Notice on the processing of personal data

The protection of your personal information is very important to us. That is why we are committed to complying with European and national legislation on the protection of personal data, in particular Regulation (EU) 2016/679 (hereinafter “GDPR”), Law 190/2018, and the following principles:

Lawfulness, fairness and transparency

We process your data lawfully and fairly. We are always transparent about the information we use, and you are duly informed.

You are in control

Within the limits of the law, we give you the opportunity to review, modify, and delete the personal data you have shared with us, and to exercise your other rights.

Data integrity and purpose limitation

We use your data only for the purposes described at the time of collection, or for new purposes compatible with the original ones. In all cases, our purposes are compatible with the applicable legislation. We take reasonable steps to ensure that personal data is accurate, complete, and up to date.

Security

We have implemented reasonable security measures to protect your data as effectively as possible. However, please note that no website, application, or internet connection is completely secure.

INTEGRATION DATA SYSTEMS S.R.L., with registered office in Bucharest, sector 1, 43 Argentina street, registered with the Trade Registry under no. J2012008392405, VAT number RO 30455799, and bank account RO67INGB0000999906214786 opened at ING BANK, email: dpo@ids-consulting.ro, represented by Gabriel Sebastian Tătaru, acting as Data Controller, processes your personal data as described in this Notice:

1. Purpose(s) and means of processing personal data We process your personal data for the purpose of conducting business correspondence and carrying out the commercial agreements concluded with the company you represent. We will also occasionally send you emails containing information about our products or company activity.
2. Legal grounds for processing The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), art. 6(1)(f) — the legitimate interest of the controller.
3. Categories of personal data processed As part of the processing operations described in this Notice, the following categories of personal data will be processed: – first and last name; – email address; – job title/position; – any other personal data you choose to include in your correspondence with our company.
4. Recipients of the personal data processed Access to the data collected for the purposes set out in this Notice is granted only to employees and collaborators of the company who have a legitimate interest in knowing it. Where the data constitutes evidence in criminal or civil litigation, it may be transmitted to state authorities upon their request, or to establish or defend the Controller’s interests.
5. Your personal data provided will not be transferred to third-party controllers or cross-border organizations outside the European Union or the United States of America.
6. Data retention period Data is retained for as long as the legal ground for its processing exists, as well as for the period required by applicable archiving legislation.
7. Your rights regarding the personal data we process In accordance with articles 15-22 of EU Regulation 679/2016, you have the following rights regarding the processing of your personal data:
   1. Right of access: the right to obtain confirmation from the Controller as to whether personal data concerning you is being processed and, if so, to access that data and certain related information as provided by law.
   2. Right to rectification: the right to obtain from the Controller the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data.
   3. Right to erasure (the “right to be forgotten”): the right to obtain from the Controller the erasure of personal data concerning you, only where:
      1. the personal data is no longer necessary for the purposes for which it was collected or processed;
      2. you withdraw the consent on which the processing is based (where processing was based on your consent) and there is no other legal ground for the processing;
      3. you object to the processing of personal data concerning you (including profiling) and there are no overriding legitimate grounds for the processing, or you object to processing for direct marketing purposes (including profiling);
      4. the personal data has been unlawfully processed;
      5. the personal data must be erased to comply with a legal obligation under Union or national law to which the Controller is subject;
      6. the data is not needed for and/or in connection with the performance of a contract;
      7. after expiry of the period for which the Controller has a legal obligation to retain and/or archive the personal data;
      8. the processing is not necessary for exercising the right to freedom of expression and information;
      9. the processing is not necessary for compliance with a legal obligation requiring processing under Union or national law applicable to the Controller;
      10. the processing is not necessary for the establishment, exercise, or defense of a legal claim;
      11. in other cases provided by law, under the conditions, limits, and exceptions established by law.
   4. Right to restriction of processing, where:
      1. you contest the accuracy of the data, for a period enabling the Controller to verify its accuracy;
      2. the processing is unlawful and you oppose the erasure of the personal data, requesting instead a restriction on its use;
      3. the Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of a legal claim; or
      4. you have objected to processing in accordance with the law, for the period during which it is verified whether the Controller’s legitimate grounds override your own.

         After restriction, personal data may only be processed (other than storage) with your consent and/or in cases provided by law. You have the right to be informed of the recipients to whom the personal data has been disclosed, and to whom we have communicated any rectification, erasure, or restriction of processing carried out at your request.

   5. Right to data portability: the right to receive the personal data concerning you that you have provided to the Controller, in a structured, commonly used, machine-readable format, and to transmit that data to another controller without hindrance from the Controller, in the cases and under the conditions provided by law. You have the right to request that personal data be transmitted directly from one controller to another, where technically feasible. The right to data portability applies under the conditions and limits provided by law.

   6. Right to object: the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you and to profiling, as provided by law, unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or where the purpose is the establishment, exercise, or defense of a legal claim before courts or other authorities as provided by law.

   7. Right to withdraw consent: where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal. Consent cannot be withdrawn with regard to personal data that is necessary for: (a) the performance of a contract; (b) compliance with a legal obligation of the Controller; (c) the pursuit of legitimate interests of the Controller or a third party, except where your interests or fundamental rights and freedoms requiring protection of personal data override those interests; (d) protecting your vital interests or those of another natural person; (e) performing a task carried out in the public interest; (f) other cases provided by law.

   8. Where automated decision-making and profiling exist, your right to obtain human intervention from the Controller, to express your point of view, and to contest the decision.

The rights listed above are not absolute. Exceptions exist, so each request received will be assessed to determine whether it is well-founded. Where a request is well-founded, we will facilitate the exercise of your rights. If a request is unfounded, we will reject it, but we will inform you of the reasons for the refusal and of your right to lodge a complaint with the Supervisory Authority and to seek judicial remedy.

We will endeavor to respond to your request within 30 days. However, this period may be extended depending on various factors, such as the complexity of the request or the high number of requests received.

Right to lodge a complaint 

As a data subject, in accordance with EU Regulation 679/2016, you have the right to lodge a complaint with the Supervisory Authority regarding how your data is processed or how your rights are respected in connection with such processing.

In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (“ANSPDCP”), address: B-dul General Gheorghe Magheru, no. 28-30, Sector 1, postal code 010336, website: www.dataprotection.ro.

Further questions

If you would like further information about the rights described above, or if you wish to exercise any of these rights, please contact us.

We will provide a response within a maximum of 30 days, with the possibility of extending this period by a further 30 days if your request is complex.

Please note, however, that there are exceptions to some of the rights mentioned. If your request is denied, we will explain the reason for the refusal. If any exception applies, we will indicate this when responding to your request.

Before responding to any request you submit, we may ask you for certain information necessary to confirm your identity.

If you have any questions about how we process your personal data, please contact us.