SELL CAR BUY CAR

Date: 07.04.2020

“SELLCARBUYCAR.COM” (herein referred to as “we”, “our”, “ours”, or “SELLCARBUYCAR.COM” in this document) refers first of all to AJM BUSINESS SERVICES SRL. AJM BUSINESS SERVICES SRL is the controller processing all personal data collected and used in the relation with clients of SELLCARBUYCAR.COM, according to Romanian provisions for the processing of personal data. AJM BUSINESS SERVICES SRL is a company registered and incorporated according to Romanian Laws, registered at the Trade Register Office from Bucharest Court under no. J23/1459/2015, tax registration code 34437647 and having its headquarter in 19 Toamnei Street, Ostratu Village, Corbeanca, Ilfov County, Romania.

INTRODUCTION

This privacy policy regarding the processing of personal data explains what we are doing with your private data, no matter if we provide products, services and/or marketing materials or we use the data as part of the research that we are unfolding for marketing or scientific purposes.

Furthermore, we would like to inform you that, starting May 25th 2018, the 2016/679/UE Regulation on the protection of natural persons with regards to personal data processing and regarding the free movement of such data (herein referred to as “The Regulation”) applies in all Member States of the European Union. The intention is to create a unitary and solid legislation framework through this Regulation, on the European Union territory.

The website SELLCARBUYCAR.COM is in line with Regulation’s provisions and we believe it to be the right moment to point out a few important aspects.

This document describes the way data collection is being performed, how your personal data is being processed and used and how, in this way, we comply with our legal obligations towards you. Your confidentiality is important to us and we are committed to protecting you and your rights.

If you are not satisfied with any aspect of our policy regarding clients’ confidentiality, you may have legal rights as described below, according to each case.

This notification can be amended from time to time. Please visit this page if you wish to stay updated on the modifications.

1. What is your personal data that we are processing?

Your personal data is being collected through our website, by email and through the call-center. According to relevant circumstances and applicable laws and local requirements, we may collect part or all pieces of information listed below:

• Name and surname;
• Phone contact number/numbers;
• Contact details: address, e-mail, contact address;
• Correspondence between you and SELLCARBUYCAR.COM; or
• Any other additional information that you choose to share with us.

Additionally, when you visit our website, we may automatically collect technical data, including IP address (Internet protocol) used to connect the device to the Internet, your connection data, browser type and version used, time zone settings, browser plug-ins types and versions, system and platform.

Important!

Please keep in mind that when using our website, cookies will be stored in the browser on your device. Remember that if you deactivate cookies, it is possible for our website not to work properly in your browser. We would like to make sure that our website offers its visitors what they need and they benefit from the most relevant marketing messages. In order to achieve this objective, it might be possible for us to store and use your data for market research, for improving the quality of our website and our services, for developing services, for website performance improvements, to measure the success of our advertising campaigns or to adapt our services to your needs and in accordance to our available cookies policy here.

2. How do we use your personal data?

We collect and use your personal data for the following purposes:

• To facilitate the provision of services and products on our website (including from third parties, according to each case). For this purpose, we collect the following data: name and surname, phone number, images and/or pictures, and the email address;
• To send out newsletters to you. For this purpose, we collect the following data: name and surname, phone number and email address;
• To send offers based on your preferences. For this purpose, we collect the following data: name and surname, phone number and email address;
• In order to communicate with you during the process of realizing client satisfaction surveys for analysis purposes, for quality improvements, services development, website performance improvements, to measure the success of advertising campaigns or to adapt our services to your requirements. For this purpose, we collect the following data: name and surname, phone number and email address.

Also, we will be able to use your personal data for these reasons if we shall consider it necessary to ensure our legitimate interests. For any further details, please check the below.

3. Is your personal data shared with third parties?

Mainly, we will share your personal data to third parties only to ensure optimal course for our contractual relations, but also to fulfill specific legal obligations, as follows:

• Any company within our group, as it might be necessary, by observing the legal provisions regarding the processing of personal data and their transfer;
• Financial consultants, audit companies, and any public authority, in cases where there is a legal obligation to share personal data attached (for example, in the situation when a notification or request is received from central or local public authorities or related to a litigation registered and in progress with any Romanian court);
• Service providers that act on our behalf (including, and without being limited to, external consultants, lawyers, auditors and/or accountants and IT consultants and experts);
• If a company from our group shall be acquired or shall merge with another company or group of companies in the future, we can provide your personal data to the representatives of the new owners (you will be notified about this procedure and all inferences on your personal data).

4. How is your personal data secured?

We are concerned with securing your personal data. This is the reason for which adequate measures have been implemented, measures meant to prevent unauthorized access and wrong use of your personal data.

We are committed to taking all reasonable and adequate measures to ensure the security of your personal data against theft or unauthorized access. All these are being achieved by implementing specific organizational and technical measures, including encryption measures and data recovery/back-up.

Important!

If you suspect unauthorized usage or theft of your personal data, please inform us immediately. Thus, we would ask you to first contact our company in order to be able to investigate the occurred incident and to further provide you with updated information regarding the resolution status of the incident and the steps to follow.

5. How long are we processing your personal data for?

We will not keep your personal data in our records for a period of time that exceeds our purposes for which it has been collected, except for the cases when there are legal provisions that involve the obligation to keep your personal data for a period of time that is longer than our purpose (for example, if a notification or request is received from the central or local public authorities or related to an ongoing dispute registered with any Romanian court).

6. What are your rights related to the personal data that we process?

One of the main objectives of the Regulation is to protect and clarify the natural persons’ rights related to the protection of their personal data. Thus, even though we are processing your personal data, the Regulation offers you a series of rights regarding your personal data.

Also, the Regulation confers more rights for people whose personal data is being processed. Thus, apart from the currently existing rights, we may find the right for data portability and data erasure.

Here is a short list of rights that you have:

• Right of access means you have the right to receive a confirmation from our side that your personal data is or isn’t processed and, if processed, you can access that data and also information on the processing method.

• Right to data portability refers to the right to receive personal data in a structured form, as currently used and that can be read automatically and the right to transfer such data directly to another controller, if this shall be feasible from a technical point of view.

• Right to object means the right to oppose personal data processing when this is necessary to fulfill a public interest task or when there is a legitimate interest of SELLCARBUYCAR.COM involved. When the purpose of personal data processing is direct marketing, you have the right to object to such processing at any time.

• The right to withdraw your consent refers to cases when we have previously obtained your consent to process your personal data for specific activities (for example, direct marketing purposes); you may withdraw this consent at any moment and we will stop performing that activity if we don’t consider there is a legal alternative to justify continuing your personal data processing for that purpose, situation in which you will be informed about this provision.

• Right to rectification efers to correcting inaccurate personal data, without any unjustified delays. Rectification shall be communicated to each recipient who received the inaccurate data, except for the cases when this proves to be impossible or involves disproportionate efforts.

• Right to erasure (“the right to be forgotten”) means you have the right to request personal data erasure, without any undue delays, if one of the following grounds applies:

  • It is no longer necessary in relation to accomplishing the purposes for which it was collected or processed;

  • You withdraw your consent and there is no legal ground for data to be processed;

  • You object processing and there is no legal reason that prevails;

  • Personal data has been unlawfully processed;

  • Personal data must be deleted in order to observe a legal obligation;

  • Personal data has been collected for providing information society services.

• The right to restriction of processing can be exercised in the following cases:

  • When you contest data accuracy, for a period of time that enables us to verify such data accuracy;

  • Processing is unlawful and you oppose to personal data erasure, requesting in exchange processing restriction;

  • In case SELLCARBUYCAR.COM no longer needs your personal data for processing, but you are requesting it to establish, exercise or defend a right in court;

  • In case you have objected to the processing pending the verification whether our legitimate interests prevail, situation in which we will offer an extensive explanation of our grounds.

Important!

All these rights may be exercised by a written application, signed and dated, sent to our headquarters or via email, all contact details being available in Annex nr. 1.

Upon request, you will receive a copy of your processed personal data; you may submit a request and receive an answer from us in any way you would like to (including e-mail).

Please remember that your right to request a copy, according to the abovementioned specifications, must not affect in any way the rights and liberties of others.

• The right to lodge a complaint with the supervisory authorities – in case you consider your rights regarding processing of personal data have been breached, you can also contact and lodge a complaint with the local supervisory authority for data protection:

7. Who is responsible for your personal data protection?

AJM BUSINESS SERVICES is the company responsible for the protection of your personal data. The headquarters of the company is: Str. Toamnei nr. 19, villa 1-2, Room 2, Village Ostratu, locality Corbeanca, County of Ilfov, Romania.

For any comments and suggestions related to this notice, please contact us using the contact information provided in Annex no. 1. We are very much preoccupied with the security of your personal data and will provide you with an answer within a term of maximum 7 business days.

8. Personal Data Transfer? How and to whom?

In order to be able to ensure a good evolution of our contractual relations, your personal data will be transferred:

• To third parties (for example, our consultants);

• To a provider of cloud storage services.

We want to make sure that your personal data is stored and transferred in a safe way.

On those grounds, we will transfer your personal data outside the European Economic Area (European Union Member states, Norway, Iceland and Liechtenstein) only if the transfer is performed by complying with all legal provisions regarding personal data protection and by ensuring a high level and adequate protection, as follows:

• By transferring your personal data in a state that offers an adequate level of protection, recognized as such through a decision issued by the Commission of the European Union;

• In case you have freely given your consent after having been informed regarding the transfer of personal data outside the European Economic Area;

• By concluding a contract regarding the transfer of personal data to a third party, a contract that should include standard clauses adopted by the Commission of the European Union related to personal data transfer to controllers and other processors located in states that ensure an adequate protection level.

9. Legal grounds for personal data processing

The Regulation provides a series of means through which your personal data can be processed by following the law. These are being described below.

Processing is happening as a result of contract implementation

Article 6, paragraph (1) in the Regulation provides that processing is legal only if one of the following conditions apply: […] b) processing is necessary for the performance of a contract to which the data subject is a party or to follow any steps at the request of the data subject prior to entering into a contract.

Therefore, we rely on this legal assumption to process your personal data, which allows us to observe our contractual obligations, but also our obligations towards third parties and to ensure that your obligations towards us have been fulfilled accordingly.

Processing based on a legal obligation

Apart from our contractual obligations, we are also bound by other legal obligations that we must observe. Article 6, paragraph (1), letter (c) from the Regulation provides that we can process your personal data in case this procedure is necessary for compliance with a legal obligation to which we are subject.

An example of such a legal obligation that we must comply with is our obligation to cooperate with fiscal authorities.

Processing based on a legitimate interest

Article 6 paragraph (1) letter (f) from the Regulation provides that we can process your data if this processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the your interests or fundamental rights and freedoms which require protection of personal data.

We consider the following as non-exhaustive examples of processing activities of your personal data according to our legitimate interests:

• For our internal administrative purposes;

• To prevent unauthorized use of our equipment and information;

• For performing investigations regarding alleged infringements; and

• For establishing, exercising and sustaining legal claims.

Processing based on freely expressed consent

In certain circumstances, we will request your consent to opt-in (voluntary registration) before assuming specific requirements related to your personal data protection.

Article 4 paragraph (11) from the Regulation provides that the opt-in consent is considered any free indication, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

In simple language, this means that:

• You must express your consent freely, without us pressuring you in any way;

• You need to know why you express your consent – we want to assure you that we will provide enough information;

• You should only be asked to consent to only one processing activity at a specific moment – therefore, we avoid asking for asking for a single consent for more processing activities, so you don’t know exactly what you consented for; and

• You must take specific measures to give us your consent – it is very likely that you will be requested to mark a checkbox to ensure that this requirement will be fulfilled in a clear manner and without ambiguities.

Once these specific personal data processing activities have been confirmed, we will offer you more information so that you can decide whether you want to subscribe or not.

You have the right to withdraw your consent for these activities. You can do this at any time and the details on how you can do this can be found above, in this document, in The right to withdraw your consent section.

Remember that we need your personal data described in Section 1 to be able to provide our services.

If you do not provide the requested personal data, we will not be able to provide the requested services, fully or partially. If you withdraw your consent, it is not possible for us to provide the requested services, fully or partially.

We do not consider that any of the above-mentioned activities might bring any prejudice to you.

However, you have the right to object to the processing of your personal data in certain circumstances.

If you need more details regarding these circumstances and how to object against our processing activities, please consult the section Right to object.

ANNEX NO. 1

For questions related to personal data protection, for exercising your rights or to register a complaint, please contact the person responsible for personal data protection by e-mail, using the address mentioned below.

You may also contact us by sending a message to the following address.

Details on how to contact the AJM BUSINESS SERVICES representative for data protection

AJM BUSINESS SERVICES has a person in charge with data protection (DPD – Data Protection Delegate) to whom you may address your questions.