INFORMATION TO DATA SUBJECT
This information to data subject governs the processing of personal data by using the website available at https://bucharestfashionfilm.ro/, performed by Galore Media S.r.l., with headquarters in Bucharest, email firstname.lastname@example.org (hereinafter the “Data controller”), complying with the existing legislation on the protection of personal data, including, in particular, Regulation (UE) n. 2016/679 (hereinafter the “GDPR”).
1. Identity and contacts of the data controller
The Data controller is Galore Media S.r.l.
As the Data controller is established in the Romanian territory, no representative has been appointed.
2. Contact details of the data protection officer of the data protection
The Data controller has not appointed a data protection officer.
3. Modalities for the processing
3.1 Cookies and environmental data
3.1.1 TECHNICAL COOKIES
Browsing, functional and session cookies: they allow the website to work correctly. The use of the so-called session cookies (that are not persistently stored on the device of the data subject and automatically deleted when the web browser is closed) is strictly limited to the transmission of identifiers of individual sessions. Session cookies shall be used for the purpose of allowing a safe and efficient navigation of the website.
With specific regard to the cookies of Google Analytics, the information derivable by the cookies about the use of the website by the users will be transmitted by the browser of the data subject to Google Inc., with headquarters at 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A., and stored on the servers of the latter.
The rules concerning privacy of Google, that you should examine, are available at the following address: http://www.google.com/intl/it/privacy/privacy-policy.html
The information to data subject concerning the services of Google Analytics is available at the following address: http://www.google.com/intl/en/analytics/privacyoverview.html
Navigation data and environmental variables: the information systems and the procedures for running of the website automatically acquire, during the normal course of operation, some personal data relative to the navigation of the data subject, including the environmental variables. This category of data includes, for example:
IP addresse of the computers used by the users who benefit from the service;
The number of the accesses;
The pages viewed;
The date and the hour of the access;
The URL of the browser before visiting the website of the Data controller;
The type of browser used for the navigation;
The operating system used.
3.1.2 NON-TECHNICAL COOKIES
Profiling cookies: the website does not use profiling cookies.
Erase and disable cookies
The cookies are common text files. Therefore, you can access to the same using a word processing programs. In any case, you can configure your browser in order to prevent it from processing the cookies.
Erase/disable the cookies through Firefox:
Erase/disable the cookies through Edge:
Erase/disable the cookies through Chrome:
3.2 Data provided for receiving updates and newsletter
The data voluntarily and freely provided by the data subject for marketing activities or send newsletter (purposes as indicated at point 4.3 of this information to data subject) persona data will be processed through paper, computerized, telematic or automated tools and management software type CRM, as well as by electronic mail systems.
3.3 Data provided voluntarily by individuals
The data voluntarily and freely provided by the data subject, by sending email to the addresses available on the website, could be used for the purposes indicated on a case-by-case basis.
In particular, in addition to the email address necessary to reply to the sender, any further data indicated in the same communication shall be processed. The data subject is invited not to insert special categories of personal data (for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) in the communications to be sent to the Data controller.
The data collected will be stored and processed exclusively for the conservation of the correspondence and will in no case be used for further purposes.
4. Purpose of the processing and relative legal basis
4.1 In relation to the technical cookies as referred to in point 3.1.1 and the navigation data, data subject’s personal data are processed for the purpose to allow the proper use of the website; this use is require to surf on the website https:/bucharestfashionfilm.ro/. In this case the legal basis for processing is the legitimate interest of the Data controller.
4.2 In relation to the non-technical cookies as referred to in point 3.1.2, the processing of personal data, made through the same, allows data subject to receive a personalized browser experience based on profiling. In this case the legal basis for the processing is the consent expressed by the data subject.
4.3 Personal data will be processed for receiving communication of direct marketing, promotional communications, notices, updates, in paper or digital format. The personal data processing could be performed in order to send communications of commercial information, newsletter, advertising material, through traditional contact systems and automated communication systems, including commercial and promotional communications by email or SMS. In this case, the legal basis for processing of personal data is the data subject’s consent, given in compliance with this information to data subject, also by flagbox.
4.4 In relation to the data voluntarily provided by email, the processing of the personal data allows to answer to the requests of the data subjects. The legal basis of this processing is the legitimate interest of the Data controller to reply to the data subjects’ requests.
5. Modalities to express the consent
The consent to personal data processing by non-technical cookies (purposes as indicated at points 4.1 and 4.2 of this information to data subject) could be given by clicking a specific box available in a banner.
The consent to personal data processing for receiving updates and newsletter (purpose as indicated at point 4.3 of this information to data subject) could be given using paper, computerized, telematic or automated tools and management software type CRM, as well as by electronic mail systems.
In any case, the Data controller reserves to require from the data subject the relative, free, consent to personal data processing before initiating a specific processing activity requiring the data subject’s consent.
6. Source of the personal data
Data controller processes only personal data provided by the data subject in compliance with this information to data subject and collected by the website, forms in both paper and electronic formats or by the email sent by the data subject.
Data deriving from public sources will not be processed.
7. Recipients and categories of recipients of personal data
Recipients of the data subject’s personal data may be:
Communication companies that carry out commercial communication and profiling activities on behalf of the Data controller and are responsible for the processing;
The companies that offer services of an information society, including, in particular, those offering hosting services.
8. Categories of data
The data subject’s personal data will be processed. The personal data belonging to the special categories pursuant to the Article 9 of GDPR will not be processed.
9. Transfer of data
The Data controller may intend to transfer personal data to a third country or to an international organisation. Such subjects may be represented, for example, by:
Communication companies that conduct communication activities on behalf of the Data controller;
The companies that offer services of an information society, including, in particular, those offering hosting services;
Suppliers of communication services.
The transfer of personal data to the aforementioned subjects, if based in a third country or international organization, is carried out according to a decision of suitability of the European Commission, which evaluates how the third country, the territory or one or more specific sectors in the third country or the international organization ensure an adequate level of protection of the data subject’s rights. In the absence of such decision, the Data controller – if deemed in any case appropriate – reserves itself the right to conclude specific separate agreements that oblige such subjects to adopt adequate security and also organizational measures, in order to offer appropriate guarantees related to the data subject’s rights. In particular, Google Inc. is contractually bound to ensure appropriate guarantees to the data subject’s rights. The data may be transferred, among others, to the United States of America. In order to obtain a copy of such data or the place where they have been made available a request may be sent to the following email address: email@example.com
10. Personal data retention period
The personal data processed and retained for the purposes indicated in this information to data subject are processed and stored as long as the data subject withdraws the previous consent, by sending a request for cancellation.
Where necessary, the Data controller reserves the right to require from the data subject the renewal the consent to the personal data processing and/or the verification of the consents already given.
11. Optional nature of the consent and consequences in case of lack of consent
In relation the personal data, processed by technical cookies for the purpose to allow the proper use of the website, the communication of the personal data is not based on contractual obligations, but on a legitimate interest of the Data controller, because the website will not be available and correctly operate without this processing.
The consent to the processing of non-technical cookies shall be considered facultative. In this case, the lack of the communication of those data will determine the impossibility to furnish a customized service.
In relation to the personal data processed for receiving updates and newsletters (purposes indicated at point 4.3 of this information to data subject) personal data are not provided on the basis of contractual or legal obligations. The personal data are voluntarily provided by the data subject; however, if personal data are not provided, Data controller may not carry out marketing activities or send newsletter.
In relation to the data voluntarily provided by email, the personal data processing is not based on a contractual obligation, but on a legitimate interest of the Data controller in replying to the data subject; in case of the lack of this processing, it will be impossible to reply to data subject’s requests.
12. Rights of data subject
12.1 Right to object
The data subject has the right to:
object to processing his or her personal data, at any time, on grounds relating to his or her particular situation, according to point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions. The Data controller shall no longer process the personal data unless the Data controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims;
object to processing his or her personal data, at any time, for direct marketing, including profiling to an extent exceeding the direct marketing, if processed for such purposes.
In case of objection against the personal data processing for direct marketing purposes, personal data shall no longer be processed for such purposes.
If personal data are processed for scientific or historical research purposes or statistical purposes, according to Article 89(1) of the GDPR, on grounds relating to his or her particular situation the data subject shall have the right to object to processing of personal data concerning him or her, except that the processing is necessary for reasons of public interest.
12.2 Other rights
The Data controller shall also inform the data subject about the existence of his or her following rights:
Right of access by the data subject: the data subject shall have the right to obtain from the Data controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and other specific information, pursuant to article 15 of the GDPR;
Right to rectification: the data subject shall have the right to obtain from the Data controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement, pursuant to article 16 of the GDPR;
Right to erasure, including the right to withdraw the consent: the data subject shall have the right to obtain from the Data controller the erasure of personal data concerning him or her without undue delay and the Data controller shall have the obligation to erase personal data without undue delay; the data subject shall have also the right to withdraw the consent, where the grounds set out in Article 17 of the GDPR apply; in that case, the right to withdraw the consent can be exercised in any time without prejudice to the lawfulness of the processing performed before the withdrawal and based on the consent already given;
Right to restriction of processing: the data subject shall have the right to obtain from the Data controller restriction of processing where the grounds set out in Article 18 of the GDPR apply;
Right to data portability: the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller without hindrance from the Data controller to which the personal data have been provided under the conditions set out in Article 20 of the GDPR.
Right to object to commercial communications: the data subject shall have the right to object, at any time, free of charge, to receiving commercial communications.
13. Exercise of the rights
The request to exercise the rights outlined in this information to data subject, including particularly the right to erase and the right to withdraw the given consent, must be addressed directly to the Data controller at the email address firstname.lastname@example.org. Alternatively, such rights may be exercised by sending a letter to such effect by registered post with acknowledgement of receipt to Galore Media S.r.l. at the address St Washington 6, Bucharest, Romania;
14. Accessibility to information to data subject
If expressly requested by the data subject, the information may also be orally provided, provided that identity of the data subject is proven, by means of a telephone call to the Data controller’s telephone number.
Privacy and newsletter
When the data subject has given his/her consent, through flag, to receiving promotional communications, notices and updates, the relative personal data processing could be performed in order to send communication of commercial information, newsletter, advertising material, to conduct market researches, through traditional contact systems and automated communication systems, including commercial and promotional communications by email or SMS; this is based on the data subject’s consent, given in compliance with this information to data subject. In that case the communication of personal data is not based on a contractual obligation. The data subject shall be allowed to provide his/her personal data; nevertheless, in case of the lack of the communication of the personal data, it will not be possible to carry out marketing activities or send newsletter. The personal data processed in this way will be stored until the data subject will request the relative erasure.