Dear Partners/Clients,

As of May 25, 2018, the provisions of the European Regulation on the protection of personal data (“General Data Protection Regulation – GDPR”) apply. These ensure increased security and protection for your personal data. Please grant us your assistance and consent so that we can correctly implement these provisions.

Starting May 25, 2018, in order for us to provide our services—namely, to continue sending you offers regarding apartments for sale, as well as any other real estate transactions that may be of interest to you, along with news, campaigns, and invitations to various events—we are required to obtain your explicit consent.

For later unsubscribing, you may exercise your right to withdraw this consent by submitting a request to that effect.

PERSONAL DATA PROTECTION POLICY – GDPR Policy

The new European Union law on the protection of personal data, the GDPR (“General Data Protection Regulation”), entered into force on May 25, 2016, but will begin to produce effects as of May 25, 2018. This law represents the most significant change in the field of personal data protection in the last 20 years and has objectives that go far beyond the simple protection of privacy.

The protection of your personal data is important to us; therefore, we pay special attention to safeguarding the privacy of visitors who access the website www.sudrezidential.ro, as well as those whose personal data have been provided to us by a third party or to which we have had access from another source, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”).

Please pay close attention to the reading of the following Policy (hereinafter referred to as the “GDPR Policy”) in order to understand how your information (“personal data”) will be treated.
The GDPR Policy explains the practices of SudRezidential Real Estate S.R.L. (hereinafter “Sud Rezidential”) regarding the application of GDPR provisions, as well as the rights you enjoy concerning how your information is processed by Sud Rezidential.

The processing of personal data carried out by Sud Rezidential will always be performed in accordance with the GDPR provisions, as well as with the regulations on personal data protection.
Through the GDPR Policy, Sud Rezidential aims to inform data subjects about the nature of the personal data we collect and process, as well as the purposes of processing. In addition, data subjects are informed through the GDPR Policy about the rights they benefit from.

WHO WE ARE

We are SUDREZIDENTIAL REAL ESTATE S.R.L., a Romanian legal entity with registered office in Popesti-Leordeni, Soseaua Oltenitei no. 45, unit no. 5, attic, lot 3/1/1, Lot 2, Room 2, Ilfov County, registered with the Trade Registry under no. J23/1776/2013, Tax Identification Code RO31810333. Our main field of activity is “Real estate agencies,” CAEN code 6831, and our legal representative is the administrator, Grigore Catalin.
Sud Rezidential acts on behalf of the real estate developers with whom it has representation and real estate intermediation contracts, being their authorized agent in relation to you. Sud Rezidential does not enter into a commercial relationship with individuals wishing to purchase a real estate asset, except in exceptional cases, such as the resale of an apartment or the rental of a real estate asset.

In turn, Sud Rezidential carries out its activity through several external collaborators (real estate advisors) who act as agents, respectively sub-agents, of the real estate developers.

WHAT IS PERSONAL DATA?

“Personal data” means any information or set of information that can identify you directly (for example, your name) or indirectly (for example, through pseudonymized data, such as a unique identification number). This means that personal data include things like your first and last name, email address, home address, mobile phone number, data on the copy of your identity card, civil status data, username, profile photos, personal preferences and shopping habits, user-generated content, financial information and information regarding your financial situation. This could also include unique numerical identifiers, such as the IP address of your computer or the MAC address of your mobile device, as well as cookies.

WHAT DOES PROCESSING OF PERSONAL DATA MEAN?

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

WHAT PERSONAL DATA OF YOURS DO WE PROCESS?

The personal data of yours that will be processed are the following: first name, last name, domicile/residence, identity card series and number, marital status, Personal Numerical Code (CNP), age, citizenship, date of birth, phone number and email, data resulting from property documents (including from the history of properties, as well as from Land Registry excerpts pertaining to properties you own).

PERSONAL DATA CONTROLLER

The controllers of personal data (hereinafter the “controller”) are the real estate developers, in most cases Sud Rezidential acting only as their processor, considering Sud Rezidential’s representation mandate with the real estate developers. By exception, in certain situations established by the Regulation, Sud Rezidential also acts as a personal data controller.

PRINCIPLES OF DATA PROCESSING

Sud Rezidential undertakes to comply with the principles of personal data protection (hereinafter the “Principles”) provided by the GDPR, to ensure that all data are:

• Processed fairly, lawfully, and transparently;
• Collected for specified, explicit, and legitimate purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and kept up to date;
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of the processing;
• Processed in accordance with the rights of the data subject, in a manner that ensures an appropriate level of security of the processing so that the data are integral, confidential, and available.

LEGAL BASIS AND PURPOSES OF PROCESSING PERSONAL DATA

For the purpose of concluding and performing contracts – Under Article 6(1)(b) GDPR, personal data may be processed for the purpose of concluding or performing the reservation agreement, the preliminary sale-purchase agreement, and the sale-purchase contract or for other types of real estate transactions. In order to offer you our products and services, we need to process personal data belonging to you.

For the purpose of fulfilling legal obligations – Under Article 6(1)(c) GDPR, personal data may be processed for the purpose of fulfilling legal obligations. We request a series of personal data, including, in certain situations, the Personal Numerical Code, for the purpose of fulfilling our obligations imposed by the tax authorities in connection with invoicing and reporting to tax authorities.

For marketing purposes – Under Article 6(1)(a) GDPR, personal data may be processed if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Thus, in certain cases, your personal data will be used for the purpose of sending you marketing messages, offers, news, future campaigns, and invitations to various events.

For the purpose of fulfilling our business object – Under Article 6(1)(a) GDPR, personal data may be processed if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Thus, we may contact you or transmit your personal data for the purpose of carrying out our business object.

For the purpose of fraud and crime prevention, Sud Rezidential records video both inside and outside its headquarters and sales offices, without transmitting or disclosing these recordings to other persons, except to the competent state authorities.

PROCESSING THE CONTACT FORM

Sud Rezidential will use the information you provide in the contact section on the website solely for the purpose of processing your request.

By providing any personal data via the website www.Sud Rezidential.ro, you understand and agree that your data will be processed in accordance with the provisions of the GDPR Policy.

Please note that in order to process your requests submitted in the website’s contact section, it may be necessary, in certain circumstances, to disclose your data to partners with whom Sud Rezidential collaborates and/or to other third-party service providers of Sud Rezidential.

Nevertheless, Sud Rezidential has adopted appropriate technical and organizational measures to ensure the security of data transfer, as well as the processing of your data by the aforementioned entities in accordance with GDPR requirements.

Sud Rezidential undertakes not to process the personal data provided for any purpose other than that for which they were transmitted, except where we have your express consent to use them for other purposes as well.

It is also possible that Sud Rezidential may have access to other personal data through your establishing a connection with Sud Rezidential, by processing data communicated as a result of telephone conversations, email conversations, visits to our headquarters to obtain information, etc.

By contacting Sud Rezidential in any of the ways stipulated above or any other method involving mediated or direct communication between you and Sud Rezidential, you understand and agree that your data will be processed in accordance with the provisions of the GDPR Policy.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

Personal data processed by Sud Rezidential may be disclosed and/or transferred to third parties only where we have your express consent to do so, except in situations where there is a legal/contractual obligation for Sud Rezidential to proceed in this way.

Sud Rezidential will transmit your personal data to notary offices, banking and non-banking financial institutions, credit intermediaries, public authorities, judicial bodies, external consultants to whom we have outsourced the provision of certain services, and other categories of recipients, exclusively in Romania.

Please note that in certain circumstances we may be required to disclose your personal data to partners with whom Sud Rezidential collaborates and/or other third-party service providers of Sud Rezidential.

PROCESSING OF DATA BY THIRD PARTIES, OTHER WEBSITES AND SPONSORS

The Sud Rezidential website may, at times, contain links to other websites whose data processing policies may differ from those of Sud Rezidential.

Please consider and consult the personal data protection policies of the other websites, as SUD REZIDENTIAL does not assume responsibility for the information sent or collected by these third parties.

AUTOMATED DATA PROCESSING. COOKIES

The website www.sudrezidential.ro uses Cookie-type identifiers. In this regard, you can consult our Cookie Policy, available on the website, and you may exercise your right to disable Cookies, as specified below.
Please consult the separate Cookie Policy for more information.

DATA RETENTION PERIOD

SUD REZIDENTIAL may retain processed data for various periods deemed reasonable, in accordance with the purposes indicated above. We retain your data only for the period necessary to achieve the purpose for which we hold the data, to meet your needs, or to fulfill our legal obligations.

To determine how long your data may be retained, we use the following criteria:

• When you acquire property rights, we retain your personal data for the duration of our contractual relationship and thereafter for the period established by financial–accounting rules, namely for a period of 10 years;
• If you participate in a promotional offer, we retain your personal data for the duration of the promotional offer;
• If you contact us with a question, we retain your personal data for the time necessary to process your queries, but no longer than 10 years from the last correspondence sent;
• If you create an account, we retain your personal data until you request their deletion or after a period of inactivity (without active interaction with us). In this regard, we note that the data processed for this purpose will be deleted 10 years after the last interaction with the account user (for example, login to your account);
• If you have given your consent for marketing, we retain your personal data until you unsubscribe or request deletion, or after a period of inactivity (without active interaction with our brands) defined in accordance with local regulations and guidelines. In this regard, we note that the data stored in our databases for the purpose of direct marketing communications are deleted from the records of these databases 10 years after your last interaction;
• If cookies are stored on your computer, we retain them for as long as necessary for them to fulfill their purposes (for example, for the duration of a session for shopping cart cookies or session ID cookies) and for a period defined in accordance with local regulations and guidelines. In this regard, we note that data processed through cookies used to deliver online behavioral advertising, to personalize our services for you, and to enable the sharing of our content on social networking sites (share buttons displayed on the website), will be retained for a maximum period of 10 years from their collection, based on your consent.

RIGHTS OF DATA SUBJECTS

In accordance with the GDPR, you have a number of rights regarding the personal data that SUD REZIDENTIAL S.R.L. processes:

1. Right of access to processed data – You have the right to access the personal data we hold. The first provision of information will be made free of charge. If you need additional copies of information already provided, we may charge a reasonable fee based on administrative costs. Manifestly unfounded, excessive, or repetitive requests may not receive a response.
2. Right to rectification – You have the right to request that your data be rectified if they are inaccurate or outdated and/or to complete them if they are incomplete. If you have an account, it may be easier to correct your own data via the “My Account” function.
3. Right to erasure (“right to be forgotten”) – In some cases, you have the right to obtain the deletion or destruction of your data. This is not an absolute right, as we may sometimes be forced to retain your data for legal or legitimate reasons.
4. Right to restriction of processing – You have the right to request the restriction of the processing of your data. This means that the processing of your data is limited, so that we can store the data but not use or process them. This right applies in specific circumstances provided by the GDPR, namely:
   – the accuracy of the data is contested by the data subject (i.e., by you), for a period allowing the controller (i.e., SUD REZIDENTIAL) to verify the accuracy of the data;
   – the processing is unlawful and the data subject (i.e., you) opposes the erasure of the data and requests the restriction of their use;
   – the controller (for example, SUD REZIDENTIAL) no longer needs the data for processing, but they are required by the data subject (i.e., you) for the establishment, exercise, or defense of legal claims;
   – the data subject (i.e., you) has objected to processing based on the controller’s legitimate interests (in this case SUD REZIDENTIAL), pending verification of whether the controller’s legitimate grounds (SUD REZIDENTIAL) override those of the data subject (i.e., you).
5. Right to data portability – You have the right to move, copy, or transfer the data that interests you from our database to another. This applies only to data you have provided when processing is based on your consent or on a contract and is carried out by automated means.
6. Right to object – You may object at any time to the processing of your data when such processing is based on a legitimate interest.
7. Right to withdraw consent at any time – You may withdraw your consent regarding the processing of your data when such processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
8. Right to lodge a complaint with the competent supervisory authority – You have the right to lodge a complaint with the data protection authority in your country of residence or domicile to challenge the data protection practices offered by SUD REZIDENTIAL.
9. Right to object to the processing of your data for direct marketing purposes – You may unsubscribe from or opt out of our direct marketing communication at any time. The easiest way to do this is by clicking the “unsubscribe” link in any email or communication we send you.
10. Right to object to the processing of your data by us when we carry out actions in the public interest or in our own legitimate interests or those of a third party – You may object at any time to the processing of your data when such processing is based on a legitimate interest.
11. Right to disable Cookies – You have the right to disable cookies. Internet browser settings are usually set by default to accept cookies, but you can adjust them easily by changing your browser settings. Many cookies are used to enhance the usability or functionality of websites/applications; therefore, disabling cookies may prevent you from using certain parts of our websites or applications, as detailed in the relevant Cookie table. If you wish to restrict or block all cookies set by our websites/applications (which may prevent you from using certain parts of the site) or any other websites/applications, you can do so through your browser settings. Your browser’s Help function will tell you how. For more information, please consult the following links: http://www.aboutcookies.org/

You can exercise any of these rights regarding the personal data that SUD REZIDENTIAL processes by submitting a simple request to SUD REZIDENTIAL’s DPO. In such a situation, we may request proof of your identity.

LEGAL REQUESTS

We access, retain, and provide your information to regulators, law enforcement, or other entities:

1. In response to a legal request, when we, in good faith, believe that the law requires us to do so. We may also respond to legal requests when we, in good faith, believe that the response required by the laws of the respective jurisdiction affects users in that jurisdiction and is consistent with internationally recognized standards.
2. When we, in good faith, believe it is necessary to: detect, prevent, and respond to acts of fraud; the unauthorized use of any material belonging to us; violations of our terms or policies; or other harmful or illegal activities; to protect us (including our rights, property, or materials), you, and others, including within investigations or inquiries by regulatory authorities; or to prevent imminent death or bodily harm. For example, where relevant, we provide information to and receive information from third-party partners regarding the reliability of your account, in order to prevent fraud, abuse, and other harmful activities within and outside our materials.
   The information we receive about you may be accessed and stored for a longer period of time when it is the subject of a legal request or legal obligation, a government inquiry, or investigations into possible violations of our terms or policies, or in other cases to prevent harm.

RELATIONSHIPS WITH OTHER CONTROLLERS

Depending on the context, we may find ourselves in the absolute necessity of providing information at a higher level—both globally and internally or externally—to our partners and those with whom we carry out data transfers in compliance with the GDPR, in order to ensure the most professional services possible. The information controlled by SUD REZIDENTIAL S.R.L. may be transferred, transmitted, or stored and processed in the EU or in countries other than the one in which you reside, for the purposes described in this policy. These data transfers are necessary in order to provide services at the highest level and to continue delivering our materials at the best professional standard. We use standard contractual clauses approved by the European Commission and rely on adequacy decisions issued by the European Commission with regard to certain countries, as applicable, for transfers of data from the EEA to the United States and to other countries.

SECURITY OF PROCESSING

SUD REZIDENTIAL has adopted technical and organizational data-processing measures, updated in accordance with GDPR requirements, with the aim of protecting your personal data against any actions of unauthorized access, misuse or disclosure, unauthorized alteration, destruction, or accidental loss. All SUD REZIDENTIAL employees and collaborators, as well as any third parties acting on behalf of and for SUD REZIDENTIAL, are required to respect the confidentiality of your information and the GDPR requirements, in accordance with the provisions of the GDPR Policy.

DISCLAIMER

The SUD REZIDENTIAL website may contain links to other websites and/or other web pages that are not owned by SUD REZIDENTIAL. SUD REZIDENTIAL assumes no responsibility for the content of these websites and therefore cannot be held liable for the content, advertising, goods, services, software, information, or other materials available on or through these websites. SUD REZIDENTIAL shall not be liable for the loss of personal data, any negative effects on visitors’ personal data, or other moral and/or material damages caused by accessing those websites.

UPDATING THE PERSONAL DATA PROTECTION AND PROCESSING POLICY

Please note that this Policy may be subject to periodic content changes by updating the SUD REZIDENTIAL website.

Please do not continue to use the SUD REZIDENTIAL website if you do not agree with such changes. We also recommend that you check this page for any updates.

The terms of the GDPR Policy are interpreted in accordance with the applicable legislation.

CONTACT

If you have questions or concerns regarding how we handle and use your personal data, or you wish to exercise any of your rights, you can write to us at the email address contact@surezidential.ro or call the Call Center phone number – 0729 572 570. With regard to the processing of personal data, you can also contact the Data Protection Officer (DPO) designated by Sud Rezidential at the email address: dpo@rocg.ro.

You may exercise your right to lodge a complaint by sending it to the Romanian Supervisory Authority for Personal Data Processing (ANSPDCP) at the following contact details: Bd G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest, postal code 010336, phone +40.318.059.211, email: anspdcp@dataprotection.ro