1. Who are we?

PRIMA SOLIS S.R.L., hereinafter the Company or We.

Our contact details are:

Registered office address: Piața Nucetului no. 12, Building A3, Ground Floor, Commercial Space no. 2, Office no. 16, Oradea Municipality, Bihor County, Romania

E-mail address: dpo@primadevelopment.ro

Phone no.: 0371.783.004

2. How do we process your personal data?

The Company, in its capacity as Controller, processes the personal data of candidates applying for available positions, employees, individual clients, representatives of corporate clients, contractual partners and collaborators, and the data of other individuals who interact with the Company and/or are involved in contractual relationships with it.

Personal data is:

• processed lawfully, fairly and transparently in relation to the data subject;
• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• accurate and kept up to date;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;
• processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

3. What types of personal data do we process and for what purpose?

In the context of staff recruitment, we process the following types of personal data: name, surname, address, date of birth, citizenship, gender, phone no., e-mail address, data on professional and/or social experience, education and professional training, skills, and other personal data resulting from the information contained in the CV and cover letter submitted, and, as applicable, during discussions held during the job interview.

For the conclusion and performance of service provision and partnership/collaboration contracts, we mainly process the following types of personal data: name, surname, ID card/passport series and number, gender, home/residence address, bank account number, e-mail address, phone no.

For the purpose of completing and submitting the contact form (“Contact”) on the Company’s website – www.primasolis.ro (hereinafter “the website”), we process the following types of personal data: name, surname, e-mail, phone number and, as applicable, any other data provided at the data subject’s own initiative in the “Message” section.

The forms currently available on the website are: the “Request a quote” form (fields: name, phone number, e-mail address, apartment type of interest, purpose of purchase – home or investment, message) and the newsletter subscription form (field: e-mail address). Submitting the form requires prior confirmation, through a checkbox that is not pre-ticked by default, that the person has read and acknowledged this Policy.

For website visitors, we may collect data through cookies or other similar technologies, such as: IP address, internet browser, location, web pages accessed on our website, time spent on the website, internet network, device used. For more details on this, please see our Cookie Policy, available at https://www.primasolis.ro/politica-privind-cookie-urile-ue/.

We do not use your personal data to send you marketing communications, such as newsletters, commercial messages via e-mail and SMS, unless you give your express consent for such communications, by checking a consent box to that effect. For this purpose, we process your e-mail address and, for SMS messages, your phone number, and we ensure that you have a simple option to unsubscribe at any time, i.e. to withdraw your consent regarding the receipt of these types of communications.

If you provided us with your contact details when purchasing a product or service, we may send you communications about similar products and services, pursuant to Article 12(2) of Law no. 506/2004, with the possibility of objecting at any time, free of charge. To send these communications, we may use specialized platforms acting as processors, and any technologies used to measure interaction with the messages are used only with your consent.

The website and the forms available on it are not directed at minors. We do not knowingly collect personal data from persons under the age of 16 – the age set out in Article 8 of the GDPR, as established at national level by Article 7 of Law no. 190/2018 – for the validity of consent in the context of information society services. If we become aware that we have collected such data without the authorization of the holder of parental responsibility, we will delete it without undue delay.

4. What legal grounds does the processing of personal data rely on?

Your personal data is processed for the purpose of:

• concluding and performing various contracts;
• fulfilling our legal obligations;
• based on consent requested and/or given in advance (in the context of staff recruitment, for sending marketing communications, etc.);
• for the purpose of the legitimate interests pursued by the Company (e.g. adopting protection and security measures for our employees, exercising the Company’s legitimate rights and interests in contentious or non-contentious proceedings, etc.).

Marketing communications via e-mail and SMS are based on consent (Article 6(1)(a) of the GDPR and Article 12(1) of Law no. 506/2004), while for clients, for similar products and services to those purchased, they are based on the Company’s legitimate interest (Article 6(1)(f) of the GDPR and Article 12(2) of Law no. 506/2004).

5. For how long do we process your personal data?

Personal data is stored for processing for as long as is necessary to achieve the processing purposes mentioned in this Policy or for the period required by law (e.g. for archiving, accounting purposes, etc.).

By way of detail, we apply the following retention periods:

• data collected through the “Request a quote” form: 3 years from the last interaction, if no contract is concluded;
• newsletter subscription data: until consent is withdrawn or the subscription is cancelled, or until the right to object is exercised, followed by keeping proof of unsubscription for 3 years;
• data from the recruitment process: 6 months from the completion of the recruitment process, or up to 2 years based on express consent, for inclusion in the candidate database;
• data related to contractual relationships: for the duration of the contract and for a further 3 years, the general limitation period (Article 2,517 of the Civil Code); supporting documents and accounting records are kept for 5 years, pursuant to Article 25 of Law no. 82/1991, as in force since 15.01.2023, and annual financial statements for 10 years;
• data collected through cookies: the individual retention periods are indicated, for each cookie, in the Cookie Policy.

6. Who do we share your personal data with?

We will not disclose or transfer any of the personal data collected from you or about you to any third party, except:

• Public authorities and institutions – where there is a legal obligation to do so or for the purpose of a legitimate interest (defending the Company’s rights in contentious or non-contentious proceedings, etc.).
• The Company’s contractual partners or collaborators who provide us with web hosting, website development and maintenance, online marketing, e-mail marketing and SMS marketing services, among others.
• Any third party – if you have given your explicit and specific consent for that particular situation and those particular data.

As of the date of the last update of this Policy, the categories of recipients and processors involved in connection with the website are: the web hosting and content delivery service provider; the website development and maintenance service provider; Google Ireland Limited (Google Analytics, Google Ads / AdSense, Google Maps, Google Fonts, YouTube); Meta Platforms Ireland Limited (Facebook, Instagram, WhatsApp); LinkedIn Ireland Unlimited Company; Microsoft Ireland Operations Limited (Microsoft Advertising, Microsoft Clarity); TikTok Technology Limited; Vimeo.com, Inc.; Mixpanel, Inc.; Adobe (Adobe Fonts). The updated list of services and corresponding cookies, together with the purpose and duration of each, is available in the Cookie Policy.

Where personal data processed by the Company is transferred by it, directly or through its contractual partners/collaborators, outside the European Economic Area, we ensure that such transfers take place in compliance with the GDPR (in particular Article 46 of the GDPR), applicable legal provisions in this area, on the basis of appropriate safeguards (standard data protection clauses adopted by the Commission), and provided that enforceable rights and effective remedies are available for data subjects. In the case of transfers to providers established in the United States of America, the transfer is carried out pursuant to Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection provided by the EU–U.S. Data Privacy Framework, where the recipient is certified under this mechanism, or, as applicable, pursuant to the standard contractual clauses adopted by Implementing Decision (EU) 2021/914, accompanied, where necessary, by supplementary measures established following a transfer impact assessment.

7. What protection measures and safeguards do we take?

The Company implements appropriate technical and organizational measures to ensure a high level of security and protection for personal data. We use security methods and technologies, together with internal work policies and procedures, including control and audit procedures, to protect the personal data collected in accordance with the legal provisions in force relevant to the protection of personal data.

8. What are your rights as a data subject?

Any data subject may exercise the following rights, as provided for by the General Data Protection Regulation:

• The right of access;
• The right to rectification;
• The right to erasure;
• The right to restriction of processing;
• The right to data portability;
• The right to object to processing;
• The right not to be subject to a decision based solely on automated processing, including profiling;
• The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro) and with the courts of law.

To exercise these rights, or for any questions related to the processing of your personal data, please contact us at the e-mail address: sales@primasolis.ro or by phone at: 0365401269, contact person Ionel Orza. Data Protection Officer (DPO) services are outsourced and provided by GDPRComplet.

We will respond to your requests without undue delay and, in any event, within one month of receiving the request, a period which may be extended by two months where necessary, taking into account the complexity and number of requests, with prior notice to you (Article 12(3) of the GDPR). You may also contact the National Supervisory Authority for Personal Data Processing, headquartered at B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest, e-mail: anspdcp@dataprotection.ro.