Cantabria IMPEX SRL with the registered office on B-dul Mircea Voda, Nr 21, Bucuresti, District 3, with CUI no. 15823285, and order number in the trade registry J40/18786/2005, represented by Roș Sorin Ovidiu as Administrator, (”Cantabria IMPEX”) processed personal data to the extent permitted by the law no. 677/2001 on individuals protection regarding personal data processing and free circulation of such data, by the Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector and by the Regulation 2016/679/EU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
1. What is personal data?
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity;
2. Categories of data processed
Personal data we process may include:
- Identification data, such as: surname and first name, home address/ residence, personal identification number, home/mobile telephone no., Id. card series and no., etc.;
- Information on the services and products you have bought (from Cantabria IMPEX and its partners);
- Information gathered from public sources, integrity data bases and credit offices;
- If legally required for compliance purposes, information on relevant and important litigation or other judicial proceedings against you or your affiliated third party and the interaction with you, which might prove relevant for any purposes regarding the supply of our services;
- Information on your preferences, if they are relevant for the services we supply;
In certain cases where the collection of such data is mandatory for the supply our services, we collect special categories of personal data, such as the Personal Identification Number (”CNP”). These special categories of personal data will be collected only based on your prior express consent or based on the fair evidence of your consent provided by a third person who communicates us such data, if there is any legal obligation to process such categories of data, or if the processing is necessary to correct a legal position (for example, for the establishment, exercise or defense of a right before the court);
3. Methods of collecting personal data
Personal data are collected through the website www.hotelultimafrontiera.com, if you agreed to provide us such personal data though actions such as filling out the forms, by sending e-mails or by requiring an offer. Data we process is used for the mentioned purposes or which result from your request (for example, if you have filled out an application form for offer, we can contact you to provide you information on our products and services).
4. Purposes of personal data processing
We process personal data in the following purposes:
a) To provide you with the products or services you have requested us and to settle any issue related to these;
b) For sale activities, including sales achievement, administration, and development;
c) For after-sale activities, such as: public relations services, users/customers information;
d) To manage or administrate your or your company’s business relation to Cantabria IMPEX, including to process payments, accounting, auditing, invoicing and cashing, support;
e) For security protection and managing access to our site, IT and communication systems, online platforms, websites and the other systems, security threat prevention and detection, frauds or other fraudulent or malicious activities;
f) To identify authorized persons to transact on behalf of our customers, beneficiaries, suppliers and/or service providers;
g) To observe, exercise and protect our legal rights;
h) To conduct surveys, researches, market studies, and statistics to improve the quality of Cantabria IMPEX services and to understand our customers’ preferences;
i) To submit offers, promotional and marketing messages regarding the products or services provided by Cantabria IMPEX or by its partners, to measure the success of our advertising campaigns, or customize the services according to your needs
j) For any related and/or ancillary purpose of any of the above-mentioned, or any other purpose for which your personal data has been provided to us.
We will process personal data for the purposes mentioned at items h and i, only with your express consent.
5. The legal basis for the personal data processing
Any personal data processing shall be performed based on one of the following:
- Processing shall be performed based on your explicit consent;
- Processing is necessary to execute a contract which you are a party to, or which your organization is a party to, or that processing is necessary to conclude a contract with you or your organization;
- Processing is necessary to carry out a task that serves for a public interest;
- Processing is necessary to comply with a legal obligation;
- Processing is necessary to protect your vital interests or another individual’s;
- Processing is necessary for the purpose of Cantabria IMPEX’s legal interests, unless your interests or your fundamental rights and freedoms prevail over these interests.
6. Personal data recipients
In the processing and storage stream, personal data could be transferred, as appropriate, to the following categories of recipients:
- State authorities (including tax authorities);
- Companies within the Cantabria IMPEX group and its contractual partners;
- Suppliers directly/indirectly involved in the service supply process (for example, IT service providers, billing service providers, marketing service providers, newsletter, customer satisfaction assessment);
- Bank institutions;
- Court or arbitral tribunals, as well as authorities competent to investigate criminal offenses;
Cantabria IMPEX will maintain the control of your personal data and will use appropriate safeguard measures according to the applicable law to ensure the integrity and security of your data.
7. Data transfer abroad
In order to achieve one or more of the goals outlined above, your data may be transferred to countries outside the European Union, which do not provide adequate protection. If the transfer to such countries is necessary, Cantabria IMPEX will require those recipients to protect the data according to the General Regulation on Data Protection (UE) 2016/679 or to other enforceable laws.
Cantabria IMPEX shall take all necessary measures to ensure that your data is adequately protected, regardless of where it is transferred.
8. Data retention time
Personal data collected by Cantabria IMPEX will be processed:
- during the entire period of contract execution
- after the contract termination, for a 10-year period
- after the expiry of the 10-year period, if the retention of personal data collected is necessary in accordance with the enforceable law, or with the retention periods provided for by the relevant legislation and the retention policy established by Cantabria IMPEX.
Personal data collected for the purpose of transmitting the commercial communication will be processed until your consent is revoked.
9. Your rights related to personal data processing
- Right to information – you may request information on your personal data processing activities;
- Right to rectification – you may rectify inaccurate personal data or you can amend it;
- Right to data erasure (“right to be forgotten”) – you may obtain data erasure, if its processing was not legal or in other cases provided by law;
- Right to restriction of processing – you may request the restriction of processing if you challenge data accuracy, as well as in other cases provided by law;
- Right to object – you may especially oppose to data processing based on our legal interest;
- Right to data portability – you may receive, under certain conditions, personal data you have provided to us, in a machine-readable format or you may request that such data is transmitted to another controller;
- Right to lodge a complaint – you may lodge a complaint with the national supervisory authority, regarding the personal data processing;
- Right to withdraw consent – in cases where processing is based on your consent, you may withdraw it at any time. The withdrawal of consent shall only have further effects, the processing performed prior to consent withdrawal shall continue to be valid;
- Additional rights related to automated decisions: you may request and obtain human intervention regarding the processing perspective, you may make your personal point on it and you may challenge the decision.
11. Contact methods
In order to exercise the rights mentioned above, you may send us a written application at the address: B-dul Mircea Voda, Nr 21, Bucuresti, District 3 or an e-mail to firstname.lastname@example.org.
Also, if any of the personal data you provide us has changed, or if you find that we have any incorrect personal data about you, please let us know by using one of the above methods.