PRIVACY POLICY

We are committed to respect your privacy, by complying with all applicable data protection laws and regulations, including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

This policy (together with our Terms and Conditions of this website and any other documents this policy refers to) is meant to inform you on which personal data we collect from you or that you provide to us through this website and how it will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

WHO WE ARE

The data controller is Asociatia Romana pentru Masurarea Audientelor, established under GO no. 26/2000 regarding associations and foundations (“ARMA” or the “Association”). For more information regarding the Association, please visit http://arma.org.ro/ro.

WHAT KIND OF PERSONAL DATA DO WE PROCESS, FOR WHAT PURPOSES AND ON WHAT GROUNDS?

In the process of operating this website, the Association will collect certain information (“personal data”) relating to identified natural persons or which can identify natural persons, which are provided by the users of this website directly (e.g. name, surname, e-mail address) or indirectly (e.g. IP address, the type of internet browser used for navigating our website, the operating system, domain name or domain host through which the user is browsing the website).

We will process personal data for the following purposes, based on the legal grounds indicated for each of them:

Browsing the website. Use of cookies

Our website doesn’t use cookies.

For more information on the use of cookies on this website and the purposes for which they are used, as well as regarding your possibilities to control and/or disable the cookies, please see our Cookies Policy. https://www.arma.org.ro/cookies-policy/?lang=en

This website may contain links to other websites, having their own privacy policies and using of cookies policies. ARMA is not responsible and does not accept any liability for these policies. Please check these policies before sending any personal data to these websites.

Answering your questions, requests or complaints

We will process your personal data, such as name and surname, email address, telephone number and any other information or details you may provide us with in the correspondence, in order to address and answer your queries, complaints or requests, depending on the communication channel you are contacting us, as described below.

	Purpose	Legal ground
1	Answer your queries, complaints or requests by electronic correspondence (e-mail) or telephone	The processing is based on a legitimate interest, allowing us to provide answers to your queries, complaints or requests.

Fulfilling formalities regarding conclusion, execution and termination of the Association’s agreements

We will process the personal data of the representatives of the contractual partners, of their contractual partners, of their employees such us name, surname, position, e-mail address, phone number, signature and any other information or details you may provide us with in the correspondence in order to conclude, execute and terminate the Association’s agreements, as described below:

	Purpose	Legal ground
1	Conclude, execute and terminate the Association’s agreements	The processing is based on a legitimate interest, allowing the contractual partner to fulfil its obligations stipulated by the agreement concluded with the Association.

Fulfilling the legal formalities related to the nomination of the management and control bodies of the Association

We will process the personal data of the members’ representatives who are nominated to the management and control bodies of the Association, such as: name, surname, data and place of birth, citizenship, domicile/residence address, signature, personal numerical code (CNP), series and number of the identity card in order to fulfil the legal formalities required for nomination to the ruling and control bodies of the Association, as described below:

	Purpose	Legal ground
1	To fulfil the legal formalities required for nomination to the management and control bodies of the Association	The processing is required by a mandatory legal provision.

Resolving any judicial issues and / or extra-judicial procedures related to conclusion and execution of the agreements signed with contractual partners (clients, providers, members, other entities).

We will process personal data of the representatives of the members and of the representatives of the contractual partners and/or of any persons acting on behalf of an entity such as: name, surename, profession, place of work, signature, numerical personal code (CNP), series and number of the identity card and any other such information sent to the Association in order to resolve any judicial issues and / or extra-judicial procedures related to conclusion and execution of the agreements signed with contractual partners (clients, providers, members, other entities), as described below:

	Purpose	Legal ground
1	Resolving any judicial issues and / or extra-judicial procedures related to conclusion and execution of the agreements signed with contractual partners (clients, providers, members, other entities)	The processing is based on a legitimate interest for protecting and exercising the rights of the Association.

Management of the relationship with the members of the Association (registering, activity fulfillment, meetings)

We will process personal data of the representatives of the members, such as name, surname, position, place of work, signature, e-mail address, phone number, image, voice, signature in order to administrate the relationship with the members of the Association, as described below:

	Purpose	Legal ground
1	Management of the relationship with the members of the Association (registering, activity fulfillment, meetings)	The processing is based on a legitimate interest, respectively the administration of the rights and obligations of the data subjects deriving from their capacity as representative of a member. For image and voice, the legal ground is data subject’s consent.

Promotion, collaboration and public relations

We will process personal data of the representatives of the national, European Union and international authorities and bodies of the members and representatives of other national, European Union or international associations, such as: name, surname, position, e-mail address, phone number in order to promote Association’s activity, to collaborate with this entities and for public relations, as described below:

	Purpose	Legal ground
1	Promoting Association’s activity, establishing collaborating relationships and for public relations	The processing is based on a legitimate interest, respectively fulfillment of the formalities to initiate and maintain collaborations.

Organizing general assemblies, events, workshops, seminars, conferences, classes

We will process personal data of the representatives of the members, of the representatives of the contractual partners, of the contact persons, of the employees, of the speakers/presenters, of the representatives of the media partners, of the students, such us: name, surname, position, e-mail address, phone number, signature, image, voice in order to organize assemblies, events, workshops, seminars, conferences, classes, as described below:

	Purpose	Legal ground
1	For organizing assemblies, events, workshops, seminars, conferences, classes, including, but not limited to sending invitations, notices on these events, publication of names in related pamphlets (guides, regulations etc.), organized by the Association or actively sustained by the Association, including also photographing and filming and publishing the photos/films on the Association’s website.	The processing is based on a legitimate interest, respectively the administration of the rights and obligations deriving from the capacity as representative of a member of the Association. The processing is based on a legitimate interest, allowing us to organize such assemblies, events, workshops, seminars, conferences, classes. For image and voice and for publishing them on the website and on the pamphlets related to the events, the legal ground is the consent given by the data subject.

Certifying reports with data obtained from the National Service for TV Audience Measurement (SNMATV)

We will process personal data of the representatives of applicants, such as: name, surname, position, place of work, e-mail address, phone number in order to conduct the procedures for certifying the reports with data obtained from SNMATV, as described below:

	Purpose	Legal ground
1	For conducting the procedures for certifying reports with data obtained from SNMATV.	The processing is based on a legitimate interest allowing us to conduct the necessary procedures for execution of the agreement on which the certifying procedures conducted by the Association are based.

Preparing the annual accounts, submitting fiscal declarations and any other legal financial obligations

We will process personal data of the representatives of the members, such us: name, surname, e-mail address, phone number, signature, personal numerical number (CNP), series and number of the identity card in order to prepare annual accounts and for submitting fiscal declarations and any other legal financial obligations:

	Purpose	Legal ground
1	For preparing and submitting annual accounts, fiscal declarations and aby other financial legal declarations.	The processing is based on mandatory legal provisions.

Processing payments due to the suppliers, administration of the balance sheet and accounts reconciliation, keeping of the supporting documents for the payments, payments monitoring, sending notices related to payments, administration of the risks related to defaults on payments, administration of the activities related to collecting due debts

We will process personal data of the representatives of the members and of the representatives of the contractual partners and/or of any person acting in the name and on behalf of such entity, such as: name, surname, position, place of work, e-mail address, phone number, fax number, signature, personal numerical number (CNP) – when necessary for filling in invoices, shipment documents and any other documents related to the relationship with the contractual partner – in order to process the payments due to the suppliers, administration of the balance sheets and accounts reconciliation, keeping the supporting documents for the payments, payments monitoring, sending notices related to payments, administration of the risk related to defaults on payments, administration of the activities related to collecting due debts, as described below::

	Purpose	Legal ground
1	For processing the payments due by the Association to services/goods suppliers/providers or clients of the Association; administration of the balance sheets and accounts reconciliation; keeping the payments supporting documents (e.g. agreements, shipment documents, invoices) concluded by the Association with contractual parties in order to support the payments (accountants and financial purposes). Monitoring the payments due by the clients to the Association, sending notices related to overdue payment terms and the unpaid amounts, administration of the risk of defaults on payments by the clients, administration of the activities for collecting unpaid debts.	The processing is based on the legitimate interest of the Association for conducting its activity by concluding agreements and on legal obligations for registering documents with fiscal authorities.

Voting procedures fulfilled by the members through the website www.vot.arma.org.ro

We will process personal data of the representatives of the members, such as name, surname, position, place of work, signature, e-mail address in order to execute the voting procedures described by the By-Laws of the Association and the voting procedures necessary in carrying out the activities of the Association, as described below:

Purpose

Legal ground

Management of the relationship with the members of the Association (activity fulfillment, meetings, fulfilling the right to vote of the members)

In order to be able to associate the name of the representative of a member with the choice expressed in a voting procedure (if the vote is not declared secret)

In order to generate reports with the names of the representatives of the members and if they voted or not.

The processing is based on a legitimate interest, respectively the administration of the rights and obligations of the data subjects deriving from their capacity as representative of a member.

Management of the relationship with the members of the Association (registering, activity fulfillment, meetings, assemblies) by using providers of audio-video teleconferencing type services

We will process personal data of the representatives of the members, such as name, surname, position, place of work, signature, e-mail address, phone number – provided directly by you and any other type of information provided indirectly when using the said service (IP address, type of browser, session start date, session end date, the number of minutes of the session), image, voice, in order to administrate the relationship with the members of the Association, as described below:

	Purpose	Legal ground
1	Management of the relationship with the members of the Association (registering, activity fulfillment, meetings, assemblies, taking the minutes of the meetings, attendance of the meetings, any other documents needed by activity fulfillment)	The processing is based on a legitimate interest, respectively the administration of the rights and obligations of the data subjects deriving from their capacity as representative of a member. For image and voice, the legal ground is data subject’s consent.

Management of the relationship with the members of the Association (registering, activity fulfillment, meetings, assemblies) by using providers of e-signing type of services for signing the documents of the Association

We will process personal data of the representatives of the members, such as name, surname, position, place of work, signature, e-mail address, phone number and any other type of information provided indirectly when using the said service (IP address) in order to administrate the relationship with the members of the Association, as described below:

	Purpose	Legal ground
1	Management of the relationship with the members of the Association (registering, activity fulfillment, meetings, assemblies, taking the minutes of the meetings, attendance of the meetings, any other documents needed by activity fulfillment)	The processing is based on a legitimate interest, respectively the administration of the rights and obligations of the data subjects deriving from their capacity as representative of a member.

Automated decision making and automated profiling

The personal data referred to herein are not subject to automated decision making, including profiling.

WHO DO WE DISCLOSE YOUR PERSONAL DATA TO?

For reaching the purposes described above, the Association uses the services of various contractors. Some of them are processors of the data, such as: the IT service provider, the accounting and secretarial service providers, SNMATV provider (Kantar Media Audiences S.R.L.), SNMATV related services provider (Armadata S.R.L.) which are carrying out their activity in Romania and may be provided with your personal data to be used within the limits of the obligations assumed towards the Association. The personal data we are disclosing to our data processors are limited to the minimum personal data information which are necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.

Some of them are data processors, such as: the provider of e-signing type services (Adobe Systems Software Ireland LTD) and the provider of the audio-video teleconference type services (Cisco Systems. Inc.) which are carrying out their activity also outside the territory of Romania. They may be provided with your personal data to be used within the limits and obligations assumed towards the Association, according to the adhesion type agreements concluded with end users and according to the public declarations from https://www.cisco.com/c/en/us/about/legal/privacy-full.html and from https://www.adobe.com/ro/privacy/policies-business/esign.html.

Some of them are third parties who are not intended to process the data but may have access to it upon fulfilling their tasks or interacting with the Association, such as technical maintenance companies, shipment companies, financial or legal auditors, companies which provide cloud back-up type services (and which are carrying out their activity also outside the territory of Romania, such as Dropbox Unlimited Company Ireland, https://www.dropbox.com/privacy).

The personal data indicated above may also be made available or submitted to third parties in the following situations: (i) public authorities, auditors or institutions competent to exercise inspections on the Association’s business or assets, which ask the Association to provide information, by virtue of the latter’s legal obligations; (ii) to comply with a legal requirement or to protect the rights and assets of our Association or other entities or people, such as courts of law; (iii) to third parties acquisitors, insofar the business of the Association would be (totally or partially) transferred and the data subjects’ data would be part of the assets representing the object of the transaction.

TRANSFER OF PERSONAL DATA ABROAD

In the context of the operations described above, your personal data may be transferred abroad to states in the European Union (“EU”) or European Economic Area (the “EEA”).

We hereby inform you that any transfer performed by the Association in a EU or EEA member state will observe the legal requirements laid down by the GDPR.

FOR HOW LONG WE STORE YOUR PERSONAL DATA

We will store your personal data only for the period of time necessary to achieve the processing purposes set out above, also by observing the legal requirements in force. In case the Association will ascertain that it has a legitimate interest or a legal obligation to further process your personal data for other purposes, you will be properly informed on this.

We estimate that the processing activities detailed above will require storing the personal data for the following periods:

	Purpose	Duration
1	Browsing the website and the use of cookies	For the duration of the session
2	Answering to your questions, requests or complaints	For the duration necessary to answer the request, but not later than 3 years from the date of their collection
3	Conclude, execute and terminate the agreements concluded by the Association	For the duration of the execution of the agreement, but no more than the legal term applicable for this situation; when no such term, the duration for storing will be 4 years from the agreement termination.
4	To fulfil the legal formalities required for nomination to the ruling and control bodies of the Association	For the duration of exercising the office and for the duration necessary for protecting the rights of the Association, including the terms mentioned by the statute of limitations and the terms mentioned by the legal provisions on accounting and fiscal matters.
5	Resolving any judicial issues and / or extra-judicial procedures related to conclusion and execution of the agreements signed with contractual partners (clients, providers, members, other entities)	For the duration of executing the commercial agreement and for the duration necessary for protecting the rights of the Association, taking into consideration the law applicable to the agreement, including the terms mentioned by the statute of limitations and the terms mentioned by the legal provisions on accounting and fiscal matters/storage duration defined by legal provisions.
6	Administration of the relationship with the members of the Association (registering, activity fulfillment, meetings)	For the duration of the capacity as member representative, but no more than 4 years from losing such capacity. If the representative of a member is replaced during this period, the data of the former representative is stored for 4 years from knowing the replacement. For the processing based on consent, data is stored till the consent is retracted, but no more than the dates indicated above.
7	Promotion, collaboration and public relations	For the duration of the collaboration
8	Organizing general assemblies, events, workshops, seminars, conferences, classes	For the duration of the capacity as member representative, but no more than 4 years from losing such capacity. If the representative of a member is replaced during this period, the data of the former representative is stored for 4 years from knowing the replacement. For the processing based on consent, data is stored till the consent is retracted, but no more than the dates indicated above.
9	Certifying reports with data obtained from the National Service for TV Audience Measurement (SNMATV)	For the duration of executing the agreement, but no more than the term mentioned by the legal provisions in this case. If no such term, the duration will be 4 years from the termination of the agreement.
10	Preparing the annual accounts, submitting fiscal declarations and any other legal financial obligations	For the duration mentioned by legal provisions on accounting and financial documents keeping
11	Processing payments due to the suppliers, administration of the balance sheet and accounts reconciliation, keeping of the supporting documents for the payments, payments monitoring, sending notices related to payments, administration of the risks related to defaults on payments, administration of the activities related to collecting due debts	For the duration of executing the commercial agreement and for the duration necessary for protecting the rights of the Association, taking into consideration the law applicable to the agreement, including the terms mentioned by the statute of limitations and the terms mentioned by the legal provisions on accounting and fiscal matters/storage duration defined by legal provisions.

Management of the relationship with the members of the Association (activity fulfillment, meetings, fulfilling the right to vote of the members)

For the duration of the capacity as member representative, but no more than 4 years from losing such capacity. If the representative of a member is replaced during this period, the data of the former representative is stored for 4 years from knowing the replacement.

Management of the relationship with the members of the Association (registering, activity fulfillment, meetings, assemblies, taking the minutes of the meetings, attendance of the meetings, any other documents needed by activity fulfillment)

For the processing based on consent, data is stored till the consent is retracted, but no more than the dates indicated above.

After the duration of the processing indicated above expires and the Association no longer has legal or legitimate reasons to process your personal data, the data will be deleted in accordance with its procedures, which may involve archiving, anonymizing, destroying it.

PROCESSING OF DATA OF CHILDREN UNDER THE AGE OF 16

All personal data processing presented herein refers exclusively to persons that are at least 16 years old. The use of the systems, as well as the results of the processing is forbidden to children under this age without the consent of their parents/tutors. In case despite our reasonable efforts to prevent it, such processing occurs, we will cease it upon noticing the fact that the users are under the age mentioned above.

SECURITY OF THE DATA PROCESSING

The Association hereby informs you that it constantly evaluates and upgrades the security measures implemented as to ensure a secure and safe personal data processing.

RIGHTSOF THE DATA SUBJECTS

Within the context of the processing of your personal data, you have the following rights:

The right of access to the processed personal data: you have the right to obtain a confirmation whether or not your personal data are being processed, and, if affirmative, to have access to the type of personal data and to the conditions of processing, by addressing a request in this respect to the data controller;
The right to request the rectification or erasure of personal data: you have the possibility to request,by sending a request in this respect to the data controller, the rectification of inaccurate personal data, the supplementation of incomplete data or the erasure of your personal data in case (i) the data are no longer needed for their original purpose (and no new lawful purpose exists), (ii) the lawful basis for the processing is the data subject’s consent, the data subject withdraws that consent, and no other lawful ground exists, (iii) the data subject exercises the right to object and the controller has no overriding grounds for continuing the processing, (iv) the data have been processed unlawfully, (v) erasure is necessary for compliance with EU law or Romanian law, or (vi) the data were collected in connection with the informational society services offered to children (if the case), where specific requirements regarding consent are applicable;
The right to request the restriction of processing: you have the right to obtain the restriction of processing in cases where: (i) you consider that the processed personal data are inaccurate, for a period enabling the controller to verify the accuracy of the personal data; (ii) the processing is unlawful, however you don’t want us to erase your personal data, but to restrict the use of data; (iii) in case the data controller no longer needs your personal data for the above-mentioned purposes, but you are requiring the data for establishing, exercising or defending a legal claim or (iv) you have objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject;
The right to withdraw your consentfor processing, when the processing is based on consent, without affecting the lawfulness of processing undertaken until that moment;
The right to object to the data processing on grounds relating to your particular situation, when the processing is based on legitimate interest and to object at any moment to the data processing for direct marketing purposes, including profiling;
The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly affects the data subject in a significant manner;
The right to data portability, meaning the right to receive your personal data, which you provided to the data controller in a structured, commonly used and machine-readable format and the right to transfer those data to another controller, if the processing is based on your consent or the performance of a contract and is undertaken by using automatic means;
The right to file a complaint with the Data Protection Authority (ANSPDCP) and the right to address to the competent courts of law.

The exercising of the above rights may be performed at any time. For using these rights, we encourage you to address a written notice, dated and signed or in electronic format at the following address: Bucharest, 3A Promoroaca Street, 3rd floor, 1st District or by email at contact@arma.org.ro.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be changed and updated by the Association from time to time as it could become necessary. The Association will notify you of any material or substantive changes to this Privacy Policy and will ensure that the notification is made in a way which ensures that you acknowledge them, for example by use of the e-mail address that you have provided to us, or any other appropriate means that ensure effective communication.

CONTACT

You may address any question regarding this document by using the following contact details: contact@arma.org.ro.