Privacy Policy Adstream Romania
This Privacy Policy is intended at providing information on the collection, use and disclosure to third parties of personal data by Adstream Romania S.A., a company incorporated under Romanian law with its head-quarter at 16 Maiorului street, district 2, Bucharest, registered at the Trade Registry under no. J40/13675/2017, fiscal code RO 38044063 (hereinafter “Adstream”).
Your privacy is very important to us. Therefore, we take outmost care to process your personal data in accordance with the principles set forth in the data protection legislation applicable in Romania, including (EU) Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”). Personal data represents any information relating to an identified or identifiable natural person, and an identifiable person is that person that may be identified directly or indirectly, particularly by reference to an identification number or to one or more factors specific to its physical, psychological, mental, economic, cultural or social identity.
This privacy policy concerns the personal data of our clients, suppliers, business partners, other persons contacting and visiting us and of the representatives thereof, potential employees, and it applies to data collected through our website, www.adstream.com.ro, as well as to all other personal data we collect through e-mail, contact form, by use of the Adstream Platform or other off-line contacts. This privacy policy describes:
- the categories of personal data we collect from you and process;
- the purposes for which we collect and use your personal data;
- the processing grounds for such purposes;
- the duration of processing of such data;
- your rights as data subjects and the manner in which you may exercise them;
- to whom we may disclose your personal data.
I. CATEGORIES OF PERSONAL DATA; PURPOSES AND GROUNDS FOR PROCESSING
In the context of your interaction with Adstream, you, as a natural person, may be subject to the data processing activities that we perform. Please be informed that we use your personal data in the following cases:
1. If you are a client or potential client of Adstream (user of the Platform):
1.1. Providing services requested from us
We use your relevant personal data in order to prepare and provide the services a requested from us. For instance, in delivering services to you, we may have to rely on your personal data of relevance for your case in order to fulfill our contractual obligations. We rely in this case on the performance of our agreement as grounds for processing.
1.2. Communicating with you
We use your contact details in order to communicate with you with respect to your requests and any other relevant business-related matters, including but not limited to informing you about our business hours during holidays. We also rely in this case on the performance of our agreement as grounds for processing.
1.3 Data processing as obligation imposed by the law
We may process some of your data in the context of providing the services based on legal obligations (e.g., the obligation to comply with fiscal laws). In such case, the grounds for processing is the legal obligation.
1.4. Categories of data
The categories of data processed in the context of our relationship with you are your name, e-mail, phone, fax, address, as well as other personal data you may provide directly to us or we might need in order to comply with the fiscal legislation.
2. If you are a representative or contact person of a Adstream’s client or potential client
2.1. Providing the services requested from us
We use your relevant personal data in order to prepare and provide the services requested from us. For instance, we may use the personal data to manage the relationship with the client you represent. We rely in this case on the legitimate interest in providing our services according to our area of activity and managing the relationship with our clients.
2.2. Communicating with you
We use your contact details in order to communicate with you with respect to your requests and any other relevant business-related matters, including but not limited to informing you about our business hours during holidays. We also rely in this case on the legitimate interest in providing our services according to our area of activity.
2.3 Data processing as obligation imposed by the law
We may process some of your data in the context of providing the services based on legal obligations, should it be the case. In such situation, the grounds for processing is the legal obligation.
3. If you are an employee or other collaborator of a Adstream client or potential client
3.1. Providing the services requested from us
We use your relevant personal data in order to prepare and provide the services requested from us. For instance, we may use the personal data to manage the relationship with the client you represent. We rely in this case on the legitimate interest in providing our services according to our area of activity.
3.2. Communicating with you
We use your contact details in order to communicate with you with respect to your requests and any other relevant business-related matters, including but not limited to informing you about our business hours during holidays. We also rely in this case on the legitimate interest in providing our services and supplying our products according to our area of activity.
3.3 Data processing as obligation imposed by law
We may process some of your data in the context of providing the services based on legal obligations, should it be the case. In such situation, the grounds for processing is the legal obligation.
4. If you are a business partner or supplier of Adstream
4.1. Maintaining our contractual relationship with you
We use your relevant personal data in order to maintain our contractual relationship with you. We rely in this case on the performance of our agreement as grounds for processing.
4.2. Communicating with you
We use your contact details in order to communicate with you with respect to any relevant business-related matters, including but not limited to informing you about our business hours during holidays. We also rely in this case on the performance of our agreement as grounds for processing.
4.3 Data processing as obligation imposed by law
We may process some of your data in the context of providing the services based on legal obligations, should it be the case. In such situation, the ground of the processing is the legal obligation.
4.4. Categories of data
The categories of data processed in the context of our relationship with you are your name, e-mail, phone, fax, address, as well as other personal data you may provide directly to us.
5. If you are a representative, contact person, employee or other collaborator of a Adstream’ business partner
5.1. Maintaining our contractual relationship with our business partner
We use your relevant personal data in order to maintain our contractual relationship with our business partner (including a supplier). We rely in this case on the legitimate interest in ensuring that the contractual relationship is managed properly.
5.2. Communicating with you
We use your contact details in order to communicate with you with respect to any relevant business-related matters, including but not limited to informing you about our business hours during holidays. We also rely in this case on the legitimate interest of ensuring that the contractual relationship is adequately carried out.
5.3 Data processing as obligation imposed by law
We may process some of your data in the context of providing the services based on legal obligations. In such case, the grounds for processing is the legal obligation.
In all cases, the data is provided either directly by you or by the business partner. The categories of data processed in this context are generally your name, position, e-mail, phone, fax, address, identification data, as well as other personal data provided to Adstream, usually by you, as needed to fulfill the above purposes.
6. If you are a job applicant:
We use the personal data contained in the CVs we receive in order to assess the applicants’ qualifications for a position within Adstream. We base our processing on the grounds of entering into and performing of the agreement.
The categories of data processed in the context of our relationship with you are your name, e-mail, phone, fax, address, personal data included in CVs, education and training details, professional qualifications, as well as other personal data you may provide directly to us. Once the position we are searching has been occupied we destroy all CV’s received within 30 days from the date the position was filed.
7. If you are a visitor of our premises (including an employee or other collaborator of Adstream, Adstream business partner, Adstream supplier, or an employee, collaborator or legal representative of an Adstream business partner or supplier):
We use your personal data in order to ensure the security of our premises, assets and personnel.
For this purpose we have installed cameras in visible places, outside of our premises and in the passing ways, together with signs for notice.
The cameras have been placed in a way to minimize the impact on the individual’s privacy and we conduct regular reviews to ensure its use remains justified.
Images from our cameras are securely stored and access to the storage room is granted only to one authorized person. The footage is stored in electronic format.
The recorded images will only be retained long enough for any incident to come to light (eg. for a theft to be noticed) and the incident to be investigated. Considering this all recorded footage is deleted automatically after 1 month.
Except for law enforcement bodies and security company, images will not be provided to third parties.
We base our data processing on the legitimate interest of Adstream, namely the protection of our premises, assets and personnel.
The categories of data processed in this context are your name, biometric data (collected as mentioned above) as well as other personal data you may provide directly to us.
8. If you are a visitor of our Internet website:
We use the personal data we collect from you when you visit our Internet site, www.adstream.com.ro, in order to process and respond to your inquiries transmitted via our website.
We base this data processing activity on our legitimate interest in giving the information requested by you in respect to our activity and services. The categories of data processed in this context are the name, email address and phone number, if you provide it to us.
We also use your personal data in order monitor the traffic and improve the content of the website. We base this data processing activity on our legitimate interest in ensuring the proper functioning of our Internet website, as well as its improvement.
The categories of data processed in this context are the hour and date of accessing the Internet website and the IP address from which our Internet website was accessed.
We use cookie technology on our website, which allows us to make your browsing experience easier, for statistical purposes and for improving our website. We are also using Google Analytics to analyse information gathered from visitors to the Site. This information allows Adstream to better understand the users of the website and how they use it. For details please see our Cookie Policy.
II. PROVIDING THE PERSONAL DATA
When the data is required directly from you, Adstream kindly asks you to provide all categories of personal data we request in the aforementioned purposes, as otherwise we shall not be able to carry out our activity (including, among others, to provide you with our services and products).
If you provide to Adstream the personal data of other natural persons, we kindly ask you to communicate to them before such disclosure the modality in which Adstream intends to process their personal data, as described in this Privacy Policy.
III. DISCLOSURE OF YOUR PERSONAL DATA
While as a rule we shall not disclose your personal data to any third parties, we may:
· disclose your contact details to our affiliates within Adstream, only for the purpose of executing the agreement we have with you;
· if necessary, transfer your data, by disclosure or providing remote access, only through secured applications, to third parties such as commercial partners of Adstream, acting as data processors for and on behalf of Adstream (e.g. hosting, legal and financial advisors, technical service providers or service providers providing dispatch support), with whom Adstream has made the necessary contractual agreements required by EU and national regulations.We shall transfer data to third parties exclusively to the extent necessary to serve the applicable processing purposes for which your data is collected and processed.
· disclose the data in order to comply with the law or in response to a request from a court or other legal authority, such as a warrant or a subpoena. Adstream might also share the information if we believe, in good faith, that it is necessary to prevent or address frauds or protect Adstream.
· if necessary, disclose relevant personal data to relevant authorities, in the context of providing the services you have requested from us.
IV. DURATION OF PROCESSING
We intend to keep your personal data for the duration of the agreement concluded with you, as well as afterwards, according to our internal policies and the legal obligations incumbent upon us (for ex. In case of financial documents the term necessary for keeping such records is of 10 years from the date the financial year was closed).
In case the data is not collected in the context of an agreement, such data will be kept for as long as necessary in order to attain the purpose of the envisaged data collection or any other longer period imposed by the law, an applicable records retention regulation or public authorities.
Promptly after the applicable storage period has ended, the data shall be:
- securely deleted or destroyed; or
- transferred to an archive (unless this is prohibited by law or an applicable records retention regulation).
V. YOUR RIGHTS
In your capacity as data subjects, the GDPR provides you with a series of rights including:
· the right of access – allowing you to obtain confirmation that your personal data is being processed by us and, if affirmative, the relevant details of such processing activities;
· the right to rectification – allowing you to rectify your personal data if inaccurate;
· right to erasure – allowing you to obtain the erasure of your personal data in certain cases (e.g., if the data is no longer necessary in relation to the purposes for which it was collected);
· right to restriction – allowing you to obtain the restriction of processing your personal data in certain cases (e.g., when you contest the accuracy of your personal data, for a period enabling us to verify such accuracy);
· the right to object – allowing you to object to further processing of your personal data within the conditions and limits set forth by law;
· right to data portability – allowing you to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another data controller.
We are happy to ensure your exercise of these rights.
You may exercise your aforementioned rights freely and at any time and find out more about such rights by filing with us, as data controller, a written request at Adstream Romania S.A., 16 Maiorului Street, district 2, Bucharest, postal code 023813, Romania or by e-mailing us at hello@adstream.com.ro.
You also have the right to file a complaint with the data protection authority.
We encourage you to contact us immediately if you believe that your personal data was provided without consent. We are committed to always treat your requests with the utmost attention and address any queries you may have in the shortest time possible.
VI. SECURITY
As part of the administration of our website, we have taken technical and organizational measures to ensure a level of security appropriate to the risks that are presented by processing, in particular from misuse or accidental, unlawful or unauthorized destruction, loss, alteration, disclosure, acquisition or access, willful or accidental manipulation, access by third parties, deletion and modification.
You shall be notified with respect to a data security breach, within a reasonable period of time following discovery of such breach, unless a law enforcement official determines that notification would impede a criminal investigation or cause damage to national security. In this case, notification shall be delayed as instructed by such law enforcement official. We shall promptly respond to your enquiries relating to such data security breach.
VII. CHANGES
This Privacy Policy is in force as of May 25th, 2018. This Privacy Policy may be updated from time to time.
When we do so, we will post those changes on our website so you can always have access to details about the information we collect, how we use it, and under what circumstances, if any, we disclose it. Any such change, material or otherwise, shall enter into force within 10 days from the publication of the new version on our website.
If at any point we decide to use personal Data in a manner different from that stated at the time it was collected, we will notify you by email. You will have a choice as to whether or not we may use your data in this different manner. Otherwise, if possible, we will use the data in accordance with the Privacy Policy under which the data was collected.
VIII. OTHER WEBSITES
Our website contains links to other websites. This Privacy Policy only applies to this website so when you link to other websites you should read their own privacy policies.
IX. CONTACT INFORMATION
If you have any further questions about how we process your personal information, or if you would like to exercise any of your rights under this policy, please send us a written request, using the following contact details: privacy@adstream.com.ro.
We shall ensure adequate steps are taken to address your request without undue delay and, in any event, within 30 (thirty) days of receipt of the request. The information shall be provided by electronic means where possible, unless otherwise expressly requested by you in writing.