PERSONAL DATA PROTECTION POLICY

Identity and contact details of the controller

We are KADRA TECH S.R.L., headquartered in Romania, Cluj-Napoca, 15 Nikola Tesla Street, KADRA Building, Cluj County, tax identification number RO17696129, registered with the Trade Register under no. J12/2258/2005, e-mail: office@kadra.ro (the “Controller“, “we” or “Kadra“). As a personal data controller, through this Personal Data Protection Policy (the “Policy“) we inform you of the conditions under which we process your personal data when you visit our website or when you get in touch with us.

You can contact us at any time at:

Address: 15 Nikola Tesla Street, KADRA Building, Cluj-Napoca, Cluj County

E-mail: office@kadra.ro

This Policy has been drawn up in light of the requirements of the personal data processing legislation directly applicable in Romania, in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), and Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (“Law 506/2004″). Accordingly, the personal data we process is processed in accordance with the legal provisions mentioned above.

Purpose of this Personal Data Processing Policy

Operating the Website and interacting with you requires the processing of personal data, and the protection of that data is a priority for us.

Through this Policy, we ensure the right of every data subject (the “Data Subject“, “you“, “your“) to be fully and clearly informed about the personal data we process (collect, use, store) when they visit or access the kadra.ro website (the “Website“), as well as about the purposes of the processing, the legal grounds and the period for which we process the data. Some data allows us to identify data subjects directly (e.g. first and last name), while other personal data is less obvious (e.g. the IP address of the device used to browse the Website). However, where such less obvious data, combined with other elements, leads to the identification of data subjects, it also constitutes personal data.

Where we indicate that the processing or provision of data is necessary, failure to provide that personal data will make it impossible for you to use the Website or for us to contact you. We will not be liable if you are unable to benefit from the Website’s features or the information requested because you refused to provide this personal data.

If the information in this document is unclear, or you believe information about the processing of your personal data is missing, please let us know using our contact details. We will try to clarify any issues so that, by the time you provide your personal data, you have all the information you need and understand the conditions under which Kadra processes it.

The provisions of this Policy take precedence over other provisions in documentation issued and communicated by Kadra (e.g. the General Terms and Conditions) regarding any matters related to the processing of personal data in connection with the Website.

In general, all information collected is used for the purpose for which you sent it to us, as stated at the time of collection or in this Policy. For details on the collection and processing of cookies and other similar technologies, such as tracking codes (“cookies”), please see our Cookie Policy, available here: https://kadra.ro/politica-privind-cookie-urile-ue/. It provides details including the purposes of processing and the third parties with whom we may share data. Through some cookies, Kadra may collect certain personal data for the purposes described in Section 4 of this Policy, including:

we use your contact details to respond to requests you send us, either through the contact form or directly by e-mail or post;

we use the e-mail address you provided to send you commercial information such as newsletters, promotions and offers, if you have given your consent;

we use information collected through cookies, pixels or tracking codes to provide you with an optimised experience when using our website;

we may use your data for statistical purposes, to assess customer satisfaction with our services. Your answers are strictly confidential and will be used exclusively to improve your browsing experience on the Website and our services.

If you choose not to provide personal information when requested, you may not be able to take part in certain activities and personalised features on our websites, and you may have limited access to our services and special offers. For example, if you choose not to share your e-mail address, you will not be able to receive our newsletter or contact us through the form on the website.

However, you do not need to provide any personal information simply to browse our websites and learn more about our products.

Categories of data subjects

The individuals whose personal data we process may be:

Website visitors;
representatives of customers, suppliers or partners;
potential customers or their representatives.

KADRA’s products and services, as well as the information available on the Website, are intended exclusively for persons aged 18 or over. Kadra does not intend to process the personal data of individuals under 18 (minor data subjects). If you are under 18, please do not use the Website.

Data processed. Purposes of processing. Legal basis. Recipients

To operate the Website, sell Kadra’s products and services, and interact with you and manage your requests and complaints, Kadra carries out certain data processing activities.

Below we set out the personal data we process, the purposes for which we process it, the legal basis for the processing and the recipients with whom we (on certain occasions) share some of your data. To help you better understand these aspects, we have structured the details by each type of processing activity Kadra is involved in.

Use of the Website

Data:

When you interact with the Website (access or visit it), various information is automatically transferred between your device and our server. Depending on how you access the Website, this may include: the IP address of your internet-connected device, time zone settings and the country and city from which you access the Website, the name and URL of the file accessed, the web page from which access took place, the browser, the type and version of the device you use, the device’s operating system, the device manufacturer, the name of the mobile communications operator, Wi-Fi/Bluetooth settings, HTTP/HTTPS protocol data, and the location of the device you connect from (if geolocation is enabled).

Insofar as you have consented to geolocation in your browser, operating system or other device settings, we will use this function to offer you the Website in English if you access it from outside Romania.

Description of processing. Legal basis. Retention period

*Purpose of processing*	*Descrierea prelucrării*	*Legal basis*	*Retention period*
Website access	Ensuring the connection, access to and optimal use of the Website.	Taking pre-contractual steps/measures or performing the contract / the Website terms of use.	For the cookie retention period set out in the Cookie Policy.
Communications via the “Contact” section	Managing our communications with you through the “Contact” section of the Website.	Performing the contract with you (the Website terms of use) or steps necessary prior to entering into a contract.	5 years from our last interaction with you.

By completing the contact forms intended for potential customers or partners, you give us access to your contact details, which we will use to respond to your requests and questions.

Recipients / categories of recipients:

HubSpot, Inc.

Google LLC

Meta Platforms, Inc.

Hotjar Ltd.

Sale of Kadra products/services

Data processed: In the process of selling its products/services, Kadra, as controller, collects and processes the following personal data:

Identification data of contact persons and legal or appointed representatives of customers/partners (e.g. when steps are taken to negotiate, conclude and perform a contract with the Customer (legal entity), when handover reports are signed, or when access to the customer’s/supplier’s/partner’s premises requires identification);
Contact details of legal or appointed representatives (e.g. when sending commercial or transactional correspondence);
Signatures of legal or appointed representatives (e.g. when signing contracts, handover reports or any other documentation);
Transactional correspondence or customer support and assistance correspondence (e.g. correspondence from our interactions with you);
Feedback given by customers, or by representatives or contact persons of corporate customers, through satisfaction surveys, insofar as this feedback contains personal data and is not given anonymously.

Description of processing. Legal basis. Retention period

*Purpose of processing*	*Description of processing*	*Legal basis*	*Retention period*
Contract performance and product delivery	Drafting, negotiating and signing the contract and accompanying documents; preparing, delivering, installing and repairing products.	Performance of the contract	The term of the contract plus a maximum of 3 years.
Maintenance, customer support and assistance	Transactional correspondence; handling customer requests, notifications and complaints during ordering and product delivery; providing customer assistance and support.	Performance of the contract	The term of the contract plus a maximum of 3 years.
Product warranty and servicing	Handling requests, questions and complaints related to product warranty and servicing.	Legal obligation (for the statutory product warranty). Performance of the contract (for the commercial warranty and post-warranty servicing).	3 years from the resolution of the request, question or complaint.
Improving your browsing experience on the Website and Kadra’s services	Culegerea de opinii, realizarea de sondaje clienți și evaluarea satisfacției clienților Kadra	Legitimate interest	For the duration of the survey process/session.
Exercising your rights (where proof of identity had to be collected, it is deleted as soon as the verification has been carried out)	Managing requests to exercise your rights (logging, communicating with you, providing the requested information extracts).	Compliance with our legal and regulatory obligations	Personal data relating to your requests to exercise your rights is kept for 3 years after the request is resolved, to demonstrate compliance with our legal obligations regarding data subjects’ rights.

Recipients / categories of recipients:
ERP system providers
Google (for Google Forms services) or satisfaction survey platforms
E-mail service providers
Hosting and cloud service providers
Consultants and specialised service providers (legal, accounting, IT)
Public authorities (where required by law)

Online promotion of Kadra services and products

Kadra’s services and products are promoted online through online behavioural advertising (personalised ads based on browsing behaviour), direct marketing (commercial communications by e-mail and phone), social media remarketing (targeted ads on Facebook and LinkedIn), and analysis and optimisation using Google Analytics, HubSpot and Meta Pixel to measure performance.

Data processed: In the process of promoting its products/services, Kadra, as controller, collects and processes the following personal data:
Identification data: first and last name, e-mail address, company name, phone number and other information about you or your business – to respond to your requests regarding Kadra solutions and to send commercial communications/newsletters.
Data about your activity on the website (information about your computer and your visits to websites, such as your IP address, geographic location, browser type, referral source, length of visit and pages visited), and data collected through cookies and tracking codes (HubSpot, Meta Pixel, Google Analytics), in order to:
display personalised ads on Meta (Facebook) platforms and Google Ads for Kadra products and services that match your demonstrated interests;
create custom audiences for remarketing campaigns;
optimise the content and offers presented according to identified preferences;
measure the effectiveness of advertising campaigns and improve the marketing experience.
Log files: When you view content we provide, we automatically collect information about your computer hardware and software. This may include your IP address, browser type, domain name, internet service provider (ISP), the files viewed on our website (e.g. HTML pages, graphics), operating system, clickstream data, access times and referring website addresses. HubSpot uses this information to provide general statistics on website use. For these purposes, we link this automatically collected data to personal information such as your name, e-mail address, address and phone number.

Information we collect from third parties

From time to time, we may receive personal information about you from third-party sources, including partners with whom we offer co-branded services or carry out joint marketing activities, and publicly available sources such as social media websites.

Methods of collecting personal data:
1. Data submitted directly by the user through contact forms when requesting information/offers, subscribing to the Kadra newsletter, or via chat.
2. Collection of users’ personal data through cookies or tracking codes, if the user has consented to such collection.

Description of processing. Legal basis. Retention period

Purpose of processing	Description of processing	Legal basis	Retention period
Displaying online ads (banners, pop-ups) based on browsing interests	Analysing information about your browsing on the Website to place you in an interest group with other customers with similar browsing behaviour, and delivering ads (banners, pop-ups) to you based on those interests.	Consent (cookie) to the installation of cookies that monitor your behaviour on the Website	Until you withdraw consent for that type of cookie or the cookie storage period expires, as set out in the Cookie Policy.
Sending commercial communications and promoting Kadra services	Sending commercial communications by e-mail (newsletter), SMS, phone call, post or social media platforms.	Consent	Until you withdraw consent for the respective commercial communication channel, but no longer than 5 years from the date consent was obtained.
Scopuri statistice	Putem folosi datele dvs. in scopuri statistice, pentru evaluarea gradului de satisfactie al clientilor in raport cu experianța pe Website și serviciile noastre	Consent	Until you withdraw consent, but no longer than 1 year from the date consent was obtained.

Please note:

You can choose not to allow a cookie to be set, either through the cookie banner or by configuring/changing your browser settings directly. You can also disable cookies for all advertising services of the same provider (e.g. Google) by setting your browser to block cookies from that domain. You can easily do this from the following page: youronlinechoices.com.
You can withdraw this consent at any time, without any further obligation, with effect for the future. Details are provided in this Policy and in the Cookie Policy, which sets out in detail all aspects of cookies, including purposes, types, retention periods and the third parties with whom we share them.
Opting out of online behavioural advertising will not stop general online ads that are not tailored to your interests.
When you access the website, the “Write to us” contact option is visible. To obtain information about the solution you are looking for, you need to complete the available form.
The form asks you to enter certain details about yourself so that we can send you relevant offers and information, and you have the option of consenting to commercial communications (newsletter).
By subscribing, you will receive direct marketing specific to our line of business, through which we will keep you up to date with our products, services and campaigns, in compliance with the legal provisions in force.
We use your data to send commercial communications by e-mail (newsletter) or another communication channel of your choice only on the basis of prior, unambiguous, direct and actively expressed consent, and only for as long as you have not withdrawn consent for that channel.
You can change your communication preferences or unsubscribe from any commercial communications (withdraw consent) at any time:
for e-mail communications (newsletter): by simply clicking the “unsubscribe” link included in every commercial e-mail;
for other communication channels: by e-mailing marketing@kadra.ro.
Once you unsubscribe, we will no longer process your address to send you commercial communications. You can change your preferences at any time to receive our commercial communications (newsletter) again.
If you like our Facebook or LinkedIn page, or provide us on your own initiative with any other personal data via these social media platforms, we will receive this data without using it for any purpose other than communicating with you and, where applicable, responding to your requests.
By clicking the Website’s link buttons to social media platforms/networks, you can log in to these platforms in accordance with the policies of these third parties.
The processing of data by these third parties (e.g. Facebook, LinkedIn) for their own purposes is their responsibility, so it is important that you read their personal data processing policies, available on the respective social networks/platforms. There you will also find additional information on how to exercise your rights as a data subject regarding data processed by these social networks/platforms, directly with these responsible controllers. Kadra does not guarantee or endorse in any way the manner in which a social platform/network collects, uses or processes data/materials, or the policies/values it promotes (e.g. data processing policy, security measures, etc.).

Recipients / categories of recipients: We share your e-mail address with our partners who provide promotion services and display banners/pop-ups on the Website, and who process data in accordance with the data processing policies available on their websites.
1. HubSpot, Inc.

Google LLC

Meta Platforms, Inc.

Hotjar Ltd.

LinkedIn Corporation

Social media features

Our websites include social media features, such as the Facebook Like button and widgets. These features may collect your IP address and the page you are visiting on our websites, and may set a cookie to enable the feature to function properly.

External websites

Our websites provide links to other websites. We do not control and are not responsible for the content or practices of these other websites. Providing such links does not constitute our endorsement of these websites, their content, owners or practices. This privacy policy does not apply to these other websites, which are subject to any privacy and other policies they may have.

Public forums

Our website offers areas where you can leave messages that are accessible to the public. Please note that if you disclose information directly in these public areas, it may be collected and used by other users. We will correct or delete any information you have posted on the websites if you request this, as described in “Opting out and unsubscribing” below.

Audits and reporting / proceedings and investigations by authorities and/or judicial bodies

Data: first and last name, address, e-mail, phone number, invoices, orders and contractual correspondence that we hold under this Policy.

Description of processing. Legal basis. Retention period

Purpose of processing	Descrierea prelucrării	Legal basis	Retention period
Audits, tax returns	Documenting, presenting and processing audit-related data	Legal obligation	For tax documents, 10 years from the following financial year
Requests/investigations by authorities/institutions	Documenting, presenting and processing investigation-related data	Legal obligation	Until the completion of the related proceedings and/or the implementation of final decisions of the courts/public authorities

Recipients / categories of recipients:

When acting as data controller, as a rule we do not share data for the above purposes with third parties other than the relevant authorities/entities.

Defending the controller’s rights in court

Personal data: data related to the performance of the contract and other personal data we hold under this Policy.

Description of processing. Legal basis. Retention period

Purpose of processing	Descrierea prelucrării	Legal basis	Retention period
Defending Kadra’s rights in court / before authorities / supervisory institutions	Exercising any of Kadra’s defences/rights before courts or public/supervisory authorities or institutions (recovering amounts owed, or protecting our interests against claims/complaints), through steps such as filing statements of defence, written submissions, applications and specific litigation documentation.	Kadra’s legitimate interest	3 (three) years from the end of our contractual relationship, or until the completion of the related proceedings / resolution of your complaints and/or implementation of final decisions of the courts/public authorities

Recipients / categories of recipients: When acting as data controller, as a rule we do not share data collected for the above purpose with third parties. We may share data with carefully selected providers of legal assistance and representation services, who are bound by confidentiality obligations in accordance with the law.

Business transfers / corporate transactions

Personal data relating to the customer account, invoices, orders placed and the fulfilment of purchases/orders, and other personal data we collect and hold during our contractual relationship with you under this Policy.

Description of processing. Legal basis. Retention period

Purpose of processing	Description of processing	Legal basis	Retention period
Administering, expanding or developing the business	(i) in the event of a business transfer (we sell part of the business or certain assets), an acquisition/merger/demerger, or a reorganisation/restructuring/change in corporate governance relating to the company/Website – in which case it may be necessary to disclose your data to the potential buyer of the respective business activities, assets or shares in order to carry out the transaction; (ii) if Kadra (or a substantial part of its assets/shares) is acquired by a third party or is subject to any reorganisation (merger, demerger, etc.).	Kadra’s legitimate interest	Until the termination of Kadra’s rights and obligations regarding the business transfer/acquisition/merger/demerger, any reorganisation, restructuring, change in corporate governance, etc.

Recipients / categories of recipients: We may need to share your data with the potential buyer, including consultants/specialists such as auditors, on the basis of any agreements that may be required (e.g. a data processing agreement for the purposes of the transaction), but always subject to confidentiality obligations firmly assumed by these recipients, including a commitment to apply the security measures necessary to protect your data. Data will also be sent to our consultants/specialists, subject to confidentiality and data security obligations.

Who we share your personal data with

As a matter of principle, we do not transfer data to third parties.

Sometimes the transfer of data is necessary, but it will only take place to fulfil the purposes, or to ensure compliance with the legal obligations, explicitly detailed in the sections above.

(a) In certain circumstances, to fulfil the purposes mentioned above, we will share your data with our partners. In such cases, certain data is processed at our request by these partners, who act as our processors and with whom we have a contract to that effect. They are carefully selected, audited by us and contractually bound in accordance with Article 28 GDPR. When we share data with our partners, we require them to protect it through strict data security measures and to use your data only in accordance with our precise and clear instructions, specifying exactly which personal data they may process, the purposes of processing, and the manner of processing, storage and retention. Our partners are not authorised under any circumstances to use your data for their own purposes, or for any purposes or in any manner other than those specifically entrusted to them by us.

We choose our partners (those we collaborate with in various areas) and suppliers (those who perform certain functions/operations/activities on our behalf or for us) carefully and rigorously, and we share with them only the data strictly necessary for the services we entrust to them.

(b) We work with a number of partners whose products and/or services we sell. Sometimes we share your data with these partners: (i) to issue warranty/quality certificates, or (ii) to resolve complaints regarding products and/or services.

(c) We may use third-party service providers for certain activities necessary to fulfil the purposes mentioned above. These include, for example: companies that provide data storage services on external servers (or in the cloud), companies involved in preparing and/or delivering goods and/or services, and companies that support our marketing activities.

Given Kadra’s contractual obligations towards these partners and/or suppliers, and to protect ourselves from competition, we cannot disclose the names of all these partners and suppliers. We assure you, however, that we have chosen them carefully and rigorously, and we continuously ensure – through the specific obligations they assume contractually, through verification and audit mechanisms, and through clear and firm working instructions – that they meet our standards for protecting your personal data and implement appropriate IT security measures to protect it, including maintaining the highest degree of confidentiality.

(d) Public authorities/judicial bodies. We may transmit some of your personal data to the competent public authorities or institutions where this is required by the relevant legal provisions (e.g. fraud investigations, investigating and/or preventing money laundering, filing tax returns), or we may use the data to bring legal action or mount a defence in court to protect our rights.

(f) Mergers and acquisitions / business transfers. If we decide in the future to sell Kadra’s shareholdings or business (assets and liabilities, etc.), we will transmit your data to / provide access to it for potential buyers or successor companies, in order to carry out the analyses and audit necessary for the acquisition of the shareholdings/business (assets and liabilities, etc.) and to structure and implement the transaction. In this regard, we will ensure that any potential buyer has the security measures necessary to protect your data, and a data protection agreement will be signed for this purpose.

(h) When you exercise your rights regarding the personal data we process, you yourself are the recipient of that personal data (we share this data with you).

How long we keep your personal data

Except for the periods specifically mentioned in this Policy, we will retain and keep your data only for as long as is actually necessary to fulfil the purposes set out in this Policy.

To show that we care about your data and your rights regarding it, we enable you to exercise the right to erasure of personal data in accordance with the erasure procedure described in the “Rights” section.

For purposes for which you have consented to the collection and use of personal data (in accordance with this Policy), we will process your data for that purpose until you withdraw your consent to processing for that purpose. However, we will retain the strictly necessary data if we are required to keep it in order to: (i) fulfil legal obligations, (ii) defend our rights in court, or (iii) report to the competent authorities.

Documents containing your personal data issued for/in the performance of obligations relating to a product purchase will be kept for as long as necessary for that purpose and in accordance with the legal provisions.

How we keep your personal data

Security measures taken by Kadra

Kadra implements the technical and organisational measures necessary to collect, process and store data securely, including against unauthorised access and use. These measures include:

– Specific IT security means, e.g. firewalls that protect Kadra’s networks and IT infrastructure;

– Access to your data is strictly limited to those people within Kadra who need it to fulfil the purposes set out in this Policy, according to their responsibilities/duties;

– Appropriate administrative and organisational measures to ensure that people with access to the data maintain confidentiality, through training and individual assumption of responsibilities, including the signing of specific confidentiality contracts/clauses by both Kadra employees and Kadra’s partners/suppliers;

– Security of the premises where the servers storing your data are located, through specific physical security measures;

– Security of electronic and physical documentation relating to the performance of product and/or service supply contracts;

– Periodic review of data collection, processing and storage processes and procedures.

Transfer of data to a third country

If we transfer your personal data outside the European Economic Area (EEA) – in the situations described in this Policy – such a transfer will only take place if the European Commission has recognised an adequate level of data protection for the third country concerned, if we have agreed an adequate level of protection with the data recipient (e.g. through the European standard contractual clauses), or if you have given us your consent – in any case, in compliance with the conditions and safeguards required by the GDPR. You can obtain more information about the list of third countries to which we may transfer your data, as well as the transfer safeguards implemented, using Kadra’s contact details for data protection matters.

Data subjects’ rights regarding personal data

Because we are committed to protecting data subjects’ rights, we would like to inform you that you have a number of rights under the GDPR. We want to assure you that Kadra will respect these rights fully, promptly and in the most professional manner.

Social media platforms and search engines give you the direct ability to manage how they process, use and share your data. We encourage you to review the features these operators offer and manage their processing of your data according to your own decisions and interests, by reviewing their data processing policies.

If you would like more details about your rights regarding your personal data in relation to Kadra, you can contact us as described below. We will try to respond to your requests without delay and no later than 30 (thirty) calendar days (or within another reasonable period, under the conditions of the GDPR). To make sure that you are the owner of the data in respect of which you are exercising your rights, we may ask you for certain information/data to verify your identity, or for more details about your request. We also inform you that we may keep our correspondence with you in order to fulfil our specific obligation to keep records of your requests regarding Kadra’s processing of personal data.

We will not charge any fee for responding to/acting on your requests to exercise a right, unless you exercise that right excessively. Also, if you ask us for a written copy of your data, we will provide the first copy free of charge and may charge a reasonable fee for further copies.

If we have a legal basis to do so (e.g. your request is manifestly unfounded or excessive, in particular because of its repetitive nature), we may refuse your request, in which case we will tell you the reasons for the refusal.

We will respond to your request through the channel you used to contact us (e-mail, phone, post) or the one you specify in your request. To help us handle your requests efficiently and promptly, please make the subject line of your written e-mail request as descriptive as possible (e.g. “personal data portability”, “access request”).

The right to be informed is ensured through this data processing Policy.
The right of access to data

Through this Policy we provide details about the data, the purpose and the manner in which we process your data.

However, you may ask us at any time to confirm what data we collect and process about you, and you may request access to your data and the following information about it: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients to whom the data has been or will be disclosed; the envisaged period for which the data will be stored, or the criteria used to determine it; the existence of the right to request rectification or erasure of your data, restriction of processing or to object to processing; the right to lodge a complaint with the supervisory authority; the source of any data obtained from third parties; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing.

To exercise your right of access, you can send us your request easily and quickly via the contact form or by e-mail: contact@kadra.ro.

The right to object to the processing of data for certain purposes

If you wish to object to the processing of data based on our legitimate interest, we may nevertheless continue processing if we can demonstrate compelling legitimate grounds for further processing that override your interests, rights and freedoms, or if the purpose of further processing is the establishment, exercise or defence of legal claims.

You can object directly at any time, unconditionally, by sending a written request using the contact form or by e-mail: contact@kadra.ro. We will act on your request without delay and respond within the stated time frame.

The right to withdraw consent

If we process your data based on your consent, you can withdraw your consent at any time, and Kadra will no longer process your data for that purpose, unless Kadra can base further processing on another legal ground, in which case we will inform you as soon as possible and provide all relevant details.

You can withdraw your consent by sending a written request using the contact form or by e-mail: contact@kadra.ro. We will act on your request without delay and respond within the stated time frame.

The right to erasure (“right to be forgotten”)

You have the right to ask us to erase your data in any of the following situations: (i) the personal data is no longer necessary for the purposes for which we collected or processed it; (ii) you withdraw the consent on which we process your data and there is no other legal ground for further processing; (iii) you object to processing based on our legitimate interest and we cannot demonstrate compelling legitimate grounds that justify the processing and override your interests, rights and freedoms; (iv) you object to the processing of data for direct marketing purposes; (iv) the personal data has been processed unlawfully; (v) the personal data must be erased to comply with our legal obligations.

We may refuse your request for erasure only where: (i) we are required to comply with legal obligations; or (ii) it is necessary for the establishment, exercise or defence of our legal claims.

You can contact us to exercise your right to erasure easily and quickly via the contact form or by e-mail: contact@kadra.ro.

In addition, if your data is erased, we will inform our partners/suppliers with whom we carry out certain activities / who are authorised to process data on our behalf to erase any links to, copies or reproductions of that data.

The right to restriction of processing

You have the right to obtain from us the restriction of processing of your data in the following situations: (i) you contest the accuracy of the data we process – in which case we will restrict processing for the period during which we verify the accuracy of the data; (ii) the processing is unlawful and you request only the restriction of its use (and oppose its erasure); (iii) although we no longer need your data for the purposes of processing, you require it for the establishment, exercise or defence of legal claims; or (iv) you object to processing where we rely on a legitimate interest – for the time it takes us to verify whether our legitimate grounds override your rights and freedoms.

In these situations, we will refrain from processing your data (except for storing it), so that it is not subject to any further processing. If we have already shared your data with our partners/suppliers by that time, we will notify them immediately of the restriction of processing, after first consulting you.

We may continue to process your data only if: (i) any of the situations described above is resolved, (ii) you consent to further processing, or (iii) such processing is necessary for the establishment, exercise or defence of our legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of our country.

The right to rectification

You have the right to obtain from us the rectification of your data if you find that the data we process is incorrect, incomplete or inaccurate. You can request the change from Kadra via the contact form or by e-mail: contact@kadra.ro.

We will correct your data without undue delay. Where we have justified grounds for not acting on your request, we will explain the reasons for this decision.

The right to data portability

You have the right to request the transfer of your data held by us (i) to you, or (ii) to another controller you designate. The second option means you can ask us to transfer your data to another data controller.

More specifically, you can request the portability of any personal data you have actively provided to us. You have the right to portability only if we process this data based on your consent or in the performance of the contract between us.

In practice, you can request the portability of your data by submitting a written request or using the contact form.

To help us handle your requests efficiently and promptly, please make the subject line of your e-mail request as descriptive as possible (e.g. “personal data portability”).

We will respond to your request as soon as possible and no later than 30 (thirty) calendar days from the date we receive it. In the case of portability, we will send the requested data in a structured format that allows it to be reused (e.g. XML, JSON, CSV).

Before sending any data, we will identify you, and if we have reasonable doubts about your identity, we may ask you to provide (and you must provide) additional information to enable us to identify you.

The right to lodge a complaint with ANSPDCP

You have the right to lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) if you believe we are infringing your rights regarding the processing of your personal data.

You may also address various questions to ANSPDCP, the data protection supervisory authority in Romania. You can find guides and guidelines regarding your rights on the authority’s website: http://www.dataprotection.ro/.

You can lodge complaints with ANSPDCP about how we process your data. However, we hope you will choose to discuss the matter with us first, before lodging any complaint with ANSPDCP. The security of your data is extremely important to Kadra, and we will take all necessary measures to resolve, as efficiently as possible, any concerns you have about how Kadra processes your data.

Questions and requests regarding the protection of your personal data

The Kadra team is available for any questions, clarifications or details you need regarding this Policy and Kadra’s processing of your data. You can also contact us with any suggestions or comments about this Policy or how we collect and use your data at: contact@kadra.ro.

Changes to this Policy

Kadra may amend/update this Policy at any time, at its own discretion, and will make the updated versions available to data subjects.

Applicable definitions

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
“Recipient” means a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not;
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action
“EU Regulation” / “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

+4 0737 975 305

Solutions

Industries

Products

PERSONAL DATA PROTECTION POLICY

CLUJ-NAPOCA - Nikola Tesla Street No. 15, Tetarom I

BUCHAREST - Dudești-Pantelimon Road no. 42

TIMISOARA - CloșCa Street, No. 66

0737 975 305

Contact@Kadra.Ro