INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA ON SMARTREE’S FACEBOOK PAGES
Effective from May 25, 2018

In this document, you can find information regarding the following topics:

1. WHO WE ARE
2. CONTACT INFORMATION
3. WHAT DATA WE PROCESS ABOUT YOU
4. HOW WE SHARE INFORMATION
5. TRANSFERS OF INFORMATION OUTSIDE THE EUROPEAN UNION
   YOUR RIGHTS
   
   1. WHO WE ARE
   Smartree Hrtech SRL is a company headquartered in Bucharest, Expo Business Park, Strada Aviator Popișteanu, no. 54A, Building 2, 4th floor, Sector 1, registered at the Trade Register under no. J40/6894/2020, with fiscal code 42674725 (hereinafter referred to as “Smartree”, “we” or similar terms). As administrators of our Smartree Facebook page (hereinafter referred to as “our page”) together with Meta Platforms Ireland Ltd. (formerly Facebook Ireland Ltd.) based at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, as the provider of the Facebook social platform, we collect and process different categories of personal data from you as a user of our Facebook page: www.facebook.com/SmartreeHrTech. In accordance with European Union data protection legislation, both we and Facebook are considered joint controllers of your personal data. Details regarding the joint processing of personal data can be found here:

https://www.facebook.com/legal/terms/page_controller_addendum.

This Personal Data Processing Information Notice describes our practices regarding the collection and use of your personal data as a result of your interaction with our Facebook page. Please read this Information Notice carefully to understand how we process your personal data.

We reserve the right to modify, whenever we deem appropriate, our data protection practices and to update and amend this Information Notice at any time. For this reason, we encourage you to check this Information Notice periodically. This Information Notice is updated as of the date indicated at the top of the document. We will handle your personal data in accordance with the Information Notice under which the data was collected, unless we have your consent to handle it otherwise.

Regarding the collection and processing of your data by Facebook, over which we have no control, please consult Facebook’s privacy notice available here:

https://www.facebook.com/privacy/explanation
https://www.facebook.com/legal/terms/information_about_page_insights_data.

This Information Notice does not cover the processing of data in connection with accessing links (e.g., to articles on our websites) posted on our Facebook page. When you access a link, it directs you to the mobile version of a website, where you will receive information about the processing of your data by that website.

2. CONTACT INFORMATION
Please address any questions you may have regarding data protection and any requests to exercise your rights to the following contact details of our personal data protection officer: dpo@smartree.com. We will investigate and attempt to resolve any such complaints or requests regarding your rights. If you are not satisfied with the response received, you can file a complaint with the National Supervisory Authority for Personal Data Processing, whose contact details are listed below in section 6.

3. WHAT DATA WE PROCESS ABOUT YOU AND ON WHAT BASIS
On our page, we process the following personal data:

If you send a message to the page, we have access to your public profile (which includes your username) as well as the content and date/time of the message.
If you comment on a post on the page, we have access to your public profile (which includes your username), as well as the content and date/time of that comment.
If you interact with the content on our page (like, share), we can view your public profile (which includes your username) and your reaction.
When you interact with our page, Facebook processes certain personal data about you, based on which they provide us with aggregated statistics. The data we have access to does not include direct personal data and is limited to:

The number of clicks on contact information;
The number of page views;
The number of page previews via hovering over the page name;
The number of page likes;
The number of people who were shown content from the page;
The number of page recommendations made by people;
The number of interactions with the page content (likes, shares, comments, etc.);
The number of video views on the page lasting more than 3 seconds;
The number of fans;
The number of people viewing our promotional campaigns.
Additionally, when we customize the audience for our posts or advertising campaigns on Facebook, we set categories of interests that may include you (e.g., women from Cluj, aged 25 to 45, interested in real estate projects). The data that can be collected and processed through Facebook for this customization is determined by Facebook without our involvement and may include age, gender, occupation, interaction history, lifestyle data, online product and service purchases, and other information according to Facebook’s policies. This data is collected and processed by Facebook, but we only have access to the categorization established by Facebook. You can read more about this collection and processing in Facebook’s privacy policy here.

This data is processed in our legitimate interest to promote our brand and activity, as well as to prove, if necessary, any correspondence with you. The data is retained for the entire period that our page remains active. You should understand that all this data, and additional data, is always available to Facebook as the platform owner (and therefore the controller of your personal data). For more details about the processing performed by Facebook, please refer to its data processing notice here. Providing personal data is not mandatory, and you have the option to individually manage Facebook’s access rights to your data. However, you should understand that within the limits of this filter, Facebook operates uniformly for all pages and users. Therefore, if you interact with our page (which you may choose not to do), we will automatically have access to certain data about you, as explained above.

4. HOW WE SHARE INFORMATION
We will only disclose your personal data for the purposes and to the third parties described below. We will take appropriate measures to ensure that your personal data is processed, secured, and transferred in compliance with legal requirements. Regarding information sharing by Facebook, please consult Facebook’s policy: https://www.facebook.com/legal/terms/page_controller_addendum.

4.1 Disclosure of Data to Third Parties
We will share the necessary portion of your personal data only when required and only with the following categories of third parties:

(a) Facebook, which is a joint data controller regarding your data;
(b) Third-party entities that may administer the page (e.g., marketing agencies);
(c) Other entities such as public authorities and institutions, accountants, auditors, lawyers, and other external professional advisors, if their activity requires knowledge of such data, or if the law requires us to disclose it;
(d) Companies that provide us with products and services (processors), such as IT system providers and related support service providers, telecommunications providers, backup and disaster recovery services, and IT security services.
Additionally, we will disclose your personal information to third parties:

(a) If you request or give us your consent to do so;

(b) To individuals who can demonstrate that they have the legal authority to act on your behalf;

(c) If the page is transferred, which may occur in our legitimate interest to expand or develop our business activities, such as:

(i) In the case of a business transfer (where we sell part of the business or certain assets) related to the page you follow, the buyer will take over the page along with your data;
(ii) If Smartree Hrtech SRL (or a substantial part of its assets) is acquired by a third party, in which case our Facebook pages will be among the assets transferred.
(d) If we are obligated to disclose your personal data to comply with a legal obligation, any legal request from government or executive authorities, or as necessary to meet national security or law enforcement requirements, or to prevent illegal activities;

(e) To respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person, or to prevent illegal activities; or

(f) To protect the rights, property, or safety of Smartree Hrtech SRL, its employees, clients, suppliers, or other persons.

Some of these recipients may use your data in countries outside the European Economic Area (EEA).

Please refer to section 5 below for more details on this topic.

Facebook may also disclose your data to third parties without our involvement or control, which you can read about in Facebook’s policy here.

4.2 Restrictions on the Use of Personal Information by Recipients
The third parties to whom we provide your personal information, as specified above, are restricted (by law and by contract) on how they may use your personal data for the specific purposes we have identified. We will always ensure that any third parties with whom we share your personal information are subject to confidentiality and security obligations in accordance with this Information Notice and applicable laws. However, to avoid any doubt, this provision does not apply when the disclosure is not our decision, including in relation to processing performed by Facebook. Except for the cases detailed above, we will not disclose any of your personal data to any third party without notifying you.

5. TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION
As a general rule, we do not transfer your data to recipients outside the European Union. However, if this happens, we will take appropriate measures to ensure that the recipient adequately protects your personal information, such as entering into standard contractual clauses approved by the European Commission, and we will update this Information Notice.

Additionally, Facebook may transfer your data outside the European Union, regarding which we encourage you to consult Facebook’s policy.

6. YOUR RIGHTS
As a data subject, you have specific legal rights regarding the personal data we collect from you. Smartree Hrtech SRL will respect your rights and will respond to your requests appropriately.

Although we are joint data controllers with Facebook, there is no actual joint data processing between us and Facebook, meaning that we can only manage your requests related to the processing we perform. If you wish to exercise any of your rights with respect to Facebook, please contact Facebook as indicated in its policy.

a. The right to withdraw consent:
If you have given your consent for the processing of your personal data, you may withdraw your consent at any time.

b. The right of access:
You may request information regarding the personal data we hold about you, including information about the categories of data we hold or control, what it is used for, the source from which we collected it (if obtained indirectly), and to whom it is disclosed, if applicable. We will provide you with a copy of your personal data upon request. If you request multiple copies of your personal data, we may charge a reasonable fee based on administrative costs. You also have the right to information about the safeguards we apply for the transfer of your personal data to a country outside the EU and EEA, if we transfer your data to such a country.

c. The right to rectification:
You may obtain the rectification of personal data that we process about you. We make reasonable efforts to ensure that personal data we hold and continuously use is accurate, complete, up-to-date, and relevant, based on the most recent information available to us.

d. The right to restriction:
You may obtain from us the restriction of processing of your personal data if:

You contest the accuracy of your personal data, for the period necessary for us to verify its accuracy;
The processing is unlawful, and you request the restriction of processing instead of deletion;
We no longer need your personal data, but you request it to establish, exercise, or defend legal claims; or
You object to the processing while we verify if our legitimate grounds override your rights.
e. The right to data portability:
You have the right to receive your personal data that you provided to us, and, where technically feasible, to request that we transmit your personal data (which you provided to us) to another organization. These two rights apply if the following conditions are met:

We process your personal data by automated means;
Our processing is based on your consent or is necessary for the performance of a contract to which you are a party;
The transmission of your personal data does not negatively affect the rights and freedoms of others.
f. The right to erasure:
You have the right to request the deletion of your personal data that we process about you. We must comply with this request if we process your personal data, except where the data is necessary:

To exercise the right of freedom of expression and information;
To comply with a legal obligation we are subject to;
For archiving purposes in the public interest, scientific or historical research, or statistical purposes; or
To establish, exercise, or defend legal claims.
g. The right to object:
You may object at any time to the processing of your personal data for reasons related to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this case, we will no longer process your personal data unless:

We can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms; or
The processing is for establishing, exercising, or defending legal claims.
If you object to processing, please specify whether you also want your personal data to be deleted; otherwise, we will only restrict it. You may always object to the processing of your personal data for direct marketing purposes, whatever your reasons. If marketing is based on your consent, you may withdraw your consent.

We will try to fulfill your request within 30 days. This period may be extended for specific reasons related to the legal right or complexity of your request. In any case, if this period is extended, we will inform you of the extension and the reasons for it.

Restriction of access: In certain situations, we may not be able to grant access to all or part of your personal data due to legal restrictions. If we refuse your request for access, we will inform you of the reason for the refusal.

Inability to identify: In some cases, we may not be able to identify your personal data due to the identifiers provided in your request. In such cases, if we cannot identify you as the data subject, we cannot fulfill your request under this section unless you provide additional information that allows us to identify you. We will inform you and give you the option to provide such additional details.

Exercising your rights: To exercise your rights, please contact us in writing (including electronically) at the contact details provided in section 2 above.

h. Right to file a complaint:
If you are dissatisfied with how we process your data, we would prefer that you contact us directly so we can resolve your issue. However, you may also contact the National Supervisory Authority for Personal Data Processing via the Authority’s website (www.dataprotection.ro), or you may write to:

National Supervisory Authority for Personal Data Processing
B-dul G-ral. Gheorghe Magheru 28-30,
Sector 1, Postal Code 010336,
Bucharest, Romania
Phone: +40.318.059.211
Email: anspdcp@dataprotection.ro