Privacy Policy regarding personal data processing

 

Thank you for your interest in Vestra Industry systems and solutions. For us, it is particularly important to ensure the protection of the personal data you provide to us. The confidentiality of your personal data is also important to us.

This privacy policy regarding personal data processing explains how Vestra Industry collects and processes the personal information through the website and beyond, in carrying out its activities regarding the operation and delivery of services and products, while ensuring that your personal data is processed responsibly and in accordance with the applicable legislation on the protection of personal data.

Who are we?

Vestra Industry S.R.L. is an organized company that operates according to the laws of Romania, with its registered office in Catamaresti-Deal, street Mihai Eminescu no. 85, Mihai Eminescu com., Botosani county, Romania, registered at the Botosani Trade Register under no. J07/58/2016, sole registration code RO 15969249.

For any comments, suggestions, questions about issues related to the processing of your data we carry out, please do not hesitate to contact our data protection officer at any time, through any of the communication channels below:

Address of the registered office: Catamaresti-Deal, street Mihai Eminescu no. 85, Mihai Eminescu com., Botosani county 

Phone number: 0231 507 060

E-mail address: [email protected]

Principles relating to the personal data processing

In the processing of personal data, Vestra Industry will comply with the following principles, with the personal data always being:

1. processed lawfully, fairly, and transparently toward the data subject (lawfulness, fairness, and transparency);
2. collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes shall not be considered incompatible with the original purposes in accordance with article (1) (limitations relating to purpose);
3. appropriate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (data minimization);
4. accurate and, where necessary, kept up to date; all necessary measures must be taken to ensure that personal data which are inaccurate are deleted or rectified without delay (accuracy) considering the purposes for which they are processed;
5. kept in a form that allows the identification of data subjects for a period not exceeding the period necessary to fulfil the purposes for which the data are processed; personal data may be stored for longer periods to the extent that they will be processed exclusively for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with article 89 paragraph (1), subject to the implementation of the appropriate technical and organizational measures provided for in this regulation with a view to guaranteeing the rights and freedoms of the data subject (storage limitations);
6. processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by taking appropriate technical or organizational measures (integrity and confidentiality);

What data do we process?

The policy on the protection and security of personal data of Vestra Industry is to collect only the personal data required for the mentioned purposes and to require data subjects to communicate only those personal data strictly necessary to fulfil these purposes.

The categories of personal data (classical or digital) processed at the level of Vestra Industry are as follows:

1. Personal details: name; surname; gender; date of birth/age; citizenship; home /residence address, mobile/landline telephone number, fax number; e-mail address, social security number, etc, the rest of the information in your identity document (including the date of issue, the expiry date of the document, the place of birth), function/profession, professional history, biometric data, signature;
2. Image data: geolocation data, images/video recordings, (in our premises where we have installed – CCTV video surveillance cameras where there are, they are indicated by signs of vision);
3. Your contact with us, such as a note or recording of a call you made to us, data sent by email or letter, requesting an offer, or other records of contact with us;
4. Payment data: billing address, bank account or bank card number/IBAN code, name and surname of the bank account holder or bank card holder; the date from which the bank card is valid; the expiration date of the bank card, the code of the client;

Please do not provide us with any personal data other than those strictly necessary for the purpose stated in this policy.

Which is the purpose of data processing?

The personal data provided will be collected and processed following your direct request, for the following purposes:

1. For the provision of our services. Your personal data is used to conduct our activity, to conclude and perform commercial contracts, respectively individual employment contracts, and, to comply with requests made by the competent authorities that supervise and regulate our work.
2. Billing and relationships with the customers. To bill you for the purchase of our services, to contact you if the billing data you have provided to us is incorrect, is about to expire or if we cannot charge the payment, to answer any questions or concerns which you may have about our services;
3. Managing our communications and IT systems. Managing our communications systems; managing our IT security; conducting security audits on our IT networks, issuing reports to competent institutions, or repairing system errors;
4. The fulfilment of our legal obligations. The fulfilment of our legal obligations regarding the archiving, security, reporting, record keeping and other obligations that the legislation imposes on us.
5. The improvement of the services. Identifying potential problems regarding our services to improve them, solving your complaints/referrals registered on the Company's website https://www.erbasu.ro/,- managing the usual correspondence with the contractual partners, etc., control of visitor access to the Company's premises;
6. The surveillance of the premises according to the legal provisions. CCTV systems mounted for the surveillance of the access areas, value areas, for the guarding and protection of goods and personnel in those spaces, etc

What are the legal grounds on which we process your data?

Your personal data are processed for the fulfilment of the legal obligations of the controller, according to Article 6 par. 1 letters b), c) and f) of the GDPR.

To the extent that special categories of personal data are required, ANSPDCP will request your consent in accordance with the provisions of art.6 para (1), letter a) and art. 9 par. (2) let. (a) of the GDPR.

The legislation governing mainly the activities carried out by Vestra Industry:

• Regulation 2016/679/EU, Directive 2016/680/EC, Directive 2002/58/EC;
• Law 102/2005, amended and completed, Law no. 190/2018, Law no. 506/2004;
• Law no. 544/2004, Government Ordinance no. 27/2002;
• Civil procedure code;

Source of personal data

Vestra Industry collects personal data directly from you or from third parties or from public documents.

If we need to process the personal data obtained from third parties’ legal entities, the latter are obliged to provide you with the necessary information regarding the use of the personal data transmitted.

Who has access to your data?

The personal data transmitted by you are processed by Vestra Industry in accordance with the General Data Protection Regulation.

Your personal data are intended for use by Vestra Industry and are communicated to the following recipients, if applicable: public institutions, collaborators, consultants, and data processors.

The disclosure of data to third parties is made according to the legal provisions for the categories of recipients specified above.

How long is your data stored?

The personal data provided by you will be stored only for as long as necessary and/or for the period provided by the legislation in force for the application of the legal provisions on archiving .

Your data that is required for the purposes related to the provision of our services will be stored for a period of 3 years from the termination of the service contract concluded with Vestra Industry.

The data related to payments/billing will be stored for a period of 10 years, according to Law no. 82/1991 on accounting.

The data relating to video surveillance to ensure the security of goods and persons will be stored for a period of 30 calendar days in accordance with the legislation in force.

If there is no legal requirement, we will only store them for as long as necessary for the processing of the data for the purposes mentioned above. 

Except where the law provides otherwise and those exemplified above, we will usually process your data for the duration of validity of a contract between you and Vestra Industry, plus a period of 3 years from its termination.

What are your rights?

As a data subject you have the following rights:

• right of access to data – you are entitled to obtain from Vestra Industry a confirmation that personal data concerning you or not are being processed, as well as access to such data; at the same time, you can obtain a copy of the personal data provided to Vestra Industry and which are the subject of the processing; for any other copies requested by you, Vestra Industry may charge a reasonable fee based on administrative costs; if you enter the application electronically and unless you request another format, the information will be provided in an electronic format that is currently used;
• right to rectification – you are entitled to obtain the rectification by Vestra Industry of inaccurate personal data, as well as the right to obtain the completion of personal data that are incomplete; Vestra Industry shall communicate to each recipient to whom the personal data have been disclosed any rectification thereof, unless this proves impossible or involves disproportionate efforts and will inform you of these recipients if you request it;
• the right to erasure – you are entitled to obtain from Vestra Industry the deletion of personal data concerning you without undue delay and it is obliged to delete such data electronically when: (i) the personal data are no longer necessary for the purposes for which they were collected or processed; (ii) you withdraw your consent based on which the processing takes place and there is no other legal basis for the processing; (iii) you object to the processing and there are no legitimate grounds to prevail with respect to the processing; (iv) the personal data have been unlawfully processed; (v) the personal data must be deleted in order to comply with a legal obligation incumbent on the part of Vestra Industry under Union or Romanian law; Vestra Industry will communicate to each recipient to whom the personal data have been disclosed any deletion thereof, unless this proves impossible or involves disproportionate efforts and will inform you of these recipients if you request it;
• right to restriction of processing – you are entitled to obtain from Vestra Industry the restriction of processing if you are in one of the following cases: (i) you challenge the accuracy of the data for the period that allows Vestra Industry to verify the accuracy of the data; (ii) the processing is illegal and you oppose the deletion of personal data, requesting instead the restriction of their use; (iii) Vestra Industry no longer needs the personal data for the purposes of the processing, but you request them for the establishment, exercise or defence of legal claims; or (iv) you have objected to the processing for the period during which it is verified that the legitimate rights of Vestra Industry prevail over your rights.; Vestra Industry will communicate to each recipient to whom the personal data have been disclosed any restriction of processing, unless this proves impossible or involves disproportionate efforts and will inform you about these recipients if you request it;
• the right to data portability – you are entitled to receive your personal data, as provided to Vestra Industry, in a structured format, commonly used and machine-readable and to transmit this data to another operator under certain conditions; in the exercise of this right, you are entitled to have your personal data transmitted directly from Vestra Industry to another operator when technically feasible;
• the right to object to processing – you are entitled to oppose, for reasons related to the situation in which you are, at any time, to the processing of your personal data, including profiling based on those provisions;
• the right not to be subject to a decision based solely on automated processing, including profiling;
• the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing;
• the right to withdraw your consent at any time without affecting the lawfulness of the processing of personal data carried out by Vestra Industry based on the consent prior to its withdrawal.

Processing of special or consent-based data

Where processing is based on Article 6 par (1) letter (a) ”the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes” or on Article 9, par. (2) letter (a) ”the data subject has given his or her explicit consent to the processing of such personal data for one or more specific purposes, unless the Union or national law provides that the prohibition provided for in paragraph (1) cannot be lifted by the consent of the data subject” of the GDPR, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out based on the consent prior to its withdrawal. Thus, you can modify or remove your consent at any time, and we will act immediately accordingly, unless there is a legal reason or legitimate interest not to do so.

How do you have access to your data?

You can change the data provided by sending an e-mail to the address [email protected].

For any questions or requests relating to the personal data you have submitted to us, including for the exercise of your rights, as mentioned in the previous section (e.g. Request for the copy of personal data, modification, deletion), you can contact us at: [email protected], Vestra Industry will provide the information in electronic format, when possible, unless you request a different format.

The information provided, as well as any communication and measures taken in the exercise by you of the above rights, are provided by Vestra Industry, free of charge. However, if your requests are unjustified or excessive, especially because of their repetitive character, Vestra Industry may: (i) either charge a fee considering the administrative costs for providing the information or communication or for taking the requested measures; (ii) either refuse to comply with the request.

Thank you!

N.W. By accepting this agreement, your personal data will be processed by Vestra Industry according to this Personal Data Processing Policy.