SOCAR PETROLEUM SA POLICY REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA

 

GENERAL PROVISIONS

In order to carry out its activities, Socar Petroleum SA (“Socar”) processes personal data of certain categories of individuals. These may include personal data of the users of this website, of the customers or of the collaborators / contractual partners of Socar.

Personal data refers to information about an identified or identifiable individual, namely information about a person whose identity is either obviously clear, or can be, at least, established by obtaining additional information.

If the data about such a person is processed, this person is referred to as the “data subject” within the meaning of the legislation in the field of personal data protection.

 

THE PURPOSES, GROUNDS AND CATEGORIES OF PERSONAL DATA

According to the provisions of Regulation no. 679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (“GDPR”), the data processed by Socar through this website or for conducting its activity can be used for purposes such as:

  1. For the performance of the contract of purchase of goods and the management of the relationship with the customers, which include operations such as selling, carrying out payments and drawing up financial-accounting documents, based on art. 6 para. (1) pt. b) and f) of the GDPR, as the case may be, Socar processes the last name, the first name, address and payment dates.
  2. For the performance of the fuel purchase contract based on a fuel card, based on art. 6 para. (1) pt. b) and f) of the GDPR, as the case may be, Socar processes personal data such as first and last name, username, customer representative position, phone number, e-mail address, card data, customer / customer representative ID data, and signatures;
  3. For the performance of the contract for the purchase of road fees / road tolls and the fulfilment of the legal obligations imposed by the legislation incident in this matter, based on art. 6 para. (1) pt. b), c) and f) of the GDPR, as the case may be, Socar collects the following categories of data: first and last name (only in case of issuing tax invoices), registration number, country of registration, date and time of issue / expiration of the road fee / road toll (insofar as they lead to the identification of the person), VIN, signature, address (only in case of issuing tax invoices), copy of registration certificate (only in case of correction of the registration number), road fee / road toll series and unique transaction series;
  4. For conducting wholesale operations, including by filling in the form available at the Wholesale section, the following categories of personal data may be collected: first and last name, home address, position, workplace, department, phone no., e-mail address, ID data, data in the driving license, as well as signatures, based on art. 6 para. (1) pt. b) of the GDPR;
  5. Administration and maintenance of the socar.ro website, which also includes the use of cookies, to ensure fast and easy interactions between users and website, based on art. 6 para. (1) pt. a) and f) of the GDPR.

The Website uses Google Analytics, which is a web analytics service provided by Google, Inc. (certified Safe Shield supplier), which, in turn, uses cookies. Through this service, Socar processes personal data such as interest categories, the language preferred by the user, location, technology, devices, browser, IP or other identifiers of the devices with which you access this website.

For more details, see the Terms and Conditions section, which also includes the Cookies Policy.

Please note that after entering your personal data in one of the sections of the website, you express the express and unequivocal agreement so that the owner of the website can use this data for the purpose for which you provided the data.

  1. For conducting personnel recruitment operations, including by filling in the form available in the Careers section on this website and for accessing the Contact section, based on art. 6 para. (1) pt. a) of the GDPR, Socar processes the following categories of personal data: first and last name, e-mail address, phone number, and in the case of the Careers section, also data from your CV;
  2. For conducting advertising campaigns, based on art. 6 para. (1) pt. a), c) and f) of the GDPR, Socar collects personal data such as first and last name, image, voice, contact details or other data required by the tax provisions, as the case may be;
  3. For the protection of the goods, persons and premises of Socar by using video monitoring devices, in the Socar stations and at the registered office of Socar, based on art. 6 para. (1) pt. c) and/or f) of the GDPR, as the case may be, Socar processes your image by automated means and the registration number of your vehicle;
  4. For solving your requests, questions or complaints, based on art. 6 para. (1) pt. a), b) and/or f) of the GDPR, as the case may be, Socar processes the first and last name and the contact details provided by you;
  5. For conducting labour relations, which involve data processing for the performance of employment agreements, the fulfilment of legal obligations and / or the fulfilment of a legitimate interest, based on art. 6 para. (1) pt. b), c) and f) of the GDPR, Socar processes personal data of its employees, as they were detailed in the information note provided to employees; in certain particular situations, which exceed the performance of the employment agreement, Socar processes the data of the employees on the basis of their consent, based on art. 6 para. (1) pt. a) of the GDPR;
  6. For communication with our contractual collaborators and partners, based on art. 6 para. (1) pt. a), b) and/or f) of the GDPR, as the case may be, Socar processes personal data such as first and last name and contact details;
  7. For the purchase of real estate or the transfer of substantive rights to Socar, pursuant to art. 6 para. (1) pt. b) and f) of the GDPR, as the case may be, Socar processes personal data such as: first and last name, the data contained in the identity document, the data included in the title deed, the data contained in the tax registration certificate, the data contained in the energy certification and the data contained in the Land Registry extract. Also, to the extent that Socar carries out an analysis of the history of ownership, it is possible to process personal data of persons with whom it does not have a direct relationship, such as the family members of the seller, the legal representatives of the seller or other persons appearing in the history of ownership.
  8. For the preparation of the civil liability insurance file, to the extent that incidents occur in Socar stations, which cause damages to certain people, based on art. 6 para. (1) pt. a) of the GDPR, Socar processes personal data such as first and last name, the data contained in the identity document, the data included in the registration certificate of the vehicle, the data included in the driving license, phone number and the data contained in the statements.

 

WAYS OF PROCESSING PERSONAL DATA AND THE TRANSFER OF SUCH DATA

Socar processes your personal data for the period of time required to perform the contracts, to comply with the legal obligations specific to our field of activity or according to the applicable limitation periods or to comply with the archiving obligations imposed by the applicable legislation (for example, those specific to the fiscal and financial-accounting field, which require the keeping of financial-accounting documents for a period of 10 years). In the case of CVs transmitted through this website, they are stored for 6 months. Personal data processed through video monitoring will be stored for a period of 30 days for each and every recording.

After the end of the storage period, personal data will be destroyed or deleted from the computer systems or transformed into anonymous data insofar as it will be necessary to use them for scientific or statistical research purposes. Please note that in certain expressly regulated situations, we store the data for the period that is required by law.

When consent is the basis for the processing of personal data, Socar will inform you about this before giving the consent. You have the right to withdraw your consent at any time, specifying that this does not affect the legality of the processing carried out on the basis of the consent before its withdrawal.

Personal data of minors (such as: first and last name, address, phone number, educational establishment, other personal data thereof, personal data of family members) will not be processed by Socar, without the prior consent of their parents / legal representatives.

If Socar intends to use your data for a different purpose than the one for which the data were collected, Socar will inform you, in advance of the further processing, regarding the secondary purpose, and will make available any other imperative information according to the law.

Your personal data are processed by the Socar personnel who has the role to process this data. Where there is a legal ground, your data may be transmitted to our lawyers, partners who provide correspondence services, insurers, consultants and auditors. In special situations, at the request of the judicial bodies, your data may be transmitted.

Your personal data will not be transferred to a third country that does not provide a proper degree of protection.

 

RIGHTS OF DATA SUBJECTS

Your rights regarding the processing of personal data, as provided in the GDPR, are the following: the right to information, the right to access data, the right to rectify data, the right to delete data, the right to restrict data, the right to be notified of the rectification or deletion of personal data, the right to data portability, the right to object, the right not to be subject to an individual decision, the right to address the competent authority in the field of personal data protection and the competent courts.

The rights listed above are not absolute. There are exceptions, which is why each request received will be analyzed so that we decide whether it is well-founded or not. To the extent the request is well-founded, we will facilitate the exercise of your rights. If the request is unfounded, we will reject it, but we will inform you about the reasons for the refusal and about the rights to file a complaint with the National Supervisory Authority for Personal Data Processing and to address the justice.

 

WHOM CAN YOU ADDRESS?

For the exercise of these rights, you can send a written request, dated and signed, to the attention of the person in charge with the protection of personal data, at dpo@socarpetroleum.ro. In the request, it will be specified whether it is desired that the information be communicated to a certain address (even e-mail address) or through a correspondence service that will ensure the personal delivery.

Your personal data will not be subject to an automated decision-making process.

We will try to respond to your request within 30 days. However, the term can be extended under the conditions of the law, depending on different aspects, such as the complexity of the request, the large number of requests received or the inability to identify you in due time.

If we make every effort and fail to identify you, and you do not provide us with additional information to be able to identify you, we are not obliged to respond to the request.