Privacy Policy
GENERAL INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA
Version 02
Last modified on 13.01.2021
In this document we explain how Vitalitas processes your personal data and how it ensures the protection of your personal data, in accordance with the applicable data protection legislation, including Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).
This notice applies in relation to data processing carried out by Vitalitas. This document is relevant to you regardless of your position: customer, partner - natural person, representative of a partner - legal person, applicant for an offer or person contacting us for other purposes (e.g. in connection with requests or complaints), visitor to one of our offices or workplaces, former/current/potential employee, intern, visitor to our website, etc.
This note deals, in the order below, with the following issues:
(a) the categories of personal data we process;
(b) the purposes for which we process that personal data;
(c) the grounds on which we process the data;
(d) to whom we disclose the data;
(e) the period for which we store the data;
(f) the consequences of refusing to provide us with your personal data;
(g) your rights and information on how to exercise them;
(h) our contact details; and
(i) the circumstances in which this notice and its amendments apply.
1. CATEGORIES OF DATA. PURPOSE. SUBJECT
1.1 Current or potential clients of Vitalitas
We may process personal data relating to you for:
(i) Providing our services. We will use your data to send you an offer (at your request), to conclude and execute the contract with you, and to ensure that we provide you with the requested services. We may also collect and process this data through our call centre. In this case, we will base the processing on the need to conclude and/or perform the contract with you or, where applicable, your consent.
We will mainly process your identification data (name, surname, other data from your identity document) and, if we have a contractual relationship with you, the data included in the contract with you - including medical data necessary for the performance of the contract.
(ii) Processing your requests. We will use your data to respond to any requests, demands, complaints, or any other enquiries you make to us in the course of our relationship with you. We may also collect and process this data through our call centre.
In this case, the basis of the processing will be the performance of the contract with you or, where applicable, your consent.
We will mainly use your name, your surname, your contact details (e-mail address, telephone number) and information contained in the request you submit to us.
(iii) Marketing communications. In order to send you communications and offers about our products, services and promotions (on our initiative), we need to process your personal data. In this case, the data processing will be based on your consent. We may also collect and process this data via the call centre.
We will mainly process the following data relating to you: name, surname, e-mail address, telephone number, postal address.
1.2 Members (employees, collaborators, etc.) of our contractual partners - legal entities
We may process your data for:
(i) Maintaining the contractual relationship with the companies to which you belong. In order to be able to work with the company to which you belong (including communicating with you to resolve any problems your company or Vitalitas may have in relation to the contract between them), we will need to process personal data relating to you. In this case, we will base our processing on our legitimate interests in being able to perform the contracts we have entered into with other companies and to ensure that other companies also perform those contracts.
We will mainly process the following data relating to you: name, surname, position, employer, telephone number,
e-mail address.
(ii) Communication for marketing purposes. In order to send you communications and offers about our products, services and promotions, we need to process your personal data. In this case, the processing of your data will be based on your consent to receive such communications from us or, where applicable, on our legitimate interests, where following our analysis we have concluded that our legitimate interests prevail.
We will mainly process the following data relating to you: name, surname, telephone number, e-mail address, post address.
1.3 Our contractual partners - individuals (business partners, not customers)
We may then process your personal data for the following purposes:
(i) To be able to conduct business relationships with you. It is necessary for us to process certain information that relates to you in order to start and maintain business with you.
In this case, we will base the processing of data relating to you on its necessity for the conclusion/performance of the contract between you and us.
We will mainly process the following data relating to you: name, surname, data from your identity card.
(ii) Processing your requests. We will use your data to respond to any requests, demands, complaints, or any other queries that you send to us in the course of our relationship with you.
In this case, the basis of the processing will be the performance of the contract with you or, where applicable, your consent.
We will mainly use your name, your surname, your contact details (e-mail address, telephone number) and information contained in the request you submit to us.
(iii) Marketing communications. In order to send you communications and offers about our products, services and promotions, we need to process your personal data. In this case, the processing of your data will be based on your consent to receive such communications from us or, where applicable, on our legitimate interests, where after our analysis we have concluded that our legitimate interests prevail.
We will mainly process the following data relating to you: name, surname, telephone number, e-mail address, post address.
1.4 Members of public authorities
Then, we will use your personal data to fulfil our legal obligations, such as responding to requests from authorities, keeping records required by law and the like.
For example, we will need to keep your name, surname, the authority to which you belong and your signature in the control registers we are required by law to keep. Also, if you send us a request for information from the authority - your employer, we will process your data (name, first name, position, employer) in order to respond.
1.5 Applicants for positions/internships with Vitalitas
We may then process your personal data for the purpose of conducting the recruitment process.
In order to be able to analyse your application, it is necessary to process the data included in your application. This data will usually include your name, surname, contact details (telephone number and e-mail address), your professional experience, education and any other information from your CV and other documents that we may request from you or that you voluntarily submit to us.
In these cases, we will base our processing of your data on the conclusion/performance of the employment contract, internship, etc. with you, or, where applicable, your consent.
Where we ask you to provide us with letters of recommendation, we will process personal data relating to the opinions that the authors of those recommendations have about you. In this case, the source of your personal data will be those individuals. In this case, we will also process personal data relating to the authors of those letters (on the basis of their consent) and other identified or identifiable persons mentioned in those documents (on the basis of our legitimate interests).
1.6 If you are a visitor to our premises, workstations or other premises
Then we may use your personal data to ensure the security of persons and property.
In some of our premises we have video surveillance cameras (CCTV) installed to ensure the security of our employees, other people in those premises and our property. We will therefore process images (video recordings) of you (and possibly your voice). In all cases, we have indicated the locations of these cameras with information plates, as required by law. The processing of data for this purpose is based on our legitimate interest in ensuring the security of persons and objects on our premises.
We will also process your personal data contained in a valid identity document, as well as information on the purpose of your visit, at the reception desk, also for the purpose of ensuring the security of persons and objects in our premises, based on our legitimate interest.
1.7 If you are a visitor to our websites or have interacted with any of our social media pages
Then we may use your personal data for the following purposes:
(i) Improving your experience on our website. In order to keep track of the preferences you have expressed in previous browsing sessions, to tailor our website to the device you are using, to address problems you may encounter when accessing it, we process data such as: IP address; cookie identifiers; other online identifiers; unique device identifier (Universal Unique ID - UUID); date and time of website access; visit history; web request; date and time of request/date and time of website access; device from which you access the website; Internet browser type and browser language; information about events on your device (e.g. errors); information about your device's hardware settings; information about where you are when you access our website.
For more information on how we use cookies and similar technologies, please see our dedicated policy "Cookie Policy".
The basis for processing will in most cases be your consent or our legitimate interest.
(ii) Management of our communications and IT systems and their protection. We may process your data for the purposes of: managing our communications systems; managing our IT security; conducting security audits of our IT networks; protecting our data and systems against attacks and other similar acts in the virtual environment.
In this case, we will base our processing on our legitimate interests or, where applicable, the fulfilment of our legal obligations.
1.8 In general, whatever position you are in
We may also process your data for the following purposes:
(i) Processing your requests. We will use your data to respond to any requests, demands, complaints, or any other enquiries you make to us.
We will mainly use your first name, your surname, your contact details (e-mail address, telephone number) and the information contained in the request you submit to us.
In this case, the basis of the processing will be the performance of the contract with you (if any) or, where applicable, your consent.
(ii) Responding to requests from authorities or processing data in other cases where we are required to do so by law. We may sometimes have a legal obligation to disclose your data to certain authorities, to store your data for a certain period or to otherwise process your data. In this case, the basis of the processing will be the fulfilment of a legal obligation of ours.
(iii) Carrying out transactions, restructuring or other operations. In the context of transactions, we may disclose your data to potential acquirers or their advisers or authorities, although we will try to minimise this as far as possible. In this case, processing will take place on the basis of our legitimate interests or the fulfilment of legal obligations.
(iv) Defending our or others' rights and interests. We may process your data for the establishment, exercise or defence of our or others' rights or interests before courts, bailiffs, notaries public, other public authorities, arbitration tribunals, mediators or other public or private bodies that settle disputes, our lawyers, consultants (such as auditors or experts or specialists) or other natural or legal persons, public or private, who are involved in those disputes. In this situation, we will process your personal data, as appropriate, pursuant to the fulfilment of legal obligations incumbent on us or our legitimate interests.
(v) Fraud prevention. We are interested in conducting our business lawfully. Therefore, we may process your data (such as by providing this data to our consultants in various fields - auditors, lawyers, etc. or by consulting this data). In these cases, the processing will be justified by our legitimate interests in preventing fraud and other illegality in our business or, where applicable, by our legal obligations to ensure the lawfulness of our operations (such as obligations imposed by anti-money laundering legislation).
1.9 About third party data
If you transmit personal data to us concerning other persons (e.g. your representatives, your family members, your dependants, etc.), you must ensure that you have informed them of this and have directed them to this information on how Vitalitas processes personal data.
We will inform those individuals appropriately about how we process their data where appropriate.
2. TO WHOM WE WILL DISCLOSE YOUR PERSONAL DATA
As a rule, we will not disclose your data to other natural or legal persons.
We try to limit access to the data to persons outside Vitalitas who process your personal data (i.e. the company to whom you have provided personal data about you). However, in certain cases, we may need to disclose your data as set out below.
We may disclose your data to other companies or individuals, such as: other companies in the Vitalitas group, natural or legal persons acting as proxies for us or other companies in the Vitalitas group in various areas (such as archiving of documents, document destruction, or data storage, payment services, various services we may outsource, such as in the field of human resources), other persons, courts, authorities. In these cases, we will disclose data for legitimate reasons related to our business, such as ensuring our ability to secure documents, relieving us of the burden of doing business, establishing, defending and exercising our or another person's rights or interests.
Also, as stated above, in certain cases we may have a legal obligation to disclose data to public authorities or other natural or legal persons.
In all these cases we will ensure that the recipients of personal data relating to you process it securely and confidentially, in accordance with the purpose for which we have transmitted it and with respect for your rights.
3. UNDER WHAT CONDITIONS WE MAY TRANSFER YOUR DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS
At this time we do not transfer and do not intend to transfer your personal data or any part of it to other companies, organisations or individuals in third countries or to international organisations.
If we need to transfer data to any of the above destinations, we will inform you in advance of our decision, giving you sufficient time to exercise your rights in relation to the transfer of your data.
4. HOW LONG WE WILL KEEP YOUR DATA
We will store your data in accordance with our personal data storage policy, which assigns a storage period depending on the purpose of the processing and the category of data processed.
These periods are based on legal provisions (in particular in the field of personal data protection), also taking into account the obligations to store certain data, applicable limitation periods, relevant best practices and the purposes of our business.
5. WHAT MAY HAPPEN IF YOU DO NOT PROVIDE US WITH DATA
In most cases, you do not have an obligation to provide us with your personal data.
However, if you do not provide us with the requested data, we will not, for example, be able to enter into or negotiate a contract with you, sell you our products or provide you with our services, give you access to all the options on our website, respond to your complaints or requests or send you communications about our products, services and promotions that may be of interest to you.
6. NO AUTOMATED DECISION-MAKING PROCESS
We do not make decisions based solely on automated processing of your data (including profiling) that produce legal effects with respect to you or that similarly affect you to any significant extent.
7. YOUR RIGHTS AND HOW TO EXERCISE THEM
Your rights
You have the following rights:
- Right of access to data. You have the right to obtain access to data about you that we process or control or copies of such data; you also have the right to obtain information from us about the nature, processing and disclosure of such data.
- Right to rectification of data. You have the right to obtain rectification of inaccuracies in the data we process or control about you.
- Right to erasure of data ("right to be forgotten"). You have the right to obtain from us the erasure of data about you that we process or control.
- The right to restrict data processing. You have the right to restrict the processing of data we process or control about you.
- Right to object. You have the right to object to the processing of data about you by us or on our behalf.
- Right to data portability. You have the right to obtain the transfer to another controller of the data we process or control about you.
- Right to withdraw consent. Where we process data about you on the basis of your consent, you have the right to withdraw your consent; you may do so at any time, at least as easily as you originally gave us your consent; withdrawal of consent will not affect the lawfulness of the processing of data about you that we have carried out prior to withdrawal.
- The right to lodge a complaint with the supervisory authority. You have the right to lodge a complaint with the supervisory authority for the processing of personal data about the processing of your data by us or on our behalf. In Romania, this authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP). The contact details of the ANSPDCP can be found on the website www.dataprotection.ro.
How you can exercise your rights
To exercise one or more of these rights or to ask any questions about any of these rights or any provision of this notice or any other aspect of our processing of your data, please use the contact details in the OUR CONTACT DETAILS section below.
8. OUR CONTACT DETAILS
You can contact us at the details below.
Our contact details
Full name: SC VITALITAS SRL
Registered office address (mailing address): STR. TONY BULANDRA NR. 27, SECTOR 2, BUCURESTI, (INCINTA SPITALULUI MONZA) ZIP CODE 021967
Telephone number: 031 9300 (available between 08:00 - 20:00)
E-mail address: office@vitalitas.ro
Website: https://vitalitas.ro/
Contact details of the personal data protection officer
Full name: Radu Taracila Padurari Retevoescu SCA (RTPR)
Correspondence address: Piata Charles de Gaulle nr. 15, etaj 5, sector 1, Bucuresti, postal code 011857
E-mail address: contact@vitalitas.ro
9. WHEN THIS INFORMATION APPLIES
This general information applies in relation to the processing of data relating to you by Vitalitas.
This information does not apply in relation to services or products offered by other companies or individuals, including those posted on our websites or about which we otherwise inform you. Nor does this information cover the activity of other companies or individuals who advertise our services or products or otherwise process your data through our websites or on social media in connection with our pages.
10. CHANGES TO THIS POLICY
We may change this policy. In such cases, we will inform you in advance by posting this policy on the website 20 days before it comes into effect.
This version of this policy will come into force on 13.01.2021
11. WHAT DO THE TERMS WE HAVE USED IN THIS NOTE MEAN
- Personal Data Processing Supervisory Authority: an independent public authority which, by law, has powers relating to the supervision of compliance with personal data protection legislation. In Romania, this supervisory authority for the processing of personal data is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
- Special categories of personal data (sensitive personal data/sensitive data): personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the unique identification of a natural person; data concerning the health, sex life or sexual orientation of a natural person.
- Personal data: any information relating to an identified or identifiable natural person (referred to as a "data subject"). A natural person is identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identifier, e.g. name, identification number, location data, online identifier, one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity. Thus, for example, the notion of personal data includes the following: first and last name; home or residence address; e-mail address; telephone number; personal identification number (CNP); medical services accessed (sensitive data); diagnosis made (sensitive data); genetic data (sensitive data); biometric data (sensitive data); geolocation data. The categories of personal data relating to you that we process are listed above.
- Controller: the natural or legal person who decides why (for what purpose) and how (by what means) personal data are processed. According to the law, the primary responsibility for compliance with personal data legislation lies with the controller. In our relationship with you, we are the controller and you are the data subject.
- Processor: any natural or legal person who processes personal data on behalf of the controller, other than employees of the controller.
- Data Subject: the natural person to whom certain personal data refer (to whom they "belong"). In relation to us (the controller), you are the data subject.
- Processing of personal data: any operation/set of operations which is/are performed upon personal data or sets of personal data, whether or not by automatic means; for example collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of such personal data/sets of personal data. These are only examples. Basically, processing means any operation on personal data, whether by automatic or manual means.
- Third State: a State outside the European Union and the European Economic Area.
