Privacy policy
PERSONAL DATA PROTECTION POLICY
The National Commission for Nuclear Activities Control (CNCAN), headquartered at 14 Libertății Blvd., District 5, Bucharest, acting as Controller, processes personal data in accordance with the provisions of Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Before you continue browsing our web pages, we recommend that you read this policy carefully. If you do not agree with it and do not wish your data to be used as detailed below, please do not continue to use our website and do not provide us with your personal data.
Each time you access the pages of our website, you confirm that you have read, understood and consented to comply with this policy.
1. DEFINITIONS
Personal data – any information relating to an identified or identifiable natural person (“data subject”).
Identifiable natural person - a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
Processing – any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or national law, the controller or the specific criteria for its designation may be provided for by Union law or by national law.
Processor - a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
Supervisory Authority - the regulatory or supervisory authority responsible for the application of the Regulation. In Romania, this role is performed by the National Supervisory Authority for Personal Data Processing (ANSPDCP).
2. INFORMATION ABOUT OUR WEB PAGES
The www.cncan.ro domain is hosted and administered by the relevant internal department. Our web pages may include links to other web pages which are managed by other entities/legal persons that are not connected with the activity of CNCAN and for which CNCAN bears no responsibility. Our web pages also provide links to other partner web pages, which apply separate policies regarding the processing of personal data. If you access these portals through our web pages, you should consult the privacy policies of those websites in order to understand how they collect, use and disclose your information. Our web pages mentioned above use cookies or traffic analysis tools.
3. DATA SUBJECTS
The categories of data subjects concerned by the processing of personal data are the following:
-employees, members of employees' families, former employees;
-candidates for vacancies within CNCAN;
-signatory parties to contracts and the persons involved in the conclusion and performance of contracts;
-participants in events organized or supported by CNCAN;
-students on internship at CNCAN;
-participants in training and specialization courses held within CNCAN;
-representatives of authorities, public institutions and the mass media;
-medical clinics, individual medical practices and their employees, who are examined by CNCAN staff with a view to obtaining the practice permit;
-persons accessing the web pages.
4. CATEGORIES OF PERSONAL DATA
CNCAN processes the personal data which data subjects provide directly, data which are generated on the basis thereof, as well as data from public sources.
The categories of personal data processed are:
-identification data: surname, first name, academic title, position, department, personal identification number, series and number of the identity card (BI/CI)/passport/driving licence, employee number, access card ID;
-IT identification data: IP address, user name, password;
-data concerning the person: date and place of birth, sex, citizenship, marital status, signature;
-contact data: home/residence address, e-mail address, landline/mobile telephone number;
- recruitment data: data contained in CVs, recommendations, employment record book or equivalent, criminal record certificate;
-financial data: bank account number and other financial information;
-data concerning health;
-biometric data: voice, image;
-data collected on the occasion of registration for and participation in events organized or supported by CNCAN (photographs, video, quotations, social media posts, etc.)
5. PURPOSE OF THE PROCESSING OF PERSONAL DATA
The purpose of the processing is the fulfilment of the legal obligations related to the scope of activity of CNCAN, in the exercise of its regulation, licensing and control duties, as provided for in Law no. 111/1996, republished, as subsequently amended and supplemented.
6. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
CNCAN processes personal data in accordance with the provisions of Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
The processing of personal data takes place in the following situations:
6.1-Legal obligation - processing is necessary for compliance with a legal obligation to which the controller is subject.
6.2-Performance of a contract - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, including steps related to carrying out the scope of activity.
6.3-Protection of vital interests - processing is necessary in order to protect the vital interests of the data subject or of another natural person.
6.4 Public interest - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, where applicable.
6.5 Legitimate interest - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. This category may include the fulfilment of communication and dissemination objectives, the recruitment process and human resources.
6.6 Consent - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. According to the Regulation, consent is deemed to have been given either by means of a written document or by an unambiguous affirmative action. Consent given in this way may be withdrawn in accordance with the provisions of the Regulation.
7. RECIPIENTS OF PERSONAL DATA
In order to fulfil the purposes of the processing, CNCAN may disclose certain categories of personal data to the following categories of recipients: the data subject and/or his or her legal representatives, representatives of CNCAN, judicial authorities or other public authorities, international organizations, medical clinics, insurance companies, professional organizations, market research organizations, contractual partners and/or processors of CNCAN.
8. DURATION OF DATA PROCESSING
In order to achieve the processing purposes mentioned, CNCAN processes the personal data identified above in accordance with its own archival nomenclature, drawn up in accordance with the National Archives Law no. 16/1996, as subsequently amended and supplemented.
9. DATA SECURITY
CNCAN attaches great importance to personal data and undertakes to ensure appropriate security throughout the processing activities. To this end, CNCAN implements appropriate measures for protection against unauthorized or unlawful processing and against accidental loss, destruction or damage of personal data.
10. RIGHTS OF THE DATA SUBJECT
10.1 The right to information is the right to be informed about the processing and protection of personal data.
10.2 The right of access to data is the right to obtain from the data controller confirmation as to whether or not personal data are being processed by it.
10.3 The right to rectification of data is the right to obtain the rectification of inaccurate data, as well as the completion of incomplete data.
10.4 The right to erasure of data ("right to be forgotten") is the right to obtain, to the extent that the legal conditions are met, the erasure of personal data.
10.5 The right to restriction of processing is the right of the data subject to obtain from the Controller the restriction of processing in cases such as: the accuracy of the data being contested, the data being retained but their processing restricted.
10.6 The right to data portability is the right to receive personal data in a structured, commonly used and easily readable format, as well as the right to have those data transmitted to another data controller, to the extent that the legal conditions are met.
10.7 The right to object to data processing is the right to object at any time, on well-founded and legitimate grounds relating to one's particular situation, to personal data being subject to processing, to the extent that the legal conditions are met.
10.8 The right not to be subject to automated decisions, including profiling, is the right to request and obtain the withdrawal, annulment or reassessment of any decision based solely on processing carried out by automated means (including profiling) which produces legal effects concerning data subjects or similarly significantly affects them.
10.9 The right to refer to the competent authorities/to the courts is the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), and to apply to the courts for the defence of any rights guaranteed by the applicable legislation in the field of personal data protection which have been infringed.
The requests by which you exercise these rights must contain your identity data, as necessary for us to make sure that the request comes from you.
11. DATA PROTECTION OFFICER To exercise your rights regarding the processing of personal data carried out by CNCAN, you may send us a written, dated and signed request, as follows:
- by post, addressed to the National Commission for Nuclear Activities Control (CNCAN), 4 Lt. Zalic Street, District 6, Bucharest, marked "For the attention of the Data Protection Officer"
- by e-mail, to gdpr@cncan.ro
Each request will be examined and the actions taken in this regard will be communicated, in compliance with the provisions of the Regulation.
For questions or further information regarding the processing of personal data, you may call us at +4021 316.05.72.