This Policy regarding the processing of personal data (hereinafter referred to as “the Policy“) details when and why we, MASTERANGE ROMANIA S.R.L. (hereinafter referred to as “Masterange“), based in Bucharest, Nordului Road, no. 24-26, floor 2, room 25, 1st District, registered at the Trade Register under no. J40 / 3330/2003, CIF RO 15262492, acting as a Controller, owner and operator of the Stejarii Residential Club, process your personal data, how we use it, the conditions under which we may disclose it to others, your rights as a data subject and how you can exercise these rights.

In certain specific situations, Masterange acts as a joint controller together with:

• FERGUS CONSTRUCT INTERNATIONAL S.R.L., headquartered in Bucharest, Nordului Road, no. 24-26, 1st District, registered at the Trade Register under no. J40 / 20491/1994, CUI RO6435888, acting as administrator of MASTERANGE ROMANIA S.R.L. and service provider, respectively
• ITH MANAGEMENT OFFICE S.R.L., headquartered in Bucharest, Nordului Road, no. 24-26, 1st District, Bucharest, registered at the Trade Register under no. J40 / 20487/1994, CUI RO6435918, acting as administrator of the company MASTERANGE ROMANIA S.R.L. and service provider.

The controllers jointly establish the purpose and the means of the processing activities conducted in connection with Stejarii Residential Club. In this regard, the joint controllers have entered into an agreement to establish and share responsibilities for the processing of personal data.

When we process your personal data, we act in compliance with European and national legislation on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with as regards the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (hereinafter “GDPR” or “Regulation“).

This Policy addresses to:

• potential customers – individuals,
• customers – individuals,
• representatives of potential customers/customers,
• visitors to our website and social media pages,

 who access, use, or visit our website, each person in these categories is hereinafter referred to individually as the “data subject“.

For any information or request regarding the processing of personal data covered by this Policy or for the exercise of your rights as a data subject with regard to the processing of personal data as detailed below, you may contact our Data Protection Officer by using the following contact details:

ITH Management Office S.R.L.

Address: Nordului Road, no. 24-26, 1st District, Bucharest

Email Address: dataprotection@tiriacimobiliare.ro

Telephone number: 0040214312140

I. SOURCE OF PERSONAL DATA

 Personal data are obtained directly from you when you visit and / or complete the forms available on our website, our social media pages or when you contact us by e-mail or telephone.

The data may also be obtained indirectly from a representative / employee of the company you represent, from a representative appointed by you, as the case may be, or from our joint controllers.

II. PERSONAL DATA PROCESSED. HOW WE USE YOUR PERSONAL DATA. 

a. Purpose of processing 

Personal data are processed in order to communicate an offer at your request or to book a visit (when you fill in the form available on our website).

Personal data processed: name, surname, e-mail address, telephone number, type of apartment, other details inserted in the field dedicated to the message which, by association, may represent personal data.

Legal basis: the processing is carried out in order to take steps at your request before concluding a lease contract, the legal basis of the processing being represented by art. 6, para. (1), lit. b) of the GDPR, or when you have the quality of legal representative or designated contact person, the legal basis is art. 6, para. (1), lit. f) of the GDPR, respectively our legitimate interest to take steps before concluding a lease agreement with a legal entity.

b. Purpose of processing:

When you contact us using the form available on our website, we process your personal data in order to reply at any request submitted.

Personal data processed: name, surname, e-mail address, telephone number, type of apartment, object of the request, other details inserted in the field dedicated to the message, which by association may represent personal data.

Legal basis: we process this data to answer any request and / or questions you may have, in which case the legal basis for processing is our legitimate interest, according to art. 6 para. 1 lit. f) of the GDPR.

c. Purpose of processing:

If you choose to express or withdraw your consent to receive commercial communications regarding our activities and services, we will record your options so that we can comply with your choice.

Personal data processed: name, surname, telephone number, e-mail address, option to send commercial communications, date, and time of expression / withdrawal of consent.

Legal basis: the processing is carried out on the basis of our legitimate interest, in order to be able to prove compliance with the provisions of the applicable legislation, according to art. 6 para. 1 lit. f) of the GDPR.

We will contact you to keep you informed about our activity and services, such as invitations, events, offers, etc., only to the extent that you have given your consent.

In order to stop receiving such communications, you may at any time withdraw your consent in accordance with Section 6 (h) below.

Personal data processed: name, surname, telephone number, e-mail address, option to send commercial communications.

Legal basis: your consent, according to art. 6 para. 1 lit. a) of the GDPR.

If you withdraw your consent, processing will cease, so you will no longer receive commercial communications about our activity and services.

d. Purpose of processing: 

We keep proof of information provided to you regarding the details about how we process your personal data.

Personal data processed: confirmation of reading the information note, name and surname, respectively date and time of confirmation.

Legal basis: our legitimate interest in demonstrating compliance with the provisions on the transparency of the processing of personal data, according to art. 6 para. 1 letter f) of the GDPR.

e. Purpose of processing:

If you visit Stejarii Residential Club, we will process your personal data in order to ensure and maintain security and protection of the objectives, goods, valuables, ​​and the protection of individuals, as follows:

• By keeping records of access of persons and vehicles

Personal data processed: name, surname, serial number and IC number, date and time of entry, respectively registration number, as appropriate.

Legal basis: the need to fulfil the legal obligations established by the applicable legislation on the protection of objectives, goods, valuables, ​​and the protection of individuals, respectively, Law 333/2003, with subsequent amendments, according to art. 6 para. 1 lit. c) of the GDPR.

• Through the video surveillance system installed inside the Stejarii Residential Club

Personal data processed: registration number, video image of the person and / or vehicle.

Legal basis: the need to comply with the legal obligations established by the applicable legislation on the protection of objectives, goods, valuables, ​​and protection of individuals, respectively, Law 333/2003, with subsequent amendments, according to art. 6 para. 1 lit. c) of the GDPR, respectively our legitimate interest to prevent the loss or damage of some goods, respectively to request the establishment, exercise, or defence of a right, according to art. 6 para. 1 lit. f) of the GDPR.

Personal data are collected by observation using the video surveillance system installed.

In addition, we will also process your personal data indicated above, for the following purposes:

f. Purpose of processing: 

Personal data will be processed to produce aggregate statistics and reporting for the purpose of developing and improving Masterange’s business and services, streamlining business management, streamlining processes, centralizing operations, and maintaining an internal database, analysing, and minimizing financial and reputational risks to which the company is exposed in connection with the conduct of the business.

Legal basis: the processing is carried out on the basis of our legitimate interest to ensure the good management of the business, according to art. 6 para. 1 lit. f) of the GDPR.

In this case, the data shall be processed in an anonymous form and only exceptionally and when clearly necessary.

g. Purpose of processing: 

The data are processed for the establishment, exercise, or defence of certain rights, respectively the settlement of disputes, if applicable.

Legal basis: the processing is carried out on the basis of our legitimate interest to request the establishment, exercise, or defence of our rights, according to art. 6 para. 1 lit. f) of the GDPR.

h. Purpose of processing

The data are processed to protect the computer systems (including the website) and ensure their maintenance.

Legal basis: the processing is carried out pursuant to art. 6 para. 1 lit. f) of the GDPR, in order to achieve our interest in ensuring the proper functioning of IT systems.

i. Purpose of processing

We will process your data collected through cookies, in order to ensure your access to all the functionalities of the website and the security of the website.

Data processed: unique identifiers, the type of browser from which the website is accessed.

Legal basis: the processing serves to ensure the security and integrity of traffic and the operation of the website, the legal basis for the processing of your personal data is to fulfil our legal obligations to apply technical and organizational measures to ensure the security of data processing and development online activity, according to art. 6 para. 1 lit. f) of the GDPR.

j. Purpose of processing

We may also process your personal data, such as information about your online activity, in order to create statistics and to provide you with advertising tailored to your personal preferences.

Legal basis: cookies are configured according to your consent and preferences.

You can find more details about the use of cookies in our Cookies Policy.

Please note that if we intend to process personal data for purposes other than those for which we originally collected it and which are not compatible or related to the original ones, we will inform you in advance and we will provide you with all the relevant information, the subsequent processing being done only insofar as there is a legal basis for its performance, in compliance with the principles of legality according to art. 6, para. (4) of the GDPR.

Using plug-in technologies

When you follow the presentations that we upload to our Facebook, Instagram, LinkedIn, YouTube page or the links on our website, those social networks may process certain personal data that belong to you. These social networks act as controllers of personal data and have their own policies on how they process personal data, including through cookies. You can change these preferences under these third-party policies, which we cannot control.

Processing of personal data through social networks or other websites.

When you interact with our website through the social networks Facebook, Instagram, LinkedIn, or YouTube, they inform us that we have had you as visitors.

If you send us messages and reviews from your account on the social networks Facebook, Instagram, LinkedIn or YouTube, the legal basis for the processing of your personal data is the consent expressed by the fact that you have chosen to send these messages.

In all these cases, we process the personal data contained in your profile on the social networks Facebook, Instagram, LinkedIn, or YouTube and which you have chosen to make manifestly public on this network according to your preferences. You can change these preferences according to privacy policies:

Facebook (https://www.facebook.com/privacy/explanation)

Instagram (https://help.instagram.com/519522125107875)

LinkedIn (LinkedIn Privacy Policy)

YouTube (https://policies.google.com/privacy?hl=en)

III. RECIPIENTS OF PERSONAL DATA 

Personal data may be disclosed, strictly to the extent necessary for the purposes detailed above or in cases where this is required by law or we have a duly justified legitimate interest, to the following categories of recipients who may have the status of independent controllers / joint controllers or processors, as follows:

A. Our service providers, such as:

• business administration and consultancy services,
• personal data protection services,
• computer and website maintenance services,
• website hosting services;
• security audit and IT infrastructure services,
• cloud services,
• marketing services,
• archiving services,
• security and surveillance services, respectively maintenance of access and video surveillance systems,
• anonymization services for captured images.

 B. External consultants we contact in specific situations (for example, lawyers, tax consultants, experts, other advisers).

C. Public authorities and bodies, respectively investigative bodies, and courts, insofar as the transmission of data to them is required by law and / or is necessary in case of litigation or settlement of a dispute, as well as in case of controls in which we have the obligation to make them available (for example, tax authorities, ANSPDCP).

D. Persons expressly indicated by you.

E. Third party acquirers, to the extent that our business would be transferred (in whole or in part) and the data of the data subjects would be inherently linked to the assets that are the subject of such a transaction.

IV. TRANSFERS TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS 

As a rule, we will not transfer your personal data outside the European Economic Area. In exceptional cases and only if necessary, the transfer of your personal data outside the European Economic Area will only be done with the application of appropriate protection measures in accordance with the specific legal provisions on the protection of personal data and with your appropriate information.

V. DATA RETENTION

The personal data indicated in the sections above will only be processed for the period necessary to fulfil the purposes mentioned in this Policy.

Subsequently, we will remove or delete personal data from our systems and records and / or take steps to anonymize them so that you can no longer be identified.

Thus, the storage periods of personal data are as follows:

1. In case of request for an offer or to schedule a visit, the data shall be kept for a period of 3 years from the date of their collection;
2. If a lease contract is concluded, the data related to the offer will be kept for a period equal to the contractual duration, plus the periods provided by law (for example, financial-accounting legislation)
3. When you submit a request, the data will be kept for a period of 3 years from the date of settlement of the request / complaint, according to the general limitation period, in order to document the way in which they were resolved, so that we can defend our rights and interests.
4. The period of validity of the consent to receive commercial communications regarding the activity and services of Masterange is 2 years from the date of its granting. Thus, the data on the consent given will be kept throughout this period so that we can send you communications according to your choice. At the end of this period, the data will be kept for a period of 3 years, to protect our rights and interests. If you withdraw your consent, the data relating to this registration will be kept for a period of 3 years from the date of withdrawal.
5. To keep proof of information provided to you regarding the way in which we process the data, we keep the mentioned in section II letter e) for a period of 3 years from the date of completion the form available on our website.
6. Personal data processed in the context of disputes will be processed for the entire duration of their settlement as well as subsequently according to the applicable limitation periods.
7. The storage period of the data from the registers of records of access of persons and vehicles is 2 years from the date of their collection, according to the applicable legal provisions.
8. The duration of the storage of data obtained through the video surveillance system is 30 days, except in situations expressly regulated by law or in duly justified cases (for example, in the case of the opening of an investigation, requests from the authorities, In the event of a request from you or in the event of a dispute, the relevant images will be kept for the duration of the application, as well as subsequently, in accordance with the applicable limitation period. applicable). Upon expiration of the storage periods, the data will be destroyed or deleted by overwriting, as the case may be, depending on the medium on which they were stored.
9. In the case of website visitors, the data collected through cookies are kept for the period defined in Cookies Policy.

VI. YOUR RIGHTS 

Unless otherwise provided by law, you have the following rights with respect to your personal data:

a. Right to access data

By exercising this right, you can obtain confirmation from us that we are processing your personal data, as well as a copy of them and providing information about the processing conditions.

The answer to the request for access will be sent to you within a maximum period of one month from the date of the request. In special conditions this period may be extended up to two months, in which case we will inform you about the extension.

b. Right to rectification

By exercising this right, you can request the rectification / correction and / or completion without undue delay of inaccurate and / or incomplete personal data. Please note that any rectification will be made within a maximum period of one month from the date of the request. Under special conditions provided by the Regulation, this period may be extended to a maximum of two months, in which case we will inform you of the extension. In this regard, you may be required to provide the necessary documents for rectification or updating.

If you notice that some of your data are incorrect, please inform us as soon as possible using the contact details mentioned in the introductory part of this Policy.

c. Right to erasure / the right to be forgotten 

You have the right to request us, and we have the obligation to delete personal data processed without undue delay in the following cases:

• your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you have withdrawn your consent on the basis of which the processing takes place, in accordance with art. 6 of the GDPR and there is no other legal basis for processing;
• you object to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for processing, or you object to the processing under Article 21 (2) of the GDPR;
• your personal data have been unlawfully processed by us;
• your personal data have to be deleted in order to comply with a legal obligation incumbent on us under Union or national law to which we are subject.

When we can deny the request to delete data:

• processing is necessary for the exercise of the right to freedom of expression and information;
• processing is necessary to comply with an applicable legal obligation;
• for reasons of public interest in the field of public health, in accordance with Article 9 (2) (h) and (i) and Article 9 (3);
• the processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, under the conditions of the GDPR, insofar as the exercise of the right may make it impossible or seriously affect the achievement of the processing objectives;
• processing is necessary to establish, exercise or defend a right in court.

d. Right to restriction 

“Restriction” means that – except for storage – your personal data may be retained but may be processed only with your consent or for the establishment, exercise, or defence of a right in court or for the protection of the rights of another natural or legal person, public interest of the EU or of an EU Member State.

This right shall apply if:

• you dispute the accuracy of your personal data,
• the processing is unlawful, and you oppose the deletion of personal data, instead requesting the restriction of the processing,
• we no longer need your personal data, but you request that it be kept for you to establish, exercise, or defend a right in court,
• you have objected to the processing, for the time period in which it is verified that our legitimate interests in the processing of personal data prevail over your rights.

e. Right to object 

You have, for reasons related to your particular situation, the right to object to processing  carried out for the purpose of our legitimate interests, unless we demonstrate that we have legitimate reasons to process your data, which prevails over interests, rights, and freedoms. or to establish, exercise or defend a right in court.

Please also keep in mind that you can object at any time, free of charge and without any justification, to the processing of your data for direct marketing purposes, including the creation of profiles for this purpose.

f. Right to data portability

You have the right to receive the personal data, which you have provided to us for the purposes shown, in a structured, commonly used and automatically readable format, as well as the right to request that we send this data to another controller (only if this transmission is technically feasible), if the processing is based on consent or a contract and the processing is carried out by automatic means.

g. The right not to be subject to a decision based solely on automated processing, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects on you or affects you in a similar manner, unless such processing is necessary for the performance of the contract, is permitted by law or is based on your explicit consent.

h. The right to withdraw your consent

Without prejudice to your right to contact at any time the public authority for the processing of personal data, please contact us in advance regarding the exercise of your rights mentioned above by sending a written request to the contact details. indicated in the introductory part of this Policy.

If you consider that we have not solved all your requests or you are dissatisfied with our answers, you can file a complaint to NSAPDP, using the following contact data:

Headquarters: Bucharest, Gen. Blvd. Gheorghe Magheru no. 28-30, sector 1, CP 010336

Phone: +40.318.05.92.11

Fax: +40.318.05.96.02

Email: anspdcp@dataprotection.ro

Website: www.dataprotection.ro

You can also address to the competent courts.

Please note that if we have any doubts about the identity of the applicant as a data subject, we may request additional information to confirm the identity.

VII. KEEPING YOUR PERSONAL INFORMATION SECURE 

Masterange will make every reasonable effort to protect your personal data in its possession or control by establishing reasonable security measures to prevent unauthorized access, collection, use, disclosure, copying, modification or deletion of your data, and other similar risks.

This Policy is effective as of 25 May 2022. This Policy may be updated periodically, in which case we will keep you informed accordingly.