Information on the contractors’ personal data protection
Dear Madam / Sir, Considering the provisions of the (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, as controller, we send you this document to detail when and why we process your personal data, how we use them, the conditions in which we may disclose them to others and how we store them under safety conditions. If you have any questions about the way in which we process your personal data, you can refer to our Personal Data Protection Policy here or you may contact us via e-mail at rpd@heidelbergcement.ro. We process your personal data for determined purposes Considering your capacity of legal representative, proxy or contact person, we process your personal data for the following purposes: - performance of the contract concluded with the legal entity on behalf of which you act; - compliance with applicable standards, legal regulations, codes of conduct or guidelines or for law enforcement and cooperation with competent authorities (including, without limitation, tax and legal authorities). We process your personal data for the performance of the contract with the legal entity on behalf of which you act (which also includes the interactions prior to its signature) and for the fulfillment of our obligations as a contracting party. In addition, we process your personal data in order to fulfill legitimate interests, for example: -
-
prevention, detection and investigation of offences, including fraud and money laundering or terrorist financing, as well as analysis and management of commercial risks; in relation to any claim, action or procedure (including, without limitation, drafting and review of documents, preparation of the documentation necessary for concluding a transaction, obtaining legal advice and facilitating dispute settlement) and/or for the protection or exercise of our contractual and legal rights and obligations; cooperation with the public authorities and institutions; management and preparation of internal reports, request for information/answers or participation in opinion polls, as well as research and/or analyses for statistical purposes or for other purposes so that we can establish our products, understand the customers’ behaviour, the market preferences and trends and review, develop and improve the quality of our products.
Your personal data are disclosed to other third parties In order to facilitate the performance of activities related to the purposes of the previously detailed processing, we communicate these data to third parties, including affiliates within the HeidelbergCement Group and our contractual partners, for example, to: - contracting parties and their banks in relation to any type of transfer of funds;
1
-
companies providing insurance and/or reinsurance services for us; service providers (i.e., courier, telecommunications, IT, payments, processing, training, storage, archiving); any business partner, investor, assignee (current or potential) in order to facilitate the transactions with commercial assets (which may include merger, acquisition, debt or sale); professional consultants such as auditors or lawyers; regulatory authorities, professional bodies and/or public authorities to comply with applicable regulations; organisers of tenders, evaluators or other third parties in relation to acquisitions, sales, loans or credits.
We will transfer your personal data outside the European Economic Area only in compliance with the legal provisions in force, applying the appropriate protective measures and notifying you when it is the case. Your rights with regards to the personal data Unless the law stipulates otherwise, you have the following rights: - the right of access, namely the right to obtain a confirmation from us that we process your personal data, as well as the access to them and the provision of information about the way of processing; - the right to rectification which refers to the correction, without unjustified delays, of the inaccurate personal data and/or to the completion of incomplete data; - the right to erasure/the right to be forgotten, namely the right to delete, without unjustified delays, your personal data collected in case when such data are no longer necessary for the fulfillment of the purposes for which they have been collected and there is no other legal basis for processing, the data have been unlawfully collected or the data must be deleted for compliance with a legal obligation; - the right to restrict processing, which applies in case when (i) you contest the accuracy of personal data, (ii) the processing is illegal and you object to the erasure of personal data, requesting in exchange the restriction of the processing, (iii) we no longer need your personal data, but you request them for the establishment, exercise or defense of legal claims, (iv) you have objected to the processing for the period of time in which it is checked whether our legitimate interests in processing the personal data override your rights; - the right to object to the processing, except for the case in which we demonstrate that we have legitimate interests to process your data, reasons which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims; - the right to portability, namely the right to receive the personal data you have provided to us for the purposes indicated herein in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another controller; - the right to lodge a complaint with the National Authority for Supervision of Personal Data Protection (ANSPDCP) to the postal address b-dul. G-ral. Gheorghe Magheru nr. 28-30, district 1, 010336 Bucharest or to the e-mail address anspdcp@dataprotection.ro; - the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects upon you or affects you in a similar manner, except for the case in which such processing is necessary for the performance of the individual employment contract or it is permitted by law. Except for the right to lodge a complaint with ANSPDCP, according to the aforementioned, these rights may be exercised by sending a written request to the headquarters of HeildelbergCement România S.A.
2
in Bucharest, șos. București-Ploiești nr.1A, Bucharest Business Park, building C2, district 1 or to the email address rpd@heidelbergcement.ro. We will not make an automated processing of your personal data. Retention period We will keep your personal data for the period of time necessary for complying with the legal obligations specific to our field of activity or according to the applicable limitation periods (for example, 3 years from the date of termination of the contractual relationship) or for complying with the archiving obligations required by the applicable legislation (for example, the law specific to the financial and accounting field). Security of personal data The Company will make all reasonable efforts to protect your personal data in our possession or under our control by establishing reasonable security measures in order to prevent the unauthorized access, use, disclosure, copy, amendment or disposal, as well as other similar risks.
3