1. General presentation
1.1. Introduction
CONCORDIA Humanitarian Organization, as the operator of personal data, processes personal data relating to the natural persons with whom it interacts, for the stated purpose.
These may represent data relating to customers, suppliers, business contacts, employees and other persons with whom the company has concluded a contract or with whom it is in contact: identification data (name and surname, ID card series/number/passport, Personal code), contact details (postal and e-mail addresses, telephone numbers), studies, position held.
This policy describes how personal data must be collected, used and stored in order to comply with the company’s data protection standards – and also to meet the condition of legality. This control applies to all systems, persons and processes that make up the organization’s IT systems, including board members, directors, employees, suppliers and other third parties who have access to CONCORDIA Humanitarian Organization systems.
1.2. The existence of policy
This data protection policy ensures within the CONCORDIA Humanitarian Organization:
• The applicable legal requirements at European and national level regarding the protection of personal data and good practices in this field are respected;
• Protection of the rights of data subjects: for example partners, customers, employees / collaborators;
• How to store and process personal data collected directly or from third parties;
• Protecting the company from possible risks related to data security breaches;
• Increasing the degree of trust of the external environment, in relation to the CONCORDIA Humanitarian Organization.
1.2.1. Legislation on the protection of personal data
(EU) Regulation no. 679/2016 describes how companies – including the CONCORDIA Humanitarian Organization – have to process personal data. Significant fines are applicable if an infringement is considered to have been adopted under the GDPR Regulation, which has the role of protecting the personal data of citizens of the European Union.
These rules apply regardless of whether the data is stored in electronic format, on paper or on other materials.
In order to be in compliance with the law, personal information must be collected and used correctly, stored securely, and its illegal use is not permitted.
(EU) Regulation No 2016/679 transposes the fundamental principles on the basis of which data processing is permitted, with companies having the obligation that the personal data they collect:
1. Be processed lawfully, fairly and transparently to the data subject (”legality, fairness and transparency”);
2. To be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (”purpose-related limitations”);
3. Be appropriate, relevant and limited to what is necessary in relation to the purposes for which they are processed (”minimization of data”);
4. Be accurate and, if necessary, be up-to-date; all necessary measures must be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are deleted or rectified without delay (”accuracy”);
5. Not to be kept longer than necessary (”storage limitations”);
6. Be processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures (”integrity and confidentiality”);
7. To be processed in accordance with the rights of data subjects;
8. Not to be transferred outside the European Economic Area, unless the territory / country where they are to be transferred ensures an adequate level of protection of personal data.
1.2.2. Definitions
GDPR’s definition of personal data is broad:
Personal data = any information concerning an identified or identifiable natural person
In order to be able to make a correct interpretation of the definition of this policy, it is necessary to know the fundamental data protection terms:
Data subject: An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifying element, such as a name, an identification number, location data, an online identifier, or one or more many specific elements, specific to his/her physical, physiological, genetic, mental, economic, cultural or social identity.
Processing: Any operation or set of operations performed on personal data or personal data sets, with or without the use of automated means, such as the collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or otherwise made available, alignment or combination, restriction, deletion or destruction.
Operator: The natural or legal person, public authority, agency or other body which, alone or together with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or national law, the controller or the specific criteria for its designation may be laid down in Union or national law.
Person authorized by the operator The natural or legal person, public authority, agency or other body which processes personal data on behalf of the operator.
1.3. Principles regarding the processing of personal data
(EU) Regulation No 2016/679 transposes the fundamental principles on the basis of which data processing is permitted, with companies having the obligation to carry out the processing of personal data under certain conditions.
In order to comply with the applicable legal framework, personal data within the CONCORDIA Humanitarian Organization is:
• processed lawfully, fairly and transparently to the data subject (“legality, fairness and transparency”);
• collected for specific, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes shall not be considered incompatible with the original purposes, in accordance with Article 89 (1) (“purpose limitations”);
• appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed (“minimization of data”);
• accurate and, if necessary, updated; all necessary measures must be taken to ensure that personal data which is inaccurate, having regard to the purposes for which it is processed, is deleted or rectified without delay (‘accuracy’);
• kept in a form which allows the identification of data subjects for a period not exceeding the period necessary to fulfil the purposes for which the data is processed; personal data may be stored for longer periods in so far as they will be processed exclusively for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, in accordance with Article 89 (1), subject to the implementation of appropriate technical and organizational measures provided for in this Regulation in order to guarantee the rights and freedoms of the data subject (‘storage limitations’);
• processed in a way that ensures adequate security of personal data, including protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures (“integrity and confidentiality”).
We will always take all necessary activities to ensure that we comply with all these principles both in the current processing process and as part of the introduction of new processing methods, such as possible new computer systems.
1.4. The rights of the data subject
The data subject has several rights under the GDPR Regulation. These consist of:
• The right to withdraw consent;
• The right to information;
• The right of access;
• The right to rectification;
• The right to delete data (“the right to be forgotten”);
• The right to restrict processing;
• The right to data portability;
• The right to oppose processing;
• The right not to be subject to a decision based exclusively on automatic processing, including the creation of profiles;
• The right to file a complaint with the Authority;
• The right to go to court.
Each of these rights is supported by appropriate wording from the CONCORDIA Humanitarian Organization which allows the necessary action to be taken within the time limits set by the GDPR Regulation.
The data subjects can exercise some of the above rights by e-mail, addressed to the data operator at secretariat@concordia.org.ro. Applications will be exempt from any fees. The operator will be obliged to provide a response within a maximum of one month, and in certain exceptional cases within a maximum of two months from receipt of the request.
We will always verify the identity of any data subject who addresses us with a request regarding his/her data processed by us. In order to respond to requests and allow the exercise of rights, the legal department or external legal advisers will have a say on the merits of the request.
1.5. Grounds for processing
The processing of personal data by the CONCORDIA Humanitarian Organization is based on the following legal grounds contained in (EU) Regulation 679/2016:
• in order to conclude and execute service contracts that are the object of our activities – art. 6, para. 1, lit. (b);
• in order to fulfil the legal obligation to highlight and report to the state bodies – art. 6, para. 1, lit. (c).
The personal data collected and processed is necessary to conclude or execute a contract with the data subject, in which case his/her explicit consent is not required. This is because the contract cannot be concluded without the personal data in question, for example an appointment cannot be made without a telephone number at which the customer can be contacted.
Given that personal data must be collected and processed by us in order to comply with the law, explicit consent is not required. This may apply to certain employment and taxation data, for example.
1.6. Purposes of processing
As part of our professional activity, we process personal data to implement the company’s object of activity – increasing the number of social sector organizations capable of planning and conducting on-the-job training courses for professionals in the sector.
We also process personal data in order to honour the legal obligations that regulate our field of activity, such as the Civil Code, the Fiscal Code, the Labour Code.
2. Limits of policy applicability
2.1. The field of policy
This policy applies to:
• Headquarters of the CONCORDIA Humanitarian Organization;
• All departments of CONCORDIA Humanitarian Organization;
• The entire staff and volunteers of the CONCORDIA Humanitarian Organization;
• All contractors, suppliers and other persons working on behalf of the CONCORDIA Humanitarian Organization.
It is applicable to all data that the company holds in connection with identifiable individuals.
The categories of personal data processed are those that you provide when completing the contact form. This data includes: name, email address and phone number.
In addition to providing products from the electrical industry, we reserve the right to process personal data for marketing purposes. To keep you up to date with the latest news related to the activity of CONCORDIA Humanitarian Organization.
2.2. Risks
The policy helps to protect CONCORDIA Humanitarian Organization from real security risks, including:
• Breach of confidentiality.
• Reputation damage.
For example, the company could be harmed if this data was obtained by people interested in it, from the inside, by producing a security breach.
3. Data storage
These rules describe how and where personal data should be stored.
When data is stored on paper, it must be kept in a safe place where unauthorized persons cannot access it.
These instructions also apply to data that is normally stored in electronic format but has been printed for certain reasons:
• Papers or files should be kept in a closed place or in a closed drawer;
• Employees should ensure that paper or printed matter is not left to unauthorized persons who may see it, such as on the printer;
• Prints should be destroyed when no longer needed.
When data is stored in electronic format, it must be protected from unauthorized access, accidental deletion or intentional hacking attacks:
• Data should be protected by strong passwords that are regularly changed and never shared between employees, while sensitive data should be encrypted;
• When data is stored on removable media (such as CDs, DVDs), it is kept safe when not in use;
• Data will only be stored on servers or specialized drives and should be uploaded to an approved cloud computing service;
• Servers containing personal information should be placed in a safe place, away from general office space;
• Data must be saved directly on laptops and not on other mobile devices such as tablets or smartphones.
• Data has a periodic backup;
• All servers and computers containing data are protected by Security software and firewalls.
4. Use of data
CONCORDIA Humanitarian Organization does not process personal data on a large scale nor sensitive data. Even so, we want to keep our data safe. In order to prevent risk situations such as corruption or even theft, we have established a series of mandatory rules when using this data:
• When working with personal data and remain unattended even for short periods of time, staff ensure that computer screens are closed;
• Personal data is processed at the headquarters and / or at the place of work of our beneficiaries. All documents containing personal data, in electronic format, on paper and on any other means of storage and transfer of personal data shall be processed / collected / kept / stored / archived / destroyed, etc., by the beneficiary, in the conditions of the law;
• We minimize the transmission of personal data by e-mail, as this means of communication is not secure. As an exception, the only e-mail transmission of sensitive data are those intended for the data subject, at his express request;
• Sensitive data should be encrypted before being transferred electronically;
• Personal data is not transferred outside the European Economic Area;
• Workers are prohibited from saving personal data on their personal devices;
• Data will be stored in a few places; staff must not create other unnecessary additional places, such as unnecessary copies;
• Staff is trained to use every opportunity to ensure that data is kept up to date. For example, by confirming details when the customer calls;
• Data is updated when inaccuracies are discovered. For example, when a customer can no longer be contacted via a phone number, it is recommended that they be removed from the database.
5. Disclosure of data for other reasons
In certain circumstances, the law allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.
In these circumstances, CONCORDIA Humanitarian Organization will disclose the necessary data. The data operator will ensure that the request is legitimate, seeking assistance from the company’s legal advisers where necessary.
6. Providing information
CONCORDIA Humanitarian Organization aims to ensure that data subjects know how the data is processed, ensuring that they understand:
• How their data is used;
• How they can exercise their rights.
For this purpose, the company has a Cookies Policy, establishing how people’s data is used within it.
7. Consequences
Failure to comply with this Policy by company employees or other external collaborators may lead to disciplinary action (including termination of employment), termination of contracts and, as appropriate, legal action for full recovery of damages to the organization for non-compliance with this Policy.
When there is a suspicion of illegal activities (such as, for example, stealing documents, copying, distributing, transferring databases), the Company will report the criminal activity to law enforcement for criminal prosecution of the perpetrator.
This Policy will be brought to the attention of the company’s management by all employees, collaborators, business partners or other third parties, including by publishing it on the company’s website, projectfocus.eu.