Privacy Notice Boreal-Plus

Impact Developer & Contractor SA, a Romanian legal entity established in Bucharest,  172-176 Bucuresti-Ploiesti Road, Willbrook Platinum Covention Center, Building A, Floor 1, Office no. 1, District 1, registered at the Trade Register under no. J40/7228/2018, with Fiscal Code RO1553483, bank account no. RO83BTRL05001202G09191XX opened with Transilvania Bank, as the controller of your personal data in the context of subscribing to commercial communications would like to inform you on how this data is processed.

For the purpose of subscribing to commercial communications, other controllers will be involved, respectively other companies affiliated to Impact Developer & Contractor SA Group – Greenfield Copou Residence SRL and Actual Invest House SRL.

The purpose of personal data processing

The processing of your data is intended to enable commercial communications and allows us to: send you commercial communications taking into account the interests you have identified when transmitting your contact details; to send you communications on news, events / contests and promotions organized by the controllers, to send you communications on events dedicated to potential investors, to perform statistical analysis on the performance of this service, but not limited thereto.

If you have filled in your phone number when subscribing using the tablets available at the sales offices or at the relevant trade fairs, you should know that we will be able to send you commercial messages for the purposes mentioned above or we will be able to contact you by phone.

If the subscription to commercial communications was made by any means other than the use of the tablet, we will use as the communication channel only the email address provided at the time of subscribing by checking the appropriate subscription box. Under these conditions, by using an API, only information regarding last name, first name, email address, source and date and time of subscribing will be transmitted in the consent management platform.

Subscribing to marketing communications is performed in two steps (double opt in). To ensure the accuracy of the personal data collected, after completing the form and subscribing to our newsletter or to receive commercial information, we will send you an email containing a link confirming your email address, which will be valid for 48 hours. If, after 48 hours, you have not confirmed your email address, your personal data provided by filling in the form will be deleted from our database.

Processing basis

We process your data for the above purposes under art. 6 para. (1) a from GDPR – respectively the express consent given by you by going through the subscription process, respectively providing the data in the subscription form, and confirming this data by accessing the validation link.

Types of personal data that are processed

– Mandatory: last name, first name, email address;

– Optional: phone number

– Observed: subscription date and time, IP address, source from which the subscription was performed.

Regarding the processing of your data having as source the websites operated by the other controllers from the Impact group, this will be done based on art. 6 para. (1) f of the GDPR – the legitimate interest of the controllers, which are part of the same economic group, regarding the centralization of consents on commercial communications and their management in a unitary database, with adequate security measures.

Failure to provide the mandatory data will make it impossible to use the service.

Data source

Your data provided to receive commercial information (respectively last name, first name, email and / or telephone number) will be sourced from the forms on the websites www.boreal-plus.ro, www.luxuria-residence.ro,  www.impactsa.ro, www.greenfieldresidence.ro  – baneasa or copou, through which you have expressly expressed your desire to subscribe to commercial communications either by filling in the data in the contact form or in the newsletter, or by checking the appropriate box on the request form, or by ticking the appropriate box on the contact form.

Also, your data (last name, first name, email address and / or phone number) may be the source of the Impact Genius program you have signed up for.

Last but not least, the source of the data can be the filling in of the data required for the subscription to the marketing communications on the tablets available at the relevant trade fairs or in the sales offices.

Target categories

The individuals who show up at the sales offices of any of the residential complexes, those who subscribe to these communications in the context of participating in the real estate fairs where the controllers are present, or those who tick the box corresponding to the subscription to commercial communications on the websites operated by to these controllers.

Recipients of data

Your data is not transferred outside Romania.

In the event that we decide to use a proxy for the processing of your data for the purposes set out above, we will do so only with the prior conclusion of a proxy contract under art. 28 of the GDPR and with the transfer of responsibility in its charge.

Storage time

Your personal data will be stored until you exercise your right to delete it. If you exercise only a right of opposition in respect to commercial communications, they will not be deleted, but only properly marked, so that you will not receive such communications in the future. In general, your data will be stored for 3 years from obtaining your consent or from the last interaction with you.

Email addresses and personal data provided but not confirmed within 48 hours of receiving the confirmation link will be immediately automatically deleted.

Personal data security measures

With regard to the personal data collected through each of the controllers’ websites, they are transmitted via an API to the database that manages the consents.

With regard to the security measures applicable to the database access, the principle of necessary and sufficient access in relation to users’ duties has been considered, as have the internal rules on passwords associated with user accounts.

In order to ensure compliance with the principle of data accuracy, the use of the email address as a communication channel will start only after you have gone through the process of confirming the email address.

Exercise of rights

In accordance with the provisions of art. 15 – 22 of the GDPR (General Data Protection Regulation 2016/679), you have the following rights that you will be able to exercise by making a request to dpo@impactsa.ro.

• The right to withdraw consent – which does not affect the processing conducted during the validity period of this consent and which can be exercised at any time by clicking on the unsubscribe link available in each commercial communication sent or by making a request to withdraw your consent. This right may be exercised in respect to any of the communication channels.
• The right to be informed refers to the obligation of the controllers to provide you with correct information regarding the processing of data, regarding the manner in which your personal data is used;

• The right to access means that you have the right to obtain confirmation from us whether or not we process your personal data, and if so, we provide you with access to that data as well as information about how it is processed. You also have the right to obtain a copy of the data we process in respect to you;
• The right to portability refers to the fact that you can receive personal data in a structured, commonly used and automatically readable format as well as the transmission of this data to another controller, subject to certain conditions provided by the provisions of the Regulation;
• The right to object targets the right to oppose the processing of personal data when it serves a public interest or a legitimate interest of ours.
• The right to rectify refers to the correction, without undue delay, of inaccurate personal data;
• The right to delete/the right to be forgotten means that you have the right to delete your collected data without undue delay, in any of the following situations: the data is no longer necessary for the purposes for which they were collected, withdrawal of consent, opposition of processing, illegal collection, deletion for compliance with a legal obligation or collection made with the provision of information society services;
• The right to restrict the processing can be exercised if the accuracy of the data is disputed for a certain period, sufficient to verify the data, if the processing is illegal but one doesn’t want to delete the data only to restrict it, if we no longer need the personal data for processing but you are asking us to defend a right in court or if you objected to the processing.

If you are not satisfied with the manner in which we have resolved a request for the exercise of a right, you have the right to file a complaint with the National Supervisory Authority For Personal Data Processing (www.dataprotection.ro).