PRIVACY NOTICE
Regarding the processing of personal data
– Phone Calls –
I. IDENTITY OF THE DATA CONTROLLER
We, Masterange Romania S.R.L, headquartered in Bucharest, 24-26 Nordului Road, District 1, registered at the Trade Register under no. J40/3330/2003, having the Tax registration code RO 15262492, hereinafter referred to as the „Company”, „Controller” or ”Masterange”, hereby provide you with the relevant information according to Article 13 and Article 14 of the GDPR regarding how we process your personal data in the context of telephone interactions with our representatives and their recording.
For any other details or requests regarding the processing of your personal data, or to exercise your rights under the GDPR, you can contact our Data Protection Officer using the following contact details:
ITH Management Office S.R.L.
- Address: 24-26 Nordului Road, District 1, Bucharest.
- Email to: dataprotection@tiriacimobiliare.ro.
- Phone: 0040214312149.
Please read this notice carefully, as it contains important information for you!
II. SOURCE OF DATA
Your personal data is obtained by us either directly from you, as a Lessee, Occupant, or Representative of a Lessee in Stejarii Residential (Stejarii Residential Club or Stejarii Collection), in the context of previous interactions we have had with you, or when you interact with our representatives by phone to submit your requests, through our system used for receiving and recording calls.
III. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASES FOR PROCESSING
The recording of the telephone call takes place based on your consent, expressed by your choice to continue the call, according to Article 6 (1)(a) of the GDPR.
The purpose of recording calls is to properly manage and resolve the requests you send us and to provide the requested services, ensuring the highest quality standards of the services offered. It also allows us to check the quality of these services against the Company’s standards, thereby improving your overall experience.
Recorded calls can only be accessed by our specially designated representatives and only in well-justified situations, respecting the technical and organizational measures adopted to protect your rights and interests.
Additionally, recorded calls may be used as necessary to comply with a legal obligation or for the establishment, exercise, or defense of a legal right or legitimate interest, for evidentiary purposes.
If you do not agree with the call recording, you have the option to submit your requests by visiting Concierge Office within Stejarii Residential Club or Stejarii Collection, via email: concierge@stejarii.ro and concierge@stejariicollection.ro or through the mobile App Stejarii.
In the context of telephone interactions with our representatives, we collect and process the following personal data:
- Identification and contact data: name, surname, phone number, spoken language.
- Data regarding the real estate: unit number, building and floor number, storage room number and its location, parking space number and its location, garden number.
- Data regarding the requests made: information related to the requests made, which may include aspects related to the execution of the lease agreement (reservations, cleaning services, repairs, etc.), email address if written communication regarding the resolution of the request is required, applicable rates for certain services, complaints, and any other information that, by association, could represent personal data.
- Technical data regarding the call: date and time of the call, call duration, voice.
Additionally, the data collected in the context of telephone interactions will be processed to the extent that they are relevant and necessary for:
- the execution of the lease agreement, pursuant to Article 6(1)(b) of the GDPR, or when you are acting as a legal representative or designated contact person, pursuant to Article 6(1)(f) of the GDPR, specifically our legitimate interest in communicating regarding the execution of the lease agreement concluded with a legal entity;
- mediating or providing the maintenance work you requested, the legal basis being the execution of a contract, pursuant to Article 6(1)(b) of the GDPR, or when you are acting as a legal representative or designated contact person, the legal basis is Article 6(1)(f) of the GDPR, specifically our legitimate interest in communicating regarding the execution of the contract concluded with a legal entity;
- providing the expressly requested services, specific to the Concierge Office, such as receiving correspondence, Concierge access to the building using the spare key for services according to express requests, assistance in the apartment (e.g., watering plants, feeding pets), facilitating business center activities (copying, printing, meeting room) or other similar services, the legal basis being the necessary steps for concluding/executing a contract, pursuant to Article 6(1)(b) of the GDPR, or when you are acting as a legal representative or designated contact person, the legal basis is Article 6(1)(f) of the GDPR, specifically our legitimate interest in communicating regarding the conclusion/execution of a contract concluded with a legal entity;
- resolving other types of requests, including received complaints, based on the legitimate interest in properly managing these requests, pursuant to Article 6(1)(f) of the GDPR;
- correspondence regarding the details of participation in events we organize, to ensure good organization, pursuant to Article 6(1)(f) of the GDPR;
- compliance with certain requirements imposed by applicable legislation, such as financial-accounting legislation, pursuant to Article 6(1)(c) of the GDPR;
- ensuring the functioning of systems, networks, and equipment used in connection with the activity of recording calls, such as ensuring maintenance and conducting security audits, pursuant to Article 6(1)(f) of the GDPR, to achieve our legitimate interest in ensuring the security and proper functioning of the entire infrastructure;
- preparing statistics and reports aimed at developing and improving our services, increasing the efficiency of our operations, optimizing processes, centralizing operations, and maintaining internal databases, analyzing, and minimizing the risks the company is exposed to; processing is carried out based on our legitimate interest in ensuring the efficiency, continuity, and improvement of the business, pursuant to Article 6(1)(f) of the GDPR.
IV. WITHDRAWAL OF CONSENT
You can withdraw your consent at any time by contacting our Data Protection Officer using the contact details available on the first page of this notice. If you choose to give your consent again later, we will take your new preference into account. Withdrawal of consent does not affect the legality of the processing carried out based on the consent before its withdrawal.
V. DATA RECIPIENTS
The personal data collected in the context of telephone interactions, which is relevant and strictly necessary for the purposes mentioned above, may be disclosed to the following categories of recipients which may act as independent controllers/joint controllers or processors, as follows:
a. Our service and/or product providers:
- business administration and management services (e.g. Fergus Construct International S.R.L., ITH Management Office S.R.L.),
- cloud and communication services,
- call center system provider through which telephone calls are recorded,
- support and maintenance services related to the systems, networks, and equipment used,
- audit services,
- archiving services,
- concierge services,
- maintenance services for the housing unit,
- security and protection services,
- cybersecurity services,
- data protection officer services,
- other services necessary for resolving submitted requests.
b. Courts or arbitration tribunals and/or other public authorities, in relation to the activities of these authorities to the extent that the transmission of data to them is required by law and/or is necessary in case of litigation or dispute resolution, as well as in the case of inspections or legal requests where we are obliged to provide them (for example, ANSPDCP, police, prosecutor’s office, others);
c. Lawyers, specialists in audit, legal, tax consultancy, etc.;
d. Third parties expressly indicated by you;
e. Third-party buyers, to the extent that Masterange’s business activity would be transferred (in whole or in part) to another entity, and the data of the data subjects would be part of the assets subject to such a transaction, based on a legitimate interest in developing and adapting our business activities.
Disclosure of your personal data to our service and/or product providers acting as processors is limited to the information strictly necessary for the provision of the respective services, these providers being contractually obliged not to use the personal data processed on our behalf for any other purpose.
VI. TRANSFERS TO THIRD COUNTRIES AND INTERNATIONAL ORGANIZATIONS
As a rule, we will not transfer your personal data outside the European Economic Area, to countries that are not deemed to provide an adequate level of data protection. In exceptional situations and only if necessary, the transfer of your personal data outside the aforementioned area will be done only with the implementation of appropriate safeguards and protection measures according to specific legal provisions in the field of personal data protection and with proper notification to you.
VII. STORAGE OF PERSONAL DATA
Recorded calls will be stored for a period of 1 year. After that period, they will be deleted or, if they are part of a dispute, will be retained for the entire duration of the dispute resolution, plus the applicable statute of limitations.
Personal data collected during telephone interactions and relevant to achieving the other purposes stated in Section III letters a-h will be saved separately and retained according to the Company’s internal policies, such as:
- Personal data processed in the context of contract execution and related activities (e.g., maintenance services, Concierge services) will be retained for a period equal to the contractual duration, plus the periods required by law (e.g., financial-accounting legislation).
- If you submit a request outside of contract execution, we will process your data for the entire duration of your request’s resolution and for a period of 3 years from the date of the last interaction, for purposes such as statistical analysis, reporting, and defending against disputes.
Subsequently, we will remove/delete your personal data from our systems and records and/or take measures to anonymize it so that you can no longer be identified. We will take all reasonable measures to ensure the deletion of personal data transmitted to recipients for the aforementioned purposes
VIII. YOUR RIGHTS REGARDING PERSONAL DATA
Except the cases in which Romanian law or GDPR provides otherwise, you have the following rights:
a. The right to be informed: The controller facilitates this right by making available this Information Notice, as well as other particular information notices when requesting your personal data.
b. The right of access to personal data concerning you: you have the right to obtain confirmation as to whether or not your personal data is being processed by the Controller and, if affirmative, to have access thereto and to obtain information on the processing, under the conditions of art. 15 of GDPR.
c. The right to request the rectification of personal data, if it is incorrect or incomplete, under the conditions of art. 16 of GDPR.
d. The right to request deletion of personal data: you have the possibility to request the Controller to delete your personal data if (i) the data is no longer necessary for the purposes for which it was collected or processed, (ii) the legal basis for the processing is your consent and you withdraw your consent and there is no other legal basis to continue the processing, (iii) you exercise your right to object (where applicable) and the Controller has no overriding legitimate basis to continue the processing, (iv) the data has been processed unlawfully, (v) the deletion is necessary for compliance with EU or Romanian law. Please note that the right to deletion is not an absolute right and we may continue the processing of your personal data when the above conditions are not applicable or when the processing is necessary for (i) exercising the right to free expression and information, (ii) compliance with a legal obligation, (iii) archiving in the public interest or (iv) establishing, exercising or defending a right in court.
e. The right to request restriction of the processing: you have the right to obtain the restriction of processing in cases where: (i) you consider that the processed personal data is inaccurate, for a period of time that allows the controller to verify the accuracy of personal data; (ii) the processing is illegal, but you do not want us to delete your personal data, but to restrict the use of such data; (iii) if the data controller no longer needs your personal data for the purposes mentioned above, but you need the data in order to establish, exercise or defend a right in court; or (iv) you have objected to the processing, for the period of time in which we verify whether the legitimate grounds of the data controller prevail over the rights of the data subject;
f. The right to withdraw your consent at any time You have the right to withdraw your consent at any time by submitting a request using the contact details indicated on the first page of this information.
g. The right to object to the data processing on grounds related to your particular situation, when the processing is based on the legitimate interest of the Controller.
Please note that, even in case of exercising the right to object, we will still be able to process your personal data if we demonstrate that your rights and freedoms do not prevail over our legitimate interest.
h. The right not to be subject to a decision based exclusively on automated processing, including profiling, which causes legal effects on you or similarly affects you in a significant manner.
i. The right to data portability, meaning the right to receive your personal data that you have provided to the Controller in a structured, commonly used and machine-readable form, as well as the right to transfer that data to another controller, if the processing is based on your consent or the performance of a contract and is carried out by automatic means.
j. The right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) or another competent supervisory authority. The contact details of the National Supervisory Authority for Personal Data Processing:
- address: Bucharest, 28-30 Gen. Gheorghe Magheru Blvd., 1st District, PC 010336
- phone: +40.318.05.92.11
- fax: +40.318.05.96.02
- email: anspdcp@dataprotection.ro
- website: dataprotection.ro
k. The right to appeal to courts
Please note that if we have any doubts about the identity of the access requester, we may ask for additional information to confirm the identity.
If you have addressed the Company or sent us a request to exercise the rights recognized by the GDPR, you will receive a response within one month at the latest from the receipt of the request. The period can be extended by two months, for justified situations and with your appropriate information.
IX. AUTOMATED DECISION MAKING AND PROFILING
The personal data referred to herein is not subject to automated processes.