Information Note on the Processing of Personal Data

The European Parliament and the Council adopted on 27 April 2016 Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Regulation (EU) 2016/679 was published in Official Journal of the Union L119 of 4 May 2016 and its provisions will be directly applicable in all Member States of the European Union as of 25 May 2018.

S.C. Elsaco Electronic S.R.L., as a personal data operator, understands to respect and comply with the provisions of Regulation (EU) 2016/679, sense in which formulates and communicates the present notice on the processing of personal data.

This notice is addressed to you, as a concerned person for the processing of your personal data.

S.C. Elsaco Electronic S.R.L. is an organized society and operates in accordance with the laws of Romania. The headquarters of the company is in Botoșani, 41A Pacea Street, Botoșani county, VAT RO 7464520, Trade Register Office no: J07/1201/1994, the legal representative being Șerban Iftime – CEO.

The designated person within the company for the data processing activity can be contacted at the following address: dpo@elsaco.com or tel: 0231 507 060, int. 2252 or at the address: 41A Pacea Street, Botoșani city, Botoșani county.

Personal data will be processed by S.C. Elsaco Electronic S.R.L. legally, fairly and transparently to the data subject, being accurate, appropriate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Personal data will be processed for determined, explicit and legitimate purposes.

Personal data will be processed during the course of the business/contractual relationship between you and our company as well as upon their conclusion, to the extent that the further processing of the data is necessary for the observance of the legal provisions in force.

Personal data to be processed by S.C. Elsaco Electronic S.R.L. are the following:

• e-mail address, first and last name, phone number, date of birth, recipient address, delivery address, bank account.

Your provision of this personal data is a legal and contractual obligation on behalf of the data subjects. Processing of personal data by S.C. Elsaco Electronic S.R.L. is a prerequisite for the continuation of the commercial relations between you and our society. Please do not provide other personal data other than the ones strictly necessary.

Personal data will be processed by S.C. Elsaco Electronic S.R.L. for:

• drafting the invoices as well as the necessary documents for the payment of the products sold;
• drafting and registering commercial contracts as well as other related documents;
• drafting of the notices, the loading/unloading forms, the purchase documents.
• drafting of consignment notes, CMR, other transport documents;
• making purchase orders;
• preparation and registration of accounting documents, registers and accounting reports;
• employee recruitment.

In order to achieve the aforementioned purposes, the personal data of the persons concerned can be communicated, in strict compliance with Regulation 2016/679 as well as relevant legislation in the field, to public authorities and institutions having fiscal responsibilities as well as to companies and people with whom our company collaborates. In this case S.C. Elsaco Electronic S.R.L. will take, within the limits of the law, measures to ensure the confidentiality and security of personal data.

The companies, institutions and persons who will have access to your personal data are: Employees and collaborators of the Operator, third-party companies: Urgent Cargus SRL, Fan Curier, UNICREDIT BANK, Banca Transilvania, BCR.

The legal basis for the processing of your personal data is Article 6 (1) (b), (c), and (f) of Regulation (EU) 2016/679, as follows:

• Article 6 (1) (b) is applicable as the processing of personal data is necessary for the execution of commercial and contractual relations;
• Article 6 (1) (c) is applicable since the processing of personal data is necessary for our company to comply with its legal obligations;
• Article 6 (1) (f) is applicable as the processing of personal data is necessary to achieve the legitimate interests pursued by our company, namely to ensure the functioning of the company in order to achieve a profit in strict compliance with the legal provisions as well as the rights of the other persons.

• The right of access. The data subject has the right to obtain from the operator a confirmation that personal data concerning him/her are processed or, if so, access to the data. A copy of the personal data undergoing processing may be obtained;
• The right to rectification. The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data relating to him;
• The right to delete data. The data subject has the right to obtain from the operator the deletion of the personal data relating to him, subject to Article 17 of the Regulation;
• The right to restrict the processing. The person concerned has the right to obtain from the operator the restriction of the processing under the conditions set out in Article 18 of the Regulation;
• The right to data portability. The data subject has the right to receive the personal data which he regards and which he has provided to the operator;
• The right to opposition. At any time, the data subject has the right to oppose, for reasons related to his/her particular situation, the processing of personal data concerning him/her, including the creation of profiles based on those provisions;
• The right not to be the subject of a decision based solely on automatic processing, including the creation of profiles;
• The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing.

S.C. Elsaco Electronic S.R.L. does not use an automated decision-making process including the creation of profiles.

We provide you on request in full form Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data.

S.C. Elsaco Electronic S.R.L. as a personal data controller, will take organizational, administrative and technical measures to comply with Regulation 2016/679 as well as to protect the personal data of the data subjects.