Horia Hulubei National Institute for Research and Development in Physics and Nuclear Engineering (IFIN-HH), with headquarters in Magurele, 30 Reactorului St., Ilfov county, as Controller, processes personal data in accordance with the provisions of Regulation No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (Regulation).
Before continuing navigation on our webpages, we recommend that you read these policy carefully. Should you not agree to them and wish that your personal data be not used as detailed below please do not continue using our webpages and do not provide us your personal data. Each accessing of our website pages is a confirmation that you have read, understood and consented to comply wih this policy.

1. DEFINITIONS
Personal data - any information about an identified or identifiable natural person ("data subject").
Identifiable natural person - an identifiable individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
Processing - any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller - the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the Controller.
Supervisory Authority shall mean the regulatory or supervisory authority responsible for enforcing the Regulation. In Romania, this role is undertaken by the National Supervisory Authority for Personal Data Processing (ANSPDCP).

2. INFORMATION ON OUR WEBPAGES
The domains www.nipne.ro and www.eli-np.ro and their related subdomains are the property of IFIN-HH, hosting and administration thereof being made by the internal specialised department. Our webpages may include links to other pages that are managed by other entities/legal persons which do not have any connection with the activity of IFIN-HH and regarding which IFIN-HH does not bear any responsibility. Also, our webpages provide links to other partner webpages, which enforce separate confidentiality policies. If you access these portals via our webpages, you should read the confidentiality policies of those Internet pages to be able to understand how they collect, use and communicate your information. Our webpages mentioned above do not use cookies modules or traffic analysis tools.
Depending on the webpages on which you navigate only part of the personal data categories will be used.

3. DATA SUBJECTS
The categories of data subjects to which the personal data processing refers are:
- employees, employees' family members, former employees;
- candidates for vacancies in IFIN-HH;
- parties to contracts and persons involved in the conclusion and execution of contracts;
- participants to events organised or supported by IFIN-HH;
- high school and college students;
- users of National Physics Library (BNF);
- participants in the training and specialization courses of the Center for Training and Specialization in the Nuclear Field (CPSDN);
- persons accommodated in the Institute's Centers;
- representatives of the authorities, public institutions and mass media;
- individuals accessing webpages.

4. PERSONAL DATA CATEGORIES
IFIN-HH processes the personal data provided directly by the data subjects, such data being generated on their basis, as well as from public sources.
The categories of personal data processed are:
- identification data: surname, given name, academic title, position, department, personal numerical code, number and series of ID card/passport/driving licence, mark number, access card ID;
- computer identification data: IP address, username, password;
- data regarding the person: date and place of birth, gender, citizenship, civil status, signature;
- contact information: domicile/residence address, e-mail address, landline/mobile phone;
- recruitment data: data contained in CVs, recommendations, employment history book or equivalent, criminal record;
- financial data: bank account number and other financial information;
- data regarding health condition;
- biometric data: voice, image;
- data collected upon registration and attendance to events organised or supported by IFIN-HH (photos, videos, quotations, social network posts etc.)

5. PURPOSES OF PERSONAL DATA PROCESSING
The purpose of the processing is to fulfil the legal obligations regarding the object of activity of IFIN-HH; to achieve the communication and dissemination objectives, including marketing for events; to ensure the security of individuals and property, the guard and protection of property, buildings, assets and materials with special regime which are used in the scientific research and development process; to ensure the performance of contracts.

6. THE LAWFUL OF PERSONAL DATA PROCESSING
6.1 Performance of a contract - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, including in relation to the achievement of the object of activity.
6.2 Legal obligation - processing is necessary for compliance with a legal obligation to which the controller is subject.
6.3 Protection of vital interests - processing is necessary in order to protect the vital interests of the data subject or of another natural person.
6.4 Public interest - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, if applicable.
6.5 Legitimate interest - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This category may include the fulfilment of communication and dissemination objectives, as applicable marketing (for the economic activities carried out by the institute); the safeguarding of individuals' and property security, the guard and protection of property, real estates, assets and special regime materials used in the scientific research and development process; the organisation of events; the recruitment and human resources process.
6.6 Consent - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. According to the Rules, consent is deemed given either by means of a written document or through an affirmative unequivocal action. The consent thus given can be withdrawn according to the provisions of the Rules.

7. RECIPIENTS OF PERSONAL DATA
In order to fulfil the processing purposes, IFIN-HH may disclose certain categories of personal data to the following categories of recipients: the data subject and/or his/her legal representatives, IFIN-HH representatives, the entities within the IFIN-HH, judicial authorities or other public authorities, international organisations, medical clinics, insurance and reinsurance companies, professional organisations, market research organisations, contractual partners and/or persons empowered by IFIN-HH.

8. DURATION OF DATA PROCESSING
In order to fulfil the said processing purposes, IFIN-HH processes the personal data identified above according to its own archival listing, drawn up according to the National Archives Law no. 16/1996, with further amendments and supplements. IFIN-HH also processes personal data for statistical purposes.
The duration for storing the data obtained by means of the video surveillance system for the guard and protection of persons, property and premises is proportionate to the processing purpose, but not longer than 30 days, excepting the situations expressly regulated by the law or the thoroughly justified cases, such as: special transports (radioactive materials or sources); complaints, notifications from data subjects; work accidents; physical security incidents; etc. with the mention that access to the information will be made only in the said and justified situations. In such cases, the duration for keeping the relevant film material may exceed the normal limits depending on the time necessary for additional investigations. The keeping is rigorously documented, and the need for keeping is revised periodically.

9. DATA SECURITY
IFIN-HH attaches utmost importance to personal data and understands to ensure proper security throughout the processing activities. In this respect, IFIN-HH implements adequate measures for protection against unauthorised or illegal processing and against loss, destruction or accidental damage.

10. RIGHTS OF THE DATA SUBJECT
10.1 The right to information represents the right to be informed regarding the processing and protection of personal data.
10.2 The right of access to personal data represents the right to obtain from the data controller the confirmation that the personal data are or are not being processed by it.
10.3 The right to rectification of personal data represents the right to obtain the rectification of inaccurate data, as well as the supplementation of incomplete data.
10.4 The right to erasure of personal data ("the right to be forgotten") represents the right to obtain, insofar as the legal conditions are met, the erasure of personal data.
10.5 The right to restriction of processing represents the data subject's right to obtain from the Controller the restriction of processing in cases such as: contesting data accuracy, data preservation but processing restriction.
10.6 The right to portability of data represents the right to receive personal data in a structured, commonly used manner, and in an easily readable format, as well as the right for such data to be sent to other data controller, insofar as the legal conditions are met.
10.7 The right to object to data processing represents the right to oppose at any time, for justified and lawful reasons connected with the particular situation, that the personal data be subject to processing, insofar as the legal conditions are met.
10.8 The right of not being subject to automated decisions, including profiling represents the right to ask for and obtain the withdrawal, cancellation or reassessment of any decision based exclusively on processing made by automatic means (including profiling) which causes legal effects or similarly affects the data subjects to a significant degree.
10.9 The right to refer the matter to the authorities in the field/the court of law represents the right to send a complaint to the National Supervisory Authority for Personal Data Processing (ANSPDCP) according http://www.dataprotection.ro/?page=Plangeri_RGPD&lang=ro, to go to court, respectively, in order to defend any rights secured by the applicable personal data protection legislation, which have been violated.

The requests whereby you exercise such rights must contain your identity data necessary to assure us that the request comes from you.

11. DATA PROTECTION OFFICER
In order to exercise your rights regarding the processing of personal data, you can send us a written, dated and signed request, as follows:
- by post, to the address of the Horia Hulubei National Institute for Research and Development in Physics and Nuclear Engineering, with headquarters in Magurele, 30 Reactorului St., Ilfov county, with the mention "For the attention of the Data Protection Officer"
- by e-mail, at gdpr@nipne.ro.

Each request will be analysed and you will be advised of the actions taken in this respect, in compliance with the provisions of the Regulation.
For questions or other information regarding the processing of your personal data, you can call us at (+4)021.404.61.88