Loading ...

Eveniment ”RACEBOX THE TOUR inspired by TIRIAC COLLECTION”

— Jul 16, 2024

PRIVACY NOTICE

regarding the processing of personal data 

”RACEBOX THE TOUR inspired by TIRIAC COLLECTION”

 

We, Car Gallery S.R.L., headquartered in Bucharest, 24-26 Nordului Road, District 1, Room 10, 2nd floor, Bucharest, registered at the Trade Register under no. J40/3330/2003, having the Tax registration code RO15262492, hereinafter referred to as the " Company ", the "Controller" or ”Car Gallery, hereby provide you with all the necessary information about how and why we collect, use and disclose your personal data in the context of your participation at the event ”RACEBOX THE TOUR inspired by TIRIAC COLLECTION ("the Event")according to the provisions of art. 13, respectively art. 14, of the General Data Protection Regulation ("GDPR").


For any other information or requests regarding the processing of your personal data, or to exercise your rights according to the GDPR, you can contact our Data Protection Officer using the following contact details:

Address: 24-26 Nordului Road, District 1, Bucharest;

Email to: dataprotection@tiriacgroup.ro;

Phone: 0040214312149.

 

Please read this Privacy Notice carefully, as it contains important information for you!

 

PERSONAL DATA PROCESSED, PURPOSES, GROUNDS OF THE PROCESSING AND RETENTION PERIODS

Thus, personal data is processed as follows:

To promote the Event, we will take environmental photos/videos that will capture the location (wide-angle materials aimed at capturing the general atmosphere of the Event without the purpose of identifying individuals) to enhance our brand image. As a rule, we will not seek to take photos/videos that lead to the identification of participants.

From the photos/videos taken during the Event, we will select some for online promotion and social media, while the others will be archived. However, some photos/videos may still capture the image of participants. Therefore, processing is carried out based on your consent expressed by participating in the Event.

It is also possible that your image will be captured in the photos/videos taken during the Event by the other partners of the Event and shared by Car Gallery on its own social media pages.

In the case of close-up images (portrait-type photo/video materials, or those featuring individuals), you can express your preference regarding Event photos (even verbally or through your conduct in front of the camera). If you do not wish to appear in these close-up/portrait frames, please express your refusal to be photographed.

To ensure and maintain security and protection of the premises, property, assets, and individuals, in accordance with our obligations, we utilize video surveillance systems. In this context, the video systems collect data including video/photo images of individuals and/or vehicles within or in the vicinity of our premises, vehicles registration numbers, or other information that, through association, can become personal data. The legal basis for processing is the necessity to fulfil legal obligations imposed on us by the applicable legislation concerning the protection of premises, property, assets, and the safeguarding of individuals, specifically Law no. 333/2003, as amended, in accordance with art. 6 para (1) letter (c) of the GDPR. Additionally, in the legitimate interest of preventing property loss or damage, as well as to establish or exercise a right, or defend in the context of legal claims, in accordance with art. 6 para (1) letter (f) of the GDPR.

The storage duration for data obtained through the video surveillance system is 30 days, except in cases expressly regulated by law or in well-justified circumstances (for example, in the case of an investigation, requests from authorities, requests from you, or in case of a dispute). Relevant images will be retained for the entire duration of such circumstances and subsequently, in accordance with applicable limitation periods. In the event of the exercise of a right, we will retain proof of the resolution of your request in accordance with applicable limitation periods. Upon expiration of the storage periods, the data will be securely destroyed or overwritten, as applicable, based on the storage medium.

In addition to the previously indicated purposes, we will process your personal data for the following subsequent and/or later purposes, if and as the case may be:

for compliance with the legal norms that regulate different segments of our activity, such as: reporting obligations to public authorities and institutions, the obligation related to providing you with the necessary information about the manner in which we process your data, obligations in financial and accounting matters, as well as any other obligations that may derive from the normative acts in force at a given time and which are applicable to us.

for the exercise and defence of our rights, including before public authorities and courts or arbitration, according to art. 6 para. (1) letter f) of the GDPR. Depending on the specific situation, personal data will be stored according to the retention terms established by the internal nomenclature, considering the applicable laws.

for managing IT systems (information technology), such as ensuring maintenance and carrying out security audits on our IT systems and networks, pursuant to art. 6 para. 1 letter f) of the GDPR, in order to achieve our legitimate interest in ensuring the security and proper functioning of IT systems and the entire infrastructure. The personal data existing in our IT systems will be kept according to the legal terms or established according to the main purpose of the processing described above.


CATEGORIES OF RECIPIENTS 

Personal data may be disclosed, only to the extent necessary for the purposes detailed above or in cases required by law, to the following categories of recipients who may act as independent controllers, joint controllers, or data processors, as follows:


Service providers:

- marketing,

- outsourced data protection officer,

- security and protection services,

- cloud services,

- communication services,

- archiving services,

- maintenance services,

- IT systems,

- anonymization services for the photo/video images,

- photo/video services,

- social media platform, as the case may be, such as Facebook, Instagram, YouTube (in these cases, please consult their privacy notices available as follows https://www.facebook.com/privacy/explanation, https://help.instagram.com/519522125107875, https://policies.google.com/privacy?hl=en).

judicial or arbitral tribunals and/or other public authorities, related to the activity of these authorities to the extent that the transmission of data to them is required by law and/or is necessary in case of litigation or settlement of a dispute, as well as in case of controls or legal requests in which we have the obligation to make them available (for example ANSPDCP, police, prosecutor's office, others);

lawyers, specialists in the fields of audit, legal, tax consultancy etc.;

third parties expressly indicated by you;

third party acquirers, to the extent that the activity would be transferred (in whole or in part) to another entity, and the data of the data subjects would be part of the assets that are the subject of such a transaction, based on a legitimate development interest and adaptation of our business activities.

The disclosure of your personal data to our service providers who act as data processors is limited to the information strictly necessary for the provision of those services, these providers having the contractual obligation not to use the personal data processed on our behalf for no other purpose.


TRANSFERS TO THIRD COUNTRIES OR INTERNATIONAL ORANIZATIONS

As a rule, we will not transfer your personal data outside the European Economic Area, respectively in countries that are not agreed as ensuring an adequate level of data protection. In exceptional situations and only if necessary, the transfer of your personal data outside the area described above will be made only by applying adequate guarantees and protection measures according to the specific legal provisions on the protection of personal data and with your appropriate information.


YOUR RIGHTS REGARDING PERSONAL DATA

Except the cases in which Romanian law or GDPR provides otherwise, you have the following rights:

  • The right to be informed: The Controller facilitates this right by making available this Information Notice, as well as other particular information notices when requesting your personal data.
  • The right of access to personal data concerning you: you have the right to obtain confirmation as to whether or not your personal data is being processed by the Controller and, if affirmative, to have access thereto and to obtain information on the processing, under the conditions of art. 15 of GDPR.
  • The right to request the rectification of personal data, if it is incorrect or incomplete, under the conditions of art. 16 of GDPR.
  • The right to request deletion of personal data: you have the possibility to request the Controller to delete your personal data if (i) the data is no longer necessary for the purposes for which it was collected or processed, (ii) the legal basis for the processing is your consent and you withdraw your consent and there is no other legal basis to continue the processing, (iii) you exercise your right to object (where applicable) and the Controller has no overriding legitimate basis to continue the processing, (iv) the data has been processed unlawfully, (v) the deletion is necessary for compliance with EU or Romanian law.
  • Please note that the right to deletion is not an absolute right and we may continue the processing of your personal data when the above conditions are not applicable or when the processing is necessary for (i) exercising the right to free expression and information, (ii) compliance with a legal obligation, (iii) archiving in the public interest or (iv) establishing, exercising or defending a right in court.
  • The right to request restriction of the processing: you have the right to obtain the restriction of processing in cases where: (i) you consider that the processed personal data is inaccurate, for a period of time that allows the Controller to verify the accuracy of personal data; (ii) the processing is illegal, but you do not want us to delete your personal data, but to restrict the use of such data; (iii) if the data Controller no longer needs your personal data for the purposes mentioned above, but you need the data in order to establish, exercise or defend a right in court; or (iv) you have objected to the processing, for the period of time in which we verify whether the legitimate grounds of the data Controller prevail over the rights of the data subject;
  • The right to withdraw your consent at any time

You have the right to withdraw your consent at any time by submitting a request using the contact details indicated on the first page of this information.

  • The right to object to the data processing on grounds related to your particular situation, when the processing is based on the legitimate interest of the Controller.
  • Please note that, even in case of exercising the right to object, we will still be able to process your personal data if we demonstrate that your rights and freedoms do not prevail over our legitimate interest.
  • The right not to be subject to a decision based exclusively on automated processing, including profiling, which causes legal effects on you or similarly affects you in a significant manner.
  • The right to data portability, meaning the right to receive your personal data that you have provided to the Controller in a structured, commonly used and machine-readable form, as well as the right to transfer that data to another controller, if the processing is based on your consent or the performance of a contract and is carried out by automatic means.
  • The right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) or another competent supervisory authority. The contact details of the National Supervisory Authority for Personal Data Processing:

address: Bucharest, 28-30 Gen. Gheorghe Magheru Blvd., 1st District, PC 010336

phone: +40.318.05.92.11

fax: +40.318.05.96.02

email: anspdcp@dataprotection.ro

website: www.dataprotection.ro

  • The right to appeal to courts

Please note that if we have any doubts about the identity of the access requester, we may ask for additional information to confirm the identity.

If you have addressed the Company or sent us a request to exercise the rights recognized by the GDPR, you will receive a response within one month at the latest from the receipt of the request. The period can be extended by two months, for justified situations and with your appropriate information.


STORAGE OF PERSONAL DATA 

The personal data processed for the purposes mentioned in this notice will be kept during the Event, and subsequently archived and retained for the statutory limitation period of 3 years, accessed only to defend our rights, and in case of data with tax relevance, these will be retained for 10 years, a period calculated from July 1 of the year following the conclusion of the last financial year in which they were used, as follows: a period of 5 years to comply with the legal obligation of retention according to art. 25 para. (1) of Accounting Law no. 82/1991, republished, with subsequent amendments, to which we add another period of 3 years to comply with the general limitation period, followed by an additional period of 2 years considering the legitimate interest of the entity to keep the documents for archive management analysis.

Regarding photographs, we mention that we make every effort to ensure that these do not lead to your identification. However, some of them will be posted in the public space (social media pages, etc.), and may be taken over by third parties. Car Gallery will keep the photos on its own pages for 5 years.

You have the right to request the deletion of these at any time.

Subsequently, we will delete/remove the personal data from our systems and records and/or take measures to anonymize them so that you can no longer be identified. We will take all reasonable measures to ensure the deletion of personal data transmitted to recipients for the purposes mentioned above.


AUTOMATED DECISION MAKING AND PROFILING

The personal data referred to herein is not subject to automated processes.


Adopted on 16.07.2024

Tiriac Collection APP

Visit Tiriac Collection when and where you feel like it! 

A 360º virtual Walkthrough Experience inside our mobile app.

Download App Download App
 

Visit us

Calea Bucurestilor 289. Otopeni. Ilfov
Get directions

 

Opening hours

Mon. Thu. Wed. Thu. Closed
Fri. Sat. Sun. 10:00 - 19:00