These Rules represent an extract from the R-IFIN-39 Rules on the protection of personal data, as well as information on the processing of personal data on IFIN-HH webpages.
Horia Hulubei National Institute for Research and Development in Physics and Nuclear Engineering (IFIN-HH), with headquarters in Magurele, 30 Reactorului St., Ilfov county, as Controller, processes personal data in accordance with the provisions of Regulation No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (Regulation).
Before continuing navigation on our webpages, we recommend that you read these Rules carefully. Should you not agree to them and wish that your personal data be not used as detailed below please do not continue using our webpages and do not provide us your personal data. Each access of our website pages is a confirmation that you have read, understood and consented to observe these Rules.
Personal data - any information about an identified or identifiable natural person ("data subject").
Identifiable natural person - an identifiable individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
Processing - any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller - the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the Controller.
Supervisory Authority shall mean the regulatory or supervisory authority responsible for enforcing the Regulation. In Romania, this role is undertaken by the National Supervisory Authority for Personal Data Processing (ANSPDCP).
2. INFORMATION ON OUR WEBPAGES
Depending on the webpages on which you navigate only part of the personal data categories will be used.
3. DATA SUBJECTS
The categories of data subjects to which the personal data processing refers are:
- employees, employees' family members, former employees;
- candidates for vacancies in IFIN-HH;
- signatories of contracts and persons involved in the conclusion and performance of contracts;
- participants to events organised or supported by IFIN-HH;
- representatives of public institutions;
- individuals accessing webpages.
4. PERSONAL DATA CATEGORIES
IFIN-HH processes the personal data provided directly by the data subjects, such data being generated on their basis, as well as from public sources.
The categories of personal data processed are:
- identification data: surname, given name, academic title, position, department, personal numerical code, number and series of ID card/passport/driving licence, mark number, access card ID;
- computer identification data: IP address, username, password;
- data regarding the person: date and place of birth, gender, citizenship, civil status, signature;
- contact information: domicile/residence address, e-mail address, landline/mobile phone;
- recruitment data: data contained in CVs, recommendations, employment history book or equivalent, criminal record;
- financial data: bank account number and other financial information;
- data regarding health condition;
- biometric data: voice, image;
- data collected upon registration and attendance to events organised or supported by IFIN-HH (photos, videos, quotations, social network posts etc.)
5. PURPOSES OF PERSONAL DATA PROCESSING
5.1 Performance of a contract - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, including in relation to the achievement of the object of activity.
5.2 Legal obligation - processing is necessary for compliance with a legal obligation to which the controller is subject.
5.3 Protection of vital interests - processing is necessary in order to protect the vital interests of the data subject or of another natural person.
5.4 Public interest - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, if applicable.
5.5 Legitimate interest - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This category may include the fulfilment of communication and dissemination objectives, as applicable marketing (for the economic activities carried out by the institute); the safeguarding of individuals' and property security, the guard and protection of property, real estates, assets and special regime materials used in the scientific research and development process; the organisation of events; the recruitment and human resources process.
5.6 Consent - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. According to the Rules, consent is deemed given either by means of a written document or through an affirmative unequivocal action. The consent thus given can be withdrawn according to the provisions of the Rules.
6. RECIPIENTS OF PERSONAL DATA
In order to fulfil the processing purposes, IFIN-HH may disclose certain categories of personal data to the following categories of recipients: the data subject and/or his/her legal representatives, IFIN-HH representatives, the entities within the IFIN-HH group, judicial authorities or other public authorities, international organisations, medical clinics, insurance and reinsurance companies, professional organisations, market research organisations, contractual partners and/or persons empowered by IFIN-HH.
7. DURATION OF DATA PROCESSING
In order to fulfil the said processing purposes, IFIN-HH processes the personal data identified above according to its own archival listing, drawn up according to the National Archives Law no. 16/1996, with further amendments and supplements. IFIN-HH also processes personal data for statistical purposes.
8. DATA SECURITY
IFIN-HH attaches utmost importance to personal data and understands to ensure proper security throughout the processing activities. In this respect, IFIN-HH implements adequate measures for protection against unauthorised or illegal processing and against loss, destruction or accidental damage.
9. RIGHTS OF THE DATA SUBJECT
9.1 The right to information represents the right to be informed regarding the processing and protection of personal data.
9.2 The right of access to personal data represents the right to obtain from the data controller the confirmation that the personal data are or are not being processed by it.
9.3 The right to rectification of personal data represents the right to obtain the rectification of inaccurate data, as well as the supplementation of incomplete data.
9.4 The right to erasure of personal data ("the right to be forgotten") represents the right to obtain, insofar as the legal conditions are met, the erasure of personal data.
9.5 The right to restriction of processing represents the data subject's right to obtain from the Controller the restriction of processing in cases such as: contesting data accuracy, data preservation but processing restriction.
9.6 The right to portability of data represents the right to receive personal data in a structured, commonly used manner, and in an easily readable format, as well as the right for such data to be sent to other data controller, insofar as the legal conditions are met.
9.7 The right to object to data processing represents the right to oppose at any time, for justified and lawful reasons connected with the particular situation, that the personal data be subject to processing, insofar as the legal conditions are met.
9.8 The right of not being subject to automated decisions, including profiling represents the right to ask for and obtain the withdrawal, cancellation or reassessment of any decision based exclusively on processing made by automatic means (including profiling) which causes legal effects or similarly affects the data subjects to a significant degree.
9.9 The right to refer the matter to the authorities in the field/the court of law represents the right to send a complaint to the National Supervisory Authority for Personal Data Processing (ANSPDCP), to go to court, respectively, in order to defend any rights secured by the applicable personal data protection legislation, which have been violated.
The requests whereby you exercise such rights must contain your identity data necessary to assure us that the request comes from you.
10. DATA PROTECTION OFFICER
For more details regarding the personal data processing activities carried out by IFIN-HH, as well as regarding the data subject's rights and exercise thereof, you can send us a written, dated and signed request, for the attention of the Data Protection Officer, as follows:
- by post, to the address of the Horia Hulubei National Institute for Research and Development in Physics and Nuclear Engineering, with headquarters in Magurele, 30 Reactorului St., Ilfov county, with the mention "For the attention of the Data Protection Officer"
- by e-mail, at email@example.com.