INTRODUCTION
All personal data you provide us as User undergoes processing only for the purpose of providing the best services in connection with the Site www.xbyascendis.ro (the „Site”). The purpose of this document is to describe the way we collect, use and process your Data when you use the Site, as well as your rights regarding the Personal Data.
Unless otherwise specified, the terms written in capital letters in the document will have the meaning detailed in the document “Terms and Conditions”, available at the address: No. 2b, Ion Ionescu de la Brad Blvd., District 1, Bucharest.
BY USING THE SITE, YOU ACKNOWLEDGE THAT YOU AGREE WITH THE COLLECTION, STORAGE, USE AND DISTRIBUTION OF YOUR PERSONAL DATA AS DETAILED WITHIN THE HEREBY PRIVACY POLICY. SHOULD YOU NOT AGREE WITH THE HEREBY PRIVACY POLICY, PLEASE DO NOT USE THE SITE IN ANY WAY.
We ensure the privacy of the information brought to our attention. Under this obligation, we undertake to appropriately use the personal data you make available to us. The personal data (the “personal data” or the “data”) we have access to is legally processed (e.g. pursuant to your consent, expressed within the Terms and Conditions, to the legal obligations and legitimate interests) for the purpose of ensuring the access to the Site and to reply to your requests, in compliance with the (EU) Regulation no 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “Regulation no. 2016/679”, and in compliance with all applicable subsequent regulatory acts.
Personal data protection is performed by automatic and manual means, in compliance with legal requirements, under conditions to ensure the observance of the security, privacy and rights of the targeted persons.
Within the hereby document, any reference to “Targeted person” or “User” means a reference to you as identified or identifiable natural person, following the access, reading and use of our Site.
1. PROCESSED PERSONAL DATA
We process different data, based on the activity of the Site Users, namely the Data processed following a simple visit on the Site will differ from the Data processed following the use of the Contact Form.
1.1. Visiting the Site
The User may visit the Site without disclosing any information whatsoever regarding their Personal Data. However, some Personal Data are automatically forwarded by the User’s browser. This Data refers to:
a) IP address (Internet protocol);
b) the type of the used browser, its version and the language used;
c) the access time of the Site and the addresses of the websites from which the User visits the Site;
d) the type of the device used and the operating system;
e) the date and the time when the Site was accessed
but this Data cannot be assigned to any person, that is they cannot determine the identification of the relevant person.
1.2. Using the Contact Form
Upon accessing the Contact Form, the following Data must be disclosed:
a) the surname and the first name;
b) the e-mail address;
c) the phone number;
d) the aspects for which the Site Holder is contacted and which may contain Personal Data voluntarily uploaded by the User.
The failure to provide the above Data results in the impossibility of sending the contact form and/or receiving a reply to the request.
2. THE GROUNDS AND THE PURPOSE OF DATA PROCESSING
Processing the personal data of the Site’s Users is made in compliance with the contract concluded between them and the Site Holder, due to accessing the Site and accepting the Site’s Terms and Conditions, as well as the hereby Privacy Policy, and complying with certain legal or regulatory requirements, as well as pursuing the justified interests of the Site Holder.
Personal data is collected for the purpose of managing the relationship with the Site Users. It is possible that, when a Site User does not provide the requested Personal Data, the Site Holder will not be able to provide a reply regarding the issues referred to by the Site User.
By filling in the contact form on the Site, the User states that they expressly and unequivocally express their consent for the processing of their Personal Data and their future use and processing by the Site Holder, for the following purposes:
Establishing contact with the Users;
Handling and processing the requests submitted by the User via the contact form;
To provide the requested information and to reply to the mail messages received from the Users;
Sending offers, promotions, marketing and promotion messages regarding the activity of the Site Holder and of the third parties with which the Site Holder has any kind of relationships, provided that the User expressed their expressed consent on that and they provided their e-mail address;
Complying with legal obligations and social responsibilities, pursuant to Romanian and international legislation.
The Users’ Data is collected for the aforementioned purposes, in various specific ways such as: professional traffic tracking software, saving in the database various contact forms available on the Site, which are filled in by the Users etc.
Any information provided by the User will be considered and it will represent the express consent that their Personal Data be used by the Site Holder, as well as by their trade partners, pursuant to the above mentioned purposes.
3. THE PERSONAL DATA RECIPIENTS
The Personal Data processed by the Site Holder will be accessed by the Site Holder or by their collaborators or employees, pursuant to privacy regulations and they may be disclosed to the following recipients:
a) the Site Holder’s trade partners, such as the provider of webhosting IT services or similar services, express carrier companies, should the User require that mail messages be forwarded by post or express courier, the accounting services provider (if the case), a third party, insofar as the Data is forwarded in connection with the Site’s broadcast or re-organization. These persons are compelled to secure the privacy of these Data, having been instructed on personal data protection. The Site Holder will not be liable for their trade partners, should the latter use the Personal Data outside the purposes detailed above;
b) to public central and local authorities;
c) to Courts of Law, the Public Ministry, law enforcement body, bailiffs etc. Should this Data be necessary so that certain lawsuits or legal investigations be carried out.
The Data may be transferred to other countries within the European Union, without the prior consent and notification of the targeted Persons being needed. Should the Site Holder intend to transfer the Data to counties outside the European Union, the targeted person will be informed in advance.
4. THE DATA STORAGE PERIOD
The Personal Data will be stored for the necessary amount of time so as to fulfill the purposes the Data was collected for, pursuant to the legal ground on which this Data was collected and/or the duration for which the applicable laws compels the Site Holder to store this data.
We will delete all Data uploaded by you via the Contact Form, as soon as you require this from us, except if the retention of Data is necessary to comply with legal obligations, to settle litigations etc. Continuing to visit the Site, following the deletion of the Data uploaded by you via the Contact Form, will generate the collection of the Data specific for this action, pursuant to the aforementioned (e.g. IP address, browser type etc.).
We are not liable for our trade partners’ Data deletion, even if we shall notify them on that and on their legal obligation to delete this Data.
5. THE RIGHTS OF THE TARGETED PERSONS
Regarding the Personal Data processed by the Site Holder, the targeted persons have mainly the following rights:
a) the right to be informed on Personal Data processing;
b) the right to be notified of breaches regarding the security of your Data;
c) the right to object at any time against Data processing;
d) the right to not to be the subject of an individual decision;
e) the right to access the Personal Data;
f) the right to rectify the inaccurate, incomplete Personal Data;
g) the right to delete the Personal Data exceeding the compulsory Data to be provided pursuant to the aforementioned purposes;
h) the right to restrict the Personal Data processing;
i) the right to the portability of Personal Data;
j) the right of intervention on Personal Data;
k) the right to object to Personal Data processing for the Data exceeding the compulsory data to be provided for the above mentioned purposes;
l) the right to address the appropriate authorities should it be considered that the Personal Data processing breaches legal provisions, that is the ones of the National Supervisory Authority for Personal Data Processing in Romania;
m) any other rights applicable by law.
5.1. The right to access the Data
The targeted person is entitled to secure a confirmation from the Site Holder that his/her Data is processed or not, as well as accessing such Data in case of Processing.
The Site Holder will send the following information to the targeted Person, upon their request:
a) should their Data not be processed – a notification specifying that the Site Holder does not process the Data;
b) should their Data be processed – a copy of the said Data.
The copy of the Data will be sent by the Site Holder, free of charge, except when the targeted Person requires other copies, in which case the Site Holder may charge a reasonable fee, based on the administrative costs incurred by such a request.
The Site Holder’s reply will be sent electronically should (i) the targeted person submit the request electronically or (ii) the targeted person does not require a different format.
5.2. The right to rectify the Data, including updating it by an additional statement
The targeted person shall have the right to obtain from the Site Holder, upon request and free of charge, as the case may be, corrections, updates, blocking or deletion of the Data whose processing does not comply with the applicable laws, especially in the case of incomplete or inaccurate Data, their transformation in anonymous Data, as well as that the Site Holder notifies the third parties to which the Data had been disclosed of any of the operation detailed above.
5.3. The right to data deletion (“the right of being forgotten”)
The targeted person is entitled to require the Site Holder to delete his/her Personal Data, due to the reasons hereunder:
a) The Personal Data is no longer needed to fulfill the purposes for which it had been collected or processed.
b) The targeted person withdraws his/her consent pursuant to which the processing takes place and there are no other legal grounds for processing it;
c) The targeted person objects to processing and there are no legitimate reasons to prevail with regard to processing or the targeted person objects to processing for direct marketing purposes.
d) The Personal Data was illegally processed.
e) The Personal Data must be deleted to comply with a legal obligation falling to the Site Holder, pursuant to the European Union laws or to domestic Romanian laws.
The Site Holder is not compelled to delete the Data, should processing be necessary:
a) to exercise the right to free speech and information.
b) to comply with a legal obligation referring to the processing, pursuant to European Union or Romanian legislation or to fulfil a task performed for public interest or to implement a decision of a public authority.
c) due to public interest reasons in the field of public health.
d) for the purpose of storing due to public interest, scientific research or statistical reasons, insofar as the right to free speech and information is likely to make impossible or to seriously affect the objectives fulfilment of such a processing; or
e) to ascertain, exercise or defend in court a right of the Site Holder.
The Site Holder compels to communicate to each person whose Personal Data were disclosed any correction or deletion of the Personal Data or the restriction of data processing, except if this proves to be impossible or requires disproportionate efforts. The Site Holder informs the targeted person of such recipients, should they require it.
5.4. The right to restrict the processing
The targeted person is entitled to require the Site Holder the restriction of the processing, should one of the following reasons be met:
a) the targeted person challenges the accuracy of the Data, for a period of time allowing the Site Holder to verify the accuracy of the Data.
b) the processing is illegal, and the targeted person objects to the deletion of Personal Data, requiring, in exchange, the restriction of their use;
c) the Site Holder no longer needs the Personal Data for processing, but the targeted person requires it to ascertain, exercise or defend a right in a Court of Law; or
d) the targeted person objected the processing for the duration of time in which it is verified whether the legitimate rights of the Site Holder prevail over those of the targeted person.
Following the restriction of Personal Data, the Site Holder, except for storing, will be able to continue the partial processing of said Data (i) only upon the consent of the targeted person or for (ii) ascertaining, exercising or defending a right in a Court of Law or (iii) to protect the rights of another natural person or legal entity or due to public reasons important to the European Union or to a state member of the European Union.
Before removing the processing restriction, the Site Holder will inform the targeted person of the Personal Data processing being restored.
5.5. The right to Data portability
Pursuant to the written request of the targeted person, the Site Holder will send him/her the Data in a currently used structured format, and which can be automatically read, the targeted persons being entitled to:
a) send such Data to other operators, if:
(i) processing is based on consent, and
(ii) processing is performed by automatic means.
b) their Data is forwarded directly by the Site Holder to other natural persons or legal entities, if this is technically feasible.
5.6. The right to object to Data processing
The targeted person is entitled to object at any time, due to reasons connected with their specific situation, to Personal Data processing. In this case, the Site Holder no longer processes the Personal Data, except if they can prove that their reasons are legitimate and imperious, justifying the processing and that they prevail over the interests, the rights and the freedoms of the targeted person or that its purpose is the ascertainment, exercise or defense of a right in a Court of Law.
Should the targeted person object to Personal Data processing, such data will no longer be processed for this purpose.
5.7. The right to address the National Supervisory Authority for Personal Data Processing
The targeted person is entitled to address the appropriate authorities should they consider that data processing breaches legal provisions, namely those of the National Supervisory Authority for Personal Data Processing in Romania, as well as the appropriate Courts of Law.
6. THE OBLIGATIONS OF THE TARGETED PERSON
The targeted person has the following obligations:
a) To provide true, exact and complete Data about themselves, for the purposes for which the Site holder processes such Data. Should the Personal Data of the targeted persons not be true, exact and complete, the targeted persons are compelled to notify the Site Holder, as soon as possible, so as to remedy this situation.
b) To preserve and to update the Data so as they are true, exact and complete, as necessary.
A breach of the above provisions, entitles the Site Holder to:
a) forward one or more formal warnings;
b) temporary suspend the access to the Site;
c) permanently ban the access to the Site;
d) block the access to the Site for the technical devices using your IP address;
e) contacting one or all internet services providers to require that they block your access to the Site;
f) undertake legal actions against you, either for breaching the Contract or other as such.
7. PRIVACY AND SECURITY
The Site Holder implemented reasonable technical and administrative measures, to ensure the security of the Personal Data, in case of accidental loss and of unauthorized access, use, modification or disclosure.
Our Information Privacy Policy is based on an information security standard and it follows an approach based on risks involving people, processes, and technologies.
As far as Personal Data processing is concerned, the Site Holder complies to:
a) process Personal Data pursuant to the appropriate legislation into force;
b) process Personal Data only via secure means;
c) confirm to the targeted persons the processing or the lack of Personal Data processing, following a written request dated and signed addressed to the Site Holder;
d) rectify, update, block, delete or convert to anonymous data, free of charge, Personal Data whose processing does not comply with legal provisions;
e) to cease free of charge the Personal Data processing of Data not processed in compliance with legal provisions;
f) to take all security measures necessary to protect Personal Data against unauthorized access to such Data;
g) facilitate the targeted persons exercising their rights in connection with Personal Data;
h) to notify the appropriate authorities in case of Personal Data security breach;
i) to inform the targeted persons of Personal Data security breach, should the breach be likely to generate a high risk of clashing against their rights.
8. AMENDING THE PRIVACY POLICY
We reserve the right of amending/updating the hereby Privacy Policy.
The amended Privacy Policy will be posted on the Site and it will come into force at the time of its publishing. Prior the amended Privacy Policy taking effect, you will be informed of the relevant amendments by a pop-up notification which will come up when accessing the Site.
Upon the amendments of the Privacy Policy taking effect, your express agreement with the new Privacy Policy provisions will be requested.
SHOULD YOU NOT WISH TO ACCEPT THE HEREBY PRIVACY POLICY, INCLUDING ITS SUBSEQUENT AMENDMENTS/UPDATES, YOU WILL NOT BE AFFECTED BY THE COOKIES OF THIS SITE.
By continuing to use the Site, following certain amendments/updates taking effect, the User expresses their consent to accept the said amendments/updates.
9. NOTIFICATIONS
Should a targeted person wish to exercise any of the aforementioned rights or should he/she want to forward questions/complaints regarding the Site Holder’s privacy and Personal Data protection policies, he/she is kindly asked to address the Site Holder in writing, by means of a dated and signed request sent to:
Post address: No. 2B, Ion Ionescu de la Brad Blvd., Bucharest, 013813, Romania
e-mail address: office@ascendis.ro
