General Information Notice on the Protection of Personal Data

NEPTUN S.A., headquartered in Câmpina, 57–63 Bobâlna Street, Prahova County, registered with the Trade Register under no. J29/2/1991, tax identification number RO1322535, acting as the “Controller”, collects and processes personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

For the purposes of the Regulation, “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific elements relating to their physical, physiological, genetic, mental, economic, cultural or social identity.

Methods of Collecting Personal Data

The Company collects and processes data provided by data subjects (representatives of organizations, contact persons within such organizations, as well as any other persons involved in the conclusion and performance of contracts concluded between the Company and beneficiaries, customers and potential individual customers, suppliers, service providers, collaborators), and in certain cases justified by the requirements of carrying out its activities, data obtained from public registers.

Purpose of Data Processing

Personal data will be processed by manual and/or electronic means for the following purposes:

  • Conducting the negotiation process, as well as concluding and performing the contract with you;
  • Carrying out commercial activities involving the sale and provision of services, as well as post-sale activities specific to conducting, maintaining and improving business relationships;
  • Establishing, exercising or defending the Company’s rights before courts of law;
  • Ensuring the security of property and persons on NEPTUN premises and at its points of operation, preventing and detecting any security and/or fraud threats;
  • Fulfilling a legal obligation;
  • Sending data subjects, on the basis of the Company’s legitimate interest, offers and information regarding the products and services offered.

The provision of certain personal data concerning you is necessary for the purposes indicated above; therefore, any refusal to provide such data may prevent the Company from negotiating and concluding a contract with you, selling products to you or providing services to you, or responding to any requests or complaints you may have.

Categories of Personal Data

For the purposes specified above, NEPTUN generally collects and processes the contact details of data subjects, necessary for conducting the business relationship with contractual partners, such as: first name, last name, position, email address, telephone number and signature.

For the purpose of fulfilling our legal obligations (issuing financial and accounting documents, delivery documents, etc.), in addition to the personal data mentioned above, the following may also be processed: identity card series and number, as well as the personal identification number (CNP).

Lawfulness of Data Processing

Any processing of personal data will be carried out on the basis of one of the legal grounds provided for in Article 6 of the General Data Protection Regulation (Regulation (EU) 2016/679), namely:

  • The data subject has given their consent to the processing of their personal data for one or more specific purposes;
  • Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
  • Processing is necessary for compliance with a legal obligation to which the Controller is subject;
  • Processing is necessary to protect the vital interests of the data subject or of another natural person;
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.

Disclosure of Personal Data

As a general rule, the data of data subjects will only be accessed by authorized employees of the Company and only to the extent necessary for the performance of their duties.

However, for the purposes mentioned above, certain personal data may be disclosed to:

  • Processors appointed by the Controller, which the Company may engage for the purpose of carrying out its current activities (IT service providers, invoicing services, document delivery services, marketing and advertising services, other companies belonging to the group, experts, consultants, lawyers, etc.);
  • Public authorities and institutions, for the purpose of fulfilling legal obligations and/or protecting our legitimate interests (courts of law or arbitration courts, criminal investigation authorities, tax authorities, other public-interest entities — bailiffs, notaries, banking institutions, etc.).

Any transfer of data is carried out in compliance with the principles set out in Article 5 of the Regulation, namely:
lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.

Transfer of Personal Data Abroad

In the context of carrying out the activities mentioned above, your personal data may be transferred to countries within and outside the European Economic Area. In such cases, the Company will ensure that appropriate data protection measures are implemented and that recipients comply with the requirements of personal data protection legislation.

Data Processing Period

NEPTUN S.A. will retain your personal data in accordance with the principles of proportionality and necessity, for the period necessary to fulfill the purposes for which they were collected, including compliance with applicable legal, accounting or reporting obligations.

Rights of the Data Subject

In accordance with Regulation (EU) 2016/679, data subjects have the following rights:

  • The right to information and access to data (Articles 13–15);
  • The right to rectification (Article 16);
  • The right to erasure of data (“the right to be forgotten”) (Article 17);
  • The right to restriction of processing (Article 18);
  • The right to data portability (Article 20);
  • The right to object (Article 21);
  • The right not to be subject to a decision based solely on automated processing, including profiling (Article 22);
  • The right to withdraw consent, where processing is based on your consent (Article 7); withdrawal does not affect the lawfulness of processing carried out up to that point;
  • The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (Article 77) and the right to bring proceedings before the competent courts.

In order to exercise these rights, data subjects may submit a written, dated and signed request to the following address:
57–63 Bobâlna Street, Câmpina, Prahova County, or by email at: [email protected].

Changes to the Information Notice

The most recent update to this Information Notice was made in February 2020.

We reserve the right to update or modify this Information Notice at any time. In such a case, we will inform you by publishing a new version on our website or through other appropriate means of communication.