PERSONAL DATA PROCESSING (hereafter referred to as "the Policy")
The purpose of this Policy is to explain the type of personal data collected, the way it is processed, the rights of the data subjects, the time of their storage and other information related to the processing of personal data. Data protection is a priority for Best Ride S.R.L. with headquarters in Bucharest, Str. Oltului, nr. 12B, Sector 5, registered with the Trade Registry under no. J40 / 5598/2009, having the Tax Identification Number RO24304287. Navigating on our site pages is possible without any personal data being disclosed. However, for certain specific situations, such as completing a quiz, a questionnaire, or participating in a contest, individuals may collect and process certain personal data. If the processing of personal data is necessary and there is no statutory basis for such processing, we are obliged to obtain the consent from the data subject. The processing of personal data - such as name, surname, address, e-mail address, telephone number of a person concerned - will be done each time according to the provisions of Regulation no. 679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC ("the Regulation") and in accordance with the specific data protection rules the country where BestRide operates. Through this Policy, our company would like to inform the general public about the nature, extent and purpose for which we collect and process personal data. In addition, the data subjects are also informed of the rights they enjoy, rights regulated by the Regulation. As an operator, BestRide has implemented numerous technical and organizational measures to ensure full protection of personal data.
This Policy is based on the Regulation and any and all applicable laws on the protection of personal data. The policy must be comprehensible to both the general public and our clients and business partners. To ensure this, we will explain the terminology used. In this Policy we will use, inter alia, the following terms:
Personal Data or Personal Data refers to any information that makes it possible to identify an individual (the person concerned).
Person targeted - is an identified or identifiable individual. An "identifiable" individual is a person who can be identified, directly or indirectly, including by reference to an identification number or to one or more factors characteristic of his physical, physiological, mental, economic, cultural or social identities,
Processing - is to perform any operation or set of operations on Personal Data, with or without automatic means, such as collecting, registering, organizing, storing, adapting or modifying, retrieving, consulting, using, disclosing (by transmission, otherwise available), alignment or combination, blocking, deletion or destruction.
Restriction of processing - refers to the marking of processed personal data in order to limit its processing in the future,
Profiling - refers to any authorized form of personal data processing consisting of the use of personal data to evaluate certain personal aspects that are characteristic of an individual, in particular to analyze or predict aspects of work performance, economic situation, health, personal preferences, interests, reliability, location or travel of a natural person,
Pseudonymisation - is the processing of personal data in such a way that personal data can no longer be attributed to a target person without the use of additional information, provided that this additional information is stored separately and subjected to technical and organizational measures to ensure the fact that personal data is not attributed to an identified or identifiable individual,
Operator or operator responsible for processing - is a natural or legal person, public authority, agency or other body which, alone or with the help of third parties, determines the purposes or means of processing personal data; where the purposes and means of processing are determined by Union or Member State law, the operator or the specific criteria for his nomination may be provided by Union or Member State legislation,
Recipient - is a natural or legal person, public authority, agency, or other body to whom personal data are disclosed, be it a third party or not. However, public authorities that may receive personal data in a private investigation in accordance with Union or Member State law will not be seen as recipients; the processing of those data by public authorities will be in accordance with the rules applicable to data protection in accordance with the purposes of the processing.
Third party - is a natural or legal person, public authority, agency or other body outside the data subject, operator, processor and persons under the direct authority of the operator or processor authorized to process personal data,
Consent - the consent of the data subject is any indication given freely, specifically, clearly and clearly indicated by the person concerned through a statement or a clear affirmative action, signifying the consent to the processing of his or her personal data.
2. Name and address of BestRide operator
Best Ride S.R.L. with headquarters in Bucharest, Str. Oltului, nr. 12B, Sector 5, registered with the Trade Registry under no. J40 / 5598/2009, having the Tax Identification Number RO2430427, Phone: +40 785 225 888, Email: firstname.lastname@example.org, Website: www.bestride.ro.
4. Sign up for our newsletters
On BestRide websites, users are given the opportunity to subscribe to the company's newsletter. BestRide informs its clients and business partners on a regular basis through a newsletter about the company's offers. The company newsletter may only be received by the person concerned if (1) the person concerned has a valid email address and (2) if the person concerned signs up to receive the newsletter. A confirmation email will be sent to the email address registered by the person first targeted to send the newsletter for legal reasons through the double opt-in procedure. This confirmation email is used to prove whether the email holder is authorized to receive the newsletter. During the newsletter registration, we store the IP address of the computer system assigned by the Internet Service Provider (ISP) and used by the intended person at the time of registration, as well as the date and time of the registration. Collecting this data is necessary to understand the potential inappropriate use of a person's email address at a later date, and therefore serves the purpose of legal protection. Personal data collected as part of a newsletter registration will only be used to send the newsletter. In addition, those who subscribe to the newsletter will be notified by email as long as this is necessary for the newsletter service or for a registration in question, as this may be the case in the event of changes to the newsletter offer or in the eventuality of a change in technical circumstances. There will be no transfer of personal data collected by the newsletter service to third parties. Registrations to our newsletter may be terminated by the person concerned at any time. Consent to store personal data, given by the person targeted to receive the newsletter, can be revoked at any time. There is a link in each unsubscribe newsletter. For more details check our Data Processing Policy page.
5. The possibility of contacting the website
BestRide websites contain information that allows us to have a short electronic contact with our company as well as direct communication with us by including a general email address. If a person is contacting us by email or contact form, the personal data that he or she voluntarily sends is automatically stored. Such personal data, voluntarily transmitted by a person targeted to the operator, are stored for processing and contacting the data subject.
6. Routine deletion and blocking of personal data
BestRide will process and store personal data of the person concerned only for the period necessary to meet its storage purpose, or for the period provided by the European law or other applicable law. If the storage purpose is not applicable, or if the storage period provided by the applicable law expires, the personal data is deleted, in accordance with legal requests.
7. Rights of the data subject
Right of access of the data subject. In order to exercise the right of access, the person concerned may at any time contact BestRide with a request in this respect to obtain a personal data report;
Right of rectification. Every person concerned has the right to obtain the rectification of personal data when they are incorrect or have undergone certain changes or need to be filled in.
The right to erase. Each person concerned has the right to request the deletion of personal data as follows: (i) when the data are no longer needed for the purpose for which they were collected or processed, (ii) the person concerned withdraws the consent on the basis of which the processing, (iii) the data subject objects to processing in accordance with Article 21 (1) of the Regulation and there are no legal grounds for processing, or the data subject objects to processing in accordance with Article 21 (2) of the Regulation, iv) personal data was processed illegally or a legal provision in force requires them to be erased.
The right to restrict the processing. Each person concerned has the right to obtain restriction of processing where one of the following cases applies: i) the accuracy of the personal data is contested by the data subject, ii) the processing is illegal and the data subject opposes the deletion of the personal data, but instead requires the restriction their use, iii) BestRide no longer needs personal data to process them, but they are required by the data subject for the unit for the purpose of exercising rights, iv) the data subject opposed the processing in accordance with Article 21 (1) ) of the Regulation until it has been ascertained whether the legitimate grounds of BestRide prevail over those of the person concerned.
The right to data portability. Each person concerned has the right to request the transfer of personal data to a third person or to the person concerned.
Right to opposition. Each person concerned has the right to oppose, at any time, for reasons related to his / her particular situation, the processing of his / her personal data, which is based on Article 6 (1) (e) and (f) of the Regulation. This also applies to profile creation. BestRide will no longer process personal data in the event of an opposition unless we can demonstrate persuasive and legitimate grounds for processing that override the interests, rights and freedoms of the person concerned, or for the establishment, exercise or defense of legal rights. If BestRide processes personal data for direct marketing purposes, where prior consent exists, the data subject will have the right to opt at any time to process his or her personal data for such marketing. This applies to profile creation to the point where it is related to such direct marketing. If the person concerned objects to BestRide's processing for direct marketing purposes, then BestRide will no longer process his or her personal data for these purposes. In addition, the data subject is entitled, on grounds relating to his / her particular circumstances, to object to the processing of his personal data by BestRide for purposes of scientific research or historical research, or for statistical purposes, in accordance with Article 89 (1) Regulation, unless the processing is necessary to carry out a task performed in the public interest.
Making individual decisions, including creating profiles. Every person concerned has the right not to be the subject of a decision based solely on automatic processing, including the creation of profiles, which produces legal effects on it or similarly affects it significantly, as long as the decision is not based on explicit consent of the data subject. BestRide will implement appropriate support measures to protect the rights and freedoms of the person concerned and the legitimate interests, at least the right to obtain a human intervention from BestRide, to express their point of view and to challenge the decision.
Right to withdraw consent. Each person concerned has the right to withdraw his or her consent to the processing of personal data at any time.
Right to file a complaint with the supervisory authority - if the data subject considers that his / her legitimate rights in connection with personal data processing operations have been breached, he / she may address a complaint to that effect to the National Authority for Surveillance of Processing Personal Data, headquartered in B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania.
If you wish to exercise your rights or to send us a notice / request please contact us with the contact details indicated in this Policy. BestRide will respond as soon as possible but no later than 30 days. For any delays we will let you know and we will provide you with the justified reasons for the delay.
8. Legal basis for processing
Article 6 (1) let. of the Regulation serves as the legal basis for the processing of the operations for which we obtain the consent for a particular purpose of processing. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as the case may be, for example, when the processing operations are necessary for the supply of goods or for the supply of any other service, the processing is based on Article 6 paragraph 1, point b from
Regulations. The same applies to the processing operations that are required to undertake pre-contractual measures, for example in the case of inquiries about our products or services. Our company is subject to a legal obligation that requires the processing of personal data, such as the fulfillment of tax obligations, the processing is based on art. 6 (1) lit. c Regulation. In rare cases, processing of personal data may be necessary to protect the vital interests of the data subject or of another individual. This would be the case, for example, if a visitor was injured in our company and the name, age, health insurance data or other vital information should be transmitted to a physician, hospital or other third party. The processing will then be based on Art. 6 (1) let. d of the Regulation. Finally, the processing operations could be based on Article 6 (1) (f) of the Regulation. This legal basis is used for processing operations that are not covered by any of the foregoing legal considerations, if processing is necessary for the legitimate interests of our company or a third party, unless such interests are removed by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data. Such processing operations are particularly permitted because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is the client of the operator (recital 47 of sentence 2 of the Regulation).
9. Legitimate interests pursued by the operator or a third party.
If the processing of personal data is based on Article 6 (1) (f) of the Regulation, our legitimate interest is to conduct our business in favor of the welfare of all our employees and shareholders.
10. The period for which personal data will be stored
Personal data will be kept only for the period necessary for the purpose for which they were collected. After the expiration of that period, the corresponding data is deleted. Only personal data that is part of documents / documents for which the law provides a filing period will be retained and upon expiration of the legal archive term they will be destroyed.
11. Provision of personal data as a legal or contractual requirement
Required requirement to conclude a contract; Obligation of the data subject to provide personal data; possible consequences of non-fulfillment of these data
We clarify that the provision of personal data is partly required by law (eg tax regulations) or may also result from contractual provisions (for example, contractual partner information). Sometimes it may be necessary to conclude a contract under which the data subject provides us with personal data that must be processed by us. The person concerned is, for example, required to provide us with personal data when our company signs a contract with him or her.
12. Protecting personal data
BestRide applies an internal policy framework and minimum standards on the protection of personal data. These policies and standards are regularly updated to meet regulatory and market developments. In accordance with the legal provisions in force, we take appropriate technical and organizational measures (policies, procedures, security, etc.) to ensure the confidentiality and integrity of personal data and provide the necessary framework for their processing.