GENERAL PRIVACY POLICY

About ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL, a Romanian legal entity, is a provider of adult professional training services, with some of the courses offered being accredited or in the process of accreditation. ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL offers its clients courses, both authorized and with selected specifications, held by authorized trainers in Romania, on various topics. The team of trainers has vast experience, also having different professions: Managers, lawyers, economists, medical assistants, psychologists, etc.

In terms of data protection legislation, we act as a CONTROLLER when processing your personal data. In order for the personal data of data subjects to be processed safely, we have made every effort to implement reasonable measures to protect their personal information.

Since we are always interested in hearing your opinions, as well as providing you with any additional information you may need regarding the processing of your data, we inform you that you can contact us at the email address: contact@nickavataji.com, or directly through a request registered at our registry office or sent by mail or courier to our headquarters below.

 

Rights of the data subject under the new Regulation

- The right to withdraw consent where processing is based on consent;- Dreptul de a fi informat cu privire la prelucrarea datelor;

- Right of access to data;

- Right to rectify inaccurate or incomplete data;

- Right to erasure ("right to be forgotten");

- Right to restrict processing;

- Right to data portability to another controller;

- Right to object to data processing;

- Right not to be subject to a decision based solely on automated processing, including profiling;

- Right to seek redress;

- Right to lodge a complaint with the Supervisory Authority.

 

Right to information:

• This allows data subjects to know, even at the time of collection (or within one month of acquiring the data, in the case of data collected indirectly from the data subject), how the data will be used, to whom they will be disclosed or transferred, what rights the individuals have regarding the processed data, etc.

 

Right of access to data:

• Art. 15 of the GDPR allows data subjects to obtain, from the controller, confirmation as to whether or not personal data concerning them are being processed and, if so, access to that data and other useful information (Art. 15 of the GDPR contains a list of such useful information, including the purposes of processing, categories of data processed, recipients, etc.).

• As a result of the right of access, the data subject will receive personalized information (see the content of the information, as presented in a following chapter), explaining what data are processed, for what purpose, on what legal basis, the retention period of those data, to whom they can be transferred and for what purpose, mentioning the rights of the data subject regarding those data, including the right to lodge a complaint with the Supervisory Authority if the individual is not satisfied with how this response is formulated, etc.

• In addition to this information about the processed data, the data subject has the right to obtain a copy of the data in question. While the above information discusses categories of data (e.g., email address, name, etc.), in the case of data copies, the actual data will be provided.

- Right to erasure:

• Article 17 of the GDPR allows data subjects to obtain from the controller the erasure of personal data concerning them without undue delay.

The first thing an operator should do when receiving such a deletion request is to check whether it falls under one of the exceptions provided by Article 17(3) of the GDPR, which allows or obliges them to retain the data, even in the case of a deletion request, namely:

The right to erasure does not apply if the processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) for reasons of public interest in the area of public health, in accordance with Article 9(2)(h) and (i) - preventive medicine or the provision of healthcare services, and Article 9(3) – processing under the obligation of professional secrecy;

(d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(e) for the establishment, exercise or defence of legal claims.

- Right to rectification of data:

• According to Article 16 of the GDPR: the data subject has the right to obtain from the controller the rectification or completion of inaccurate personal data concerning them without undue delay.

- Right to restriction of data:

• Article 18 of the GDPR: the right to restriction of data processing is a temporary right. In some situations, between the time when, for example, the controller decides to delete certain data (no longer needing the personal data for the purpose of processing) and the actual deletion of the data, the data subject makes a request opposing the deletion, stating that they require it for the establishment, exercise or defence of legal claims. As a result of such a request, the controller suspends the processing of the data for a certain period.

• Upon lifting the restriction on processing, the Controller must inform the data subject that the restriction has been lifted.

- Right to data portability:

• Article 20 of the GDPR. The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. In other words, personal data must be provided to the data subject in a structured format so that they can decide whether to download it or, conversely, to send it to another controller.

• This right applies only to data processed under a contract or the data subject's consent, and (cumulatively) when the processing is carried out by automated means.

• The right to data portability applies both to data directly provided by the data subject. Data derived or inferred, commonly referred to as conclusions drawn by operators (usually based on profiling operations), are excluded from portability.

- Right to object:

• Article 21 of the GDPR. The data subject has the right to object, for example, to the processing of their personal data, when such processing is carried out for direct marketing purposes. It is very important that, when there is processing that could give rise to this right for the data subject, the information should mention the existence of this right.

- Right not to be subject to a decision based solely on automated processing:

• Profiling occurs when your personal aspects are evaluated to make predictions about you, even if no decision is taken.

• Exclusive automated decision-making occurs when decisions about you are made using technological means and without any human involvement: these decisions can even be made without profiling.

• Data protection law establishes that you have the right not to be subject to a decision based solely on automated means if the decision produces legal effects concerning you or similarly significantly affects you. A decision produces legal effects when it impacts your legal rights (such as the right to vote). In addition, processing may significantly affect you if it influences your circumstances, behavior, or choices.

Decisions based on algorithms cannot use special categories of data unless you have given your consent or if processing is permitted by EU law or national law.

The right to access means that you have the right to obtain confirmation from us whether we are processing your data or not, and if so, to provide you access to this data as well as information about how it is processed.

The right to portability refers to the fact that you can receive personal data in a structured, machine-readable format and have the right to transmit this data directly to another controller.

The right to object concerns the right to object to the processing of personal data when it serves a public interest or a legitimate interest of ours.

The right to rectification refers to the correction without undue delay of inaccurate personal data.

The right to erasure/the right to be forgotten means that you have the right to have your collected data erased without undue delay in any of the following situations: they are no longer necessary for the purposes for which they were collected, you have withdrawn your consent and there is no other legal basis for processing, you object to processing, the data has been collected unlawfully, the data must be deleted to comply with a legal obligation, the collection was made in the context of offering information society services.

The right to restrict processing can be exercised if the accuracy of the data is contested for a certain period, sufficient for verifying the data, if processing is unlawful but deletion is not desired, only restriction, if the lawyer no longer needs the personal data for processing but you request it for the defense of a right in court, if you have objected to processing for the time period during which it is being verified whether legitimate rights prevail over yours.

 

Contact Information for Nick AVĂTĂJI

Bucharest, Splaiul Independenței, no. 3, bl. 17, sc. 1, ap. 4, Sector 5

contact@nickavataji.com

www.nickavataji.com

Categories of personal data. Purposes and legal bases for processing:

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL will process your personal data, depending on the context of the interactions and relationships you have with us by phone or through the website nickavataji.com.

 

Special categories of personal data are those that reveal (according to Article 9 of the GDPR):

- Racial or ethnic origin;

- Political opinions;

- Religious beliefs or philosophical convictions;

- Membership in trade unions;

- Genetic data;

- Biometric data for the unique identification of an individual;

- Data concerning health;

- Data concerning a person's sex life or sexual orientation.

 

These special categories are excluded from processing. ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER DOES NOT PROCESS SUCH DATA.

 

According to the GDPR (Article 6(1)), processing is lawful only if and to the extent that at least one of the following conditions applies:

(a) The data subject has given consent to the processing of their personal data for one or more specific purposes;

(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) Processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) Processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.

We process your name, surname, phone number, email address, and your address for:

- executing the sales contract concluded with you, including performing activities on your behalf under the contract between us;

- delivering the goods delivered by you;

- fulfilling tax obligations related to the payment of the service;

- drafting documents on your behalf, according to the entrusted mandate;

- fulfilling obligations imposed by law on merchants;

- marketing communications;

- situations where you have contacted us through the website.

 

Unless otherwise specified, data is stored for up to 10 years, except in the case of records of adult education service providers, which may be kept longer, according to the law. This data is processed because the data subject (you) has given consent to the processing of their personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the controller is subject;

 

We process your phone number, email address, Facebook account, and other data provided in point 2 (except if you have provided them) for:

- communicating with you;

- providing necessary information about our products.

 

Unless otherwise specified, data is stored for up to 10 years, except in the case of records of adult education service providers, which may be kept longer, according to the law. This data is processed because the data subject (you) has given consent to the processing of their personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the controller is subject;

 

We process the data included in your requests and communications to us, as well as the data of third parties provided in the documents you bring to our attention, for:

- fulfilling your legitimate interest in having the opportunity to read the book;

- fulfilling the public interest in adult professional education.

 

Unless otherwise specified, data is stored for up to 10 years, except in the case of records of adult education service providers, which may be kept longer, according to the law.

 

We do not use personal data for automated processing or profiling. We never make automated decisions about you. We use technical means to securely store data. We do not process data for secondary purposes that are incompatible with the purposes for which they were collected.

 

This General Privacy Policy refers to the personal data of customers, suppliers, other individuals who contact us and visit us, their representatives, potential collaborators, and applies to data collected through our website nickavataji.com, as well as all other personal data collected through email and contact forms.

 

Thus, visitors and users of the website may have the following categories of data processed:

1. In case of requesting additional information, contact and/or complaints: name, surname, email address, phone number.

2. In case of placing an order: name, surname, address, phone number, Facebook account, email address, phone number.

 

Please note that any sensitive and/or demographic information voluntarily provided to us in the scheduling process (gender, citizenship, information about citizenship, communication of patient's medical or health information - conditions, previous treatments) and/or data regarding racial, ethnic, or religious origin are considered sensitive personal data and will not be processed. However, if they are found in the documents communicated or in your emails, they cannot be deleted except by deleting the email, which is impossible, as it is preserved to prove the existence of communication.

 

For the purpose of providing services, delivering goods, and making payments under relevant contracts, we may process personal data such as identification data, contact details, banking information, business contact details, banking information, and tax identification code for individuals registered for VAT purposes.

 

Additionally, visiting the nickavataji.com website involves the automatic collection of the following data:

- technical data, for example, this may include the Internet Protocol (IP) address used to connect your computer to the internet, login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device type and mobile device brand; this data is collected and processed on our behalf, through third-party cookie files, and you can find more information about this in the Cookie Policy

- data about your visit, for example, this may include data about the URL, clickstream to, through, and from our site (including date and time), products or information you viewed or searched for on the site.

 

We process your personal data for various technical, administrative, and operational reasons, such as:

- ensuring the presentation of content in the most efficient manner for you;

- improving the nickavataji.com website, including its functionality;

- administering the nickavataji.com website;

- internal operations, including troubleshooting, data analysis, testing, research, statistics, and research;

- keeping the nickavataji.com website secure;

- advertising and marketing, including for specific marketing purposes, so that we provide content, including personalized content, that may be of greater interest to you.

Storing Personal Data

 

Unless otherwise specified, data is stored for up to 10 years, unless the records of adult training service providers are considered, which may be kept longer according to the law. These data are processed because the data subject (you) has consented to the processing of their personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation incumbent on the controller.

 

Additionally, if the data is not collected in the context of an agreement, such data will be retained for as long as necessary to achieve the intended data collection purpose or any longer period required by law, a records retention regulation.

 

Immediately after the applicable archiving period ends, the data must be:

1. Deleted or securely destroyed

2. Transferred to an archive (unless prohibited by law or by record retention regulations).

 

After the retention period, personal data of data subjects will be destroyed or deleted from IT systems or transformed into anonymous data for use in scientific, historical, or statistical research purposes.

 

Sharing Your Information with Third Parties

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL will not disclose data obtained from data subjects to other third-party companies without having obtained explicit and separate consent for this purpose.

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL confirms that personal data obtained are stored securely or are destroyed, informing data subjects that there are data processing agreements with the software provider(s) whereby they have ensured, in turn, that they comply with GDPR.

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL may disclose the personal data of individuals, respecting the applicable law, to business partners or other third parties, such as their own delegates. In these situations, we will request the commitment of these individuals to comply with this policy in advance.

 

We continuously make reasonable efforts to ensure that these third parties have implemented appropriate protection and security measures. We have contractual clauses with these third parties to protect your data. We will inform data subjects each time about the identity of these companies before transmission or within a reasonable period and ensure that any transfer is legitimate based on their consent or other legal basis.

 

Additionally, the company may share individuals' data with business partners as part of a joint effort to provide a product or service.

 

Personal information may also be provided to prosecutors, police, judicial authorities, and other authorized state bodies, within the provisions of the law and within its limits, following express requests.

 

Within reasonable limits, ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL will ensure that the personal data of data subjects do not leave the European Economic Area. However, to the extent that it transfers to states outside the EEA, it will always ensure that the transfers are legitimate, based on the explicit consent of the data subject or another legal basis.

 

Requests and Exercising Rights

 

ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL informs any data subject that:

- If you wish to exercise your rights, you can do so by submitting a written request, which can be deposited at the address indicated above or by sending a written request to the email address contact@nickavataji.com.

- The rights listed above are not absolute. There are exceptions, which is why each request received will be analyzed to decide whether it is justified or not. To the extent that the request is justified, the company will facilitate the exercise of rights. If the request is unfounded, it will be rejected, but the data subjects will be informed of the reasons for the refusal and of their rights to lodge a complaint with the Supervisory Authority and to seek justice.

- The company will attempt to respond to the request within 30 days. However, the deadline may be extended depending on various factors, such as the complexity of the request, the number of requests received, or the inability to identify you within a reasonable time.

- If, despite all efforts, the company fails to identify the data subject, and the data subject does not provide additional information to enable identification, the company will not be obliged to comply with the request.

If you wish to exercise any of the rights listed above in this General Privacy Policy, make comments, obtain additional information or clarifications regarding the processing of your personal data, if you have any questions or concerns about the processing of your information or wish to exercise your legal rights, or if you have any other concerns about the confidentiality of your data, please contact ROMANIAN PERSONAL DEVELOPMENT & AWARNESS STUDIES CENTER SRL via email at contact@nickavataji.com.

A response to all requests will be provided to you as soon as possible, within a maximum of one month from the receipt of the request, with the possibility of extending the period by up to two months if the processing is complex or if there is a large volume of such requests.

All requests must be submitted in person or sent by mail/courier to our headquarters in Bucharest, or by email to the following email address: contact@nickavataji.com. The resolution period for the request is 30 days.

It is also worth noting that Romania has the National Supervisory Authority for Personal Data Processing ("A.N.S.P.D.C.P.") and you have the right to lodge a complaint if you believe that your rights have been violated by accessing the website www.dataprotection.ro.

Dreptul de acces la date:

 

Conform Articolului 15 din GDPR, persoanele vizate au dreptul să obțină de la operator o confirmare cu privire la prelucrarea sau neprelucrarea datelor cu caracter personal care le privesc și, în caz afirmativ, acces la acele date și la alte informații relevante. Aceste informații includ scopurile prelucrării, categoriile de date prelucrate, destinatarii acestor date etc.

 

Odată cu dreptul de acces, persoana vizată va primi o informare detaliată, personalizată, care explică ce date îi sunt prelucrate, în ce scop, pe ce temei juridic, perioada de păstrare a datelor, destinatarii către care pot fi transferate aceste date și în ce scop, precum și menționarea drepturilor pe care le are persoana vizată în legătură cu aceste date. În plus, persoana vizată are dreptul de a obține o copie a datelor respective, nu doar informații despre ele.

 

Dreptul la ștergerea datelor:

 

Conform Articolului 17 din GDPR, persoanele vizate au dreptul de a solicita operatorului ștergerea datelor cu caracter personal care le privesc, fără întârzieri nejustificate. Cu toate acestea, există anumite excepții în care dreptul la ștergere nu se aplică, cum ar fi când prelucrarea este necesară pentru exercitarea dreptului la liberă exprimare și informare, pentru respectarea unei obligații legale, din motive de interes public în domeniul sănătății publice, în scopuri de arhivare în interes public, de cercetare științifică sau istorică sau în scopuri statistice, sau pentru constatarea, exercitarea sau apărarea unui drept în instanță.

 

Dreptul la rectificarea datelor:

 

Conform Articolului 16 din GDPR, persoanele vizate au dreptul de a solicita operatorului corectarea sau completarea datelor cu caracter personal inexacte sau incomplete care le privesc, fără întârzieri nejustificate.

 

Dreptul la restricționarea datelor:

 

Conform Articolului 18 din GDPR, persoanele vizate au dreptul la restricționarea temporară a prelucrării datelor. Acest drept poate fi exercitat în situații în care persoana vizată se opune ștergerii datelor, invocând necesitatea acestora pentru constatarea, exercitarea sau apărarea unui drept în instanță.

 

Dreptul la portabilitatea datelor:

 

Conform Articolului 20 din GDPR, persoanele vizate au dreptul de a primi datele cu caracter personal pe care le-au furnizat operatorului într-un format structurat, utilizat în mod obișnuit și care poate fi citit automat. De asemenea, au dreptul de a transmite aceste date altui operator, fără obstacole din partea operatorului inițial, în anumite condiții și limitări. Acest drept se aplică doar atunci când prelucrarea se bazează pe consimțământul persoanei vizate sau pe un contract, și numai atunci când prelucrarea este efectuată prin mijloace automate.

Right to object:

• Art. 21 GDPR. The data subject has the right to object, for example, to the processing of their personal data, especially when such processing is carried out for direct marketing purposes. It is very important that, when there are processing activities that could give rise to this right for the data subject, the existence of this right should be mentioned in the information provided.

 

Right not to be subject to a decision based solely on automated processing:

• Profiling occurs when your personal aspects are evaluated to make predictions about you, even if no decision is made.

• Fully automated decision-making occurs when decisions about you are made through technological means without any human involvement; these decisions can even be made without profiling.

• Data protection law establishes that you have the right not to be subject to a decision based solely on automated means if the decision produces legal effects concerning you or similarly significantly affects you. A decision produces legal effects when it impacts your legal rights (such as the right to vote). Additionally, processing can significantly affect you if it influences your circumstances, behavior, or choices.

Decisions based on algorithms cannot use special categories of data unless you have given explicit consent or unless processing is permitted by EU law or national law.

The right of access means that you have the right to obtain confirmation from us as to whether or not we are processing your data, and if we are, to access that data and information on how it is processed.

The right to data portability refers to your ability to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted directly to another controller.

The right to object concerns your right to object to the processing of your personal data when it serves a public interest or our legitimate interest.

The right to rectification refers to the correction without undue delay of inaccurate personal data.

The right to erasure/right to be forgotten means that you have the right to have your data erased without undue delay in any of the following situations: they are no longer necessary for the purposes for which they were collected, you have withdrawn consent, and there is no other legal basis for processing; you object to the processing; the data was collected unlawfully; the data must be erased to comply with a legal obligation; the data was collected in relation to the offer of information society services.

The right to restriction of processing can be exercised if the accuracy of the data is contested for a certain period, sufficient for the verification of the data; if the processing is unlawful but erasure is not desired, only restriction; if the lawyer no longer needs the personal data for processing purposes but you require them for the establishment, exercise, or defense of legal claims; if you have objected to the processing for the period of time while it is verified whether legitimate grounds override your rights.

 

Contact details for Nick AVĂTĂJI

Bucharest, Splaiul Independenței, nr. 3, bl. 17, sc. 1, ap. 4, Sector 5

0743026958

contact@nickavataji.com

www.nickavataji.com