Terms and conditions and privacy policy.

1 Introduction

NELIT EVOLUTION SRL, hereinafter referred to as the CONTROLLER, is committed to protecting the confidentiality and privacy of the information entrusted to it. As part of this fundamental obligation, the CONTROLLER undertakes to protect and make appropriate use of the personal information (hereinafter referred to as "personal data") that has been collected both in electronic and in physical form.

We hereby inform you about the processing of your personal data and about your rights in accordance with the provisions of Regulation (EU) 2016/679 – the General Data Protection Regulation ("GDPR"), with the Law implementing the provisions of the GDPR, as well as with any other decisions that may be issued by the National Supervisory Authority for Personal Data Processing regarding the protection of personal data.

In general, our intention is to collect only the personal data provided voluntarily by clients, business partners, employees, potential employees, collaborators or online visitors of our website, so that we can provide services, carry out contractual relationships, promote our services and offer information about employment opportunities.

In addition, in order to be able to provide the services agreed with clients or to comply with various legal obligations, we inform you that certain personal data is necessary to us.

Please consult this privacy policy (hereinafter referred to as the "Privacy Policy") to find out more about how we collect, use, share and protect the personal data we have obtained.

2 The legal basis on which we must use your personal data

In general, the CONTROLLER collects only the personal data necessary to satisfy your request. Where additional optional personal data is required, you will be notified of this circumstance at the time of collection.

The law allows us to process personal data as long as we have a legal basis for doing so. Consequently, when we process your personal data, we will rely on one of the following conditions regarding processing:

• Entering into a contract: where the processing of your personal data is necessary for us in order to take steps, at your request, to enter into a contract;
• Performance of a contract: where the processing of your personal data is necessary in order for us to fulfil the obligations arising from a contract;
• Legal obligation: where we are obliged to process your personal data in order to comply with a legal obligation, such as keeping records for tax purposes or providing information to a public authority or a law enforcement institution;
• Legitimate interests: we will process personal data about you where this is in our legitimate interest, in the course of carrying on a business in accordance with the provisions of the law, in order to continue conducting it, as long as it does not override your interests; or
• Your consent: in certain cases, we will ask for your specific permission to process some of your personal data and we will process your personal data in this way only if you agree that we may do so. You may withdraw your consent at any time by contacting the CONTROLLER at the e-mail address nely_ilie@yahoo.com or the outsourced DPO (data protection officer), the company SEDRYA INFORSEC SRL, at the address office@inforsec.ro.

Examples of the "legitimate interests" mentioned above are:

• Providing information and/or services to persons who visit our website, or providing information about employment opportunities.
• Preventing fraud or criminal activity and protecting our IT systems.
• Personalising the online experience of individuals and improving the usability and the effectiveness of the performance related to the online presence of the CONTROLLER.
• Fulfilling our corporate and social responsibility obligations.
• Exercising our fundamental rights in the EU under articles 16 and 17 of the Charter of Fundamental Rights, including our freedom to conduct a business and the right to property.
• Maintaining the security of the CONTROLLER's premises and staff.
• Carrying out risk management procedures.

3 Processing of personal data in the context of the provision of professional services, business activities and employment relationships

3.1. Categories of personal data subject to processing

The categories of personal data that may be processed by the CONTROLLER are the following:

• Identification or contact personal data, such as name, date of birth, nationality, identity card series and number, personal numeric code (CNP or other), place of birth, photograph, home address, residence or correspondence address, e-mail address, telephone number, etc.;
• Personal data regarding professional training, such as certificates/attestations/diplomas of studies and/or of completion of professional training courses;
• Location data, such as remote internet connection location data of users (remote desktop), vehicle location data (GPS);
• Financial data, such as the bank account number or other details for payments, salaries, benefits, shares, etc.;
• Civil status or personal data relating to the family, such as the number of children or of other dependants;
• Electronic identification data, such as the IP address, cookies, "web beacons" technologies, as detailed in Section 4 below;
• Video data or another type of data in connection with visitors to the CONTROLLER's premises.

In some cases, the personal data we collect will also include special categories of data, such as information relating to diversity (including data about racial and ethnic origin, political opinions, religious beliefs and other beliefs of a similar nature, trade union membership and data about sexual life and sexual orientation) or data concerning health and data about alleged or proven offences, in each case where this is permitted by law.

With regard to the special categories of data that we may process, we inform you that the legal basis on which we may rely is your consent, the legal obligation incumbent on us to process such data, or the processing is necessary for the establishment, exercise or defence of a legal claim.

3.2. Categories of data subjects and the purposes of processing personal data

Website visitors

As detailed in Section 4 below.

Business partner contact details

The CONTROLLER collects and processes the personal data of potential, current as well as former business partners, together with contact details obtained directly from such data subjects or from third parties, for the purpose of maintaining, establishing and renewing communication with business partners either on the basis of consent or of legitimate interest.

Clients and data subjects associated with clients

The CONTROLLER collects and processes the personal data of clients or the personal data of representatives, contact persons, client staff, including collaborators, including but not limited to the following purposes: the provision of professional services – in order to enter into, perform and terminate contractual relationships; fulfilling the mandatory risk management formalities – in order to implement an effective global/regional risk assessment process that monitors and identifies solutions for mitigating key risk areas, in order to develop a culture of ethics and compliance that observes the core values of the CONTROLLER, in order to protect its brand and reputation and in order to act in accordance with the ethical and professional standards expected of a provider of professional services; for the provision, on the basis of clients' consent, of newsletter materials and/or other marketing materials – in this respect the CONTROLLER periodically provides business contacts with newsletter materials, information regarding the professional services and products of the CONTROLLER, our events and activities, etc.; for the CONTROLLER's compliance with the obligations imposed by law and by the applicable regulatory institutions, such as the obligations to combat money laundering and the financing of the fight against terrorism, the obligation to report to the tax authorities; analysing and improving our services and communication, including carrying out surveys regarding client satisfaction with the services provided by the CONTROLLER; exercising or defending our legal rights or complying with the provisions of the courts of law. The CONTROLLER collects personal data directly from clients or from third parties acting on behalf of clients.

Processing for these purposes is based, as the case may be, on one or more of the following legal grounds: your consent; entering into or performing a contract; the legal obligation incumbent on us to process such categories of data; our legitimate interest, or the processing is necessary for the establishment, exercise or defence of a legal claim.

Suppliers and subcontractors

The CONTROLLER collects and processes personal data relating to its suppliers, including subcontractors, as well as the personal data of their representatives and the details of contact persons, strictly for the purpose of performing the contractual relationship.

The CONTROLLER collects and processes the personal data of suppliers/subcontractors for the following purposes: the provision of professional services to clients through subcontractors; the performance of the contract concluded by the CONTROLLER with the suppliers; fulfilling the mandatory risk management formalities; for the provision to suppliers/subcontractors of newsletter materials and/or other marketing materials; exercising or defending our legal rights or complying with the provisions of the courts of law; for the CONTROLLER's compliance with the obligations imposed by law and by the applicable regulatory institutions.

Processing for these purposes is based, as the case may be, on one or more of the following legal grounds: your consent; entering into or performing a contract; the legal obligation incumbent on us to process such categories of data; our legitimate interest, or the processing is necessary for the establishment, exercise or defence of a legal claim.

Candidates for employment

The CONTROLLER collects and processes the personal data of candidates as included in the CV and the letter of intent sent to us, as well as any other information that may be sent.

In this respect, the CONTROLLER processes such personal data strictly for the purpose of carrying out the selection, recruitment and hiring process, or for organising internships, on the basis of your consent.

Visitors to the CONTROLLER's premises

The CONTROLLER has implemented safety measures, including the registration of visitors at reception, video cameras and, where necessary, the identification of visitors by our security staff.

The CONTROLLER collects and processes the personal data of visitors for the purpose of ensuring the security of the CONTROLLER's premises, assets and staff. Processing for these purposes is based, as the case may be, on one or more of the following legal grounds: the legal obligation incumbent on us to process such categories of data, or our legitimate interest.

4 Processing of personal data in the context of using the website

4.1. Protection of personal data on our website

Protecting your private sphere while you use our website is an extremely important matter for us. For this reason, we inform you in detail below about the processing of personal data.

4.2. Security and integrity of data

The CONTROLLER has reasonable security policies and procedures in place to protect personal data against loss, incorrect use, unauthorised modification or destruction. Nevertheless, despite the efforts made by the CONTROLLER, security cannot be absolutely guaranteed against all threats. As far as it is possible for us, access to your personal data is limited to those who need to know it. The persons who have access to personal data are obliged to keep this information confidential.

For the protection of your personal data, we have taken technical and organisational measures, in particular against loss, manipulation or unauthorised access. The measures adopted are checked regularly and are constantly adapted in accordance with the applicable current technical standards.

4.3. Collection and processing of personal data

The data you provide

We obtain personal data about you if you choose to provide it — for example, in order to contact mailboxes or to register for certain services. In some cases, you have previously provided your personal information to the CONTROLLER (if, for example, you are a former employee). If you choose to register or log in to a website of the CONTROLLER using a third-party single sign-on service, which authenticates your identity and connects your login information from social networks (for example, LinkedIn, Google or Twitter) with the CONTROLLER, we will collect any information or content necessary for registration or login that you have permitted the social network provider to share with us, such as your name and e-mail address. Other information we collect will depend on the privacy settings you have established with your social network provider; therefore, please consult the privacy statement or the policy of the applicable service.

When you register or send personal data to the CONTROLLER, we will use this information in the manner described in this Privacy Policy. Your personal data is not used for other purposes, except where we obtain your permission to that effect or where it is otherwise provided for or permitted by law or by professional standards. For example, if you register on a website of the CONTROLLER and provide information about your preferences, we will use this information to personalise your user experience. Where you register or log in using a third-party single sign-on, we may recognise you as being the same user across all the devices you use and personalise your user experience on other websites of the CONTROLLER that you visit. If you send us a CV in order to apply online for a position within the CONTROLLER, we will use the information you provide in order to find the most suitable employment opportunities available.

In some cases where you have registered for certain services, we will temporarily keep your e-mail address until we receive confirmation of the information you have provided by e-mail (that is, we send an e-mail to the e-mail address provided as part of your registration in order to confirm the request for a subscription).

Automatic collection of personal data

In certain cases, the CONTROLLER and its service providers use cookies, "web beacons" technologies and other technologies in order to automatically collect certain types of information when you visit us online, as well as through the e-mails we may exchange. The collection of this information allows us to personalise your online experience, to improve the performance, usefulness and efficiency of the CONTROLLER's online presence and to measure the effectiveness of our marketing activities.

IP addresses

An IP address is a number attached to your computer whenever you access the internet. It allows computers and servers to recognise each other and to communicate with one another. The IP addresses from which visitors appear to originate will be recorded for IT security and for system diagnostics. This information will also be used in aggregated form in order to carry out analysis of the trend and performance of the website.

Cookies

Cookies will normally be placed on your computer or on your internet-connected device whenever you visit us online. This allows the website to remember your computer or device and serves several purposes.

On some of our websites, a notice will appear requesting your consent for the collection of cookies. If you do not give your consent, the computer or internet-connected device used by you will not be tracked for marketing-related activities. A secondary type of cookie called "user input-based cookies" may nevertheless be required by the necessary functionality. Such cookies will not be blocked through the use of this notice. Your selection will be saved in a cookie and will be valid for a period of 90 days. If you wish to cancel the selection, you can do so by deleting your browser's cookies.

Although most browsers automatically accept cookies, you may choose whether or not to accept cookies through your browser settings (often present in the Tools or Preferences menu of your browser). You may also delete cookies from your device at any time. However, please bear in mind that if you do not accept cookies, you may not be able to fully experience some of the features of our websites.

Additional information about managing cookies can be found in your browser's help file or on websites such as www.allaboutcookies.org

Other third-party tools and widgets will be used from time to time on our individual pages in order to provide additional functionality. The use of these tools or widgets will usually place a cookie on your device in order to facilitate the use of the service and to ensure that your interaction is displayed correctly on our web pages.

Cookies in themselves do not indicate your e-mail address to us and do not otherwise identify you personally. In our analytics reports, we will obtain other identifiers, including IP addresses, but the purpose of this is to identify the number of unique visitors to our websites and the geographical origin of visitor trends, and not to identify individual visitors.

By browsing our websites or entering your login details in order to access the areas reserved for registered users, you agree that we may place these cookies on your computer or internet-connected device.

Google Analytics

The CONTROLLER uses Google Analytics. More information about how it uses Google Analytics can be found here: google.com/analytics/learn/privacy.html

In order to offer website visitors more options regarding the way in which their data is collected by Google Analytics, Google has developed the Google Analytics opt-out browser extension. The extension communicates with the Google Analytics JavaScript (ga.js) in order to indicate that information about the website visit should not be sent to Google Analytics. The Google Analytics opt-out browser extension does not prevent information from being sent to the website or to other web analytics services.

"Web beacons" technologies

A web beacon is a small image file on a web page that can be used to collect certain information from your computer, such as the IP address, the time interval during which the content was viewed, the type of browser and the existence of cookies previously set by the same server. The CONTROLLER uses web beacons exclusively in accordance with the applicable laws. The CONTROLLER or its service providers may use web beacons in order to track the effectiveness of the websites of third parties that provide us with recruitment or marketing services, or in order to gather aggregated statistics about visitors and to manage cookies.

You have the option of making some web beacons unusable by rejecting the associated cookies. The web beacon file may still record an anonymous visit from your IP address, but the information related to the cookie will not be recorded.

In some of our newsletters and other communications, we will monitor the actions of recipients, such as e-mail open rates, through the links embedded in the messages. We collect this information in order to assess users' interest and to improve future user experiences.

Location-based tools

The CONTROLLER will collect and use the geographical location of your computer or mobile device. This location data is collected in order to provide you with information about the services we believe might interest you depending on your geographical location and in order to improve our location-based products and services.

Social network widgets and applications

The websites of the CONTROLLER will usually include functionality to allow sharing through third-party social network applications, such as the Facebook Like button and the Twitter widget. These social network applications will collect and use information relating to the use of the CONTROLLER's websites (see the details regarding "Social sharing" cookies above). Any personal data that you provide through these social network applications will often be collected and used by other members of that social network application, and such interactions are governed by the privacy policies of the companies that provide the application. We have no control over, or responsibility for, these companies or the use of your data.

In addition, the CONTROLLER's websites may host blogs, forums, crowd-sourcing and other applications or services (referred to collectively as "social network features"). The purpose of the social network features is to facilitate the sharing of knowledge and content. Any personal data that you provide on any social network will normally be shared with other users of that social network feature (except where otherwise provided at the point of collection), over which we often have limited control or no control at all.

Children

The CONTROLLER understands the importance of protecting the confidential nature of personal data relating to children, especially in an online environment. Our website is not intentionally designed for children, nor is it directly addressed to children under the age of 16. Our policy is never to deliberately collect or keep information about any person under the age of 16, except where this forms part of an engagement to provide professional services.

Options

In general, you are not required to provide personal data to the CONTROLLER, but we will ask you to provide certain personal data in order to receive additional information about our services and events. The CONTROLLER will also request your permission for certain uses of your personal data, and you may accept or refuse these uses. If you sign up for certain services or communications, such as an electronic newsletter, you will be able to unsubscribe at any time by following the instructions included in each communication. If you decide to unsubscribe from a service or a communication, we will endeavour to remove your information promptly, although we may request additional information before we are able to process your request.

As described in "Cookies" above, if you do not wish cookies to monitor you while you browse our websites, you may reset your browser in order to refuse all cookies or to indicate when a cookie is sent. You should note, however, that if you choose to refuse the presence of cookies, certain portions of our website may not operate at normal parameters.

Links to other websites

We wish to inform you that the CONTROLLER's websites will usually contain links to other websites, including websites maintained by other member firms of the group to which the CONTROLLER belongs, which are not governed by this Privacy Policy but by other privacy statements that may often be different. We recommend that users review the privacy policy of each website visited before disclosing personal data.

All the processing activities mentioned in this section are concluded, as the case may be, on the basis of one or more of the following legal grounds: your consent, entering into or performing the contract, legal obligation, our legitimate interest, the processing is necessary for the establishment, exercise or defence of a legal claim. By registering on any website of the CONTROLLER and then navigating to another website of the CONTROLLER while you are logged in, you agree to the use of your personal data in accordance with the Privacy Policy of the website owned by the CONTROLLER that you visit.

5 Sharing and transfer of personal data

5.1. Transfers to third parties

We do not share personal data with third parties, except where this is necessary for our legitimate professional and operational needs, in order to meet your requirements and/or as required or permitted by laws or professional standards.

The CONTROLLER will not transfer the personal data you provide to third parties for their own direct use for marketing purposes. All the processing activities mentioned in this section are concluded, as the case may be, on the basis of one or more of the following legal grounds: your consent, the performance of a contract, legal obligation, our legitimate interest, the processing is necessary for the establishment, exercise or defence of a legal claim.

6 Your rights

If the CONTROLLER processes personal data about you, you have the following rights:

Information

you have the right to be informed about the personal data processing operations carried out by the CONTROLLER.

Access

you have the right to access this data. This is sometimes called a "Data Subject Access Request". If we agree that we are obliged to provide you with personal data, we will provide you with this data free of charge. Before providing you with personal data, we may ask you for proof of identity and sufficient information about your interactions with us, so that we can locate your personal data.

Rectification

where the information we hold about you is incorrect, you have the right to ask us to correct any inaccuracy in the personal data.

Erasure

You have the right to request from the CONTROLLER, without undue delay, the erasure of your personal data in the following situations:

• Your personal data is no longer necessary for the fulfilment of the purposes for which it was collected or processed by the CONTROLLER;
• You withdraw the consent on the basis of which the processing of the personal data took place;
• You object to the processing of the personal data on the basis of legitimate interests and there are no well-founded legal grounds for the processing;
• You object to the processing of personal data based on direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing;
• Your personal data has been processed unlawfully;
• Your personal data must be erased in order to comply with a legal obligation binding upon the CONTROLLER.

Restriction of processing

You have the right to request the CONTROLLER to restrict processing where one of the following applies:

• The accuracy of your personal data is contested by you, for a period enabling the CONTROLLER to verify the accuracy of the personal data;
• The processing is unlawful and you oppose the erasure of your personal data and request instead the restriction of its use;
• The CONTROLLER no longer needs the personal data for the purposes of the processing, but the data is required by you for the establishment, exercise or defence of a legal claim;
• You object to processing based on legitimate interests, the processing being restricted for the period of time during which it is verified whether the legitimate rights of the CONTROLLER override your legitimate interests.

Portability

you have the right to receive from the CONTROLLER the personal data concerning you which you have provided to the CONTROLLER, in a structured, commonly used and machine-readable format, and to transmit this data to another controller, where the technical means allow this. You have this right only where the processing is based on your consent or where the processing is carried out by automated means.

Objection

you have the right to object, on grounds relating to your situation, to processing based on the legitimate interests of the CONTROLLER. The CONTROLLER will no longer process the personal data unless it demonstrates that it has compelling legitimate grounds justifying the processing which override your interests, rights and freedoms, or that the purpose is the establishment, exercise or defence of a legal claim.

Automated individual decision-making, including profiling

you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Lodging a complaint

you have the right to lodge a complaint with the competent authority responsible for protecting personal data, the National Supervisory Authority for Personal Data Processing.

You may make a request or exercise these rights by contacting the CONTROLLER at the e-mail address specified, or the DPO, in the person of the company SEDRYA INFORSEC SRL, whereupon we will make all reasonable and practical efforts to comply with your request, as long as it is consistent with the applicable legislation and professional standards.

7 Retention period

The CONTROLLER has implemented technical and organisational measures for the retention of your personal data. Accordingly, we will keep your personal data in accordance with the provisions of the Data Retention Policy applicable at the level of the CONTROLLER.

Nevertheless, we will cease to process any of your personal data as long as it is no longer necessary for the established purposes or when you withdraw your consent, this being the legal basis of the processing, and there are no compelling legitimate grounds for the CONTROLLER's firm to continue processing that would override your interests, rights and freedoms, or if the personal data is not necessary for the establishment, exercise or defence of a legal claim.

8 Changes to this Privacy Policy

The CONTROLLER may amend this Privacy Policy from time to time in order to reflect current privacy practices. When we make changes to this Privacy Policy, we will revise the "updated" date at the top of this page. Any changes made to the processing of personal data described in this Privacy Policy which affect you will be communicated to you through an appropriate medium, depending on the way in which we normally communicate with you.

9 Questions and enforcement

The CONTROLLER undertakes to protect the confidentiality of your personal data. If you have questions or comments regarding the administration of your personal data, please contact us at nely_ilie@yahoo.com or the DPO at the address office@inforsec.ro.

You may also use these addresses to communicate all your concerns regarding compliance with our Privacy Policy.

We will acknowledge your e-mail within 14 days and will endeavour to resolve your concern within one month of receipt. Where the matter is complex or we have a large number of complaints, we will notify you that the complaint will take more than one month to resolve and we will endeavour to resolve your problem within three months of the notification of the concern. We may accept your complaint (and, in that case, we will implement one of the measures set out in the "Your rights" section above), or we may reject your concern on legitimate grounds. You may also lodge a complaint with the local data protection Authority at the following contact details: