INFORMATIVE SUMMARY ON PERSONAL DATA PROTECTION AND CONSENT STATEMENT GIVEN BY INDIVIDUALS FOR THE PROCESSING OF THEIR PERSONAL DATA DURING SUPPLIER PRE-SELECTION PROCEDURES
Personal Data Operator
KMG Rompetrol (The Company), which is part of the KMG International Group, with its head office in Piata Presei Libere 3-5, 5th floor, Bucharest, registered with the Trade Registry under number J40/9817/2010, duly represented by Mr. Zhanat Tussupbekov, acting in his capacity as Administrator, has the obligation to process and store the personal data that you provide to us safely and in observance of the applicable laws in place.
• Law no. 677/2001 on people’s protection in terms of their personal data processing and the free circulation of this data (the Law) and
• (EU) Regulation no. 679 dated April 27, 2016, on people’s protection
Personal data - surname, first name, position, company e-mail address (PD)
Purpose of processing – TPD is processed by the Company in connection to its internal procedures carried out to select service and products suppliers, by submitting the application forms received for the pre-selection, along with the PD comprised therein, to the internal departments of the Company, in charge of selecting service and products suppliers, via the following Internal Communication Channels: email, SharePoint, archived materials; publicly communicating photographic materials (Materials), depending on the Company’s legitimate interests.
Data processing duration - PD shall be stored during the bid selection process and then, it shall be internally archived by the Company, as long as the Company still has a legitimate interest in this data or until you withdraw your consent with this regard, whichever of these events happens first.
Authorised Persons/Consignees/Associated Operator – PD may be processed by the following persons, in strict observance of the existing personal data protection laws in place:
The companies making up the KMG International Group, executing any activities for the Company or to which the Company is reporting its results (KMG Rompetrol Services Centre).
Additional Service Providers, such SC Webstyler SRL and any other entities with which the Company concludes service and products provision contracts, provided that such companies implement appropriate protection measures.
Other service suppliers that have contracts concluded with the Company, thus holding the title of associated operator under art. 26 of GDPR, thus granting them the right to use, archive the Materials related to the Event, for the purpose of promoting such event, based on your consent.
The Company shall take all the necessary technical and legal measures to protect your PD and the copyrights related to such data.
The rights held by the person concerned, in relation to PD
According to the Applicable Law, you have the following rights:
i. the right to be informed on and to access your personal data
ii. the right to have your personal data rectified,
iii. the right to be forgotten/the right to have your personal data deleted;
iv. the right to restrict the processing of your personal data;
v. the data portability right;
vi. the right to oppose the processing of your PD;
vii. not to be subjected to an individual automatic decision;
viii. the right to notify the National Supervisory Authority for Personal Data Processing (link) or any other competent bodies.
All these rights may be exerted via a written, signed and dated letter, addressed to the Data Protection Officer, at the following address: firstname.lastname@example.org
Also, in your capacity as person concerned, you have the right to resort to the National Supervisory Authority for Personal Data Processing and the justice system.
If you file an application asking to exert your personal data protection rights, the Operator shall answer such an application within 15 days, according to Law no. 677/2001, and, starting from the 25th of May, 2018, within 30 days, according to the General EU Data Protection Regulation 2016/679.
If you wish to use your right to oppose the processing of your PD, you shall receive an answer according to art. 21 of GDPR, while your objection related to this operation shall not have any effect on the other purposes stated in this summary.
The Personal Data Operator guarantees the processing of your data in a legitimate manner, while also implementing all the proper technical and organisational measures needed to insure you data integrity and confidentiality, as stated in art. 25 and 32 of the General Data protection Regulation.