GENERAL PRIVACY POLICY
WHO WE ARE
The company INTERMED CONCEPT LINE, with its registered office at Ion Agârbiceanu street, no. 3-11, Telephone: 0758.730.044, http://www.romania-fulfillment.ro; e-mail: office@romania-fulfillment.ro; Trade Register no.: J40/11635/2013; Tax ID: RO32264566, e-mail address of the Data Protection Officer: dpo@romania-fulfillment.ro, is the controller of personal data collected in the course of its legitimate business activity – courier services.
INTERMED CONCEPT LINE collects data in many ways and through several channels: when you contact us by telephone or e-mail, when you visit our website, when you request a quotation from us, when you enter into insurance contracts with us or when you submit a claim for compensation addressed to us. We also collect data when you visit us at one of our offices or places of business, as well as when you send us CVs or job applications.
DEFINITIONS
Personal data (Data) – any information relating to an identified or identifiable natural person (the data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special categories of personal data – any information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
Processing of personal data (Processing) – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data subject – a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Person authorised by the Controller (Processor) – the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Third Party – a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent – any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Pseudonymisation – means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. The principles of personal data processing apply to pseudonymised data, since such data remain personal data.
Anonymisation – means the processing of personal data in such a manner that is irreversible and that transforms the data so that they can no longer be attributed to a specific data subject. The principles of personal data processing do not apply to anonymised data, since such data no longer constitute personal data.
ANSPDCP – means the independent public supervisory authority in Romania, namely the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (the Romanian National Supervisory Authority for Personal Data Processing).
GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
PROCESSING PRINCIPLES
The processing of personal data by INTERMED CONCEPT LINE is always subject to the following principles:
- All data processing operations have a valid legal basis
- All data processing operations are carried out fairly
- We inform data subjects about what data we process, why, how and for how long we process them, whether and to whom we transfer them, as well as what rights they have in relation to their data
- Data are collected for specified, explicit and legitimate purposes and are not further processed in a manner that is incompatible with those purposes
- Data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
- We take care to use only accurate data and, where necessary, we will make sure they are kept up to date
- Data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, subject to the implementation of appropriate technical and organisational measures
- Data are processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
INTERMED CONCEPT LINE will ensure that it complies with these principles both in its current activities and in the event that it introduces new data processing technologies in the future, such as, but not limited to, new IT systems.
WHAT PERSONAL DATA WE PROCESS
INTERMED CONCEPT LINE specifically informs data subjects about the personal data collected and processed in each case where this occurs (for example, when sending a service quotation, when signing a contract, when receiving a CV, etc.).
If you are a customer.
For the performance of the services contracted with INTERMED CONCEPT LINE we process the following personal data: surname, first name, address (domicile/residence), personal identification number, series, number, date and issuer of the identity document, e-mail address, telephone, fax, bank, bank account. We also process the personal data of the recipients of your shipments: surname, first name, delivery address, telephone.
For carrying out the activity of selling courier services and related services, for managing the accounts of INTERMED CONCEPT LINE customers, for sending information and for handling complaints and claims made by the customer, we process the following personal data: surname, first name, address (domicile / residence), e-mail, telephone, fax, destination delivery addresses of the customers' shipments.
If you are the recipient of shipments.
In order to carry out its business activity, the company INTERMED CONCEPT LINE processes personal data that are necessary for the delivery of shipments (courier services) such as surname, first name, address (domicile/residence), telephone, series and number of the identity document and signature. The provision of this information by the customer is mandatory for drawing up the transport documents related to the services ordered from the company INTERMED CONCEPT LINE and for notifying the recipient about the delivery. At the same time, the processing of the series and number of the identity document is necessary for the safe performance of the service contract, for the security of the delivery of shipments.
Other types of processing.
For carrying out promotional and advertising activities, marketing activities, for running promotional campaigns, for sending periodic newsletters, for the activities of tracking and monitoring the delivery of shipments, the following personal data may be processed: surname and first name, telephone/fax, e-mail, address (domicile/residence), the degree of satisfaction of the customer and of the recipient with the services offered by INTERMED CONCEPT LINE.
If you contact us by telephone, we collect the following personal data: surname and first name, telephone/fax, e-mail, address (domicile/residence), voice. We collect these data
for the purpose of improving the quality of the services offered and provided, an activity carried out through the Customer Relations Department and/or the Sales Department.
INTERMED CONCEPT LINE processes the information listed above for drawing up the statements and reports required by law, and for protecting its rights in its relations with the competent supervisory authorities.
INTERMED CONCEPT LINE processes the data submitted by those who wish to join the INTERMED CONCEPT LINE team. The information sent to our company in connection with employment or collaboration is used exclusively for this purpose. INTERMED CONCEPT LINE is not liable for the accuracy of the data submitted for this purpose.
WHY AND HOW WE USE YOUR PERSONAL DATA
Your personal data are used to carry out our activity of delivering shipments (courier services), including to draw up quotations, to enter into contracts, to act on requests and complaints (in which case we must clarify the facts and carry out additional checks within a strictly legal framework), and to act on requests made by the competent authorities that supervise and regulate our activity.
We process data in order to provide you with the courier services and the information you request.
We also process personal data in order to ensure the security of the premises in which we carry out our activity, of the assets we use for this purpose, the safety of our employees and of the data and information we manage.
Your personal data are processed by collection, recording, organisation, storage, alteration, consultation, use, disclosure by transmission, making available, combination, restriction, erasure, destruction, etc. Your personal data are not subject to automated decision-making (including profiling) except in exceptional situations, in which case the data subject is informed of its existence, as well as of the details regarding this special method of processing.
INTERMED CONCEPT LINE specifically informs data subjects about the purposes and methods of processing in each case where this occurs (for example, when sending a service quotation, when signing a contract, when receiving a CV, etc.).
ON WHAT LEGAL BASIS WE USE YOUR PERSONAL DATA
INTERMED CONCEPT LINE aims to carry out data processing operations on the basis of at least one of the legal grounds listed below:
a) Consent – Where no other legal basis for processing set out below applies, INTERMED CONCEPT LINE always obtains the consent of the data subject for the processing of his or her personal data for one or more specific purposes.
b) Performance / Conclusion of a contract – Processing is necessary for the performance by INTERMED CONCEPT LINE of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
c) Legal obligation – Processing is necessary for compliance with a legal obligation to which INTERMED CONCEPT LINE is subject.
d) Legitimate interest – Processing is necessary for the purposes of the legitimate interests pursued by INTERMED CONCEPT LINE or by a third party, under the conditions laid down by law. For example, in the case of recording telephone calls, INTERMED CONCEPT LINE has a legitimate interest in retaining evidence or in improving the services offered.
e) Vital interest – Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
f) Public interest – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In the case of special categories of personal data, INTERMED CONCEPT LINE relies on the applicable legal provisions in order to always ensure a valid legal basis for processing.
TO WHOM WE TRANSFER YOUR PERSONAL DATA
Your personal data may be transferred to third-party subcontractors, or to competent authorities, etc. Whenever we do so, we make sure that there is a sound justification, that we will transfer only the data strictly necessary for achieving the purpose of the transfer, and we will endeavour to ensure that the recipient provides a high standard of personal data protection.
In the case of data processing activities carried out by a third-party provider/supplier/partner/intermediary on behalf of the controller INTERMED CONCEPT LINE, on the basis of a service contract of any type concluded between INTERMED CONCEPT LINE and the respective third party (which has the capacity of processor of personal data within the meaning of the GDPR), such contracts are concluded in writing and include a series of specific clauses whereby the respective third parties provide INTERMED CONCEPT LINE with sufficient guarantees to implement appropriate technical and organisational measures, so that the processing meets the requirements of the GDPR and ensures the protection of the rights of the data subject.
The transfer of personal data to an international organisation or to a country outside the EU and the EEA (the EEA includes the EU as well as Iceland, Liechtenstein and Norway) may take place only if the organisation or country concerned, to which the transfer is intended to be made, can ensure an adequate level of protection in accordance with the requirements of the GDPR.
The transfer of data to an international organisation or to a country whose legislation does not provide an adequate level of protection, recognised by an adequacy decision issued by the European Commission, is possible only if there are sufficient guarantees regarding the protection of the fundamental rights of data subjects and provided that enforceable rights and effective legal remedies are available to data subjects. These guarantees are established by INTERMED CONCEPT LINE, in compliance with the GDPR, in contracts/agreements concluded with the suppliers/service providers to which the data are transferred or by other legal means, on a case-by-case basis.
HOW LONG AND HOW WE KEEP YOUR PERSONAL DATA
We keep your personal data only for as long as we need them or as required by the legislation in force.
Throughout this time, we make sure that the data are kept securely and, in the event of security breaches, we are prepared to apply all technical, organisational and legal measures to limit the possible consequences and to inform the ANSPDCP, as well as the data subjects, if there are risks to them.
To the extent possible, we will anonymise the data that we no longer need in a manner that would permit the identification of data subjects, or we will apply pseudonymisation in order to limit the risks relating to the personal data processed.
WHAT RIGHTS YOU HAVE IN RELATION TO YOUR DATA THAT WE PROCESS
Right of access to Data
Any Data subject has the right to obtain from INTERMED CONCEPT LINE, when it acts in its capacity as controller, upon request and free of charge for one request per year, confirmation as to whether or not data concerning him or her are being processed by it, and, where that is the case, the following information will be provided: the purposes of the processing; the categories of data concerned; the recipients or categories of recipients of the data, in particular recipients in third countries or international organisations, as well as the appropriate safeguards provided in the case of such a data transfer; where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period; the existence of the right to request from INTERMED CONCEPT LINE rectification or erasure of data or restriction of their processing, or of the right to object to processing; the right to lodge a complaint with the ANSPDCP; where the data are not collected from the data subject, any available information as to their source; the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved, the significance and the envisaged consequences of such processing for the data subject.
Right to rectification
The data subject has the right to obtain from INTERMED CONCEPT LINE, as data controller, without undue delay, the rectification of inaccurate personal data concerning him or her.
Taking into account the purposes for which the data were processed, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure of data ("right to be forgotten")
The data subject has the right to obtain the erasure of personal data concerning him or her without undue delay, and INTERMED CONCEPT LINE will have the obligation to erase the data without undue delay where:
a) the data are no longer necessary in relation to the purposes for which they were collected or processed;
b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
c) the personal data have been unlawfully processed
d) the data subject exercises the right to object under the conditions of the GDPR;
e) the data have to be erased for compliance with a legal obligation of the controller;
f) the personal data have been collected in relation to the offer of information society services to minors under the conditions of the GDPR;
g) the personal data have been collected in relation to the offer of information society information to children under the conditions of the GDPR.
INTERMED CONCEPT LINE, as data controller, may refuse the request for erasure of data under the following conditions:
a) the processing is necessary for exercising the right of freedom of expression and information;
b) the processing is necessary for compliance with a legal obligation applicable to the controller;
c) the processing is necessary for reasons of public interest in the area of public health, under the restrictive conditions imposed by the GDPR;
d) the processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, under the conditions of the GDPR, insofar as the exercise of the right is likely to render impossible or seriously impair the achievement of the objectives of that processing;
e) the processing is necessary for the establishment, exercise or defence of legal claims.
Right to restriction of processing
The data subject has the right to obtain from INTERMED CONCEPT LINE, as data controller, restriction of processing in the following cases:
a) the data subject contests the accuracy of the data, for a period enabling the controller to verify the accuracy of the data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) INTERMED CONCEPT LINE no longer needs the personal data for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
e) a data subject who has obtained restriction of processing is informed by INTERMED CONCEPT LINE before the restriction of processing is lifted.
Right to object
The data subject has the right, in relation to INTERMED CONCEPT LINE:
a) to object at any time, on grounds relating to his or her particular situation, to the data concerning him or her being subject to processing based on public interest or legitimate interest. In the event of an objection, the processing may no longer cover the data in question unless there are compelling legitimate grounds which justify the processing and which override the rights of the data subject, or if the purpose is the establishment, exercise or defence of legal claims.
b) to object at any time, free of charge and without any justification, to the data concerning him or her being Processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
Right to data portability
The data subject has, in relation to INTERMED CONCEPT LINE, the right to receive – in a structured, commonly used and machine-readable format – the personal data concerning him or her which he or she has provided to the Company, and to transmit those data to another controller where:
a) the processing is based on consent or on a contract; and
b) the processing is carried out by automated means.
In exercising his or her right to data portability, the data subject has the right to have the data transmitted directly from INTERMED CONCEPT LINE to another controller, where technically feasible.
Right not to be subject to automated decision-making (including profiling)
In this respect, the data subject has, in relation to INTERMED CONCEPT LINE, the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning the data subject or similarly significantly affects him or her.
This right shall not apply in the following exceptional situations, where the automated decision:
a) is necessary for entering into, or the performance of, a contract between the data subject and INTERMED CONCEPT LINE;
b) is authorised by Union or Member State law to which INTERMED CONCEPT LINE is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests; or
c) is based on the data subject's explicit consent.
In the situations referred to in points a) and c) of this paragraph, INTERMED CONCEPT LINE has the obligation to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Right to withdraw consent
Where the processing of data is based on your consent, you have the possibility to withdraw your consent, in which case we will immediately cease processing your personal data. The withdrawal of consent shall not affect the processing carried out before that moment.
To exercise any of these rights, please contact the Data Protection Officer at the e-mail address dpo@romania-fulfillment.ro or by sending a request to the company INTERMED CONCEPT LINE, at its registered office in Bucharest.
Right to apply to the courts and/or the ANSPDCP
The data subject whose personal data are processed by INTERMED CONCEPT LINE has:
a) the right to lodge a complaint with the ANSPDCP (Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal – the Romanian National Supervisory Authority for Personal Data Processing, registered office: Bucharest, Bdul Gen. Gheorghe Magheru no. 28-30, sector 1, postal code 010336; Telephone: +40.318.05.92.11, Fax: +40.318.05.96.02 e-mail: anspdcp@dataprotection.ro, website: www.dataprotection.ro) if the data subject considers that the processing of his or her data is carried out in breach of the GDPR;
b) the right to bring an action before the courts if the data subject considers that the processing of his or her data is carried out in breach of the GDPR.