Impact Developer & Contractor SA, with headquarters in Bucharest, Willbrook Platinum Business & Convention Center, Building A, 1st floor, Sos. Bucharest – Ploiesti, no. 172 – 176, sector 1, registered with the Trade Registry under J40/7228/2018, fiscal code RO 1553483 and Bergamot Developments LLC, with its registered office in Bucharest, Șos. București-Ploiești, 172-176, Willbrook Platinum & Convention Center, Building A, 1st floor, office no. 1, Sector 1, registered with the Trade Register under no. J40/6057/2017, fiscal code RO 37471856, as operators of your personal data in the context of subscribing to commercial communications, wish to inform you about how this data is processed.
If other operators or other affiliated companies of the two mentioned operators are involved for the purpose of subscribing to commercial communications, this information note will be modified and amended accordingly.
The purpose of personal data processing
The processing of your data is for the purpose of managing subscriptions to commercial communications and allows us to: send you commercial communications considering the interests you indicated at the time of subscription; send you communications regarding news, events/contests, and promotions organized by the operators; and perform statistical analyses on the performance of this service, without limitation to these.
If, at the time of subscribing using the tablets available at sales offices or trade shows, you also provided your phone number, please be aware that we may send you commercial messages for the purposes mentioned above or contact you by phone.
If subscribing to commercial communications was done through any means other than using the tablet, we will exclusively use the email address provided at the time of subscription by checking the appropriate subscription box as the communication channel. Under these conditions, using an API will transmit only information regarding: last name, first name, email address, source, and date and time of subscription to the consent management platform.
Marketing communication subscription is a two-step process (double opt-in). To ensure the accuracy of the personal data collected, after completing the form and subscribing to our newsletter, we will send you an email containing a confirmation link for your email address, which will be valid for 48 hours. If you have not confirmed your email address after this 48-hour period, the personal data you provided by completing the form will be deleted from our database.
Legal basis for processing
We process your data for the purposes mentioned above based on Art. 6 para. 1 lit. a of the GDPR – namely, your express consent given by completing the subscription process, providing data within the subscription form, and confirming this data by clicking the validation link.
Types of personal data that are subject to processing
– Required: last name, first name, email address;
– Optional: phone number
– Observe: subscription date and time, IP address, source from which the subscription was made.
Regarding the processing of your data sourced from websites operated by other operators in the Impact group, this will be done based on art. 6 paragraph (1) letter f of GDPR – the legitimate interest of operators belonging to the same economic group concerning the centralization of consents for commercial communications and their management in a unified database, with appropriate security measures.
Failure to provide mandatory data will result in the inability to use the service.
Data source
Your data regarding newsletter subscription (name, surname, date and time of subscription, and email address) may be sourced from the forms on the websites www.impactsa.ro, www.greenfieldresidence.ro, www.luxuria-residence.ro, www.boreal-plus.ro through which you have expressly expressed your wish to subscribe to commercial communications, either by filling in your details in the newsletter subscription form, by ticking the corresponding box in the offer request form, or by ticking the corresponding box in the contact form.
Additionally, your data (last name, first name, email address, subscription date and time) may originate from the Impact Genius program to which you subscribed.
Last but not least, the data source can be represented by you filling out the forms available at trade fairs or sales offices with the necessary data to subscribe to marketing communications.
Targeted categories of people
Individuals who present themselves at sales offices in any of the residential complexes, those who subscribe to these communications in the context of participating in real estate fairs where operators are present, or those who tick the corresponding box to subscribe to commercial communications on the websites operated by these operators.
Data recipients
Your data is not subject to transfer outside of Romania.
In the event that we decide to use a processor for the processing of your data for the purposes set out above, we will only do so after a prior data processing agreement has been concluded in accordance with Article 28 of the GDPR and by ensuring the transfer of responsibility to them.
Storage duration
Your personal data will be stored until you exercise your right to erasure. If you only exercise your right to object to commercial communications, your data will not be erased, but only marked accordingly, so that you will no longer receive such communications in the future. Generally, your data will be stored for 3 years from the date of obtaining your consent or from your last interaction with us.
Email addresses and personal data provided but not confirmed within 48 hours of receiving the confirmation link will be automatically deleted immediately.
Personal data security measures
Regarding the personal data collected through each of the operators' websites, they are transmitted via an API to the database that manages consents.
Regarding the security measures applicable to database access, the principle of necessary and sufficient access in relation to users' job responsibilities was considered, as were the internal rules regarding passwords associated with user accounts.
To ensure the principle of data accuracy is upheld, the use of email as a communication channel will only commence after you have completed the email address confirmation process.
Exercising rights
In accordance with the provisions of Articles 15-22 of the GDPR (General Data Protection Regulation 2016/679), you have the following rights, which you can exercise by submitting a request to dpo@impactsa.ro.
- Right to withdraw consent – without prejudice to the processing carried out during the validity period of this consent and which can be exercised at any time by clicking the unsubscribe link available in each commercial communication sent or by submitting a request to withdraw consent. This right can be exercised with regard to any of the communication channels.
- The right to be informed refers to the obligation of operators to provide you with correct information regarding data processing, concerning how your personal data is used;
- Right of access this means you have the right to obtain confirmation from us as to whether or not we process your personal data, and if so, we provide you with access to this data as well as information on how it is processed. You also have the right to obtain a copy of the data we process concerning you;
- The right to portability it refers to your ability to receive personal data in a structured, commonly used, and machine-readable format, as well as to transmit this data to another controller, subject to certain conditions provided for by the Regulation.;
- Right to object targets the right to object to the processing of personal data when it serves a public interest or our legitimate interest.
- Right to rectification refers to the rectification, without undue delay, of inaccurate personal data;
- The right to erasure/the right to be forgotten This means you have the right to have your collected data deleted without undue delay, in any of the following situations: they are no longer necessary for the purposes for which they were collected, withdrawal of consent, objection to processing, unlawful collection, deletion to comply with a legal obligation, or collection made in connection with the offering of information society services;
- The right to restrict processing it can be exercised if the accuracy of the data is contested for a period sufficient to verify the data, if the processing is illegal but deletion is not desired, only restriction, in cases where we no longer need personal data for processing but request it for the defense of a right in court, or if you have objected to the processing.
If you are not satisfied with the way we have handled a request regarding the exercise of a right, you have the right to lodge a.