Impact Developer & Contractor SA, headquartered in Bucharest, Romania, at Willbrook Platinum Business & Convention Center, Building A, floor 1, Bucuresti – Ploiesti Road, no. 172 – 176, Sector 1, registered at the Trade Register with J40 / 7228/2018, fiscal code RO 1553483 and Bergamot Developments S.R.L, based in Bucharest, at Șos. Bucharest-Ploiesti, 172-176, Willbrook Platinium & Convention Center, Building A, floor 1, office no. 1, Sector 1, registered in the Trade Register under no. J40 / 6057/2017, fiscal code RO 37471856, as operators of your personal data in the context of subscribing to commercial communications, would like to inform you how this data is processed.
If other operators or affiliated companies of the two mentioned operators are involved for the purpose of subscribing to commercial communications, this information notice will be modified and amended accordingly.
The purpose of processing personal data
The processing of your data aims to allow the management of subscriptions to commercial communications and enables us to: send you commercial communications considering the interests you indicated at the time of subscription; send you communications regarding news, events/contests, and promotions organized by operators; and perform statistical analyses on the performance of this service, among other things.
If, at the time of subscription using the tablets available in sales offices or at trade fairs, you have provided your phone number, please be aware that we may send you commercial messages for the purposes mentioned above or contact you by phone.
If the subscription to commercial communications was made by any means other than the use of the tablet, we will exclusively use the email address provided at the time of subscription through the appropriate check box as the communication channel. Under these conditions, by using an API, only information including: name, surname, email address, source, and date and time of subscription will be transmitted to the consent management platform.
Subscription to marketing communications is done in two steps (double opt-in). To ensure the accuracy of the personal data collected, after completing the form and subscribing to our newsletter, we will send you an email that will contain a link to confirm your email address, which will be valid for 48 hours. If, after the expiration of the 48-hour period, you have not confirmed your email address, your personal data provided by completing the form will be deleted from our database.
Legal basis for processing
We process your data for the above purposes under Art. 6 para. (1) lit. a of the GDPR – respectively, your express consent given by completing the subscription process, providing data within the subscription form, and confirming this data by accessing the validation link.
Types of personal data subject to processing
– Required: name, surname, email;
– Optional: phone number
– Observed: subscription date and time, IP address, source of subscription.
Regarding the processing of your data sourced from websites operated by other entities within the Impact group, this will be conducted based on Article 6(1)(f) of the GDPR – the legitimate interest of operators belonging to the same economic group in centralizing consents for commercial communications and managing them in a unified database, with appropriate security measures in place.
Failure to provide mandatory data will make it impossible to use the service.
Data source
Your newsletter subscription data (respectively name, surname, date and time of subscription, and email address) may be sourced from the forms on the websites impactsa.ro, greenfieldresidence.ro, luxuria-residence.ro, boreal-plus.ro. Through these forms, you have expressly expressed your desire to subscribe to commercial communications, either by filling in the data in the newsletter subscription form, by checking the appropriate box on the tender form, or by checking the appropriate box on the contact form.
Also, your data (name, surname, email address, date and time of subscription) may be sourced from the Impact Genius program to which you have subscribed.
Lastly, the source of data can be represented by the completion, on the tablets available at the profile fairs or in the sales offices, of the information necessary for subscribing to marketing communications.
Categories of persons concerned
Individuals who appear at the sales offices of any residential complexes, those who subscribe to these communications in the context of participating in real estate fairs where operators are present, or those who check the box corresponding to subscribing to commercial communications on websites operated by these operators.
Data recipients
Your data is not subject to transfer outside of Romania.
In the event that we decide to use a proxy for the processing of your data for the purposes set out above, we will do so only after a proxy contract has been concluded pursuant to Art. 28 of the GDPR, and we will ensure the transfer of responsibility to them.
Storage time
Your personal data will be stored until you exercise your right to deletion. If you only exercise your right to object to commercial communications, your data will not be deleted but will be properly flagged, so you will no longer receive such communications in the future. Generally, your data will be stored for up to 3 years from the date consent is obtained or from your last interaction with us.
Email addresses and personal data provided but not confirmed within 48 hours of receiving the confirmation link will be automatically deleted immediately.
Personal data protection measures
Regarding personal data collected through each operator's website, it is transmitted via an API to the consent management database.
Regarding the security measures applicable to database access, the principle of necessary and sufficient access in relation to users’ service duties was taken into account, as were the internal rules on passwords associated with user accounts.
To ensure compliance with the principle of data accuracy, the use of the email address as a communication channel will begin only after you have completed the email address confirmation process.
Exercise of rights
In accordance with the provisions of articles 15-22 of the GDPR (General Data Protection Regulation 2016/679), you have the following rights that you may exercise by submitting a request to dpo@impactsa.ro .
- The right to withdraw consent – which does not affect the processing carried out during the validity period of this consent and which can be exercised at any time by clicking on the unsubscribe link available in each commercial communication sent or by making a request to withdraw consent. This right may be exercised for any of the communication channels.
- The right to be informed refers to the obligation of the operators to provide you with correct information regarding the processing of data, regarding the way in which your personal data are used;
- The right of access means that you have the right to obtain confirmation from us as to whether or not we process your personal data, and if we do, we offer you access to this data as well as information about how it is processed. You also have the right to obtain a copy of the data we process concerning you.;
- The right to portability refers to the fact that you can receive personal data in a structured, commonly used, and machine-readable format, as well as transmit this data to another controller, under certain conditions provided by the provisions of the Regulation;
- The right to object to the right to object to the processing of personal data when it serves a public interest or a legitimate interest of ours.
- The right of rectification refers to the correction, without undue delay, of inaccurate personal data;
- The right to deletion / the right to be forgotten means you have the right to erase your collected data without undue delay in any of the following situations: they are no longer necessary to fulfill the purposes for which they were collected, withdrawal of consent, objection to processing, unlawful collection, erasure for compliance with a legal obligation, or collection made with the provision of information society services;
- The right to restrict processing can be exercised if the accuracy of the data is challenged for a certain period, sufficient to verify the data, if the processing is illegal but you do not want to delete the data, only restrict it, if we no longer need personal data for processing but you are asking us to defend a legal right or if you have objected to the processing.
If you are not satisfied with the way we have resolved a request regarding the exercise of a right, you have the right to address a complaint to the National Authority for the Supervision of Personal Data Processing.