PROCEDURES FOR THE PROCESSING OF PERSONAL DATA
1. PURPOSE
The purpose of these procedures is to guarantee and protect the fundamental rights and freedoms of individuals, in particular the right to intimate, family and private life, with regard to the processing of personal data.
2. SCOPE OF APPLICATION
This procedure applies to Max Loads SRL for the processing of personal data, wholly or partially, by automatic means or by other means.
The procedure applies to the processing of personal data as an operator or empowered of an operator.
3. DEFINITIONS
Agreement – Agreement regarding the protection of personal data processing.
Personal data – any information relating to an identified or identifiable individual; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, psychological, economic, cultural or social identity.
Anonymous data – data which, due to the origin or specific mode of processing, can not be associated with an identified or identifiable person.
Consignee – any natural or legal person, whether private or public, including public authorities, their institutions and their territorial structures to whom data are disclosed, whether or not a third party; public authorities to whom data are given under a special investigative competence shall not be considered as recipients.
Operator – any natural or legal person, whether private or public, including public authorities, their institutions and their territorial structures, which establishes the purpose and means of processing personal data; if the purpose and means of processing personal data are determined by a normative act or by a normative act, the operator is the natural or legal person, whether public or private, which is designated as an operator by that normative act; or based on that normative act.
Data subject – person whose data are collected and/or processed person authorized by the operator – a natural or legal person, whether private or public, including public authorities, their institutions and their territorial structures, that process personal data on behalf of the operator.
Processing of personal data – any operation or set of operations that is performed on personal data by automatic or non-automatic means such as collecting, recording, organizing, storing, adapting or modifying, extracting, consulting, using, disclosing to third parties by transmission, dissemination or in any other way, joining or combining, blocking, deleting or destroying.
Personal Data Recording System – any organized structure of personal data, accessible according to specified criteria, whether this structure is organized centrally or decentralized or is distributed according to functional or geographic criteria.
Storage – Keeping personal data gathered on any support.
Third – any natural or legal person, whether private or public, including their public authorities, their institutions and their territorial structures, other than the data subject, the operator or the person empowered or the persons, under the direct authority of the operator or the person empowered, are authorized to process data.
4. DESCRIPTION OF ACTIVITY
4.1. Categories of persons:
a. Employees of the company and their family members
b. People applying for a position within the company
c. Any natural or legal person that has a commercial or contractual relationship with Max Loads
4.2. Purpose of collecting personal data:
a. Max Loads is required to administer safely and for the specified purposes, only the personal data provided to it by the categories of natural persons referred to in Article 4.1.
b. The purpose of collecting personal data in the case of employees, their family members and persons applying for a position within Max Loads is organizational, administrative and economic-financial management at the time of employment and after employment (occupational medicine, accounting, GPS monitoring, bank, human resources, timing, approval of inputs/outputs to partners or their collaborators)
c. The purpose of collecting personal data in the case of natural or legal persons having commercial or semi-public relations with Max Loads is the proper conduct of the specific transport, installation or other service activities of the company and are related to the acknowledgment of taking over or deliver transported goods or with the access for installation and billing.
4.3 Parties that have access to personal information
The information collected is intended for use by Max Loads and its authorized agents and is only communicated to the following recipients: the data subject, the legal representatives of the data subject, the operator’s access rights, the operator’s agents, other legal entities that process data on behalf of the operator, criminal prosecution authorities, other law enforcement agencies to request information.
4.4 Collected data
The personal data collected by Max Loads SRL are those mentioned in Article 2 of the Agreement on the Protection of Personal Data.
4.5 Data processing mode
The processing of personal data may be accomplished by automatic or non-automatic means in the course of operations or sets of operations, but not limited to, as follows:
a. Collecting – gathering, collecting or receiving personal data by any means and from any source
b. Registration – recording of personal data in an automatic or non-automated recording system, which may be a register, an automated file, a database or any other form of evidence organized, structured in a certain way, data or documents, regardless of the way the data is written
c. Organizing – organizing, structuring, or systematizing of personal data, according to predefined criteria, according to the legal duties of the operator, for the purpose of efficiency-optimization of their processing activities
d. Storing – Retaining on any support whatsoever the collected personal data, including backing up
e. Adaptation – transformation of personal data initially collected, according to pre-defined criteria and purposes for which they were collected
f. Modifying – updating, filling in, changing, correcting, or restoring personal data in order to maintain the accuracy, reality, actability characteristics
g. Withdrawal – removing part of the specific category of personal data for the purpose of using it separately and distinct from the original processing
h. Consultation – Examining, viewing, querying or researching personal data without being limited to the purpose of performing operations or sets of subsequent processing operations
i. Use – use of personal data in whole or in part by and within the operator, empowered by the operator or the consignee, as the case may be, including by printing, copying, duplication, scanning or any other similar procedure
j. Disclosure – make personal data available to third parties through communication, transmission, dissemination or otherwise
k. Joining – adding, attaching, or appending personal data to existing ones that it modifies
l. Combining – merging or assembling of personal data initially separated in a new form based on predetermined criteria for specific purposes
m. Blocking-discontinuing the processing of personal data
n. Deletion – removing or eliminating, in whole or in part, the personal data from the records or registrations, by fulfilling the retention period, upon reaching the purpose for which they were introduced, the caducity, the inexistence, the inaccuracy
o. Transformation – the operation performed on personal data with the purpose of anonymizing them
p. Destruction – bringing into use, under the conditions of the law, definitive and irrecoverable, through mechanical or thermal means, the physical support on which personal data were processed
4.6 Communication of personal data
Personal data may be communicated between operators and their empowered agents or between their operators or agents and other public or private bodies or institutions in either of the following circumstances:
-if the data subject has given his express and unambiguous consent to the communication of his data
-without the consent of the person concerned in the cases provided by law.
Requests for the communication of personal data to Max Loads SRL must contain the applicant’s identification data as well as the reasoning and the purpose of the request, in accordance with the legal provisions. Compliant applications shall receive a response within 30 days of their registration.
4.7 Technical measures concerning the processing of personal data
All documents containing personal data are recorded and followed by the storage and processing rules as follows:
– personal data is processed only by the persons designated in Annex 2 of the Agreement;
– personal data is physically stored in the company’s archive in locked key cabinets and accessed by persons designated in Annex 2 of the Agreement and electronic on the company’s antivirus protected server in a file accessible only to the administrator and the Data Protection Officer;
– in exceptional situations, persons providing technical support may have access to personal data during the intervention, only in the presence of a user designated by the operator.