Rompetrol

INFORMATION MEMORANDUM REGARDING PERSONAL DATA PROTECTION

 

In accordance with EU Regulation No. 679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “General Data Protection Regulation” or  “GDPR”), of the internal regulatory acts approved in view of the implementation of the EU General Regulation, the Company Rompetrol Downstream SRL, which is part of the KMG International (hereinafter referred to as the “Company”), with its headquarters in Bucharest, Sector 1, 3-5 Piata Presei Libere, City Gate Northen Tower, 2nd floor, registered with the Bucharest Trade Registry under no. J40/1716/2000, SRC RO12751583, duly represented by Vladislav Rusnac, as General Manager, has the obligation to process your personal data that you provided to us under safety conditions, in good faith and in accordance with the legal provisions in force, solely for the achievement of the specified purposes.

 

1. Personal Data Controller:

Rompetrol Downtream SRL is a Romanian company organized and existing in accordance with the laws of Romania, which, in its Controller capacity, stores in good faith the personal data of its clients’legal representatives or its conventional clients legal entities, in accordance with the applicable regulations, in full compliance with the principles of personal data processing for legitimate purposes, according to Law No. 677/2001 and article 5 of the EU General Regulation regarding the data protection, of the internal regulatory acts approved in view of the implementation of the EU General Regulation.


2. Personal data

The data processed:

   a) Name and first name,
   b) Date and place of birth, other data in the marital status documents;
   c) Address (domicile / residence), telephone/ facsimile, email;
   d) Personal identification number, identity card series and number;
   e) Place of work;
   f) Bank and IBAN account,
   g) Data on the services and products purchased, such as: quantity, amount, purchase date and place;
   h) Fill&Go Card Code;
   i) Data on the incomes obtained;
   j) Your image;
   k) Your voice, in case of telephone calls through Infoline;
   l) Other data

3. Purposes of the personal data processing

These data are processed by the Company for the following purposes:

  1. For the purchase of LPG products, fuels and of other specific products, for the issuance of financial securities for the amounts withheld as surety, as the case may be, for the contracting and administration of the agreements concluded by you, as client and/or user of a Personal Fill&Go Card, as per art. 6 para. 1, letter b) of the General Regulation on data protection with a view to the conclusion and performance of an agreement with the data subject,
  2. And for the performance of the payments, respectively of the billing f the services provided as per 6 para. 1, letter b) of the General Regulation on data protection;
  3. With a view to verifying the reliability and approval of the credit limit for the Fill&Go Credit clients, as per art. 6 para.1) letter f) of the General Regulation on data protection, respectively in the legitimate interest of the controller for applying credit risk analysis measures;
  4. With a view to fulfilling a legal obligation to the Controller, respectively with a view to ensuring security services, by analyzing security incidents (Law no. 333/2003 and GD 301/2012), merchandise transport (transport of hazardous goods - GD 1175/2007, Order of the Ministry of Transport, Construction and Tourism no. 1214/2015, Order no. 1044/2003), the performance of the money laundering offences prevention measures (Law no. 652/2002 on preventing and sanctioning money laundering, as well as for instituting certain measures to prevent and combat terrorism), as per art. 6, para. 1, letter c) of the General Regulation on data protection;
  5. With a view to settling complaints and notifications in the Rompetrol gas stations, by telephone through Infoline or by mail, as per article 6 para. 1) letter c) and f) of the General Regulation on data protection, with a view to fulfilling a legal obligation (Order no. 21/1992 on consumer protection), respectively for fulfilling a legitimate interest of the Controller consisting in the analysis and settlement of the incidents notified;
  6. For your contacting with a view to obtaining your opinion on the services and products of the Controller and of the KMG International Group purchased by you, by telephone call, email, SMS, website, social media channels and mobile application in compliance with art. 6 para. 1) letter f) of the General Regulation on data protection;
  7. For statistical purposes, as per art. 6 para. 1), letter f) and art. 89 of the General Regulation on data protection;
  8. For intra group reporting, respectively for the performance of the clients’ attending services through the KMG International Group entities, as per art. 6 para. 1) letter f) of the General Regulation on data protection, in the legitimate interest of the Controller for organizing its clients’ attending activity in the most efficient manner, thus guaranteeing a high level of the quality of the services and products offered;
  9. For recovering the debts owed by you to the Controller, amicably/by forced execution, including for settling the different litigations, as per the agreements concluded and the legitimate interest of the Controller in recovering the receivables afferent to the existing contractual relationship with you, as per art. 6, para. 1), letters b) and f) of the General Regulation on data protection, as well as for recovering, by forced execution, the amounts owed as per 6 para. 1), letter c) of the General Regulation on data protection and of the legal provisions applicable;
  10. For video surveillance by recording your image in the case where you are visiting the offices of the Controller or Rompetrol gas stations, performed in the legitimate interest of the controller as per art. 6 para. 1) letters f) and c) of the General Regulation on data protection, respectively the security of the locations and persons as per Law no. 333/2003;

In the case where the Company shall decide upon processing your personal data for other purposes, especially under article 6, para. 1, letter a) of the EU General Regulation on data protection, and of the internal legislative acts approved with a view to implementing the EU General Regulation, respectively under your consent, you shall be sent a separate information memorandum, enabling you to give your freely expressed consent.


4. Duration of personal data processing

Within the purposes related to the performance of the agreement concluded with you and the provision of the services and products purchased by you, your personal data shall be stored for a limited period of time in a single place and in accordance with the legal provisions and conditions, as follows:

  • The documents containing personal data shall be stored for the duration of the contractual relationship with the Controller, respectively of 10 years after its expiry, as per the Accounting Law no. 82/1991.

The duration for keeping video recordings captured by the video surveillance cameras mentioned in item 2, letter i) is of approximately 30 days as of the date of their recording.


5. The need for processing personal data

The data processed for the purposes provided for by item 2 letters a) –d) are necessary with a view to either the conclusion or the performance of the agreement concluded with you or for the observance of a legal obligation of the Controller, so that your refusal in sending these data to the Controller may determine the impossibility for concluding a contractual relationship for certain services, such as Personnel Fill&Go service.

In the case where you oppose to the processing of your data for the purpose of obtaining your opinion with regards to the services and products offered or purchased as per item 2) letter e), the contractual relationship between you and the Controller shall not be affected in any way.

In the case where you oppose data processing for statistical purposes as per item 2) letter f), we inform you that this option shall be analyzed and, depending on your particular situation, you will receive a reply as per art. 21 of the General Regulation on data protection, your objection for such operation, not having an impact on the continuance of the contractual relationship with the Controller.


6. Empowered persons and Data Recipients

Personal data may be sent by the data subject, the representatives of the data subject, other companies within the same Group as the Controller

  • The companies within the KMG International which perform for the Company activities in the field of procurements, work relationships or to who the Company reports the results of its activity, such as KMG Rompetrol Services Center S.R.L., Global Security System S.A. KMG Rompetrol S.R.L.
  • The commercial companies servicing gas stations;
  • Other companies of the controller’s group, in EU/EEA.
  • IT and telecommunication service providers, courier services, advertising agencies, other contractual partners (for example attorneys at law, auditors bound by the confidentiality obligations with regards to the data sent).
  • State authorities such as NAFA, NACS, etcetera base on their competences provided for by the law applicable.

7. Personal data transfer:

Personal data may be accessed by other abroad companies within the KMG International Group, with a view to performing joint projects or auditing the activities of the Group entities, as follows:

  • KazMunayGas Trading AG, headquartered in via Cassarinetta 9, 6900, Lugano, Switzerland. We mention Switzerland, which as per the Decision of the European Commission guarantees an appropriate level of protection of the personal data,
  • KMG Rompetrol Kazakhstan, headquartered in Astana, 010000, Kazakhstan Republic, Astana, Raion Esil, 4a Sos. Kurgalzhinskoe. We mention that for Kazakhstan, the Controller concluded with KMG Rompetrol Kazakhstan a standard agreement for the processing of personal data.

In the case where your data shall be transferred to other companies abroad, with a view to performing the purpose of the data processing operation, you will be notified and the guarantees provided for by art. 44-49 of the General Regulation on data protection shall apply.

The data sent to third parties shall be appropriate, relevant and non-excessive by reference to the purpose for which these have been collected and which enable the transfer to a certain third party.


8. Rights of the data subject

In order to be fully informed, you, as the data subject, have the following rights exclusively in respect of your personal rights, pursuant to the EU General Data Protection Regulation:

a) Right of access means that you are entitled to obtain Controller’s confirmation whether or not your personal data are processed and, if processed, you may have access to the respective data and to information regarding how such data are processed.

b) Right to data portability means the right to receive the personal data in a standard, structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where such data are processed automatically based on consent pursuant to point (a) of Article 6(1) or on a contract pursuant to point (b) of Article 6(1) of the EU General Data Protection Regulation.

c) Right to object means your right to object, on grounds relating to your particular situation, to processing of your personal data, including profiling based on those data, where processing is necessary pursuant to points (e) and (f) of Article 6(1), to achieve a legitimate interest of the Controller or for the performance of a task carried out in the public interest.

d) Right to rectification refers to the right the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement, and your rectified data will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.

e) Right to erasure (“right to be forgotten”) represents the right to request erasure of your personal data, without undue delay, where your personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed; where you withdraw your consent and there is no other lawful basis for processing; where you object to the processing and there are no prevailing legitimate legal grounds; where your personal data have been processed unlawfully; where your personal data must be erased in order to comply a legal obligation; your personal data have been collected in relation to the provision of information society services. The data erasure will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.

f) Right to restriction of processing refers to the case where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; where the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; where the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

g) Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for entering into, or performance of, a contract with you, in which case the processing takes place based on the legal provisions in effect or on your free consent.

h) Right to withdraw your consent. Where your personal data are processed based on your consent, you are entitled to withdraw your consent at any time, without effect on the lawfulness of the processing based on such consent prior to the withdrawal thereof.

Furthermore, as data subject you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or with any competent courts.
All the above rights may be exercised by means of a written signed and dated request transmitted to the office of the Controller Rompetrol Downstream SRL, to 3-5 Piata Presei Libere, City Gate Northern Tower, 2nd floor, Sector 1, Bucharest. As of May 25th, 2018, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer to one of the following email addresses: dataprotection@rompetrol.com, compliance@rompetrol.com or you may call us at the telephone number 0800 0800 08.

In the case where you will have any questions regarding the exercise of your data protection rights, these will be answered by the Controller within 15 days, pursuant to Law no. 677/2001, and as of May 25th, 2018, within 30 days, in accordance with the EU General Data Protection Regulation no. 679/2016.

The Data Controller guarantees that your data are processed for legitimate purposes, and that it implements adequate technical and organizational measures to ensure data integrity and confidentiality pursuant to Articles 25 and 32 of the EU General Data Protection Regulation.

 

Rompetrol Downstream SRL,

General Manager,

Vladislav Rusnac

Discover