic media will be deleted by performing a new writing on the same medium;– [other technical methods] If for technical reasons the permanent deletion of personal data is not possible, SC Chimcomplex SA Borzești must ensure that these data:– are properly anonymized;– will not be able to be used by SC Chimcomplex SA Borzești or by other persons in ways that affect the data subject in any way;– will not be accessible by other organizations;– are subject to appropriate technical and organizational security measures;– will be permanently deleted when this becomes possible. The operations of effective deletion of personal data are the responsibility of the employees and collaborators of SC Chimcomplex SA Borzești, respectively of the Service Providers of SC Chimcomplex SA Borzești.
If you have any questions about the deletion of personal data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
Service Providers will take appropriate measures to ensure that they delete personal data at the expiration of the duration for which they are processed, as indicated in the contracts concluded by service providers with SC Chimcomplex SA Borzești. Before performing the erasure of personal data, service providers will inform SC Chimcomplex SA Borzești about the intention to delete the processed personal data. The Service Providers will effectively delete the personal data only after receiving the favorable opinion of SC Chimcomplex SA Borzești, through the Legal Department and the Data Protection Officer.
If you have any questions about the deletion of personal data, please contact your usual contact person from SC Chimcomplex SA Borzești to request the opinion of the Legal Department of SC Chimcomplex SA Borzești.
The deletion of Personal Data from the backup copies kept by SC Chimcomplex SA Borzești is carried out only at the time when the backup systems are reviewed. Please communicate to the Legal Department and the Data Protection Officer the deletion of certain Personal Data to ensure that personal data will also be deleted from backup copies.
3.12 Transfers of personal data
3.12.1 Making available personal data inside SC Chimcomplex SA Borzești
In carrying out the activity of SC Chimcomplex SA Borzești, the Personal Data of some Data Subjects must be processed by several departments of SC Chimcomplex SA Borzești in the fulfillment of the purposes of the processing of SC Chimcomplex SA Borzești. The internal processes of SC Chimcomplex SA Borzești are designed to comply with the requirements for the protection of personal data, including the minimization of personal data used by the various departments of SC Chimcomplex SA Borzești in their activities. There are provided hierarchical models of access to the Personal Data collected by SC Chimcomplex SA Borzești, according to which each department may intervene on the Personal Data only for the purposes of the specific activities it has to perform. The collection and processing by a specific department of data other than those provided for by these internal processes and models can be carried out only with the approval of the Legal Department and the Data Protection Officer.
If you have any questions about the processing of Sensitive Personal Data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.12.2 Transfers of personal data to service providers In order to carry out their activity, in certain situations SC Chimcomplex SA Borzești will make available to its Service Providers the Personal Data of the Data Subjects. These transfers must always be made according to the contractual provisions between the Service Providers and SC Chimcomplex SA Borzești. Such situations of transfer of personal data should be included in the relevant Information Notes by indicating the Service Provider or the category of service provider to which the respective Service Provider belongs. The employees and collaborators of SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești have the responsibility to ensure that the provisions of the contracts with the Service Providers of SC Chimcomplex SA Borzești reflect the actual exchanges between SC Chimcomplex SA Borzești and the Service Providers of SC Chimcomplex SA Borzești.
If you have any questions about the transfers of personal data to the Service Providers of SC Chimcomplex SA Borzești, please contact the Legal Department, which can provide you with the necessary explanations and indications.
3.12.3 Transfers of personal data to Third Parties The transfer of personal data to Third Parties who are not Service Providers and with whom, in general, SC Chimcomplex SA Borzești does not have a contract may be carried out on the basis of legal obligations or on the basis of the legitimate interest of SC Chimcomplex SA Borzești. For example, the concept of “Third Parties” may include public authorities, including tax authorities, courts, bailiffs’ offices, potential buyers of activities or entities of SC Chimcomplex SA Borzești, etc.
Please do not make any transfer of personal data to such Third Parties before contacting the Legal Department, which will provide you with instructions on the transmission of personal data to Third Parties.
3.12.4 Transfers of personal data outside the European Union The activity of the SCR Group does not require the transmission of personal data to entities outside the European Union. If this is the case, any situation of transfer of personal data to an entity outside the European Union will be managed only together with the Legal Department of SC Chimcomplex SA Borzești.
3.13 The assessment of the impact on the protection of personal data SC Chimcomplex SA Borzești aims to follow an approach to ensure the protection of personal data from the moment of designing its programs, products, services, websites, campaigns, systems, etc. SC Chimcomplex SA Borzești believes that this approach is essential for minimising the risks of personal data protection, which may also have the role of strengthening the relationship with its customers, employees and collaborators or Service Providers. Identifying in advance the problems that certain processing of personal data involves and solving problems before starting the processing can be an important benefit for SC Chimcomplex SA Borzești. Other important benefits may include increasing the level of knowledge of the requirements for the protection of personal data in SC Chimcomplex SA Borzești or decreasing the risk of violation of legal requirements and implicitly of applying sanctions. One of the ways to implement ensuring the protection of personal data from the moment of designing the programs, products, services, or systems of SC Chimcomplex SA Borzești is to carry out impact assessments on the protection of personal data regarding them before implementing them. According to the requirements for the protection of personal data, in the case of processing likely to generate a high risk for the rights and freedoms of natural persons, and in particular when that processing is based on new technologies, SC Chimcomplex SA Borzești has the obligation to carry out, before the actual processing of personal data, an assessment of the impact of the processing operations provided for on the protection of the data Personal. High risks relevant to the activity of SC Chimcomplex SA Borzești involve, inter alia, systematic, and extensive data processing, which include profiling or automated decision-making with legal effects or other significant effects on data subjects. In limited cases, it may be relevant for SC Chimcomplex SA Borzești to carry out assessments of the protection of personal data also in cases of large-scale processing of special personal data and data on criminal convictions and offences. As a minimum necessary, the impact assessments on the protection of personal data will include the following:– Description of the processing operations envisaged and of the purposes of the processing– Analysis of the necessity and proportionality of the processing with the identified purposes and of the risks for the identified natural persons and of the risks for the natural persons concerned– List of the measures foreshadowed to limit these risks and ensure compliance with the provisions of the applicable legislation
SC Chimcomplex SA Borzești will be able to request, as part of the operations of impact assessment on the protection of personal data, the opinion of the data subjects or their representatives regarding the planned processing, taking all measures to protect the commercial interests of SC Chimcomplex SA Borzești. In the case of employment relations, this may involve carrying out consultations with the unions to which the employees of SC Chimcomplex SA Borzești are affiliated or with other forms of their representation. Following the implementation of a specific personal data processing operation for which SC Chimcomplex SA Borzești has carried out an impact assessment on the protection of personal data, SC Chimcomplex SA Borzești will be able to carry out an analysis to assess the conformity of the processing carried out with the initial impact assessment on the protection of personal data. This subsequent assessment will be carried out on a mandatory basis when SC Chimcomplex SA Borzești establishes that the level of risk associated with the processing of personal data has changed. If you have any questions about the processing of Sensitive Personal Data, please contact the Legal Department, which can provide you with the necessary explanations and indications.
- GOVERNANCE OF PERSONAL DATA PROCESSING IN SC Chimcomplex SA Borzeşti
4.1 Organizational aspects regarding the protection of personal data
The protection of personal data is a subject that concerns all departments and activities of SC Chimcomplex SA Borzești and of the SCR Group in general. SC Chimcomplex SA Borzești considers that the commercial teams are the ones that hold the information on what personal data they use and for what purposes. Therefore, the responsibility regarding the Personal Data of the Data subjects within SC Chimcomplex SA Borzești lies mainly with the commercial teams from SC Chimcomplex SA Borzești and their Heads of Departments. The identification of personal data by the commercial teams of SC Chimcomplex SA Borzești is very important for the creation, implementation, and observance of healthy practices for the management of personal data. In the context in which personal data of the Data Subjects are made available inside SC Chimcomplex SA Borzești, between different departments and commercial teams, it is important for SC Chimcomplex SA Borzești to have a single responsible person regarding the Personal Data processed by SC Chimcomplex SA Borzești. This allows to ensure a high standard of integrity in relation to the processing of personal data; it also avoids duplication of compliance efforts with the requirements for the protection of personal data. SC Chimcomplex SA Borzești will implement a governance model regarding personal data applicable within the organization. Also, SC Chimcomplex SA Borzești will apply the governance models in terms of personal data that are developed at the level of the SCR Group. Within SC Chimcomplex SA Borzești, a working group on the protection of personal data was created, which includes the following people: – Lawyer – Legal Office – Head of Human Resources Office – Head of Technical Office – Head of Accounting Office– Payroll;– Head of Marketing Office – Sales – Head of IT Office
4.2 Continuous education on the protection of personal data
All employees of SC Chimcomplex SA Borzești will be constantly trained on issues related to the processing of personal data and how they should work with this data. The Service Providers of SC Chimcomplex SA Borzești must, in their turn, implement regular education programs on personal data protection issues in relation to their personal data processing activity for SC Chimcomplex SA Borzești. The training will be carried out by the Personal Data Protection Officer and will consist of training sessions that concern both general data protection issues and specific aspects, depending on the concrete work duties of the staff who come into contact with personal data. The Personal Data Protection Officer will draw up a list of the relevant training sessions for the different categories of staff, which he/she will make available to them on a regular basis. If you have any questions about the training sessions on personal data protection issues, please contact the Personal Data Protection Officer, who can provide you with the necessary explanations and indications.