Personal Data Protection and Processing Policy

Art.1 PARTIES OF THE AGREEMENT

The person accepting this personal data processing policy, hereinafter referred to in this agreement as the Transferor, and CORNERSTONE TECHNOLOGIES S.R.L. ("CST"), with registered office in Bucharest, Sector 1, B-Dul Magheru, Nr.12-14, Sc.C, Et.3, Ap.35, unique registration code RO32067289, registered at the Trade Register under No. J40/9411/2013, legally represented by Mr. Gabriel ACHIM as administrator, hereinafter referred to in this agreement as the Assignee.

Art.2 PREAMBLE

Considering European Regulation No. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, taking into account the nature of the contract and the data provided by the parties, the Assignee informs and the Transferor acknowledges the manner in which personal data will be processed in accordance with the law.

Art.3 PERSONAL DATA OF THE TRANSFEROR INDIVIDUAL PROCESSED BY THE ASSIGNEE AS CONTROLLER

The personal data collected by the Assignee from the Transferor are: Full Name; Place of Residence; Phone Number; Email; The Transferor undertakes to provide accurate and up-to-date information to the Assignee.

Art.4 LEGAL BASIS AND PURPOSE OF REQUESTING AND PROCESSING DATA

The transmitted data are accurate and will be updated if necessary. The data are provided to Cornerstone Technologies SRL, so that the latter can contact the Transferor after completing our contact form or after submitting an application for our job announcements.. If necessary, the Assignee may process the data to establish, exercise, or defend rights or interests before courts, bailiffs, notaries, other public authorities, arbitral tribunals, mediators, or other public or private bodies that resolve disputes, lawyers, consultants, or other individuals and legal entities, public or private, involved in such disputes or negotiations. In these situations, the Assignee will process the Transferor's data, as the case may be, on the basis of fulfilling legal obligations or its legitimate interests. Regarding the retention of the Transferor's email address and phone number in the Assignee's database and the provision of marketing information by the latter, the Transferor expressly agrees to receive subsequent communications from the Assignee via email regarding civic involvement topics.

Art.5 DATA PROCESSING METHOD. DATA DISCLOSURE

The data will be processed legally, fairly, and transparently to the Transferor, who can request a report on their personal data at any time. The data will be processed in a manner that ensures adequate security in accordance with the law and the Assignee's internal policy for processing and storing customers' personal data. They may be retained as long as necessary, according to the law, for the execution of the contract and the completion of legal forms (e.g., accounting, archiving, payment orders, etc.). Where there is no storage period set by law, the Assignee will consider the applicable prescription periods, along with recommended practices in the field of data protection. The Assignee will process the Transferor's data strictly for the legal and proper execution of the contract, being obliged not to use them for any other purpose. The data will be stored electronically in files accessible only to the Assignee's staff and will be protected through confidentiality agreements and limitations on the possibility of copying this data. The Assignee may provide the Transferor's personal data to the magazines, newspapers, websites, and social networks with which it collaborates and which will broadcast advertisements or news containing the image, name and/or pseudonym or nickname of the Transferor, ensuring that adequate guarantees are always in place to protect the Transferor's personal data. The data will be provided based on the contract concluded by the Assignee and its collaborators, under the law, and the collaborators undertake, in turn, to process personal data in compliance with legal provisions. The Assignee's collaborators are EU member states and, in this regard, are subject to compliance with EU legal regulations regarding the protection of personal data.

Art.6 RIGHTS OF THE TRANSFEROR

The Transferor has the following rights regarding their personal data provided to the Assignee under this agreement:

1. (a) The right to access data: The Transferor has the right to access the data provided to the Assignee, to obtain information about the nature, processing, and disclosure of this data.
2. (b) The right to rectify data: The Transferor has the right to obtain the rectification of data if they are not accurate.
3. (c) The right to erasure of data: The Transferor has the right to request and obtain the erasure of data when they are no longer processed or there is no longer a legal obligation to retain or archive them.
4. (d) The right to restrict data processing: The Transferor has the right to request and obtain the restriction of data processing. In this sense, if the contract can no longer be executed or carried out due to the restriction, the Assignee will inform the Transferor about this.
5. (e) The right to object: The Transferor has the right to object to the processing of data. In this sense, if the contract can no longer be executed or carried out due to the objection raised, the Assignee will inform the Transferor about this.
6. (f) The right to data portability: The Transferor has the right to request a complete format of all data provided to the Assignee and to transmit it to another controller.
7. (g) The right to withdraw consent: In the event that certain data have been processed by the Assignee with the explicit consent of the Transferor, the latter has the right to withdraw their consent, without affecting the legality of the processing before withdrawal and the legality of other personal data provided on other legal grounds (e.g., for the conclusion and execution of the contract).
8. (h) The right to lodge a complaint with the supervisory authority: The Transferor has the right to lodge a complaint with the supervisory authority for the processing of personal data (National Authority for the Supervision of Personal Data Processing – ANSPDCP) regarding the processing of data provided to the Assignee or by authorized persons on its behalf.

Art.7 ABSENCE OF AUTOMATED DECISION-MAKING

The Assignee does not make decisions that produce legal effects concerning the Transferor or significantly affect them and that are based on the automated processing of personal data or the creation of a profile of the Transferor.