Privacy Policy
Version 1.0 / 20.09.2023
The purpose of this Privacy Policy is to explain what data we process, why we process it and what we do with it. We are aware that personal data belongs to you, so we make every effort to store it securely and process it carefully. We do not provide personal data to third parties without informing you and without firm confidentiality agreements with those third parties that include strict requirements regarding the technical and organizational measures for the protection of personal data that are binding on third parties.
The purpose of this Privacy Policy is to explain what data we process, why we process it and what we do with it. We are aware that personal data belongs to you, so we make every effort to store it securely and process it carefully. We do not provide personal data to third parties without informing you and without firm confidentiality agreements with those third parties that include strict requirements regarding the technical and organizational measures for the protection of personal data that are binding on third parties.
2. Processing of personal data
In order to carry out its activities, CEBIS processes personal data of certain categories of individuals. These may include personal data of customers, users of this site or employees / contractual partners of CEBIS.
Personal data means any information about an identified or identifiable natural person and an identifiable person is that identifiable person, directly or indirectly, in particular by reference to an identifying element, such as a name, an identification number, location, an online identifier, or one or more specific elements of one’s physical, physiological, genetic, mental, economic, cultural, or social identity.
This Policy applies to the personal data of our customers, business partners, other people who come into contact with us or who visit our locations, employees or people in the process of hiring, collaborators, etc. and applies to personal data collected by: e-mail, directly at the reception, various forms, CVs, videos, web-site, social media. For the purpose of carrying out the activity, CEBIS may collect, process and store certain personal data that are legally necessary for the conclusion and / or performance of a contract or in the legitimate interest. This data can be, but is not limited to: name, surname, citizenship, address, telephone, home address, e-mail address, IP address, photo-video images, etc.
If the data about such a person is processed, this person is referred to as the “data subject” within the meaning of the legislation in the field of personal data protection.
Personal data means any information about an identified or identifiable natural person and an identifiable person is that identifiable person, directly or indirectly, in particular by reference to an identifying element, such as a name, an identification number, location, an online identifier, or one or more specific elements of one’s physical, physiological, genetic, mental, economic, cultural, or social identity.
This Policy applies to the personal data of our customers, business partners, other people who come into contact with us or who visit our locations, employees or people in the process of hiring, collaborators, etc. and applies to personal data collected by: e-mail, directly at the reception, various forms, CVs, videos, web-site, social media. For the purpose of carrying out the activity, CEBIS may collect, process and store certain personal data that are legally necessary for the conclusion and / or performance of a contract or in the legitimate interest. This data can be, but is not limited to: name, surname, citizenship, address, telephone, home address, e-mail address, IP address, photo-video images, etc.
If the data about such a person is processed, this person is referred to as the “data subject” within the meaning of the legislation in the field of personal data protection.
3. Purpose for which we collect and process your personal data
3.1. Customers or potential customers
a. To offer you our services:
– PSP, CRS services- the legal basis for the data processing is your consent.
Personal data processed: name and surname, e-mail address, telephone
b. To communicate with you
– Your information, opinions, notifications, suggestions from you, solving the various problems you report to us, offering personalized services- the legal basis for the data processing is the legitimate interest of the operator, the interest of the natural persons concerned
Personal data processed: name and surname, home address, e-mail address, telephone
– Sending newsletters (business information)- the legal basis for the data processing is the legitimate interest of the controller based on your consent. You can withdraw your consent at any time, expressing your wish not to receive any more newsletters from us.
Personal data processed: name and surname, home address, e-mail address, telephone
c. In order to comply with our legal obligations
– According to the applicable legislation in Romania, some of your personal data are processed under our legal obligation.
Personal data processed : name and surname, domicile address, e-mail address, telephone number, nationality, serial number and identity card number
d. Legitimate interest
– Audio-video recordings through CCTV surveillance system -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in the protection of persons and property
Personal data processed: photo-video images
– Online identifiers -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in protecting computer systems and improving your relationship with you.
Personal data processed: IP address, MAC address of your device, geographic location, operating system information, and browser
3.2. Employees or collaborators
a. For employment- the legal basis for data processing is the conclusion of an Individual Employment Contract
Personal data processed : name and surname, telephone number, home address, e-mail address, information on education and training, professional qualifications, experience, state of health, etc. (information included in CVs, skills sheets)
b. During employment- the legal basis for data processing is the execution of an Individual Employment Contract and the legal obligations incumbent on the controller (labor law)
Personal data processed : name and surname, telephone number, home address, e-mail address, information on education and training, professional qualifications, experience, health, assessments, etc. (information contained in CVs, skills sheets, medical certificates, etc.)
c. Legitimate interest
– Audio-video recordings through CCTV surveillance system -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in the protection of persons and property
Personal data processed: photo-video images
– Online identifiers -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in protecting computer systems and improving your relationship with you.
Personal data processed: IP address, MAC address of your device, geographic location, operating system information, and browser
3.3. Visitors
We use your personal data to ensure the security of you, our property and our staff as well as to comply with national law established during cases of force majeure, e.g. COVID-19 pandemic. In this case, we base the processing of data on the legitimate interest, namely the protection of these spaces, persons, assets and personnel.
Data processed in this context may be your name as well as other personal data that you may provide to us directly at our request, as well as your images recorded using the video surveillance system.
3.4. Visitors to our site
When you access our site, the web server automatically saves access logs (logs) containing the visitor’s IP address, the web resource (document) accessed as well as information about the Operating System / Browser used. We store this data to prevent fraud and to ensure the security of your website and information.
We also use cookies on our site to improve the browsing experience of all visitors as well as to measure the effectiveness of this website.
Through cookies we do not collect or process any information on the basis of which the user could be identified. For more details, see “Cookie Policy”.
We collect information about how you use our services, such as the types of content you view or interact with, or the frequency and duration of your activities.
We collect the contact information you provide.
We collect information from or about the computers, phones, or other devices from which you access our site, depending on the permissions you have granted.
Here are some examples of device information we collect:
• attributes such as operating system, hardware version, device settings, file and software names and types, and device identifiers;
• Device locations, including specific geographic locations, such as via GPS, Bluetooth, or Wi-Fi signals.
• connection information, such as the name of your mobile operator or Internet service provider (ISP), browser type, language and time zone, mobile phone number, and IP address.
a. To offer you our services:
– PSP, CRS services- the legal basis for the data processing is your consent.
Personal data processed: name and surname, e-mail address, telephone
b. To communicate with you
– Your information, opinions, notifications, suggestions from you, solving the various problems you report to us, offering personalized services- the legal basis for the data processing is the legitimate interest of the operator, the interest of the natural persons concerned
Personal data processed: name and surname, home address, e-mail address, telephone
– Sending newsletters (business information)- the legal basis for the data processing is the legitimate interest of the controller based on your consent. You can withdraw your consent at any time, expressing your wish not to receive any more newsletters from us.
Personal data processed: name and surname, home address, e-mail address, telephone
c. In order to comply with our legal obligations
– According to the applicable legislation in Romania, some of your personal data are processed under our legal obligation.
Personal data processed : name and surname, domicile address, e-mail address, telephone number, nationality, serial number and identity card number
d. Legitimate interest
– Audio-video recordings through CCTV surveillance system -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in the protection of persons and property
Personal data processed: photo-video images
– Online identifiers -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in protecting computer systems and improving your relationship with you.
Personal data processed: IP address, MAC address of your device, geographic location, operating system information, and browser
3.2. Employees or collaborators
a. For employment- the legal basis for data processing is the conclusion of an Individual Employment Contract
Personal data processed : name and surname, telephone number, home address, e-mail address, information on education and training, professional qualifications, experience, state of health, etc. (information included in CVs, skills sheets)
b. During employment- the legal basis for data processing is the execution of an Individual Employment Contract and the legal obligations incumbent on the controller (labor law)
Personal data processed : name and surname, telephone number, home address, e-mail address, information on education and training, professional qualifications, experience, health, assessments, etc. (information contained in CVs, skills sheets, medical certificates, etc.)
c. Legitimate interest
– Audio-video recordings through CCTV surveillance system -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in the protection of persons and property
Personal data processed: photo-video images
– Online identifiers -the legal basis for data processing is the legitimate interest of the controller, the legitimate interest of data subjects in protecting computer systems and improving your relationship with you.
Personal data processed: IP address, MAC address of your device, geographic location, operating system information, and browser
3.3. Visitors
We use your personal data to ensure the security of you, our property and our staff as well as to comply with national law established during cases of force majeure, e.g. COVID-19 pandemic. In this case, we base the processing of data on the legitimate interest, namely the protection of these spaces, persons, assets and personnel.
Data processed in this context may be your name as well as other personal data that you may provide to us directly at our request, as well as your images recorded using the video surveillance system.
3.4. Visitors to our site
When you access our site, the web server automatically saves access logs (logs) containing the visitor’s IP address, the web resource (document) accessed as well as information about the Operating System / Browser used. We store this data to prevent fraud and to ensure the security of your website and information.
We also use cookies on our site to improve the browsing experience of all visitors as well as to measure the effectiveness of this website.
Through cookies we do not collect or process any information on the basis of which the user could be identified. For more details, see “Cookie Policy”.
We collect information about how you use our services, such as the types of content you view or interact with, or the frequency and duration of your activities.
We collect the contact information you provide.
We collect information from or about the computers, phones, or other devices from which you access our site, depending on the permissions you have granted.
Here are some examples of device information we collect:
• attributes such as operating system, hardware version, device settings, file and software names and types, and device identifiers;
• Device locations, including specific geographic locations, such as via GPS, Bluetooth, or Wi-Fi signals.
• connection information, such as the name of your mobile operator or Internet service provider (ISP), browser type, language and time zone, mobile phone number, and IP address.
4. Transmission of personal data to third parties
CEBIS transmits personal data to the following third parties:
a. Personal data of our clients are transmitted to the public authorities, according to the legal provisions and to our partners for the execution of the contracts in force.
b. Personal data of employees and collaborators are transmitted to public authorities, according to the legal provisions and to contracted companies (occupational medicine, occupational health and safety, meal vouchers, gift vouchers, etc.).
a. Personal data of our clients are transmitted to the public authorities, according to the legal provisions and to our partners for the execution of the contracts in force.
b. Personal data of employees and collaborators are transmitted to public authorities, according to the legal provisions and to contracted companies (occupational medicine, occupational health and safety, meal vouchers, gift vouchers, etc.).
5. Duration of personal data processing
CEBIS processes:
a. Personal data of the clients for a period of 5 years after the termination of the contract, according to the legal provisions
b. Personal data of employees and collaborators during the employment and then for the duration provided by the labor legislation of the personnel file.
a. Personal data of the clients for a period of 5 years after the termination of the contract, according to the legal provisions
b. Personal data of employees and collaborators during the employment and then for the duration provided by the labor legislation of the personnel file.
6. How we protect personal data
Personal data is processed securely. CEBIS has taken appropriate technical and organizational measures regarding data security, against unauthorized processing or alteration, against loss or destruction, as well as against unauthorized disclosure and access to personal data transmitted, stored or processed.
CEBIS ensures the integrity, availability, confidentiality and authenticity regarding personal data.
CEBIS uses advanced security methods and technologies, together with policies applied to employees and work procedures to protect the processing of personal data, according to the legal provisions in force.
CEBIS has concluded a contract by which the provider of Internet and hosting services ensures that it has taken all security measures, such as: limiting both physical access and remote access, being installed in a data center and periodically audited for security.
CEBIS makes every reasonable, commercially justified effort to protect the personal data we hold, analyze new technologies in the field and, if necessary, apply them to upgrade our security systems.
We have also implemented appropriate technical and organizational measures to ensure that only personal data necessary for the specified purposes are processed.
The principle of implicit data protection will also be followed during the development of new services.
However, despite our efforts to store the information collected in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of this information during transmission or storage in our systems. In the event of a security breach that jeopardizes your privacy or personal information, we agree to inform you of these things, either through the website or through other methods available to us (emails, phone calls, etc.).
CEBIS ensures the integrity, availability, confidentiality and authenticity regarding personal data.
CEBIS uses advanced security methods and technologies, together with policies applied to employees and work procedures to protect the processing of personal data, according to the legal provisions in force.
CEBIS has concluded a contract by which the provider of Internet and hosting services ensures that it has taken all security measures, such as: limiting both physical access and remote access, being installed in a data center and periodically audited for security.
CEBIS makes every reasonable, commercially justified effort to protect the personal data we hold, analyze new technologies in the field and, if necessary, apply them to upgrade our security systems.
We have also implemented appropriate technical and organizational measures to ensure that only personal data necessary for the specified purposes are processed.
The principle of implicit data protection will also be followed during the development of new services.
However, despite our efforts to store the information collected in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of this information during transmission or storage in our systems. In the event of a security breach that jeopardizes your privacy or personal information, we agree to inform you of these things, either through the website or through other methods available to us (emails, phone calls, etc.).
7. The rights of individuals
As a holder of personal data, you have a number of rights, including:
• the right of access- allows you to obtain confirmation that your personal data is processed by us and, if so, what are the relevant details of these processing activities;
• the right of rectification- allows you to rectify your personal data if it is incorrect;
• the right to delete- allows you to obtain the deletion of your personal data in certain cases, such as:
– if the data are no longer necessary in connection with the purposes for which they were collected;
– if the processing was based on your consent and if you have withdrawn your consent, or it has expired or if there is no longer a legal basis for the processing of your personal data;
– a court or regulatory authority has ruled that your personal data in question should be deleted;
– if it turns out that your personal data has been processed illegally.
• the right to restriction- allows you to obtain the restriction of the processing of your personal data in certain cases, for example, when you challenge the accuracy of your personal data, for a period that allows us to verify this accuracy;
• the right to object- allows you to object to the further processing of your personal data, under the conditions and within the limits established by law;
• the right to data portability- allows you to receive the personal data you have provided to us, in a structured, commonly used and legible format, or to pass this data on to another data controller.
You can exercise your rights mentioned above and obtain information regarding the processing of your personal data by submitting to us, as our data controller, a written request or e-mail to: data.protection@cebisusa.com
You also have the right to file a complaint with the National Authority for the Supervision of Personal Data Processing, in its capacity as an autonomous central public authority with general competence in the field of personal data protection.
• the right of access- allows you to obtain confirmation that your personal data is processed by us and, if so, what are the relevant details of these processing activities;
• the right of rectification- allows you to rectify your personal data if it is incorrect;
• the right to delete- allows you to obtain the deletion of your personal data in certain cases, such as:
– if the data are no longer necessary in connection with the purposes for which they were collected;
– if the processing was based on your consent and if you have withdrawn your consent, or it has expired or if there is no longer a legal basis for the processing of your personal data;
– a court or regulatory authority has ruled that your personal data in question should be deleted;
– if it turns out that your personal data has been processed illegally.
• the right to restriction- allows you to obtain the restriction of the processing of your personal data in certain cases, for example, when you challenge the accuracy of your personal data, for a period that allows us to verify this accuracy;
• the right to object- allows you to object to the further processing of your personal data, under the conditions and within the limits established by law;
• the right to data portability- allows you to receive the personal data you have provided to us, in a structured, commonly used and legible format, or to pass this data on to another data controller.
You can exercise your rights mentioned above and obtain information regarding the processing of your personal data by submitting to us, as our data controller, a written request or e-mail to: data.protection@cebisusa.com
You also have the right to file a complaint with the National Authority for the Supervision of Personal Data Processing, in its capacity as an autonomous central public authority with general competence in the field of personal data protection.