In accordance with the EU General Protection Regulation (EU Regulation 2016/679, “GDPR”) applicable as of May 25, 2018, ASSOCIATION “DARUIESTE ARIPI” (the “Association”) hereby informs you of the following:
For the Association’s legal purposes, the enforcement, or the renewal, as applicable, of the contracts/agreements/partnerships concluded by the Association, your personal data, including, without limitation, those on a copy of your identity card or on any other identity documents, as applicable, concerning your health status, image, etc. shall be collected and processed by the Association. Consequently, in the absence of the necessary personal data provided by you, the Association will not be able to provide the services that constitute the object of the contract you entered in with us and/or to enforce the contracts the Association is a party to. In the event of a subsequent processing for statistical purposes, such processing shall observe the minimal data use principle, and, where possible, it shall exclude the processing of personal data; the data shall be processed in an aggregate form, and they shall not be used in support of measures or decisions against a specific private individual.
Your personal data shall be processed by the Association for the following purposes:
- Providing information supply services concerning patients’ rights, offering counseling on obtaining the medical opinion of hospital units located in Romania and in EU member states, organizing public events and awareness raising campaigns, designing and managing fundraising projects, organizing and sponsoring scientific and educational activities and reunions, purchasing medical equipment and devices, supporting medical personnel in their publishing work and other activities under the law, in accordance with the Association’s legal purposes;
- Marketing and statistics, provided that you have given your consent for this processing purpose;
- Carrying out legal obligations and requirements issues by other authorities.
Your personal data shall be processed based on:
- The Contract/Agreement/Partnership you are a party to, request to conclude or based on which you request that a service be provided by the Association;
- Your consent, as per the relevant Agreement Form;
- Certain legal obligations.
Your personal data can be transferred, as applicable, to the following: State authorities (including courts of law, tax authorities), service providers, intermediaries, specialized medical units, other Associations or Foundations and other recipients expressly empowered by the Association, located in Romania or in EU member states, in accordance with the applicable legislation concerning personal data protection and with the processing purposes.
Your data, collected as described herein above, shall remain in the Association’s database throughout the duration of the Contract/Agreement/ Partnership or of the service provision and it shall subsequently be stored for a duration of 3 to 5 years as of the contract end date. Where a legitimate interest justifies it or if storing of the collected personal data is necessary under the domain’s applicable legislation, the Association shall store and process specific data for a longer duration, without, however, exceeding the legal limit.
The personal data collected under an express and validly expressed consent and/or for marketing communication purposes shall be processed until the date you withdraw such consent.
As of May 25, 2018 you have the following rights under the GDPR Regulation:
- Right of access by the data subject – you can request access to your personal data;
- Right of rectification or updating – you have the right to obtain from the Association without undue delay the rectification of inaccurate personal data;
- Right to erasure – you have the right to obtain from the Association the erasure of personal data concerning where one of the following grounds applies:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- You withdraw consent on which the processing is based, and where there is no other legal ground for the processing;
- You do not agree to the data being processed for direct marketing purposes;
- The personal data have been unlawfully processed;
- The personal data have to be erased for compliance with a legal obligation under the European Union or Member State law to which the Association is subject;
- Right to restriction of processing – you have the right to obtain from the Association a restriction of processing for your personal data where one of the following grounds applies:
- you contest the accuracy of your personal data, for a period enabling the Association to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- the Association no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
- you have objected to processing pursuant to your right to object, pending the verification whether the legitimate grounds of the Association override yours.
- Right to data portability – you have the right to receive your personal data from the Association in a structured, commonly used and machine-readable format or, to the extent that it is technically possible, to have those data transmitted to another organization;
- Right to obtain confirmation of the fact that your personal data have or have not been processed and communicated in an intelligible format;
- Right to change or withdraw consent. This right only applies if you have given your consent – you can withdraw your consent to have your personal data processed, at any time, without injury to the legality of the consent expressed prior to such revocation;
- Right to opposition – you can oppose the processing of your personal data, except where the Association proves to have lawful reasons in support of such processing;
- Right to be communicated any correction or erasure or processing restriction;
- Right to being notified in the event of a data breach;
- Right to file a complaint with the National Supervisory Authority for Personal Data.
In the event that, irrespective of the motive, you (also) send us the personal data of another person please communicate this Notice to such third party as well and collect such third party’s Consent, where applicable. If the communicated personal data are those of a minor, the minor’s parent or legal guardian shall be informed hereof.
Should you have any requests concerning the exercise of the rights referred to herein above or a consent withdrawal, as well as for any questions concerning the provisions hereof, please contact the Association – e-mail address: firstname.lastname@example.org – and/or the contact person, Loredana Stefan, mentioning your postal address in the message header.