The protection of personal data

and the security of data within the S.C. Tursib S.A software.

The issuing of card passes involves the use of passengers’ personal data. SC TURSIB SA hereby undertakes the obligation to comply with the stipulations of Law 677/2001 regarding the protection of individuals in processing personal and the free circulation of such data. Any operation with personal data may be carried out only in the case in which the person in question (in this case – the Tursib passenger) agreed so expressly an unequivocally.

Taking into consideration the great importance of guaranteeing the right to a private family life, such as stipulated in art. 26 of the Romanian Constitution, taking into account the protection of this fundamental right while processing personal character data, stipulated in Law no. 677/2001 for the protection of persons regarding the processing of personal data and the free circulation of such data, by Law no. 676/2001 regarding the processing of personal data and the protection of the private life in the telecommunication sector as well as by Law no. 682/2001 regarding the ratification of the Convention for the protection of individuals during the automatic processing of personal data, adopted in Strasbourg January 28th, 1981, taking into account the stipulations of art. 28 paragraph (1) of Law no. 677/2001, according to which professional associations have the obligation to elaborate codes of conduct and to submit them for approval to the monitoring authority. These codes of conduct contain appropriate regulations for the protection of the rights of persons whose personal data may be processed by the members of these professional associations. Taking into account the fact that professional associations, by means of the activity they unwind through their members, process personal data, for the protection of which it is necessary to adopt codes of conduct, SC Tursib elaborated the present code of conduct regarding the operation with personal data.

CODE OF CONDUCT

The code establishes the method of collecting personal data from Tursib clients for the issuing of electronic passes on a support type card.

The work procedure was elaborated in accordance with the stipulations of the updated version of Law 677/2001, regarding the protection of individuals, regarding the processing of personal data and the free circulation of this data.

SC Tursib SA notified the surveillance authority regarding its intention to collect personal data and as recorded in the register of the National Authority for the Monitoring of Operations with Personal Data under number 18.755.

In order to collect personal data, the person in question (the Tursib client) must express a clear and unequivocal agreement. To this purpose, the person in question will fill in and sign a printed approval.

SC Tursib SA will use personal data only with the purpose of issuing the card pass and in setting up a data base containing Tursib clients.

In order to protect the personal data it operates with, SC Tursib SA will allocate each client a Tursib code. The Personal Numerical Code of the persons in question will be recorded on the company server (by scanning the ID document). It is only this Tursib code which will be used for ulterior operations (issuing, loading, card checking, statistical processing of data).

Personal data will be preserved on the Tursib servers (protected in accordance with legal stipulations) as long as the person in question remains a Tursib client.

The person in question may, at any time, withdraw its consent, by written request, addressed to the SC Tursib SA management and by returning the card pass. Within 5 days from the recording of this request, SC Tursib SA undertakes to erase from the data base the personal data of the person in question.

UPDATING THE DATABASE

The updating of the data base is made through the information submitted by the person in cause, as well as through the information supplied by any external source authorized by law.

Annually, in August, Tursib will carry out a verification of the database. The data which was not used during the preceding year will be erased.

SC Tursib SA will request an update of the personal data every three years, at the time of the renewing of the pass.

THE PROCEDURE FOR THE RECEIVING, INVESTIGATING AND SOLVING COMPLAINTS AND OTHER REQUESTS OF PERSONS IN QUESTION

The persons in question have the right to request the checking of the exactness and completeness of the personal data concerning them. They also have the right to request an adjustment of the inexact or incomplete data, by submitting a notification.

Notifications and/or complains will be submitted in writing at the SC Tursib secretary’s office, situated in Sibiu, no. 135, Calea Dumbravii Street.

Notifications and complaints will be directed by SC Tursib SA management towards the Public Relations Office and they will be recorded in the Register for Notifications and Complaints regarding the Protection of Personal Data.

The person delegated by the management of SC Tursib within the Public Relations Office will answer in writing to all requests within the deadline imposed by Ordinance 27/2002 updated, containing the regulations regarding the solving of petitions.

THE RIGHTS OF THE PERSON IN QUESTION

1. The right to be informed

In the case in which the personal data is obtained directly from the person in question, the operator has the obligation to present to this person at least the following information:

a. the identity of the operator and its representative, according to the case;
b. the purpose for the processing of this data;
c. additional information such as: the recipient or the categories of recipients of the data; whether the supply of all requested data is mandatory and the consequences of the refusal to supply such information; the rights of the person in question stipulated in the present legislation, especially the right to access and adjust the data and the right to oppose them, as well as the conditions these rights may be exerted on;
d. any other information which must be submitted by order of the monitoring authority, keeping into account the specificity of the processing operation.

2. The right to access the information

Any person in question has the right to obtain from the operator, upon his request (without any charges, for one request per year), the confirmation whether his personal data is processed by the operator. These persons are also entitled to receive the following information:

a. Information regarding the purpose of processing, the categories of data in question and the recipients or categories of recipients to whom such data will be disclosed;
b. a notification elaborated in an intelligible form of the data which is being processed, as well as any available data regarding the orgin of the data;
c. information regarding the operation of the mechanism through which the automatic processing of data regarding that particular person is carried out; d. information regarding the existence of the right to intervene upon such data and the right of opposition, as well as the conditions in which these rights may be exerted;
e. information regarding the possibility to consult the records of the personal data processing, to forward a complaint towards the monitoring authority, as well as to address the court in order to attack the decision, in accordance with legal stipulations.

Your written request, dated and signed, will be submitted in person, at the company’s secretary office situated in Sibiu, no.135, Calea Dumbravii Street or it may be submitted by fax at number 0269/21077.

The processor has the obligation to submit the requested information within 15 days from the receipt of the request.

3. The right to intervene upon the data

Following a dated and signed written request, any person in question has the right to obtain from the processor, free of charge, the following:

a. the correction, the updating, the blocking or the erasing of the data whose processing is not in compliance with the present legislation, especially in the case of incomplete or inexact data;
b. the transformation into anonymous data, the information whose processing is not in compliance with Law no. 677/2001;
c. the notification of third parties to which data was disclosed, if this notification does not prove to be impossible or if it does not suppose a disproportionate effort measured to the legitimous interest which may thus be damaged. The processor has the obligation to communicate the adopted measures and also,if the case, the name of the third party to which the personal data was disclosed, within 15 days from the receipt of the request.

4. The right of opposition

The person in question has the right to oppose, at any time, by a dated and signed written request, for well founded and legitimate reasons related to its particular situation, the processing of own personal data, with the exception of cases in which it is contrary to legal stipulations. In case of a just opposition, the processing will no longer involve the data which is the object of such opposition. The person in question has the right to oppose at any time, free of charge, without any justification, the processing of personal data for the purpose of direct marketing, on behalf of the processor or a third party, or to be disclosed to third parties for the above-mentioned purpose.

The processor has the obligation to notify the person in question the measures which were taken, as well as, if the case, the name of the third party to which the personal data regarding the person in question was disclosed, within 15 days from the date of the receipt of the request.

5. The right not to conform to an individual decision

Any person has the right to ask and obtain the following:

a. the withdrawal or annulment of any decision which produces legal effects for that person, adopted exclusively based on the processing of personal data, carried out by means of automatic means, meant to evaluate certain aspects of that person’s character, as well as his professional competence, credibility, his behavior or any other such aspects;
b. The re-evaluation of any decision taken concerning him which significantly affects this person, if the decision was adopted exclusively based of the data processing which is in compliance with the above-mentioned conditions.

6. The right to address justice

Without affecting the possibility to address a complaint towards the monitoring authority, any person who was inflicted damages following the processing of personal data carried out illegally, may address the competent court to repair such damage.

The competent authority is that within the territory which is the domicile of the plaintiff.

The law suit request is free of judicial stamp taxes.