Privacy Policy for Business Partners

Click here for Romanian version

Thank you for visiting our website.

We take the protection of your personal data very seriously and strive to provide you with comprehensive information about the processing of your personal data. The following privacy policy applies to you if you contact us, if you enter into contract negotiations with us and/or if there is a contract in place between us and yourself or the company you are connected with, provided that data of individual is processed in that context. At the same time, this privacy policy applies if you are an associate/shareholder and/or real beneficiary of the company we are negotiation/cooperating with. The specific legal bases are the EU General Data Protection Regulation (GDPR) and Law 190/2018 for implementing GDPR provisions. Which data is processed in the individual case depends primarily on the agreed services. As a result, not all of this information will be relevant to you.

1. General information

As a rule, the personal data of yours that we collect is obtained directly from you or from the company you are connected with and that intends to be our partner/it is our partner.

However, it may also be necessary to process personal data that we obtain from other companies as well as from authorities or public institutions, such as Trade Register (portal.onrc.ro), Ministry of Finance (mfinante.ro), National Agency for Fiscal Administration (anaf.ro), Ministry of Justice (portal.just.ro ), Electronic Archive of Real Movable Guarantees (aegrm.ro/romarhiva.ro), Romanian Official Gazette, Romanian Government Portal (data.gov.ro).. At the same time, we may obtain public data by searching the Internet or from other third parties. This may include personal data that we obtain through our whistleblower channels about potential compliance violations or in the context of compliance investigations.

Relevant personal data may include: personal details (e.g., first name, last name, address and other contact details, date and place of birth and nationality), identification and authentication data (e.g., commercial register excerpts, I.D. data, specimen signature), signature (handwritten or electronic), data within the scope of our business relationship (e.g., payment data, data on orders), creditworthiness data, data on corporate and ownership structure, data relevant to compliance (e.g. politically exposed person, publicly available articles, official public data on convictions / investigations related to the company's activity or other similar activities, data regarding your position within the company, your department and your superior), photos and videos (e.g., with deliveries of goods) and other data comparable to the aforementioned categories.

You may elect to communicate with us by e-mail or mail. For technical reasons, e-mail communications may be unencrypted.

2. "Controller" within the meaning of Article 4(7) GDPR

The controller responsible for data processing within the meaning of Article 4(7) GDPR is Schwarz IT Hub SCS, Bulevardul Dimitrie Pompeiu 6 E, Bucureşti, România.

3. Purposes and legal bases of processing

a) Visiting this website

When you visit this website, log files are generated containing the following information:

  • the website from which you visit our site;
  • the IP address;
  • the date and time of access;
  • the user request;
  • the http response code;
  • the data volume transmitted;
  • information about the type of browser and operating system you are using.

Recipients/categories of recipient

Each time that a user accesses this website and each time a file is accessed, we, and in some cases, third parties save log files documenting this process; this serves exclusively to protect our systems and to prevent improper and/or fraudulent behavior.

Storage time/criteria for determining storage time:

Storage time is 7 days.

b) For the performance of contractual obligations (Article 6(1)(b) GDPR)

If you are our business partner (as an individual), the purposes of processing follow from the need to take steps prior to entering into the contract, in advance of the contractual business relationship and to perform obligations under the contract.

c) For compliance with a legal obligation (Article 6(1)(c) GDPR)

The purposes of processing follow from the statutory requirements. Such legal obligations include, for example, complying with identification and retention obligations, e.g., in the context of anti-money laundering requirements, tax monitoring, reporting requirements and data processing in the context of requests from authorities.

d) For the purposes of legitimate interests (Article 6(1)(f) GDPR)

It may be necessary to process personal data based on our legitimate interests, such as the legitimate interest of selecting suitable business partners, negotiating the contract with the representatives of our business partners, as well as concluding and carrying out the contract, conducting checks on the identity of our business partners representatives, asserting legal claims, defending against liability claims, fraud prevention, protecting our IT infrastructure, managing system access authorizations, physical and data access controls, entering your contact details in our global Schwarz Group user directory, clarifying potential compliance violations, preventing crimes and settling claims arising out of the business relationship,     invitation to business events, other internal administrative purposes, such as user and contract management, billing, process and workflow optimization.

If you accept our offer to contract by means of digital signature (e.g., Adobe Sign), we process your data, such as in particular e-mail address, IP address as well as the time and date of any modifications you make to the respective contract document, for instance when you approved, displayed or digitally signed it. We have a legitimate interest in ensuring that the process for signing contracts digitally is fast and efficient and that the signing process can be logged for verification purposes. Certain contracts may also be signed using a so-called qualified electronic signature. In this case we also process the certificate data associate with your signature in addition to the aforementioned data. We have a legitimate interest in being able to verify whether you are able to provide a valid qualified electronic signature serving to replace any written form prescribed by statute. To use a qualified electronic signature, you must independently register with a trust service provider (e.g., CertSign, DigiSign, AlphaSign). When you register, the respective provider will process your data under its own responsibility and not on our behalf, however.

e) For the purpose of complying with the Company's Principles of Compliance and conducting the Compliance Due Diligence process

We will process your personal data to ensure that our business partners meet Schwarz IT Hub's standards of compliance and business ethics, thereby reducing or eliminating compliance risks that could result in financial or reputational losses for our company.

To this end, before initiating a business relationship with the business partner, we conduct a Compliance Due Diligence process, based on our above-mentioned legitimate interest (according to art. 6 para. 1 letter f) GDPR).  Based on this processing, Schwarz IT Hub decides on initiating and / or continuing a business relationship with the business partner.

4. Who receives the personal data you provide to us?

Within our company, access to the data provided by you will be granted to those departments that require such data for the purposes of performing contractual obligations, complying with legal obligations or serving legitimate interests. In the context of the contractual relationships, we also engage processors or service providers who may be given access to your personal data. Their compliance with data protection requirements is ensured by contractual agreement.

In addition, the data may be transferred to Schwarz Group companies for purposes of performing contractual obligations.

In the case of contracts executed by digital signature, your data is also accessible to all persons involved in the approval and signing of the contract, as they receive a log after the contract has been signed indicating all processing steps, including e-mail address, IP address, date and time. Your data may also be accessible to the respective service providers that we use for the relevant digital signature procedure. In the case of Adobe Sign, this would be Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West, Business Campus, Saggart D24, Dublin, Ireland. If a qualified electronic signature is used to execute digital contracts, your data will also be accessible to D-Trust GmbH, Kommandantenstraße 18, 10969 Berlin, Germany, which is the provider responsible for checking the validity of the signature.

5. For how long will the data be stored?

The personal data will be stored for as long as necessary for fulfilling the above-mentioned purposes. As a rule, the data will be kept until the expiration of the statute of limitations (3 years) and for a period of 10 years for the data included in the documents used for accounting purposes.

6. Are you obliged to provide the data?

Within the scope of our business relationship, you must provide us with the personal data needed to commence, execute and terminate a business relationship and to perform the obligations associated therewith, which we are legally obligated to collect or are entitled to collect on the basis of legitimate interests. Without such data, we would generally not be able to enter into or to run a business relationship with you.

7. Is data transferred to third countries?

If we transfer personal data to recipients outside the European Economic Area (EEA), the transfer will only take place if an adequate level of data protection has been confirmed for that third country by the European Commission, if an adequate level of data protection has been agreed with the data recipient (e.g., by means of EU standard contractual clauses) or if we have received your consent.

8. Your rights as the data subject

Under Article 15(1) GDPR, you have the right to obtain information, free of charge, on the personal data stored about you.

If the statutory requirements are met, you also have a right to rectification (Article 16 GDPR), erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR) of your personal data.

If the basis of processing is Article 6(1)(e) or (f) GDPR, you have a right to object under Article 21 GDPR. If you object to processing, your data will no longer be processed thereafter, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests of the data subject in the objection.

If you have provided the processed data yourself, you have a right to data portability under Article 20 GDPR.

If the data processing is carried out on the basis of consent granted under Article 6(1)(a) or Article 9(2)(a) GDPR, you may revoke that consent at any time with effect for the future without this affecting the lawfulness of the previous processing.

In the above-mentioned cases, or if you have questions or complaints, please write to or e-mail the data protection officer (see no. 9).

You also have a right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority located in the state in which you live or where the controller is domiciled has jurisdiction.

9. Data protection officer

For further questions concerning the processing of your data or the exercise of your rights, please contact the competent data protection officer/coordinator of the controller at:

Data protection officer

Bulevardul Dimitrie Pompeiu 6 E

020335 Bucureşti, România

protectiadatelor@mail.schwarz.

10. Further information

Depending on the specific nature of your relationship with us, additional information on data protection and privacy is available at the links below: