​​PRIVACY AND SECURITY POLICY FOR THE PROCESSING OF PERSONAL DATA

User identification and authentication

1. By user it is meant any person acting under the authority of the Operator or a person authorized by the Operator, with a recognized right to access personal data.

2. To gain access to personal data, users need to identify themselves.

3. In the case of automated processing, the identification is done by authentication in the IT systems of the Operator. Authentication is done by entering unique login data, consisting of a username and a password.

4. Passwords are security strings that are appropriate in terms of length, composition and operational behaviour, in accordance with   DIHK in-force security procedures.

5. Any user that receives access to the personal information database is informed that he / she must maintain the confidentiality of the authentication data and hold accountability to the Operator in this regard. 

6. User access to manually managed personal information databases is done strictly based on a list approved by the Operator 's management.

Type of access

1. Users can only access the personal data required to fulfil the tasks assigned by the Operator.

2. Developers of personal data processing systems have access to personal data under a strict privacy agreement signed with the Operator, exclusively where required, each transaction being documented.

3. The technical support department may have access to personal data in order to resolve incidents and problems encountered in the use of IT systems.

4. Computers and servers containing databases with personal information are located in controlled access rooms. Documents containing personal data of the type considered as special categories of data are kept in restricted access rooms.

5. The Operator has established strict ways to destroy personal data.

Data collection

1. the Operator designates authorized users for the collection, input and processing of personal data in a computer system or in a manual system.

2. Any changes to personal data may only be made by authorized users designated by the Operator.

3. The Operator has taken steps to ensure that the information system records who has made the change, the date and time of the change. For better management, the Operator has implemented measures so that the information system maintains deleted or modified data.

Backup execution

1. The computer system automatically performs back-up of the databases daily for an eventual data recovery in case of loss, destruction or malfunction.

2. The Operator sets the timeframe for the backups of personal information databases as well as the programs used for automated processing. The users executing these backups are designated by the Operator in a limited number. Backups are stored in locations with restricted access, situated in a different room from where the backup is made.

Computers and access terminals

1. Computers and other access terminals are installed in lockable, restricted access rooms. If the computers are on without any input for a certain period of time, set by the Operator, the session closes automatically.

2. Users are trained so that personal information databases are closed when unauthorized persons are nearby.

3. Servers hosting databases can only be accessed in a controlled manner based on access rights

Access files 

1. The Operator takes steps to ensure that any access to the personal information database is recorded in an access file (called a log, for automated processing) or in a register in case of manual personal data processing, that is set by the Operator. 

2. For automated processing, this information will be stored in a general access file or in separate files for each user.

3. The Operator is required to keep access files for at least 2 years to be used as evidence for investigations. If the investigations are prolonged, these files will be kept until investigations and any actions related to them are completed. 

4. Access logs must provide information to identify persons who have accessed personal data and the respective performed operations.

Telecommunication systems

1. The Operator, through authorized users, periodically checks authentication and access types to detect malfunctions in the use of telecommunication systems. Only personal data strictly necessary will be transmitted through the telecommunication systems.

Staff training

1. Users who have access to personal information databases are trained on the national and European legal provisions, regarding the provisions of the IT security policy of the Operator, as well as the importance of maintaining their confidentiality and the risks involved in the processing of personal data.

2. Users who have access to personal data will be notified by messages that will appear on monitors. Users are forced to close their work session when they leave the workplace.

Computer use: to maintain security of the processing of personal data (especially against computer viruses), the following measures are mandatory

1. Use of software from unsafe sources has been forbidden;

2. Users do not have administrative privileges on computers;

3. Only licensed software is being used;

4. Computers are protected through antivirus software;

5. The user's activity may be monitored in limited cases, when justified by a legitimate interest of the Operator according to the provision of this policy.

Data Printing

1. Personal data shall only be printed by the designated users and only for the purposes specified in these Rules.

2. User access to printers is restricted.

The rights of persons whose personal data are being collected and/or processed

1. The right to information: any individual has the right to be provided by the Operator, at least the following information

2. The identity of the Operator and its representative;

3. The purpose of personal data being processed;

4. Additional information, such as: recipients or categories of data recipients; whether the provision of all required data is mandatory and the consequences of the refusal to provide them;

5. Any other information of which disclosure is required by authorities.

 

The right of access to data: the individuals have the right to obtain from the Operator, according to the law, upon request, confirmation as to whether or not personal data concerning him or her are being processed and to receive, free of charge a copy of the personal data undergoing processing and access to the following information:

1. the purposes of processing;

2. the categories of personal data concerned;

3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, including, in case of transfer to a third country or to an international organization, a description of the appropriate safeguards in place;

4. the envisaged storage period or the criteria used to determine this period, as possible;

5. the right to request from the Operator rectification, erasure, restriction of processing of personal data or to object such processing;

6. the right to lodge a complaint with the National Supervising Authority (ANSPDCP);

7. any available information regarding the source of the personal data, if it was not collected directly from the data subject.

For any further copies requested by the data subject, the Operator may charge a fee to cover the administrative costs.

1. The right to rectification: the individuals have the right to obtain from the Operator the rectification of inaccurate personal data concerning him or her.

2. The right to erasure: the individuals have the right to obtain from the Operator the erasure of personal data concerning him or her in any of the following cases:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

• the individual withdraws consent on which the processing is based and there is no other legal ground for the processing;

• the individual objects to the processing and there are no overriding legitimate grounds for the processing;

• the personal data have been unlawfully processed;

• the personal data have to be erased for compliance with a legal obligation in EU or Romanian law to which the Operator is subject.

 

The right to restriction of processing: the individuals have the right to obtain from the Operator restriction of processing where one of the following applies:

1. the accuracy of the personal data is contested by the individual, for a period enabling the Operator to verify the accuracy of the personal data;

2. the processing is unlawful and the individual opposes the erasure of the personal data and requests the restriction of their use instead;

3. the Operator no longer needs the personal data for the purposes of the processing, but they are required by the individual for the establishment, exercise or defence of legal claims;

4. the individual has objected to processing pending verification whether the legitimate grounds of the Operator override those of the data subject.