Processing of personal data.

INFORMATION NOTE
ON THE PROCESSING OF PERSONAL DATA

1. WHO ARE WE?
EURO MANAGEMENT GRUP SRL (hereinafter referred to as "the Company"), with registered office in Intrarea Bădeni, Nr.2A, Bl.Y7bis, Sc. C, Apt. 102, Sector 3, Bucharest, and its working point at Str. Aurel Vlaicu, Nr.147, Bl. 20, Sc. B, Ap. 61, sector 2, Bucharest, registered with the Trade Register Office under no. J40/1513/2002, CUI RO14482643, having the contact details specified below, processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (Regulation) and other applicable legal provisions on the processing of personal data.
This information notice describes why and how we process personal data and provides information on your rights when the Company acts as a Personal Data Controller.

2. HOW CAN YOU CONTACT US?
You can contact us at:
Email: gdpr@mynb.eu 
Address: Str. Aurel Vlaicu, Nr.147, Bl. 20, Sc. B, Ap. 61, sector 2, Bucharest, Postal code: 020095

3. DATA OR CATEGORIES OF PERSONAL DATA PROCESSED BY THE COMPANY 
Our policy is to collect personal data necessary for the purposes of the Company's activities and we ask our customers and partners to provide us with personal data necessary for these purposes. Due to the diversity of services and/or products we offer, described on www.mynb.eu we may process several categories of personal data, which vary depending on the type of product / service / activity / purpose of processing.

The main data / categories of data processed by the Company may be, as appropriate and depending on the purposes associated with the processing, data such as:

a) If you create an account or place an order on our website:  

• Name, first name 
• Contact and/or delivery details (phone number, email address, home/residence address, etc), 
• Data related to the position/place of work of the person concerned (e.g. in the case of individuals representing clients and/or legal entity partners)
•  Preferences in relation to the types of services and products offered by Euro Management Group and/or marketed through the website (such as browsing history, order history, etc.), evaluation of products and services 
• Personal data such as the online identifier of our customers, username, geolocation data, age, gender, etc. may be processed in connection with access to the Site and navigation on the platform, Euro Management Group may structure the data on various categories and criteria of interest, according to the Cookie Policy (for more information visit _______)
• potential data received from/collected through social networking platforms
• other data you voluntarily provide via email, etc.
•  

b) if you visit our website:

• data obtained as a result of accessing the Company's online platform (such as the online identifier of persons accessing one or more of the
• Company's pages, which identifier is processed for the purposes mentioned in the Cookie Policy, 

c) if you participate in one of our loyalty programs:

• data collected through the registration form, such as name, surname, home address, mobile phone, email, date 
• history of relationship with us and number of points earned or similar
• benefits granted under loyalty programmes
• data required by law for filing any tax returns related to loyalty programmes

d) if you are a representative of one of our partners, customers, suppliers, legal entities:

• name, surname
• contact details (email address(es), telephone numbers, etc.)
• function 
   

4. THE SOURCE FROM WHICH THE PERSONAL DATA ORIGINATED AND, WHERE APPLICABLE, WHETHER THE PERSONAL DATA ORIGINATED FROM PUBLICLY AVAILABLE SOURCES
In general, we collect personal data directly from you. We may also process personal data collected from other sources such as social media, etc.


5. WHAT TYPES OF DATA PROCESSING DOES OUR COMPANY CARRY OUT?
Our company processes personal data for the purposes set out in this information notice, and for each purpose one or more data processing operations such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction may be used.


6. THE PURPOSES FOR WHICH PERSONAL DATA ARE PROCESSEDThe company processes personal data for multiple purposes and the collection methods, legal basis for processing, use, disclosure, retention periods, etc. may be different depending on each purpose.
We may use personal data for one or more of the purposes described in this notice. If the Company will further process personal data for a purpose other than those about which you have already been informed and which is not compatible with the purposes for which the data was originally collected/which you have been made aware of, the Company will provide information about that secondary purpose and any additional relevant information.
We use personal data primarily for the following purposes:

• The performance of the Company's business activity through the website, namely the marketing of electronic products, as well as the supply of products and the provision of services related in particular to the Company's main activity carried out through the website, as well as to other related activities. We offer a wide range of services and products which can be found here: www.mynb.eu 
• Management of our relations with customers, suppliers, professionals in various fields of activity, etc., improvement of the Company's activity and services in relation to our customers and partners, correspondence, offers, negotiations, contract management.
• We process personal data in order to fulfil our contractual obligations and commitments to you, to handle requests and complaints/complaints about our services, to resolve any issues raised and to improve our products and/or services.
• Managing risks related to our business, where we take security measures to protect personal data, which involves detecting, investigating and resolving security threats. Personal data may be processed as part of security monitoring of the software applications we use. 
  We provide our customers with information about us, including in relation to services or products of the type that our customers have contracted for or expressed an interest in purchasing, marketing and advertising activities. In accordance with applicable law, we use customers' contact details to directly or indirectly provide information that we believe is of interest to them.
• When visiting our websites or our social media pages, we may process some information about the visitor's online identifier for the purposes mentioned in the Cookie Policy (for more information go to the Cookie Policy) or other personal data potentially received/collected through these platforms and/or from social media or other public digital sources.
• Complying with legal and/or regulatory requirements, such as those of a fiscal nature or those required by special legislation governing our business or, where applicable, archiving.
• Economic-financial-administrative management.
• Establishing, exercising or defending a right in court.
• Internal statistics, market research and anonymous surveys.

7. THE LEGAL GROUNDS AND CONDITIONS OF LAWFULNESS ON WHICH DATA PROCESSING IS BASEDThe legal grounds for the processing take into account the provisions of the Regulation and the regulations on the processing of personal data adopted at the Romanian level, the provisions of the applicable legislation in the field of activity of the Company, the Civil Code, the Tax Code and related legislation in the field of taxation.
The processing is based on at least one of the following conditions of lawfulness of processing:

• processing may be necessary for entering into a legal relationship/contract and/or for its performance;
• processing may be necessary for the fulfilment of a legal obligation incumbent on the Company (e.g. those relating to the management of supporting documents for tax purposes);
• processing may be necessary for archiving operations;
• processing is necessary for the purposes of legitimate interests pursued by the Company or a third party, respectively:
• for the administration of our activity carried out through the www.mynb.eu website, the provision of services related in particular to the main activity of the Company carried out through the www.mynb.eu website, i.e. the marketing of electronic products, as well as in relation to other related activities,
•  for the management of our relationships with potential customers and clients or our partners, including but not limited to the promotion of our services and/or products, related activities,
• to manage risks related to our business
  handling complaints/complaints about our services, in order to resolve any issues raised or to improve our products and/or services, or to establish, exercise or defend a right in court
• processing may be based on your consent, only if we are in one of the cases expressly provided for by the Regulation in this regard.

 

8. HOW LONG DO WE KEEP PERSONAL DATA?We keep personal data processed by us only as long as necessary for the purpose for which it was collected (including as required by applicable law or regulation), such as:

• During the performance of the contract/legal relationship for personal data necessary for its performance, including personal data with which the Company may come into contact in the course of the legal relationship
• For the duration required by law in cases where there are applicable regulations in this regard (e.g. in the case of mandatory accounting records and supporting documents underlying financial accounting entries, such as invoices issued by our Company)
• For the duration of the management of the relationship with potential clients/customers, i.e. until the exercise of the right to object (opt-out), for data used for the purpose of sending commercial communications concerning our services and/or products,
• Until consent is withdrawn for processing of personal data based solely on consent
• For the period of archiving in the public interest specified by law or in applicable Company policies, as applicable, for data contained in documents for which archiving is required by law or by the Company

In all other cases or in the absence of specific legal, regulatory or contractual requirements, our reference period for the retention of personal data is a minimum of 3 years from the date of termination of the relationship / last contact between the Company and the data subject.
Any data may be retained by the Company, by way of exception to the above provisions, if necessary, until the expiry of the limitation period, in respect of situations where the Company would have a legitimate interest in retaining certain personal data in connection with a potential dispute that may arise between the parties, for example in the context of the possible legal liability of the Company or the data subject of the processing.
In any event, except as provided for by applicable law, we delete your data at the time you request us to do so. Applicable exception situations will be communicated to the applicant by means of the response submitted to the applicant by our Company in relation to the request for erasure of data.


9. YOUR RIGHTS AND HOW TO EXERCISE THEM
Our company is responsible for facilitating the exercise of any of your rights mentioned below. Any of these rights can be exercised by sending an e-mail to gdpr@mynb.eu or you can send us a written request or you can hand it in personally at our office in Str. Aurel Vlaicu, Nr.147, Bl. 20, Sc. B, Ap. 61, sector 2, Bucharest, Postal code: 020095
For the protection of your data, in order to prevent abuse by malicious persons who would seek access to your data, we may ask you to complete some identification steps beforehand, to ensure that you are the person exercising your rights mentioned below. If we receive a request from you to exercise any of your rights, we may ask you for additional information to verify your identity before acting on your request.
If you submit a request in electronic format to exercise your rights, the information will be provided by our company also in electronic format where possible, unless you request another format.
We will endeavour to respond promptly to any request from you and, in any event, within the time limits expressly set out in the applicable legal provisions (usually 30 days from registration of the request). In certain situations expressly provided for by applicable law, we may charge for an access request which will take into account the administrative costs necessary to fulfil the request.
If, as a result of the application of legal provisions, our Company is unable to comply, in whole or in part, with a request received from you as a data subject, then the applicable exception situations will be communicated to you by means of the response submitted by the Company in connection with the request in question.


Right of access    You have the right of access, in accordance with Article 15 of the Regulation, i.e. to obtain confirmation from the Company as to whether or not it processes personal data concerning you and, if so, the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the period for which the personal data are expected to be stored or, if this is not possible, the criteria used to determine this period; (e) the existence of the right to request rectification or erasure of personal data or restriction of the processing of personal data or the right to object to processing; (f) the right to lodge a complaint with a supervisory authority; (g) where personal data are not collected from you, the right to request the rectification or erasure of the personal data; (h) the right to request the rectification or erasure of the personal data or restriction of the processing of the personal data or the right to object to processing. , any available information on their source; (h) the existence of an automated decision-making process including profiling, referred to in Article 22(1) and (4) of the Regulation, and, at least in those cases, relevant information on the logic used and on the significance and the expected consequences of such processing for the data subject.
Where personal data are transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards under Article 46 of the Regulation relating to the transfer. Upon your request, the Company shall provide a copy of the personal data undergoing processing.


Right to rectification of data    You have the right to obtain from the Company, without undue delay, the rectification of inaccurate personal data concerning you, in accordance with Article 16 of the Regulation. Taking into account the purposes for which the data have been processed, you have the right to obtain the completion of personal data that are incomplete, including by providing an additional statement.
Where possible or necessary we will make corrections (where appropriate) on the basis of updated information and inform you of this where appropriate.


Right to erasure of data          You have the right to obtain from the Company the deletion of your personal data (as provided for in Article 17 of the Regulation) without undue delay, except in certain circumstances provided for in the Regulation, if one of the following grounds applies:
(a) the personal data are no longer necessary for the purposes for which they were collected or processed;
b) you withdraw the consent on the basis of which the processing is carried out insofar as the processing is based solely on consent and there is no other legal basis for the processing;
c) you object to the processing carried out for the purposes of a public interest or for the purposes of legitimate interests pursued by the Company or by a third party and there are no legitimate grounds overriding your interests/rights and fundamental freedoms in relation to the processing or you object to the processing for direct marketing purposes;
d) personal data have been unlawfully processed;
e) personal data must be deleted in order to comply with a legal obligation incumbent on the Company under Union law or the national law to which it is subject;
f) other situations provided for by the Regulation insofar as applicable;

Right to restrict processing.  You have the right to obtain restriction of processing (under Article 18 of the Regulation) in the following cases:
a) Challenge the accuracy of the data, for a period that allows the Company to verify the accuracy of the data;
b) The processing is unlawful and you object to the deletion of the personal data and request instead that its use be restricted;
c) the Company no longer needs the personal data for the purpose of the processing, but you request it for the establishment, exercise or defence of legal claims; or
d) You have objected to the processing in accordance with Article 21(1) of the Regulation, for the period of time during which it is verified whether the legitimate rights of the controller prevail over those of the data subject.

Right to data portability.    You have the right to receive your personal data (according to Article 20 of the Regulation) that you have provided to the Company, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, without hindrance from the Company, if:
(i) the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) of the Regulation or on a contract under Article 6(1)(b) of the Regulation; and (ii) the processing is carried out by automated means.
In case you exercise your right to portability of personal data, your personal data may be transferred directly from the Company to another controller expressly indicated by you, where technically feasible.

Right to object to processing for legitimate interests pursued by the Company or a third party    You have the right to object at any time, for reasons relating to your particular situation, to processing carried out for a public interest purpose or for legitimate interests pursued by the Company or by a third party, including profiling. In this case, the Company will no longer process your personal data, unless it demonstrates that it has compelling legitimate grounds for the processing which override your interests, rights and freedoms or that the purpose is to establish, exercise or defend a legal claim.

Right to object to processing for direct marketing purposes    Where the processing is for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for this purpose, including profiling, insofar as it relates to such direct marketing.

Right to withdraw consent    If the processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal of consent. The hypothesis of withdrawal of consent is not applicable in cases where the basis of processing is not consent. 

10. THE RIGHT TO LODGE A COMPLAINT OR A CLAIM
If you wish to complain about issues concerning the processing of your personal data, please send an e-mail with the details of your complaint to gdpr@mynb.eu You can also send / submit your request to the address: 147 Aurel Vlaicu Street, Bl. 20, Sc. B, Ap. 61, sector 2, Bucharest, Postal code: 020095. We will examine and respond within the legal deadlines to any complaint we receive.
You also have the right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing ("ANSPDCP").

11. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA:The Company may transmit / grant access / disclose personal data mainly to the following categories of persons / entities:

• Public authorities and entities (such as tax authorities, etc.)
• Service providers (such as online payment platform provider, courier company, etc.) 
• Processors who process personal data on behalf of the Company in accordance with the instructions received from us and comply with this notice, data protection laws and any other appropriate privacy and security measures (such as IT service providers who may have access to personal data, marketing service providers, etc) 

Transfers and disclosures will not be made to entities outside Romania/EU. If the Company transmits your personal data to a third country or international organisation, we will ensure that it is adequately protected, i.e. that we transmit the data to a country that provides an adequate level of protection as assessed by the European Commission or, if that country is deemed not to have laws equivalent to EU data protection standards, we will require the third party to enter into a legally binding contract/agreement/instrument reflecting the latter standards or providing other appropriate safeguards to that effect. 

12. CONSEQUENCES OF REFUSING TO PROVIDE PERSONAL DATAWhere personal data is collected directly from you, please note that you are not normally obliged to provide your personal information to the Company, except where such provision constitutes a legal or contractual obligation or an obligation necessary for entering into a legal relationship/contract.  Thus, to the extent that you opt for one or more of the Company's services, enter into a legal relationship with the Company or otherwise benefit from our services/products, the provision of your personal data constitutes a necessity in terms of legal requirements and/or the legal relationship with us, as this information is necessary for the fulfilment of the Company's obligations to you or for the provision of services and/or products to you.
Thus, in certain situations, depending on the data you refuse to provide, it is possible that:

• our company is unable to conclude the contract or continue the contractual relationship with you
• our company is unable to meet part/all of its obligations to you.

If you feel that the information contained herein is ambiguous or contains any unclear information, you may request clarification from us at any time at gdpr@mynb.eu.  

By this Information Notice I have taken cognizance of the information provided by EURO MANAGEMENT GRUP SRL in the light of the Regulation and I have been informed of the rights conferred by law with regard to the processing of personal data.