UPWARD ARCHITECTURE SOLUTIONS S.R.L.

CONFIDENTIALITY AND PRIVACY POLICY

1. Definitions

• General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
• Personal Data (PD) – any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• Processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• Restriction of processing – the marking of stored personal data with the aim of limiting their processing in the future;
• Controller – UPWARD ARCHITECTURE SOLUTIONS S.R.L., a Romanian limited liability company with its registered office in Bucharest, Calea Griviţei 82-98         Et:1      Corp Podium, Camera E1.30, sect 1, registered with the Trade Registry Office by the Court of Bucharest under no. J40 /15101 /2021, with Tax Registration Number 44834695

National Data Protection Authority – ANSPDCP

2. Introduction

UPWARD ARCHITECTURE SOLUTIONS S.R.L., as Controller, is processing personal data of its clients, employees, business partners and of other individuals interacting with the company and/or doing business with such

The policy herein below describes the mode in which the PD must be processed, in accordance with the GDPR, the principles of the DP processing as well as the rights and obligations of the staff involved in data processing operations.

UPWARD ARCHITECTURE SOLUTIONS S.R.L., does not transfer PD towards third countries or international organisations.

3. Objectives

• GDPR compliance and good practices concerning protection of PD
• Protection of the rights of the Data Subjects (clients, employees, partners etc.);
• Transparency concerning the PD protection operations;
• Protection against PD security breaches.

4. Applicability

The policy herein below shall be applicable to:

• The management of UPWARD ARCHITECTURE SOLUTIONS S.R.L.;
• All employees of UPWARD ARCHITECTURE SOLUTIONS S.R.L.;
• Volunteers and interns providing services for UPWARD ARCHITECTURE SOLUTIONS S.R.L.;
• All persons doing business with UPWARD ARCHITECTURE SOLUTIONS S.R.L.

5. PD processing principles

The PD are:

• Processed legally, fairly and transparently towards the data subject;
• Collected for specific purposes and not subsequently used otherwise, in a manner incompatible with such purposes;
• Adequate, relevant and limited to what is necessary, taking into account the purposes of the processing;
• Accurate and regularly updated;
• Kept in a manner which allows identification of the data subject for a period no longer than necessary for accomplishing the purposes of the processing;
• Processed in a manner which ensures the adequate safety of the PD, including the protection against unauthorized or illegal processing, against loss, destruction or accidental degradation, by taking the appropriate technical and organizational measures.

6. Types of PD being processed

UPWARD ARCHITECTURE SOLUTIONS S.R.L. mainly processes, without limitation, the following data

• Name
• Surname
• Date of birth
• E-mail
• Address
• Phone number
• Personal Identification Number
• ID series and number

7. Legal grounds for processing

Mainly, UPWARD ARCHITECTURE SOLUTIONS S.R.L. processes personal data of its clients and of its employees. Clients’ PD are being processed based on the advisory contract.

Processing of PD belonging to employees is made upon the Labor law provisions. Therefore, for the purpose of recruitment and employment, the following documents and information are being used: CV, employment contract, job description, employment file (criminal record, driver’s license, birth certificate, bachelor’s degree diploma), pay check, travel orders, recruitment platform.

For marketing purposes, UPWARD ARCHITECTURE SOLUTIONS S.R.L. processes PD via mihaelaoroian.com. UPWARD ARCHITECTURE SOLUTIONS S.R.L. operates a Facebook page as well.

8. Prerogatives

Each employee of UPWARD ARCHITECTURE SOLUTIONS S.R.L. is responsible, according to his/her/their prerogatives, with the protection of the PD. Moreover, the following staff members have special prerogatives:

The management – is responsible for UPWARD ARCHITECTURE SOLUTIONS S.R.L. meeting its obligations in all matters concerning protection of PD, as provided by the GDPR.

Data protection responsible has the following tasks:

• Information and counseling of the Controller and of the employees involved in processing on their obligations under the GDPR
• Timely information of the Management on all aspects concerning the data protection (risks, e.g.)
• Recurrent update of the PD protection policies and procedures;
• Initiation and monitorization of the employee’s data protection training;
• Providing advice, upon request, in matters concerning PD impact evaluation and monitoring the implementation of such advice;
• Cooperation with ANSPDCP; contact point for PD processing aspects;
• Solving the requests of the data subject, when referring to their rights under the GDPR

9. Rights of the data subjects and MEANS OF EXERCISE

Any data subject may exercise their rights, as provided under the GDPR:

• Right of access
• Right to rectification;
• Right to erasure
• Right to restriction of processing
• Right of portability
• Right to oppose the processing
• Right not to be subject to a decision based on automatic processing, including profiling.

10. Transparency of the information

UPWARD ARCHITECTURE SOLUTIONS S.R.L. aims to ensure that all data subjects are duly informed of the fact that their PD are being processed and that such have acknowledged:

• Mode of processing and type of processing
• Purposes of the processing
• Means of exercising the rights in connection to the processing

To this effect, as well as for the purpose of full GDPR compliance, UPWARD ARCHITECTURE SOLUTIONS S.R.L. has designated a person with data protection prerogatives, who may be contacted at the e-mail address info@mihaelaoroian.com