Personal Data Protection

Personal Data Notice

According to Law no  677/2001 regarding the protection of persons for the processing of personal data and free circulation of such data, updated by Law  506/2004 regarding personal data processing and private life protection in the area of electronic communications and EU directive  2016/679, SC EXPERT MULTISERVICES IMPEX SRL, VAT no. RO4965500, Reg no. J40/25832/1993, throughout it Agency EXPERT TOURS (Tourism Licence no. 762 A), has the obligation to ensure the safety of personal data management and that such data is collected only within the declared scope. 

In this regard Expert Multiservices Impex Ltd complies with the six data processing principles which states that Personal data must be:

1. Processed lawfully, fairly and transparently.
2. Collected only for specific legitimate purposes.
3. Adequate, relevant and limited to what is necessary.
4. Accurate and, where necessary, kept up to date.
5. Stored only as long as is necessary.
6. Processed in a manner that ensures appropriate security.

The scope of collecting data is to offer tourist services as: airline tickets issue, accommodation and travel insurance issue. In addition, the data could be used for small direct marketing campaigns via email or post.

The data collected to offer tourist services are used internally by our travel agency or sent via different secured electronic systems to Airlines via GDS or in base of our Agreements directly to the hotels or insurance companies.

Such data will be never sent to third parties to be used for marketing campaigns or in other scopes not mentioned earlier.

Internally the data can be accessed only by authorized personnel, via a username and password and encrypted communication.

The management and protection of personal data of the visitor / user of this website is subject to the terms of this notice as well as in accordance with national, Community and international law on the protection of individuals with regard to processing of personal data, as applicable.

As per the provisions of the EU directive 2016/679 regarding the protection of persons for the processing of personal data and free circulation of such data, you benefit of the following rights:

The right to be informed

Organisations need to tell individuals what data is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties. This information must be communicated concisely and in plain language.

The right of access

Individuals can submit subject access requests, which oblige organisations to provide a copy of any personal data they hold concerning the individual. Organisations have one month to produce this information, although there are exceptions for requests that are manifestly unfounded, repetitive or excessive.

The right to rectification

If an individual discovers that the information an organisation holds on them is inaccurate or incomplete, they can request that it be updated. As with the right of access, organisations have one month to do this, and the same exceptions apply.

The right to erasure

Individuals can request that organisations erase their data in certain circumstances, such as when the data is no longer necessary, the data was unlawfully processed or it no longer meets the lawful ground for which it was collected. This includes instances where the individual withdraws consent.

The right to erasure is also known as ‘the right to be forgotten’.

The right to restrict processing

Individuals can request that an organisation limits the way it uses personal data. It’s an alternative to requesting the erasure of data, and might be used when an individual contests the accuracy of their personal data or when they no longer need the information but the organisation requires it to establish, exercise or defend a legal claim.

The right to data portability

Individuals are permitted to obtain and reuse their personal data for their own purposes across different services. This right only applies to personal data that an individual has provided to data controllers by way of a contract or consent.

The right to object

Individuals can object to the processing of personal data that is collected on the grounds of legitimate interests or the performance of a task in the interest/exercise of official authority. Organisations must stop processing information unless they can demonstrate compelling legitimate grounds for the processing that overrides the interests, rights and freedoms of the individual or if the processing is for the establishment or exercise of defence of legal claims.

Rights related to automated decision making including profiling

The GDPR includes provisions for decisions made with no human involvement, such as profiling, which uses personal data to make calculated assumptions about individuals. There are strict rules about this kind of processing, and individuals are permitted to challenge and request a review of the processing if they believe the rules aren’t being followed. In this regard we inform you that Expert Multiservices Impex Ltd will never use personal data for automated decision making and profiling.

The application of the above mentioned rights is being made by supplying a written request to our contact address mentioned in the “contact” section of this website.

You also have the right to go to the competent courts of justice in order to protect your rights regarding personal data processing.