Notification regarding the processing of personal data belonging to the representatives/employees/professional contacts of M&M MILITZER & MUNCH ROMANIA partners.
1. M&M’S POLICY REGARDING THE PROCESSING OF PERSONAL DATA
M&M MILITZER & MUNCH ROMANIA S.R.L. (hereinafter referred to as “M&M”) implemented a confidentiality and transparency Policy regarding the personal data processed in its current business, according to the principles provided by the data protection legislation applicable in Romania, including Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “Regulation” or “GDPR”).
Personal data means any information related to an identified or identifiable person, and an identifiable person is a person who can be identified, directly or indirectly, particularly by referring to an identification element or one or several elements specific to his/her own physical, physiological, genetic, mental, economic, cultural or social identity;
This notification is related to the personal data of our business partners, of other people who contact us and visit us and their representatives or contacts or employees, and it applies to the data collected by email or other offline methods.
This notice decribes:
- the data categories we process,
- the method and purpose why we collect and use them,
- how we process personal data within the management of the relationship without business partners,
- the processing duration of such data,
- the recipients to whom we transfer personal data in relation to you and
- your rights as a subject and how you can exercise such rights.
2. M&M - THE PERSONAL DATA CONTROLLER
M&M MILITZER & MUNCH ROMANIA S.R.L. (“M&M”) the controller of your personal data, having its registered office in Calea 13 Septembrie no. 90, Room 2.09, 2nd floor, District 5, Bucharest, Romania, registered with the Trade Registry Office under no. J40/2942/2002, having the URC RO14574275.
As regards the personal data covered by this Notification, we inform you that M&M has taken the technical and organizational security measures designed to protect the personal data of the Data Subjects against accidental loss, alteration, disclosure or unauthorized access, especially when processing involves the transmission of data in a network, as well as against any other illegal form of processing.
Contact data for GDPR: email@example.com
3. CATEGORIES OF PROCESSED PERSONAL DATA
The personal data we process within our relationship without business partners may include:
- Contact details, such as your surname and first name, your position, post address, including your home address, if you have communicated it to us, your professional address, phone number, mobile phone number, fax number, e-mail address, electronic correspondence, business card, signature;
- Additional commercial information mandatorily processed in a project or contractual relation with M&M or voluntarily communicated by you, such as provided instructions, performed payments, requests and projects, etc.;
- Information collected from public sources;
- Other personal data regarding your preferences, if they prove relevant in the business relationships between the parties;
- Details of your visits to our offices or of our meetings with you;
- Other personal data usually provided by you, as required in order to fulfill the allowed purposes listed below.
The personal data related to you are provided directly by you or originate from a third party source. For instance, we may collect personal data from your organization, other organizations related to you, government agencies, information or service providers or public databases.
If you provide us with personal data related to another person (such as a person with whom you have professional relationships), you must make sure that you have the right to disclose such personal data to us and that, without taking any other measures, we may collect, use and disclose such personal data, as described herein. Particularly, you must make sure that the natural person in question is aware of all matters contemplated herein, as they are related to that person, including our identity, how he/she may contact us, why we collect such data, our personal data disclosure practices, the natural person’s right to access his/her personal data and to submit complaints regarding the management of his/her personal data, and the consequences of providing and not providing personal data (such as our impossibility to provide services).
4. PURPOSES AND LEGAL GROUNDS OF THE PROCESSING
In the context of your interaction with M&M, you, as a natural person, as legal representative, employee or contact person of a client or potential client, supplier or potential supplier or another business partner of M&M, may be subject to the data processing activities performed by us.
Thus, we hereby notify you that we use your personal data in the following cases:
4.1 The supply of services requested from us or the supply of services to us
When you or your organization request(s) the supply of services within M&M’s scope of business, we use your relevant personal data in order to prepare and provide the services requested from us.
When you supply or offer to supply or your organization supplies or offers to supply services for M&M, we use your personal data in order to ensure the provision of the services in optimal conditions, in our favor.
For this purpose, we shall only use your personal data for the following allowed purposes:
- managing the relationship with the client or supplier you represent;
- negotiating and concluding the agreement with the client or supplier;
- performing the activities required for the performance of the agreement, for preparing or requesting the required materials, or to communicate with you regarding your requests or any other relevant business related matters;
- managing or administrating your or your organization’s business relationship with M&M, including payment processing services, accounting, auditing, invoicing and collection, support;
- analyzing and improving our services and notifications to you;
- monitoring and assessing the compliance with our policies and standards;
- identifying the persons authorized to make transactions on behalf of our clients, suppliers and/or partners;
- complying with court decisions and exercising and/or defending our legal rights;
- any purpose related and/or ancillary to the aforementioned ones or any other purpose for which your personal data was provided to us.
We rely in all of the aforementioned cases, on the grounds of legitimate interests in the supply of our services, according to our scope of business, and the management of the relationship with our clients or the legitimate interest in accessing the services supplied by our partners and the management of the relationship with our suppliers.
4.2 Data processing as a legal obligation
We may process some of your data in the context of a commercial activity with your organization, due to the legal obligations regarding the archiving and keeping records on the agreements based on which the parties have engaged in commercial and economic relationships.
Also, we may process your data in the context of any changes in the structure of the share capital of M&M or another entity in which M&M could own shares, if your organization is part of such transaction. In this case, the grounds for the processing may be represented by the legal obligation to disclose certain personal data to public bodies, in relation to the recording and performance of the agreement concluded by M&M in the context of such transaction.
4.3 Voluntary data communication
We may collect personal data related to you at the time when you communicate or your organization communicates to us, voluntarily, for any reason, your personal data.
In this situation, we shall make sure that the processing of the data is compliant with all the legal provisions, and that we shall erase your data if we fail to identify legal grounds for storing such data and we shall notify you regarding this matter.
5. THE DISCLOSURE OF YOUR PERSONAL DATA
Wemay disclose your personal data in the following circumstances:
- if we have collected your personal data during the supply of services to another one of our clients, we could communicate such data to that client, and, if allowed by law, to other persons, for the purpose of supplying such services;
- to service providers, for inspections against money laundering or other purposes, for fraud and crime prevention, and companies providing similar services, including financial institutions, credit bureaus and regulatory authorities with which such data are shared;
- to any third party involved in the assignment or novation of any rights or liabilities;
- to courts of law, law enforcement authorities, regulatory authorities or attorneys or other persons, if this is proven fairly required for concluding, exercising or defending a right in court or a natural right, or for the purpose of a litigation settlement process;
- to our processors, mainly service providers or collaborators of M&M, for the processing of personal data for the purposes allowed herein, on our behalf and exclusively in accordance to our instructions. M&M shall remain in control of your personal data and shall make sure that the processors use appropriate protection measures, according to the applicable law, in order to ensure the integrity and safety of your personal data;
- to M&M Group, within our contractual partner reporting requirements, subject to the same obligations provided by Regulation (EU) 2016/679 regarding the enforcement of proper protection measures for ensuring the integrity and safety of your personal data.
6. THE UPDATING OF YOUR PERSONAL DATA
If any of the personal data you have provided to us is subject to changes, e.g. if you change your first name, surname or e-mail address or if you wish to cancel any request to us, or if you become aware that we have any inaccurate personal data related to you, please notify us, by sending an e-mail to firstname.lastname@example.org.
We shall not be responsible for any loss arising from inaccurate, unauthentic, insufficient or incomplete personal data provided by you, as we shall not be responsible for any unpredictable change in your personal data.
7. DATA STORAGE PERIOD
Your personal data shall be kept as long as they are reasonably required for the purposes allowed herein or until you withdraw your consent (if your consent is the grounds for processing) and M&M no longer has the legal obligation to continue to store such data. However, we shall keep your personal data when it is required for the exercising or defending by M&M of a right belonging to you or to another person in a court of law, until the end of the relevant retention period or the settlement of such court proceedings.
Unless you expressly request that we store your personal data for a longer period or unless the personal data is required for defending a potential right in court, without retention period, the personal data shall be deleted within 30 years from their collection date.
8. YOUR RIGHTS IN RELATION TO DATA
Subject to certain legal conditions, you have the following rights in relation to the processing of your personal data:
- the right of access – consisting of the right to obtain from M&M confirmation as to whether or not personal data concerning him or her are processed, and, where that is the case, the right to request a copy of the personal data that we hold concerning you; if you exercise this right in an obviously abusive or unfounded manner, we reserve the right to indemnification for any required costs incurred by the Company;
- the right to rectification of any inaccurate personal data
- the right to erasure, which allows you to obtain the erasure of your personal data in certain cases (for instance, if you have withdrawn your consent, the processing is no longer necessary in relation to the purposes for which they were collected or the processing is unlawful);
- the right to restriction of processing by M&M of your personal data, in certain cases (for instance, when you challenge the accuracy of your personal data, for a period that would allow us to check such an inaccuracy);
- the right to portability, which allows you to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit that data to another controller;
- the right to object, which allows you to object to the subsequent processing of your personal data, in the conditions and at the extent allowed by the law;
M&M shall ensure the exercise of all your rights.
If you wish to proceed according to the aforementioned provisions, please send us an e-mail to the address email@example.com or a written notification to the address Calea 13 Septembrie no. 90, Room 2.09, 2nd floor, District 5, Bucharest, Romania. We may ask you to prove your identity, by sending us a copy of a valid identification document, in order to comply with our safety obligations and prevent unauthorized data disclosure.
M&M shall consider any requests or complaints received from you and we shall reply to you as soon as possible, but no later than 1 (one) month from receiving the request.
If you are not satisfied with our answer, you may submit a complaint to the National Supervisory Authority for Personal Data Processing – having its headquarters in Blvd. Gheorghe Magheru no. 28-30, District 1, Bucharest, Romania.
9. NOTIFICATION UPDATES
The latest update of this Notification was performed in 25 May 2018.
We reserve the right to update and amend from time to time the data processing notification, in order to reflect any changes in the way we process your personal data or any amendments in the legal requirements. In the case of any such change, the amended version shall become effective within 15 days from its posting on the M&M website or its communication to you through any other means.