How we protect your data

NOTIFICATION ON THE PROCESSING OF PERSONAL DATA

This Data Protection Notice (hereinafter referred to as the “Notice”) sets out the situations in which Policolor SA, headquartered in Bucharest, Theodor Pallady, Bd. 51, sector 3, Romania (hereinafter referred to as the “Company” or “We”) may collect, use, otherwise take over the personal data of our clients in accordance with Regulation no. 679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data (hereafter referred to as “GDPR”).

PERSONAL DATA

1. As used in this notification:

“Client” means a person who (a) has contacted us by any means to learn more about any products or services we provide; or (b) or has entered into a contract with us to provide any products or services; and

“Personal data” means information, whether true or not, of a client or potential client which can be identified or identifiable: (a) from these data; or (b) from the data and/or other information which we have or may have access to.

2. Depending on the nature of the interaction with us, some examples of personal data that we may collect from you are your name and your identification information, contact information such as your address, email address, or phone number, gender, date of birth, employment information, and financial information such as credit card numbers, debit card numbers, or bank account information.

3. Other terms used in this notice have the meanings provided by the GDPR (if the context permits).

COLLECTION, USE AND DESCRIPTION OF PERSONAL DATA

4. We proceed to collect personal data if (a) they are provided by you to us voluntarily, directly or through a third party that has been authorized by you to disclose your personal data (your authorized representative) after (i) you (or your authorized representative) have been notified of the purposes for which your data is collected, and (ii) you (or your authorized representative) have expressed your consent in writing for the collection and use of your data (b) the collection and use of personal data without consent is permitted or required by the GDPR or other applicable law. The collection and use of your personal data will only take place after obtaining your consent and will not be used for any other purpose except as permitted by law.

5. We may collect and use your personal data for any or all of the following purposes:
a) fulfillment of obligations in the course of or in connection with the supply of products and/or services requested by you;
b) verification of your identity;
c) responsibility, handling and processing of queries, requests, complaints and feedback from you;
d) managing the relationship with us;
e) processing of payment or credit transactions;
f) Sending marketing information about our products or services, including notification of our marketing events, initiatives and promotions, membership and reward schemes and other promotions;
g) compliance with any applicable laws, regulations, codes of practice, guidelines or rules, or assist in the enforcement of law and investigations by the government and/or by the regulatory authority;
h) any other purposes for which you provided the information;
i) any other business purposes related to or in connection with the foregoing.

5.1.We do not use personal data for automated processing or profile creation. We never make automated decisions about you. We use technical means for safe storage. We do not process data for secondary purposes incompatible with the purposes for which we have collected them.

6. We can disclose your personal data:
a) whether such disclosure is necessary for the performance of your obligations in the course with or in connection with the provision of the products or services requested by you; or
(b) third-party service providers, agents and other organizations with whom we are committed to perform any of the functions listed in art. 5 above.

7. The purposes listed in the above clauses may continue to apply even in situations where your relationship with us (for example, under a contract) has been terminated/ended or modified in any way for a reasonable amount of time (including, if applicable, a period allowing us to exercise our rights under any contract concluded with you).

Withdrawal of consent
8.You may withdraw your consent, only for the future, by asking us not to use and/or disclose your personal data for any or all of the purposes listed above. The withdrawal of the consent will be made by sending your request in writing at Theodor Pallady Bd. 51, Sector 3, Bucharest, Romania or by e-mail at GDPR@policolor.ro.

9. Upon receipt of your request to withdraw your consent, we may request that you be granted time without exceeding the deadline imposed by the GDPR (depending on the complexity of the request and its impact on our relationship with you) in order for your request to be processed and to inform you of the consequences of our adherence to these, including any legal consequences that may affect your rights and obligations. In general, we will seek to process your request within ten (10) business days of receipt.

10. While respecting the decision to withdraw your consent, please note that, depending on the nature and purpose of your request (for example, fulfillment of orders), we may not be able to continue providing our products or services and, in such circumstances, we will notify you before your request is processed. If you decide to cancel the withdrawal of consent, please inform us in writing, as described in Art. 8 above.

ACCESS AND CORRECTION OF PERSONAL DATA

11. If you want to make (a) a request to have access to a copy of your personal data or information on how we use or disclose your personal data, or (b) a request for correction to update any personal data we hold about you, you can submit your request in writing at Theodor Pallady Bd. 51N, 3rd fl. ap. C13, Sector 3, Bucharest or by e-mail GDPR@policolor.ro.

PROTECTION OF PERSONAL DATA

12. In order to protect your personal data from unauthorized access, collection, use, disclosure, copying, modification, removal or similar risks, we have introduced administrative, physical and technical procedures such as up-to-date antivirus protection, encryption, and privacy to ensure the storage and transmission of personal data by us and the disclosure of personal data both internally and to our authorized third party service providers and agents only on a need-to-know basis.

ACCURACY OF PERSONAL DATA

13. In general, we rely on personal information provided by you (or by your authorized representative). In order to ensure that your personal data is up to date, complete and accurate, please inform us if there are any changes to your personal data by submitting a written request at Theodor Pallady Bd. 51N, 3rd fl. ap. C13, Sector 3, Bucharest or by e-mail at GDPR@policolor.ro

RETENTION OF PERSONAL DATA

14. We may retain your personal data for as long as it is necessary to fulfill the purpose for which it was collected, or as required or permitted by applicable law.

15. We will waive the retention of your personal data or the removal of the means by which data may be associated with you as soon as it is reasonable to assume that such retention no longer serves the purpose for which personal data has been collected and incident law does not require keeping them.

TRANSFER OF PERSONAL DATA OUTSIDE ROMANIA

16. We do not transfer your personal data to other countries. In any case, if we do so, we will obtain your prior consent and ensure that your personal data will be protected.

YOUR RIGHTS

17. At any time, you can exercise the following rights: rights of information, access, rectification, deletion, restriction of processing, portability, opposition, and the right not to be subject to an automatic decision. In order to exercise these rights you can contact us at the e-mail address GDPR@policolor.ro or by sending a notification at Theodor Pallady Bd. 51N, 3rd fl. ap. C13, Sector 3, Bucharest
Right to information and access

At your request, we communicate to you all and each of the information we hold about you.

Right of rectification
You may request that we modify and/or update your data or correct your data if inaccurate.
Control rights over your data (restriction of processing, portability, opposition, and the right not to be subject to an automated decision – profiling)

For the pertinent data we hold about you, you may request us: to delete (data in whole or in part), portability (we transfer it to any operator indicated by you where technically feasible), restriction of processing, and the right not to be the subject of an automated decision- profiling.

We take into consideration any requests or complaints we receive and we will send you an answer in accordance with the deadlines set by law. If you are not satisfied with our response or consider processing to be in breach of the applicable law, you may file a complaint with the Romanian Data Surveillance Authority, namely the National Authority for the Surveillance of Personal Data Processing, based in Gheorghe Magheru Bd. no. 28-30, Bucharest, Romania.