In accordance with the provisions of Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of such data, PriceCarz processes personal data in compliance with the principles mentioned below, for legitimate purposes. The processing of personal data is carried out by mixed means (manual and automated) while respecting legal requirements and under conditions that ensure security, confidentiality, and respect for the rights of the data subjects.

EXCERPT from Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of such data (published in the Official Gazette no. 790 of December 12, 2001); amended and supplemented by Law no. 102/2005 of May 3, 2005 (Official Gazette, Part I no. 391 of May 9, 2005)

Chapter IV

Rights of the data subject in the context of personal data processing

Information of the data subject

Art. 12.

(1) In the case where personal data is obtained directly from the data subject, the data controller is obliged to provide the data subject with at least the following information, unless the data subject already possesses the respective information:

a) the identity of the data controller and its representative, if applicable;

b) the purpose for which the data is processed;

c) additional information such as: recipients or categories of recipients of the data; whether providing all requested data is mandatory and the consequences of refusing to provide them; the existence of rights provided by this law to the data subject, especially the right of access, intervention over the data, and opposition, as well as the conditions under which they can be exercised;

d) any other information required to be provided by the supervisory authority's order, taking into account the specific nature of the processing.

(2) In case the data is not obtained directly from the data subject, the data controller is obliged, at the time of data collection or, if disclosure to third parties is intended, at the latest upon the first disclosure, to provide the data subject with at least the following information, unless the data subject already possesses the respective information:

a) the identity of the data controller and its representative, if applicable;

b) the purpose for which the data is processed;

c) additional information such as: the categories of data concerned, recipients or categories of recipients of the data, the existence of rights provided by this law to the data subject, especially the right of access, intervention over the data, and opposition, as well as the conditions under which they can be exercised;

d) any other information required to be provided by the supervisory authority's order, taking into account the specific nature of the processing.

(3) The provisions of paragraph (2) do not apply when data processing is exclusively for journalistic, literary, or artistic purposes, if their application would reveal the sources of information.

(4) The provisions of paragraph (2) do not apply when data processing is for statistical, historical, or scientific research purposes, or in any other situations where providing such information proves impossible or would involve a disproportionate effort compared to the legitimate interest that could be harmed, as well as in situations where the recording or disclosure of data is expressly provided by law.

Right of access to data

Art. 13.

(1) Any data subject has the right to obtain from the data controller, upon request and free of charge for one request per year, confirmation as to whether data concerning them are being processed by it. The data controller is obliged, in the case of processing of personal data concerning the requester, to communicate to them, together with the confirmation, at least the following:

a) information regarding the purposes of processing, the categories of data considered, and recipients or categories of recipients to whom the data are disclosed;

b) communication in an intelligible form of the data undergoing processing, as well as any available information regarding the data's origin;

c) information about the principles of operation of the mechanism by which any automated processing of data concerning the person is carried out;

d) information about the existence of the right to intervene on the data and the right to object, as well as the conditions under which they can be exercised;

e) information about the possibility to consult the register of records of personal data processing, as provided for in Article 24, to file a complaint with the supervisory authority, and to address the court to challenge the decisions of the data controller, in accordance with the provisions of this law.

(2) The data subject may request from the data controller the information provided for in paragraph (1) through a written request, dated and signed. In the request, the requester may indicate whether they want the information to be communicated to a specific address, which may also be an email address, or through a correspondence service that ensures delivery only to the person.

(3) The data controller is obliged to communicate the requested information within 15 days from the date of receiving the request, respecting the possible option of the requester as expressed under paragraph (2).

(4) In the case of personal data related to health status, the request provided for in paragraph (2) can be made by the data subject either directly or through a medical practitioner who will indicate in the request the person on behalf of whom it is made. At the request of the data controller or of the data subject, the communication provided for in paragraph (3) can be made through a medical practitioner designated by the data subject.

(5) In cases where personal data related to health status is processed for scientific research purposes, if there is no apparent risk to the rights of the data subject and if the data is not used to make decisions or take measures concerning a specific person, the communication provided for in paragraph (3) can be made within a longer period than that provided in that paragraph, to the extent that this could affect the smooth running or the results of the research, but no later than the end of the research. In this case, the data subject must have expressly and unequivocally consented to the data being processed for scientific research purposes and to the possible delay in communication as provided in paragraph (3) for this reason.

(6) The provisions of paragraph (2) do not apply when data processing is exclusively for journalistic, literary, or artistic purposes, if their application would reveal the sources of information.

Right to rectify data

Art. 14.

(1) Any data subject has the right to obtain from the data controller, upon request and free of charge:

a) where applicable, the rectification, updating, blocking, or erasure of data the processing of which does not comply with this law, especially incomplete or inaccurate data;

b) where applicable, the transformation into anonymous data of data the processing of which does not comply with this law;

c) notification to third parties to whom the data has been disclosed of any operation carried out under subparagraphs a) or b), if such notification is not impossible or does not involve a disproportionate effort compared to the legitimate interest that could be harmed.

(2) To exercise the right provided for in paragraph (1), the data subject shall submit a written, dated, and signed request to the data controller. In the request, the requester may indicate whether they want the information to be communicated to a specific address, which may also be an email address, or through a correspondence service that ensures delivery only to the person.

(3) The data controller is obliged to communicate to the data subject the measures taken under paragraph (1), as well as, if applicable, the name of the third party to whom the personal data concerning the data subject has been disclosed, within 15 days from the date of receiving the request, respecting the possible option of the requester as expressed under paragraph (2).

Right to object

Art. 15.

(1) The data subject has the right to object at any time, on compelling legitimate grounds relating to their particular situation, to the processing of data concerning them, except where otherwise provided by law. In the case of justified objection, processing may no longer involve the data in question.

(2) The data subject has the right to object at any time, free of charge and without justification, to the processing of data concerning them for direct marketing purposes, either on behalf of the data controller or a third party, or to the disclosure of data to third parties for such purposes.

(3) In order to exercise the rights provided for in paragraphs (1) and (2), the data subject shall submit a written, dated, and signed request to the data controller. In the request, the requester may indicate whether they want the information to be communicated to a specific address, which may also be an email address, or through a correspondence service that ensures delivery only to the person.

(4) The data controller is obliged to communicate to the data subject the measures taken under paragraph (1) or (2), as well as, if applicable, the name of the third party to whom the personal data concerning the data subject has been disclosed, within 15 days from the date of receiving the request, respecting the possible option of the requester as expressed under paragraph (3).

Exceptions

Art. 16.

(1) The provisions of Articles 12, 13, of Article 14, paragraph (3), and of Article 15 do not apply in the case of activities provided for in Article 2, paragraph (5), if their application would undermine the effectiveness of the action or the objective pursued in carrying out the legal duties of the public authority.

(2) The provisions of paragraph (1) apply strictly for the period necessary to achieve the objective pursued by the conduct of the activities mentioned in Article 2, paragraph (5).

(3) After the situation justifying the application of paragraph (1) and (2) has ceased, operators conducting the activities provided for in Article 2, paragraph (5) shall take the necessary measures to ensure compliance with the rights of the data subjects.

(4) Public authorities shall keep records of such cases and shall periodically inform the supervisory authority about how they have been resolved.

Right not to be subject to an individual decision

Art. 17.

(1) Any person has the right to request and obtain:

a) the withdrawal or annulment of any decision having legal effects concerning them, adopted solely on the basis of automated data processing aimed at assessing certain aspects of their personality, such as professional competence, credibility, behavior, or other similar aspects;

b) the reconsideration of any other decision significantly affecting them if the decision was made solely on the basis of data processing meeting the conditions set out in subparagraph a).

(2) Subject to the other safeguards provided by this law, a person may only be subject to a decision as referred to in paragraph (1) in the following situations:

a) the decision is taken in the conclusion or performance of a contract, provided that the request for conclusion or performance of the contract, submitted by the data subject, has been satisfied or that appropriate measures, such as the opportunity to express one's point of view, guarantee the defense of one's own legitimate interest;

b) the decision is authorized by a law specifying measures to guarantee the legitimate interest of the data subject.

Right to resort to justice

Art. 18.

(1) Without prejudice to the possibility of complaining to the supervisory authority, data subjects have the right to resort to the courts to protect any rights guaranteed by this law that have been infringed.

(2) Any person who has suffered damage as a result of illegal data processing may apply to the competent court for compensation.

(3) The competent court is the one within whose territorial jurisdiction the claimant has their domicile. The action for damages is exempt from court fees.