Privacy policy

The European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data(the “Regulation”) has been in force since 25 May 2018. The main purpose of the Regulation is to increase the level of protection of personal data and to create a climate of trust that enables each person to exercise the rights recognised in relation to the personal data processed in connection with his/her person. Therefore, we consider it appropriate to inform you how we have committed ourselves to the provisions of the Regulation.

Purposes of Processing

We process your personal data to the extent allowed or required by the applicable law for the following purposes, as the case may be:

• to communicate with you in order to permanently inform you about the development of the requested service, to analyse and improve our services and communications to you;
• to manage and administer the business relationship between you and ZIROM, including payment processing, accounting, audit, invoicing and collection services;
• to comply with our legal obligations (such as the obligation to identify the clients in order to perform integrity checks for purposes of preventing and identifying frauds);
• to protect the security and to manage the access to our headquarters, IT and communication systems, websites and other systems, to prevent and detect security threats, frauds or other criminal activities;
• to comply with the court judgments and to exercise and/or defend our legal rights; and
• for any purpose related and/or additional to any of the above.

Categories of Personal Data

The data processed by ZIROM are only those required for the above mentioned processing purposes and may include, as the case may be:

• personal identification data, such as name and surname, date and place of birth, personal numerical code and other identity card data;
• occupational data, such as your job title and name of the company/entity you belong to, business address, phone number, e-mail address and other similar data;
• payments made to ZIROM, requests and projects, and any other data related to your interaction with ZIROM;
• information collected from public sources and databases;
• IP address etc.

We collect your personal data directly from you and, in certain circumstances, including:

• when you navigate, request information or interact on our website;
• when you render or offer to render services for us;
• when you willingly communicate us, for any reason, your personal data.

Grounds for your Personal Data Processing

Any operation which is equivalent to processing your personal data will be carried out based on one or several of the legal grounds described below:

• the processing is based on your consent as legal ground for collecting, storing and using your personal data, as allowed by the applicable law;
• the processing is required for the fulfilment of an agreement to which you are a party or such processing is required for entering into an agreement with you;
• the processing is required for the compliance with a legal obligation;
• the processing is required for the protectionof your vital interests or those of another natural person;
• the processing is required for the legitimate interests of ZIROM or of a third party, unless your interests orfundamental rights and freedoms prevail over such interests.

Disclosure to Third Parties

We may transfer your personal data to our processors, mainly to the service providers within or outside ZIROM, in order forthem to process your personal data for the authorised purposes, on behalf of ZIROM and strictly based on ZIROM instructions.

The transfer of your personal data to the above mentioned recipients will be done only on the basis of their commitment to maintain confidentiality and to ensure an appropriatesecurity level, whereas they warrant that your personal data are kept secure.

Retention Period

Personal data processed for the purposes specified herein will be retained only as long as it may be necessary during your relation with ZIROM, as well as subsequently for the retention periods required under the applicable law. Should any legal proceedings be initiated, the personal data may be retained until the end of such proceedings, including throughout any period of appeal or second appeal, and then they will be erased or archived, as provided by the applicable law.

Basically, your personal data will be kept for as long as it is required or permitted under the applicable law. Subsequently, after the expiry of such periods or upon your exercising one of your rights, as provided by law, we will remove/erase your personal data from our systems and records and/or will take actions for their anonymisation so that you may no longer be identified based thereon.

Your Legal Rights

Under the applicable laws, you have the following rights:

1. Right of access to personal data - You have the right to be informed, upon request, as to whether or not your personal data are being processed, and, where that is the case, to request access to them. The access information includes, inter alia, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom your personal data have been or will be disclosed.
   You have the right to obtain a copy of your processed personal data. For any additional copies, we may charge a reasonable fee based on administrative costs.
2. Right to data portability - You have the right to receive your personal data in a structured, commonly used and machine-readable format and you have the right to transmit those personal data to another entity without any objection on our part.
3. Right to rectification - You have the right to request that your inaccurate or incomplete personal data be rectified or updated.
4. Right to erasure (“the right to be forgotten”) - You have the right to ask us to erase your personal data, without undue delay, in the following situations:
   • personal data are no longer required for thefulfilment of the purposes for which they have been processed;
   • you withdraw your consent and there is no other legal ground for processing;
   • you oppose to the processing and there is no other legitimate basis to prevail;
   • personal data have been processed illegally.
5. Right to restriction of processing - You have the right to request the restriction of your personal data processing. In this case, those data will be marked and may be processed by ZIROM for certain purposes only.
6. Right to object–You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we may be requested to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. You will not incur any costsfor exercising this right.
   Such right may be cancelled, in particular, if the processing of your personal data is necessary for the steps prior to entering into a contract,for the fulfilment of analready concluded contract or for the fulfilment of a legal obligation.
7. Right to lodge a complaint at our headquarters and / or with the National Supervisory Authority for Personal Data Processing when you consider yourself or your legal rights harmed.

All these rights can be exercised by a written, signed and dated request, sent to headquarters of ZIROM S.A. at Sloboziei Road, km 4, Giurgiu, or by e-mail to GDPR@zirom.ro or GDPR@zirom-titanium.com

Versions of this Personal Data Processing Policy

This Policy will become effective as of November 19, 2018.

This Policy may be updated from time to time. Any updated version will become effective as of the date of its publication on ZIROM website, www.zirom-titanium.com, or as of the date it is communicated to you in any way.