In accordance with EU Regulation No. 679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “General Data Protection Regulation” or “GDPR”), of the internal regulatory acts approved in view of the implementation of the EU General Regulation, the Company Rompetrol Downstream SRL, which is part of the KMG International (hereinafter referred to as the “Company”), with its headquarters in Bucharest, Sector 1, 3-5 Piata Presei Libere, City Gate Northen Tower, 2nd floor, registered with the Bucharest Trade Registry under no. J40/1716/2000, SRC RO12751583, duly represented by Vladislav Rusnac, as General Manager, has the obligation to process your personal data that you provided to us under safety conditions, in good faith and in accordance with the legal provisions in force, solely for the achievement of the specified purposes.
1. Personal Data Controller:
Rompetrol Downtream SRL is a Romanian company organized and existing in accordance with the laws of Romania, which, in its Controller capacity, stores in good faith the personal data of its clients’legal representatives or its conventional clients legal entities, in accordance with the applicable regulations, in full compliance with the principles of personal data processing for legitimate purposes, according to Law No. 677/2001 and article 5 of the EU General Regulation regarding the data protection, of the internal regulatory acts approved in view of the implementation of the EU General Regulation.
2. Personal data
The data processed:a) Name and first name,
These data are processed by the Company for the following purposes:
In the case where the Company shall decide upon processing your personal data for other purposes, especially under article 6, para. 1, letter a) of the EU General Regulation on data protection, and of the internal legislative acts approved with a view to implementing the EU General Regulation, respectively under your consent, you shall be sent a separate information memorandum, enabling you to give your freely expressed consent.
Within the purposes related to the performance of the agreement concluded with you and the provision of the services and products purchased by you, your personal data shall be stored for a limited period of time in a single place and in accordance with the legal provisions and conditions, as follows:
The duration for keeping video recordings captured by the video surveillance cameras mentioned in item 2, letter i) is of approximately 30 days as of the date of their recording.
The data processed for the purposes provided for by item 2 letters a) –d) are necessary with a view to either the conclusion or the performance of the agreement concluded with you or for the observance of a legal obligation of the Controller, so that your refusal in sending these data to the Controller may determine the impossibility for concluding a contractual relationship for certain services, such as Personnel Fill&Go service.
In the case where you oppose to the processing of your data for the purpose of obtaining your opinion with regards to the services and products offered or purchased as per item 2) letter e), the contractual relationship between you and the Controller shall not be affected in any way.
In the case where you oppose data processing for statistical purposes as per item 2) letter f), we inform you that this option shall be analyzed and, depending on your particular situation, you will receive a reply as per art. 21 of the General Regulation on data protection, your objection for such operation, not having an impact on the continuance of the contractual relationship with the Controller.
Personal data may be sent by the data subject, the representatives of the data subject, other companies within the same Group as the Controller
Personal data may be accessed by other abroad companies within the KMG International Group, with a view to performing joint projects or auditing the activities of the Group entities, as follows:
In the case where your data shall be transferred to other companies abroad, with a view to performing the purpose of the data processing operation, you will be notified and the guarantees provided for by art. 44-49 of the General Regulation on data protection shall apply.
The data sent to third parties shall be appropriate, relevant and non-excessive by reference to the purpose for which these have been collected and which enable the transfer to a certain third party.
In order to be fully informed, you, as the data subject, have the following rights exclusively in respect of your personal rights, pursuant to the EU General Data Protection Regulation:
a) Right of access means that you are entitled to obtain Controller’s confirmation whether or not your personal data are processed and, if processed, you may have access to the respective data and to information regarding how such data are processed.
b) Right to data portability means the right to receive the personal data in a standard, structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where such data are processed automatically based on consent pursuant to point (a) of Article 6(1) or on a contract pursuant to point (b) of Article 6(1) of the EU General Data Protection Regulation.
c) Right to object means your right to object, on grounds relating to your particular situation, to processing of your personal data, including profiling based on those data, where processing is necessary pursuant to points (e) and (f) of Article 6(1), to achieve a legitimate interest of the Controller or for the performance of a task carried out in the public interest.
d) Right to rectification refers to the right the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement, and your rectified data will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.
e) Right to erasure (“right to be forgotten”) represents the right to request erasure of your personal data, without undue delay, where your personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed; where you withdraw your consent and there is no other lawful basis for processing; where you object to the processing and there are no prevailing legitimate legal grounds; where your personal data have been processed unlawfully; where your personal data must be erased in order to comply a legal obligation; your personal data have been collected in relation to the provision of information society services. The data erasure will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.
f) Right to restriction of processing refers to the case where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; where the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; where the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
g) Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for entering into, or performance of, a contract with you, in which case the processing takes place based on the legal provisions in effect or on your free consent.
h) Right to withdraw your consent. Where your personal data are processed based on your consent, you are entitled to withdraw your consent at any time, without effect on the lawfulness of the processing based on such consent prior to the withdrawal thereof.
Furthermore, as data subject you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or with any competent courts.
All the above rights may be exercised by means of a written signed and dated request transmitted to the office of the Controller Rompetrol Downstream SRL, to 3-5 Piata Presei Libere, City Gate Northern Tower, 2nd floor, Sector 1, Bucharest. As of May 25th, 2018, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer to one of the following email addresses: firstname.lastname@example.org, email@example.com or you may call us at the telephone number 0800 0800 08.
In the case where you will have any questions regarding the exercise of your data protection rights, these will be answered by the Controller within 15 days, pursuant to Law no. 677/2001, and as of May 25th, 2018, within 30 days, in accordance with the EU General Data Protection Regulation no. 679/2016.
The Data Controller guarantees that your data are processed for legitimate purposes, and that it implements adequate technical and organizational measures to ensure data integrity and confidentiality pursuant to Articles 25 and 32 of the EU General Data Protection Regulation.
Rompetrol Downstream SRL,