GDPR – General Data Protection Regulation
INFORMATION NOTICE PURSUANT TO ART 13 OF REGULATION (EU) 2016/679 (GDPR) AND THE RELEVANT ROMANIAN LEGISLATION
Pursuant to the art 13 of Regulation (EU) 2016/679 and the relevant Romanian legislation in force regarding the protection of personal data, we inform you that your personal data will be processed by Cerved Property Services S.A. (hereinafter referred to as the “CPS SA” or “the Company”) as Data Controller.
Requests to the Data Protection Officer (hereinafter DPO) must be made in writing and send to the following address dpo.cps.ro@cerved.com
1. What personal data does the Company collect and from which source?
The Company collects personal data directly from you, as clients or potential clients/ clients, or from real estate websites, from which we receive your messages.
The personal data that the Company collects and processes fall primarily within the following categories:
a) Identification data: name, father’s name, Identity Card Number, Personal Identification Number, date of birth, sex, residence address etc. The aforementioned data are collected directly from you.
b) Contact information: residence and postal address and e-mail address, fixed and mobile telephone number etc. The data are collected directly from you and/or from third parties acting on your behalf.
c) Data regarding your economic or financial situation, your profession, salary, other income, family members etc. This data is collected directly from you / at your request, or from publicly accessible sources, such as land books, etc.
d) Data related to the operation of your contract(s) with the Controller and the use of the provided services.
e) Image data collected from the video surveillance systems of the premises of the Controller, within which informative signs have been placed pursuant to the law.
The data collection from you encompasses the data collection from a third party acting on your behalf as well as the data collection from a CPS SA ’s client or potential client associated with you (natural or legal person).
Moreover, in case you provide us with personal data of third parties you must have ensured their consent and have referred them to this Data Protection Information.
2. Purpose and legal basis of the proccesing of Personal Data
The Company collects and processes your personal data:
A. For the settlement or execution of a contract and in order to carry our pre-contractual measures upon your request
The processing of your data as described in Section 1 serves indicatively the following purposes:
a) Identification and communication with you during the pre-contractual and / or contractual relationship with the Company, as well as any other transaction between you and the Company according to the provisions of art. 6 (1), letter b) GDPR
b) The signing of a contract (provision of services etc.) with you, the execution and smooth functioning of said contract and the fulfilment of the Company’s obligations towards you. article 6(1), lit b) GDPR
c) Communicating with you, information on the best use of the Company's services (ie information notes on sales / rental properties), improving them and also in order to send you questionnaires about your satisfaction of the services of the Company intended for you, as a customer.
This processing also serves the purpose of the Company's compliance with legal obligations, as well as the legal interests of the Company or third parties.
B. For the Company’s compliance with its legal obligations, according to the provisions of article. 6(1) lit c) GDPR
The processing of your data as described in Section 1 serves indicatively the following purposes:
a) The prevention and repression of money laundering and terrorist financing, as well as the prevention, detection and repression of frauds against the Company or its clients and of any other illegal act.
b) The Company’s compliance with the obligations imposed by the relevant legal, regulatory and supervisory framework in force, as well as with the decisions of any authority (public, supervisory, judicial)
c) The protection of the Company’s clients, its personnel and their property as well as the Company’s premises and property in general.
This processing also serves the legal interests of the company or of a third party
C. For serving the Company’s or third parties’ legal interests, according to article 6(1) lit f) GDPR
The processing of data in accordance with Section 1 serves purposes such as securing the computer systems of the Company's facilities and assets, preventing and discouraging criminal acts or fraud, and protecting the rights and legal interests of the Company.
D. To serve as information and / or your participation in promotional activities for new services / marketing
The processing of your data, as described in Section 1, serves as an indication of the purpose of keeping you informed about the services provided by the Company and to keep in touch in case new opportunities arise that may interest you.
This processing also serves the legitimate interests of the company and is done only with your express consent.
In cases where the company has requested and received your consent, the processing of your data specified in section 1.b. is based on the explicit consent of the situation specified in this section. However, you have the right to withdraw your consent at any time without affecting the processing of data carried out prior to the withdrawal.
E. Profiling or automated decision-making
For the fulfilment of the abovementioned purposes especially under point 2.B.a as well as for promotion purposes the Company may create your profile by using your data under Section 1.
In case the Company makes a decision solely based on automated processing, including profiling, which produces legal effects concerning you or affecting you in a similar way it will provide you with specific information and, if necessary, will ask for your consent.
3. Who are the recipients of your data?
During the performance of its contractual and legal/regulatory obligations, of serving its legal interests as well as in cases where the Company is authorized or has received your consent, recipients of your personal data may indicatively be the following:
a) The Company’s employees who are responsible for the evaluation of your requests, the management and performance of the contract(s) with the Company, the fulfillment of the obligations arising from it/them, as well as of the relevant obligations imposed by the Law.
b) Entities to which the Company delegates the performance of specific tasks on its behalf (Processors), which may indicatively but not exclusively be engineers, qualified valuers, energy efficiency inspectors, lawyers, law firms, notaries, bailiffs, experts, information products and/or services providers, electronic systems and network support providers, including but not limited to online systems and platforms, companies responsible for the storage, retention, filing, management and destruction of files and data, call centers, or other natural or legal persons that process data for the purposes of controlling and updating them (including updating your communication data in case you did not inform the Company of such an amendment), consulting companies (i.e, financial planning, audits), companies responsible for customers satisfaction or market surveys, the promotion of services etc., provided that security conditions and confidentiality have been met.
c) The clients of the Company, owners of the buildings promoted by the Company
d) Supervisory, independent, judicial, prosecution, public and/or any other authorities, or bodies.
4. Transfer of personal data
The company does not transfer your data to third countries.
5. For how long will your personal data be stored?
Your personal data will be stored for a strictly specified period of time, which will end when you either withdraw the request or, for objective reasons, it is not completed.
Your personal data collected and processed for the purpose of the Company's marketing policy (according to Point A, letter d) will be stored until your express consent is withdrawn.
Your personal data processed during the execution of a successfully completed contract will be stored for a period of time, not exceeding 10 years, in order to fulfill the legal obligations of the Company, as a reporting entity, according to the provisions of Law 129/2019 on preventing and combating money laundering.
At the end of the storage period, the data are deleted or anonymized after processing.
6. What are your rights, as Data Subject, regarding the protection of your personal data?
You have the following right, in quality of Data Subject:
a) To know the categories of your personal data that we store and process, their source, the purposes of their processing, the categories of their recipients, the period of storage as well as your relevant rights (right of access), according to article 15 GDPR.
b) To demand the rectification or/and to have your incomplete data completed so that they are accurate and complete (right to rectification) by providing supplementary statements that justify the need for rectification or completion, according to the article 16 GDPR.
c) To ask for a restriction of the processing of your personal data (right to restriction of processing),
according to the article 18 GDPR.
d) To object to any further processing of your stored personal data (right to object), according to the article 21 GDPR.
e) To obtain the erasure of your personal data from the Company’s records (right to erasure) according to the article 19 GDPR.
f) To request the transfer of your data stored by the Company to another controller (right to data portability), according to the article 20 GDPR.
Please note the following as regards your rights:
i. Your rights as explained above (points c, d and e) may be partly or fully not satisfied if the data are deemed necessary data for the contract regardless of their source.
ii. The Company has in any case the right to deny your request for restriction of processing or erasure of your data if their processing or storage is necessary for the establishment, exercise or
defense of the Company’s rights or the fulfillment of its obligations.
iii. The exercise of these rights is valid for the future and does not affect previous data processing.
g) To lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro) in case you consider that your rights are in any way violated
7. How can you exercise your rights?
For the exercise of your rights you may contact in writing Cerved Property Services S.A., Bucharest, 1st District, 169A Calea Floreasca, Building B, Floreasca Business Park, 7th floor or send an email at dpo.cps.ro@cerved.com.
The Company shall use its best endeavors to address your request within thirty (30) days of the receipt of this request. The abovementioned period may be prolonged for sixty (60) more days, if deemed necessary, according to the Company’s judgment taking into account the complexity of the issue and the number of the requests. The Company shall inform you within thirty (30) days of the request’s receipt in any case of prolongation of the abovementioned period.
The abovementioned service is provided by the Company free of charge. However, in case the requests manifestly lack of foundation and/or are repeated and excessive, the Company may, after informing you, refuse to address your request(s).
8. Contact regarding personal data
For issues regarding your personal data you may contact the Data Controller in writting and send to the email address: info.cps.ro@cerved.com or in attention to the DPO at the e-mail address: dpo.cps.ro@cerved.com
9. How does the Company protect your personal data?
The Company, as Data Operator, takes all appropriate technical and organizational measures to ensure the security and confidentiality of your personal data, its processing and protection against accidental or unlawful destruction, loss, modification, illegal transfer, dissemination, access and any other forms of illegal processing.
This data protection information replaces from 25.05.2018 (which is the date of entry into force of Regulation (EU) 2016/679, GDPR, on the protection of personal data) any other previous general information regarding the processing of your personal data.
By receiving this information, it is considered that you have been informed about the processing of your personal data by the Company for the purposes mentioned in section 2 A, B, C.