DERMESTETICA SRL, with its registered office at Bvd. Aviatorilor no. 49, ground floor, Sector 1, Bucharest, Romania, sole registration number 18358339, entered in the Trade Register under J2006001911408, acting as Controller of personal data by the nature of its activity, will process your personal data in accordance with the applicable legislation and with the terms of this notice.
To ensure that the personal data we handle in our dealings with clients is properly protected, we have appointed an officer who can be contacted at: office@dermestetica.ro.
Definitions
"Personal data" means any information relating to an identified or identifiable natural person (the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
"Processing" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Legal basis and purpose of processing
We process your personal data for contractual and legal purposes. The basis for processing is the contract for the provision of medical services — your own request to the clinic to arrange a consultation and/or to carry out medical procedures — together with the applicable legal provisions.
Accordingly, in order to carry out the activities connected with that contract and to meet our legal obligations, we will use this data only for the purpose for which you provided it to us.
With your consent, we may pass such data — for example surname, given name, date of birth, email address and telephone number — to companies we work in partnership with, for purposes such as marketing, advertising or statistics. We will ensure that our partners keep that information secure, and that it is provided to them in accordance with the applicable legislation.
As a client of ours, your email address may be processed in order to send you our newsletter, should you choose to subscribe. In that case the address becomes active and will be used for that purpose until you choose to unsubscribe, by replying to that email with the subject "Unsubscribe".
We may also provide your personal data to state supervisory bodies where the legislation in force obliges us to do so.
In determining how long the data will be processed, we take into account the term of the contract, until the contractual obligations have been discharged, and the applicable statutory retention periods.
Your rights
The right of access means that you have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed and, where that is the case, access to that data and to information about how it is processed.
The right to rectification concerns the correction, without undue delay, of inaccurate personal data. The rectification will be communicated to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort.
The right to erasure (the "right to be forgotten") means that you have the right to ask us to erase your personal data, without undue delay, where one of the following applies: it is no longer necessary for the purposes for which it was collected or processed; you withdraw your consent and there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation; the personal data was collected in relation to the offer of information society services.
The right to restriction of processing may be exercised where the data subject contests the accuracy of the data, for a period enabling us to verify it; where the processing is unlawful and the data subject opposes erasure and requests restriction instead; where we no longer need the personal data for the purposes of the processing but the data subject requires it for the establishment, exercise or defence of legal claims; or where the data subject has objected to processing, pending verification of whether our legitimate grounds override theirs.
The right to data portability concerns the right to receive your personal data in a structured, commonly used and machine-readable format, and the right to have that data transmitted directly to another controller where this is technically feasible.
The right to object, and automated individual decision-making concerns your right to object to the processing of your personal data where that processing is necessary for the performance of a task carried out in the public interest, or rests on the legitimate interests of the controller. Where personal data is processed for direct marketing purposes, you have the right to object at any time. You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Further information about your rights, how to exercise them, the exceptions and so on can be found in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, published in the Official Journal of the European Union L 119 (4.5.2016) and applicable from 25 May 2018.
All of these rights may be exercised by a written request, signed and dated, sent to our registered office.
Everything about how your personal data is processed is on this site, under Data processing; whenever it changes, the change appears there.
In addition, if you have any complaint or question about the processing of personal data, you may write to office@dermestetica.ro. Complaints regarding the processing of personal data may be addressed to the Romanian National Supervisory Authority for personal data Processing.
Purpose and manner of processing personal data
The personal data processed is that which you provide to us: surname, given name, address, the series and number of your identity document, personal numeric code, signature, email address, telephone number, bank details, and any other personal data necessary for the purposes listed below.
Personal data is processed by collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission and making available, erasure and destruction. It will be processed both by manual means and by electronic ones.
Your personal data will be processed for the following purposes:
- Providing the services connected with our business as a private medical clinic;
- Completing appointment, consultation and procedure records;
- Invoicing for the services provided under the contract with the client;
- Recovery of debts through authorised persons acting under collaboration or service contracts;
- Commercial communications and marketing.
The legal basis for processing personal data:
- The contract entered into;
- Compliance with a legal obligation;
- Freely given consent.
Where a client declines to provide personal data and to permit its processing, we are unable to provide the services connected with the Controller's business. Withholding your consent to processing for commercial and marketing purposes has no bearing on the conclusion or performance of the contract. A client has the right to withdraw consent given for the processing of personal data; withdrawal does not affect the lawfulness of processing carried out on the basis of that consent before it was withdrawn.
Recipients of personal data
Personal data collected by the Controller will be disclosed, for the purposes set out above, to our employees and associates. Transfers of personal data will be made on paper only.
The retention period for personal data will observe the principles of necessity and proportionality, and will extend at least until the purposes for which it was collected and processed have been met. On termination of the relationship, or on expiry of the statutory retention period for tax and accounting purposes, the data will be erased.
Exercising your rights
In respect of the personal data provided, the GDPR gives you the right:
- To access it and to request a copy;
- To request its rectification and its erasure;
- To obtain restriction of the processing;
- To object to the processing;
- To withdraw at any time your consent to the processing of your personal data for commercial or marketing purposes.
To exercise any of the rights listed above, you may submit a written request, dated and signed:
- By email to: office@dermestetica.ro;
- By post to: Bvd. Aviatorilor no. 49, ground floor, Sector 1, Bucharest.
For further information about your personal data you may contact our data protection officer at the email address given above. If you consider that the processing of your personal data infringes the Regulation, you may lodge a complaint with the Romanian National Supervisory Authority for personal data Processing.
Cookies and consent
To manage the cookies and similar technologies we use — tracking pixels, web beacons and the like — and the consents attached to them, we use the consent tool "Real Cookie Banner". Details of how "Real Cookie Banner" works can be found at devowl.io/rcb/data-processing.
The legal basis for processing personal data in this context is Article 6(1)(c) and Article 6(1)(f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used, and of the consents attached to them.
Providing this personal data is neither contractually required nor necessary for entering into a contract. You are under no obligation to provide it. If you do not, we will be unable to manage your consents.