This Policy regarding the processing of personal data (hereinafter referred to as “the Policy“) details when and why we, MASTERANGE ROMANIA S.R.L. (hereinafter referred to as “Masterange“), based in Bucharest, Nordului Road no. 24-26, floor 2, room 25, 1st District, registered at the Trade Register under no. J40/3330/2003, CIF RO 15262492, acting as a Controller, which owns and administers the Stejarii residential club, we inform you about the processing of personal data according to art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/ EC (hereinafter referred to as “GDPR” or “Regulation”). When we process your personal data, we act responsibly and in compliance with European and national legislation on the protection of personal data. In certain specific situations, for the administration of Stejarii the residential club, Masterange acts as a joint controller together with:

• FERGUS CONSTRUCT INTERNATIONAL S.R.L., headquartered in Bucharest, Nordului Road no. 24-26, 1st District, registered at the Trade Register under no. J40/20491/1994, CUI RO6435888, acting as administrator of MASTERANGE ROMANIA S.R.L. and service provider, respectively,
• ITH MANAGEMENT OFFICE S.R.L., headquartered in Bucharest, Nordului Road no. 24-26, 1st District, Bucharest, registered at the Trade Register under no. J40/20487/1994, CUI RO6435918, acting as administrator of the company MASTERANGE ROMANIA S.R.L. and service provider.

The controllers jointly establish the purpose and the means of the processing activities conducted in connection with Stejarii Residential Club. In this regard, the joint controllers have entered into an agreement to establish and share responsibilities for the processing of personal data.

This Policy addresses to:

• potential customers – individuals;
• representatives of potential customers/ legal persons customers;
• visitors to our website and our social media pages

who accesses, uses or visits our website and Facebook, Instagram, YouTube pages, each person in these categories being referred, individually, as “data subject“.

For any information or request regarding the processing of personal data covered by this Policy or for the exercise of your rights as a data subject with regard to the processing of personal data as detailed below, you may contact our Data Protection Officer by using the following contact details:

ITH Management Office S.R.L.

Address: Nordului Road no. 24-26, 1st District, Bucharest

Email Address: dataprotection@tiriacimobiliare.ro

Telephone number: 0040-21-4312149

 

I. THE SOURCE OF PERSONAL DATA

Personal data are obtained directly from you when you visit and/or complete the forms available on our website, our social media pages or when you contact us by e-mail or telephone.

The data can also be obtained indirectly from a representative/employee of the company you represent, from a representative appointed by you, as the case may be, or from our associated operators who were contacted by the data subjects.

 

II. PURPOSE AND LEGAL BASIS OF PERSONAL DATA PROCESSING; DATA PROCESSED.

1. Purpose: to schedule a visit, as a result of your request sent through the form “Book a visit” and the “Stejarii contact form” available on the website.

Personal data processed: name, surname, e-mail address, telephone number, type of apartment, other details inserted in the field dedicated to the message which, by association, may represent personal data.

Legal basis: the processing is carried out in order to take steps at your request before concluding a lease contract, the legal basis of the processing being represented by art. 6, para. (1), lit. b) of the GDPR, or when you have the quality of legal representative or designated contact person, the legal basis is art. 6, para. (1), lit. f) of the GDPR, respectively our legitimate interest to take necessary steps before concluding a lease agreement with a legal entity.

2. Purpose: to be able to solve your requests send through the forms „ Book a visit”, „ Stejarii contact form ” and „ GDPR panel ”.

Personal data processed: name, surname, e-mail address, telephone number, type of apartment, object of the request, other details inserted in the field dedicated to the message, which by association may represent personal data.

Legal basis: we process this data to answer any request and / or questions you may have, in which case the legal basis for processing is our legitimate interest, according to art. 6 para. 1 lit. f) of the GDPR.

3.  Purpose: the transmission of commercial communications, if you choose to express your consent to receive commercial communications from Masterange Romania S.R.L., such as: offers, invitations to events or news regarding services, through the newsletter, the telephone call with a human operator and/or by SMS, but also to comply with your request to withdraw consent, if applicable. We will register your options in order to respect your choice.

Personal data processed: name, surname, telephone number, e-mail address, option to send commercial communications, date, and time of expression / withdrawal of consent.

Legal basis: the processing is carried out on the basis of our legitimate interest, in order to be able to develop relations with customers, to document compliance with consent and to respect the rights of the data subjects, according to art. 6 para. 1 lit. f) from the GDPR

Personal data are processed only to the extent that you have ticked the appropriate box in the “Book a visit”, “Stejarii contact form” and “GDPR Panel” forms available on the website.

Also, personal data are processed for the purpose of withdrawing consent through the GDPR Panel on the website or through any other way of submitting the request.

In order to stop receiving such communications, you may at any time withdraw your consent in accordance with Section 6 (h) below.

If you withdraw your consent, processing will cease, so you will no longer receive commercial communications about our activity and services.

In case of withdrawal of consent, the processing will cease for the future, according to the Regulation, so that you will no longer receive commercial communications, offers, invitations to events or news regarding the services, through the newsletter, the telephone call with a human operator and/or through SMS.

4. Purpose: documentation of compliance with the Regulation, technical and organizational measures, compliance with the rights of the data subjects Personal data processed: date and time of confirmation of reading the information note, name and surname, date and time of the request for access, of the request to withdraw consent, name and surname, e-mail address and telephone number.

Legal basis: our legitimate interest in demonstrating compliance with the provisions on the transparency of the processing of personal data, according to art. 6 para. 1 letter f) of the GDPR.

5. Purpose: if you visit Stejarii Residential Club, we will process your personal data in order to ensure and maintain security and protection of the objectives, goods, valuables, ​​and the protection of individuals, by keeping records of access of persons and vehicles.

Personal data processed: name, surname, series and ID number, date and time of entry/exit, respectively vehicle registration number, as the case may be, the location visited. Legal basis: the need to fulfil the legal obligations established by the applicable legislation on the protection of objectives, goods, valuables, ​​and the protection of individuals, respectively, Law 333/2003, with subsequent amendments, according to art. 6 para. 1 lit. c) of the GDPR.

6. Purpose: video surveillance through the video surveillance system installed inside the Stejarii Residential Club

Personal data processed, collected by observation, using the installed video surveillance system: registration number, video image of the person and/or vehicle.

Legal basis: the need to comply with the legal obligations established by the applicable legislation on the protection of objectives, goods, valuables, ​​and protection of individuals, respectively, Law 333/2003, with subsequent amendments, according to art. 6 para. 1 lit. c) of the GDPR, respectively our legitimate interest to prevent the loss or damage of some goods, respectively to request the recognition, exercise, or defence of a right, according to art. 6 para. 1 lit. f) of the GDPR.

7. Purpose:to produce aggregate statistics and reporting for the purpose of developing and improving Masterange’s business and services, streamlining business management, streamlining processes, centralizing operations, and maintaining an internal database, analysing, and minimizing financial and reputational risks to which the company is exposed in connection with the conduct of the business.

Legal basis: the processing is carried out on the basis of our legitimate interest to ensure the good management of the business, according to art. 6 para. 1 lit. f) of the GDPR.

In this case, the data shall be processed in an anonymous form and only exceptionally and when clearly necessary.

8. Other general purposes:

• for the defense, exercise or recognition of certain rights, respectively the settlement of disputes, if applicable.

Legal basis: the processing is carried out on the basis of our legitimate interest to request the establishment, exercise, or defence of our rights, according to art. 6 para. 1 lit. f) of the GDPR.

• the data are processed to protect the computer systems (including the website) and ensure their maintenance.

Legal basis: the processing is carried out pursuant to art. 6 para. 1 lit. f) of the GDPR, in order to achieve our interest in ensuring the proper functioning of IT systems.

• in order to ensure the security of the website and to ensure your access to all the functionalities of the website, by using the cookies module.

Data processed: unique identifiers, the type of browser from which the website is accessed.

Legal basis: the processing serves to ensure the security and integrity of traffic and the operation of the website, the legal basis for the processing of your personal data is to fulfil our legal obligations to apply technical and organizational measures to ensure the security of data processing and development online activity, according to art. 6 para. 1 lit. f) of the GDPR.

• to generate statistics 

Legal basis: cookies are configured according to your consent and preferences.

We may process information about your online activity on other websites of third parties, the unique online identifier and/or device ID, the pages accessed and the sections of the website that were of interest, the number of accesses, the number of visitors and other statistics.

You can find more details about the use of cookies in our Cookies Policy.

Please note that if we intend to process personal data for purposes other than those for which we originally collected it and which are not compatible or related to the original ones, we will inform you in advance and we will provide you with all the relevant information, the subsequent processing being done only insofar as there is a legal basis for its performance, in compliance with the principles of legality according to art. 6, para. (4) of the GDPR.

9. Using plug-in technologies

When you follow the presentations that we upload to our Facebook, Instagram, LinkedIn, YouTube page or the links on our website, those social networks may process certain personal data that belong to you. These social networks act as controllers of personal data and have their own policies on how they process personal data, including through cookies. You can change these preferences under these third-party policies, which we cannot control.

10. Processing of personal data through social networks or other websites

When you interact with our website through the social networks Facebook, Instagram, LinkedIn, or YouTube, they inform us that we have had you as visitors.

If you send us messages and reviews from your account on the social networks Facebook, Instagram, LinkedIn or YouTube, the legal basis for the processing of your personal data is the consent expressed by the fact that you have chosen to send these messages.

In all these cases, we process the personal data contained in your profile on the social networks Facebook, Instagram, LinkedIn, or YouTube and which you have chosen to make manifestly public on this network according to your preferences. You can change these preferences according to privacy policies:

Facebook (https://www.facebook.com/privacy/explanation)

Instagram (https://help.instagram.com/519522125107875)

LinkedIn (LinkedIn Privacy Policy)

YouTube (https://policies.google.com/privacy?hl=en)

 

III. RECIPIENTS OF PERSONAL DATA 

Personal data may be disclosed, strictly to the extent necessary for the purposes detailed above or in cases where this is required by law or we have a duly justified legitimate interest, to the following categories of recipients who may have the status of independent controllers/joint controllers or processors, as follows:

1. Our service providers, such as:

• • business administration and consultancy services;
  • personal data protection services;
  • computer and website maintenance services;
  • website hosting services;
  • security audit and IT infrastructure services;
  • cloud services;
  • marketing services;
  • archiving services;
  • security and surveillance services, respectively maintenance of access and video surveillance systems;
  • services for anonymization or blurring of images captured by CCTV systems.
  2. External consultants we contact in specific situations (for example, lawyers, tax consultants, experts, other advisers).
  3. Public authorities and bodies, respectively investigative bodies, and courts, insofar as the transmission of data to them is required by law and / or is necessary in case of litigation or settlement of a dispute, as well as in case of controls in which we have the obligation to make them available (for example, tax authorities, ANSPDCP).
  4. Persons expressly indicated by you.
  5. Third party acquirers, to the extent that our business would be transferred (in whole or in part) and the data of the data subjects would be inherently linked to the assets that are the subject of such a transaction.

 

IV. TRANSFERS TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS 

As a rule, we will not transfer your personal data outside the European Economic Area. In exceptional cases and only if necessary, the transfer of your personal data outside the European Economic Area will only be done with the application of appropriate protection measures in accordance with the specific legal provisions on the protection of personal data and with your appropriate information.

 

V. DATA RETENTION

The personal data indicated in the sections above will only be processed for the period necessary to fulfil the purposes mentioned in this Policy.

Subsequently, we will remove or delete personal data from our systems and records and/or take steps to anonymize them so that you can no longer be identified.

The storage periods of personal data are as follows:

1. In case of request for an offer or to schedule a visit, the data shall be kept for a period of 3 years from the date of their collection;
2. In the case of an offer completed with the conclusion of a lease agreement, the data will be kept for a period equal to the contractual duration, plus the periods provided by law (for example, the financial-accounting legislation) of at least 10 years from the date of termination of the contract, plus three years of the prescription period.
3. In the case you submit a request or a complaint, the data will be kept for a period of 3 years from the date of settlement of the request/complaint, according to the general limitation period, in order to document the way in which they were resolved, so that we can defend our rights and interests.
4. The period of validity of the consent to receive commercial  communications regarding the activity and services of Masterange is 5 years from the date of its granting. Thus, the data on the consent given will be kept throughout this period so that we can send you communications according to your option. At the end of this period, the data will be kept for a period of 3 years, to protect our rights and interests. If you withdraw your consent, the data relating to this registration will be kept for a period of 3 years from the date of withdrawal.
5. To keep proof of information provided to you regarding the way in which we process the data for a period of 3 years from the date of completion the form available on our website.
6. Personal data processed in the context of disputes will be processed for the entire duration of their settlement, as well as subsequently according to the applicable prescription terms of at least 3 years.
7. The storage period of the data from the registers of records of access of persons and vehicles is 2 years from the date of their collection, according to the applicable legal provisions plus 3 years of the prescription period.
8. The duration of the storage of data obtained through the video surveillance system is 30 days, with the exception of situations expressly regulated by law or thoroughly justified cases (for example, in the case of opening an investigation, requests from the authorities, requests from you or in the case of a dispute), the relevant images will be kept throughout their duration, as well as afterwards, according to the applicable limitation periods; in the event of exercising a right, we will retain proof of the settlement of your claim according to the applicable limitation periods. Upon expiry of the retention periods, the data will be destroyed or deleted by overwriting, as the case may be, depending on the storage medium.
9. In the case of website visitors, the data collected through cookies are kept for the period defined in Cookies Policy.

 

VI. RIGHTS 

Please be aware that if we have doubts about the identity of the Data Subject exercising his rights, we may request additional information to confirm the identity.

Except the situations where Romanian law or RGPD provides otherwise, you have the following rights:

1. The right to be informed according to art. 13 and art. 14 of the Regulation, as it happens in this document.
2. The right of access to data: (art. 15 of Regulation no. 2016/679) – the right to obtain confirmation of the fact that personal data are or are not processed by Masterange and, if so, to have access to the type of personal data and the conditions under which they are processed, by sending a request in this regard, through any communication channel: post, e-mail, courier, others;

The answer to the access request will be sent to you within a maximum period of one month from the date of the request, and in special conditions this term can be extended up to two months, in which case we will inform you about the extension.

2. The right to data rectification

By exercising this right, you can request the rectification/correction and/or completion without undue delay of inaccurate and/or incomplete personal data. Please keep in mind that any correction can be made within a maximum period of one month from the date of the request, and in special conditions this term can be extended to a maximum of two months, in which case we will inform you about the extension. In this sense, it is possible to request the communication of some documents necessary to carry out the rectification or update.

If you notice that some of your data is incorrect, please inform us as soon as possible, using the contact details mentioned in the introductory part of this Policy.

3. The right to erasure/the right to be forgotten 

You have the right to request us, and we have the obligation to delete personal data processed without undue delay in the following cases:

• your personal data are no longer necessary to fulfill the purposes for which they were collected or processed;
• you have withdrawn your consent on the basis of which the processing takes place, in accordance with art. 6, respectively art. 9 of the GDPR and there is no other legal basis for the processing;
• you object to processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing or you object to processing pursuant to Article 21(2) of the GDPR;
• your personal data would have been processed by us illegally;
• your personal data must be deleted in order to comply with a legal obligation according to EU law or the applicable internal law.

We can also refuse the data deletion request when:

• processing is necessary for the exercise of the right to free expression and information;
• processing is necessary to comply with an applicable legal obligation;
• for reasons of public interest in the field of public health, in accordance with Article 9 paragraph (2) letters (h) and (i) and Article 9 paragraph (3) of the GDPR;
• the processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, under the terms of the GDPR, to the extent that the exercise of the right may make it impossible or seriously affect the achievement of the respective processing objectives;
• processing is necessary for establishing, exercising or defending a right in court.

4. The right to restriction of processing

Restriction of data processing means that, except for storage, your personal data can be kept, but can only be processed with your consent or for the recognition, exercise or defense of a legal right or for the protection of the rights of another natural or legal person or for reasons of public interest of the EU or an EU member state.

This right applies if:

• you dispute the accuracy of your personal data;
• the processing is illegal and you object to the deletion of personal data, requesting instead the restriction of the processing;
• we no longer need your personal data, but you request that it be kept for establishing, exercising or defending a right in court;
• you have objected to the processing, for the period of time in which it is checked whether our legitimate interests in the processing of personal data prevail over your rights.

5.  The right to object to processing (the right of opposition)

The right to opposition (art. 21 of Regulation no. 2016/679) – is the right of the data subject to oppose the processing of personal data for reasons related to the particular situation in which he is and applies to the processing necessary for the performance of a task that serves an interest public or resulting from the exercise of the public authority with which the operator is vested or when: (i) the processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party; (ii) when the processing of personal data is aimed at direct marketing; (iii) if the data are processed for scientific or historical research purposes or for statistical purposes, unless the processing is necessary for the performance of a task for reasons of public interest.

You have the right, for reasons related to your particular situation, to object to processing carried out for the purposes of our legitimate interests, unless we demonstrate that we have legitimate reasons to process your data that override your interests, rights and freedoms you or for establishing, exercising or defending a right in court.

Please also keep in mind that you can object at any time, free of charge and without any justification, to your data being processed for direct marketing purposes, including the creation of profiles for this purpose.

6. The right to portability

Means your right to receive the personal data, which you have provided to us for the purposes indicated, in a structured, commonly used and machine-readable format, and the right to request that we send this data to a another operator (only if this transmission is technically feasible), if the processing is based on consent or a contract and the processing is carried out by automated means.

7. The right not to be subject to a decision based solely on automated processing

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly affects you, unless such processing is necessary for the performance of the contract or is permitted by law or is based on your explicit consent.

8. The right to withdraw your consent

 This right is applicable if your data is processed as a result of the expressed consent, in which case you have the possibility at any time:

– to send an e-mail to the address: dataprotection@tiriacimobiliare.ro;

– access the GDPR Panel and fill in the form;

– to send the request by mail to the address: Soseaua Nordului no. 24-26, Sector 1, Bucharest.

The withdrawal of consent does not affect the legality of the processing carried out on the basis of the consent before its withdrawal. The withdrawal of consent regarding the processing of your personal data has the effect of stopping the processing, so that you will no longer receive commercial communications, information about Masterange’s activities and services in the future.

9. The right to file a complaint

 Without affecting your right to contact the Public Authority for the Supervision of the Processing of Personal Data at any time, please contact us in advance, in connection with the exercise of your rights mentioned above.

If you consider that we have not solved all your requests or you are not satisfied with our answers, you can contact the National Authority for the Supervision of the Processing of Personal Data – ANSPDCP, to file a complaint (headquarters: Bucharest, B-dul Gen. Gheorghe Magheru no. 28- 30, sector 1, CP 010336, telephone: +40.318.05.92.11 – fax: +40.318.05.96.02 – e-mail: anspdcp@dataprotection.ro, website: www.dataprotection.ro) or you can contact us with a complaint to the competent court.

 

 VII.SECURITY OF YOUR PERSONAL DATA

Masterange makes all reasonable efforts to protect your personal data in its possession or control by establishing reasonable security measures to prevent unauthorized access, collection, use, disclosure, copying, modification or deletion of data, as well as other similar risks.

 

VIII. AUTOMATED DECISIONS AND PROFILING

The personal data referred to in this Policy are not subject to automated decision-making processes.