INTRODUCTION
Since we consider ensuring the right to personal data protection as a fundamental commitment for SMARTREE, we dedicate all necessary resources and efforts to process your data in full compliance with Regulation 679/2016 (the “General Data Protection Regulation” or “GDPR”), as well as with any other applicable legislation in Romania. The processing of personal data is carried out through mixed means (manual and automated), complying with legal requirements and under conditions that ensure the security, confidentiality, principles, and rights of the data subjects.

As one of the essential principles of this legal framework is transparency, we ask you to read this document through which we wish to inform you about how we collect, use, transfer, and protect your personal data when you interact with us in relation to our products and services, including through our website.

The SMARTREE privacy policy applies to any visitor/user of the site, as well as to any personal data processing activities.

Please also consult our pages on the Terms and Conditions of use of the website http://www.smartree.com and the Cookie Policy where we explain what types of cookies we use and how long we retain them. Normally, our website can be used without entering personal data. Also, to see how we process your personal data in connection with social media platforms, please consult the related information notices, which you can find here: LinkedIn, Facebook.

As a rule, SMARTREE collects and processes the data that website users freely choose to provide. When personal data is collected on the site (such as name, surname, email address, personal data in CVs), these are collected because the interested person voluntarily provides these data to the site.

CONTENTS
1. Who we are and how to contact us
2. Definitions
3. What categories of personal data we process
4. What are the purposes of processing
5. What are the legal grounds for our processing activities
6. How we collect your information
7. How long we keep your personal data
8. Accuracy and updating of processed personal data
9. Data minimization
10. Collection of data from minors
11. Who we share your personal data with
12. International data transfers
13. How we ensure the security and confidentiality of your personal data
14. How we respect your rights to access personal data
15. Our contact information
16. How we update the Privacy Policy

1. WHO WE ARE AND HOW TO CONTACT US
The website www.smartree.com is operated to promote the services of SMARTREE HRTECH S.A., a Romanian company headquartered at Expo Business Park, Str. Aviator Popișteanu, no. 54A, Building 2, 4th floor, office no. 5, sector 1, Bucharest, registered with the Bucharest Trade Registry under no. J40/6894/2020, with fiscal code RO42674725, hereinafter referred to as SMARTREE.

The aforementioned company processes personal data as detailed below in this Privacy Policy.

This Privacy Policy applies to personal information for which we determine the purpose and means of processing, regardless of how it is collected or stored. It describes, among other things, the types of information collected, how your information may be used, when it may be disclosed, how you can control the use and disclosure of your information, and how it is protected. This Policy covers the information collected by SMARTREE through various communication means, including but not limited to the website: https://www.smartree.com/

For any issues or requests related to how we process your personal data, you can always contact us at the postal address of SMARTREE HRTECH S.A., at: Bucharest, Expo Business Park, Str. Aviator Popișteanu no. 54A, Building 2, 4th floor, sector 1, postal code 012244, or by email at: dpo@smartree.com

2. DEFINITIONS
“Personal data” means any information about a natural person or from any person that can be directly or indirectly identified.

“Process”, “Processing” or “Processed” means any activity involving personal data, including but not limited to the collection, recording, organization, structuring, storage, retrieval, use, transmission, deletion, or destruction of personal data.

The term “User” of the site refers to any visitor who accesses a site and completes an online registration form.

3. WHAT CATEGORIES OF PERSONAL DATA WE PROCESS
In general, we collect your personal data directly from you, so you control the type of information you provide us. During our business processes, we may have access to the following categories of data:

Data processed by each company within the group as an operator:
Personal data provided during the recruitment process: name, surname, phone number, email address, work experience, education, and the location of your residence at the time of application.
Data processed by the group companies as joint operators to promote the image and services of the group entities, given that the two companies belong to the same group:
Business-related personal data of contact persons from our partners and suppliers: name, surname, company, position, department, email address, and work phone number.
Commercial information related to the types of solutions and services requested.
Information about your interactions with our online content or social media (Facebook, LinkedIn, Twitter).
Records of any consent you have given, the type of activity that required consent, the date and time of giving consent, and any related information (e.g., opting-in via email).
Any comments or opinions you submit or post regarding SMARTREE on social platforms, including websites, forums, and online communities.
In the case of newsletter subscriptions: name, surname, email address, and tracking data to analyze the level of interest these communications have for the recipient (e.g., IP address, clicks, accesses, location).
The use of cookies – common forms of website access tracking that may contain information about your device’s IP address, browser version, and the type of device used.
If you wish to apply for a position published by SMARTREE on the job page (https://www.smartree.com/cariere), we will collect all personal data you mention in your CV, cover letter, or any recommendation documents. Please do not send us special or intimate personal data. Any other information you provide that is not necessary for processing will be deleted, to the extent possible. We may request references from former employers, but only with your consent. Personal data will be processed by SMARTREE HRTECH S.A.

In addition, third parties, such as application providers, tools, widgets, and plug-ins on our site (e.g., social media tools), may use automated data collection methods to track your interaction with these platforms. In this case, the data is collected directly by those providers, meaning that the data subjects whose data are processed by these providers must consult the data protection policies and notices of those providers, as their data collection processes are subject to their respective policies. Subject to applicable law, SMARTREE is not responsible for the data protection practices of these providers. For details on how personal data is processed in connection with social media platforms, you can read the specific information notices available here: LinkedIn, Facebook.

To send marketing materials via your email, SMARTREE uses the HubSpot platform. When this platform is used, certain tracking data about your device and service usage (IP address, access, clicks, location, browser, and device used) are automatically collected or provided to analyze your level of interest in the information received and to make adjustments to the types of communications we send.

We assure you with full responsibility that we do not collect or process sensitive data included in the special categories of personal data under the GDPR. Also, we do not collect or process personal data of minors under the age of 16.

4. PURPOSES FOR PROCESSING YOUR PERSONAL DATA
The purposes for which we may process personal information, in accordance with applicable law, include:

Workforce selection and placement in specific human resources services: The data provided is necessary to identify whether your professional experience and qualifications are suitable for the position you applied for. Contact details are used solely to inform you about the jobs you applied for, schedule interviews, communicate interview results, notify you of potential new jobs of interest, and request your consent to participate in a new recruitment process. The use of data for this purpose may involve transferring this data to third parties—potential employers.
Resolving requests and/or complaints and providing any information requested by completing the contact form: Both the request to contact us and the data submitted (name, surname, email address, phone number, message, subject, city, company) will be used solely to resolve the received request and any subsequent activities.
Analyzing and improving our services and communications: Tracking data helps us analyze whether the information we communicate is of interest to the data subjects. Based on the number of communications received, opened, and accessed, we can determine if changes are needed in the communications we make. The IP address is processed by the provider through which SMARTREE sends electronic communications, specifically HubSpot, under our instructions.
Protecting security and managing access to our premises, IT and communication systems, online platforms, websites, and other systems.
Monitoring and evaluating compliance with our policies and standards.
If you have given your consent, we may also process your personal data for the following purposes:

Direct marketing communication through channels you have approved to keep you updated on SMARTREE’s activities, announcements, and other information about SMARTREE’s services and products, events, and projects SMARTREE is involved in, or any other news and updates on topics related to our activity. Your data will not be used for other purposes.
You have the right to withdraw your consent at any time by simply clicking the ‘unsubscribe’ link at the bottom of each direct marketing message or by sending a message with complete information about the service you want to unsubscribe from to: dpo@smartree.com.

5. LEGAL GROUNDS FOR OUR PROCESSING OF PERSONAL DATA
In accordance with Article 6 (1) of the GDPR, SMARTREE processes personal data based on the following legal grounds:

The existence of a contract (service provision, purchases, invoice, delivery note, or other contractually binding documents).
A legal obligation, of a commercial or legal nature, associated with certain types of activities (Labor Code, accounting and commercial laws).
Processing necessary for the legitimate interests of providing you with the best possible solutions and services, except where your interests or fundamental rights and freedoms override our interests.
Consent freely given and informed, associated with personal data processing for direct communication activities or any other processing activities for which there is no other legal basis.

6. HOW SMARTREE COLLECTS YOUR PERSONAL DATA
We may collect personal data about you in the following ways:

When you browse, request information, or interact with our website.
When you contact us through the contact form or the email addresses available on the website.
When you apply for a job posted on our website and/or recruitment portals.
When you provide us with information about yourself in any way to participate in the selection process for an open position within SMARTREE.
SMARTREE is not responsible for the personal information you voluntarily provide about yourself on the public pages of social networks or through phone, email, or website requests. Additionally, this policy does not cover the practices of third parties who may provide information about you to SMARTREE.

In certain circumstances, we collect personal data about you from a third-party source (such as recruitment portals like Bestjobs, Ejobs), which is responsible for the accuracy of this data and has all the obligations and responsibilities of a data controller under applicable law.

7. HOW LONG WE KEEP YOUR PERSONAL DATA
SMARTREE has implemented appropriate technical and organizational measures to organize the process and criteria for deleting or removing your personal data.

Your personal data will be deleted or removed when it is no longer needed for the purposes for which it was collected, or when you request the deletion of the data by exercising your right to be forgotten and SMARTREE no longer has a legal obligation to continue storing the respective data.

According to our retention policy, personal data is kept for a period of 3 years from the date it was collected unless you expressly request us to store your data for a longer period or if the personal data is needed to defend a legal right.

Personal data processed as part of the recruitment process is retained by SMARTREE HRTECH S.A. for 4 years after the recruitment process ends, after which it is deleted in accordance with our procedures.

If you wish for the data in your CV to be deleted earlier than the 4-year period, you can send a request to: dpo@smartree.com.

8. ACCURACY AND UPDATING OF PERSONAL DATA
SMARTREE takes reasonable steps to ensure that your personal information is accurate and, if necessary, updated. In this regard, there are situations where we may contact you to ensure that the information we hold about you is up-to-date and accurate.

If any of the personal data you have provided to us changes, for example, if you change your name, surname, or email address, if you wish to cancel any requests to SMARTREE, or if you become aware that we hold inaccurate personal data about you, please inform us of any such issues via email at: dpo@smartree.com.

9. DATA MINIMIZATION AND PURPOSE LIMITATION
In accordance with the GDPR principles of minimization, relevance, and adequacy, SMARTREE takes reasonable steps to ensure that the personal data we process is limited to what is strictly necessary, relevant, and adequate for the purposes of the processing. Where procedural conditions for acquiring personal data and legal provisions allow, SMARTREE tries to limit the processing of certain types of personal data that are not strictly necessary or do not represent the purpose of a particular activity. This limitation and minimization can be done without affecting legal conditions and internal rules set by SMARTREE.

10. COLLECTION OF DATA FROM MINORS
As we care about the online safety and privacy of children, we do not knowingly contact or collect information from individuals under the age of 16. Our website does not intend to solicit information from individuals under the age of 16.

11. WHO WE SHARE YOUR PERSONAL DATA WITH
We may, depending on the circumstances, transmit or provide access to certain personal data to other categories of recipients/third parties, such as: courier service providers, payment/banking service providers, IT service providers. If we have a legal obligation or if it is necessary to defend a legitimate interest, we may also disclose certain personal data to public authorities.

SMARTREE will retain control over your personal data and use appropriate protection measures, in accordance with applicable law, to ensure the integrity and security of your personal data.

All our relationships with these third-party companies are based on compliance with GDPR principles, the legal grounds associated with each type of processing, as well as the fundamental rights and freedoms of our customers. We ensure that third-party access to your data is done in accordance with legal provisions regarding data protection and confidentiality, based on contracts concluded with them that include necessary confidentiality and data protection clauses.

SMARTREE also reserves the right to transfer your personal data in cases of reorganization and/or transfer of its assets or parts of its assets to third parties, in compliance with applicable legal provisions regarding the processing of personal data.

Your personal data will not be transferred to third parties or partners for direct marketing purposes. We will never transfer your personal data to third parties without your request or permission, except in cases where disclosure is required by applicable law or by regulations or requests from judicial or official bodies.

12. INTERNATIONAL DATA TRANSFERS
For clients in Romania, SMARTREE does not transfer personal data to other locations in other countries. Currently, we store and process your personal data only in Romania.

The only personal data that may be transferred through standard communication channels (phone, email, online platforms, courier) are the contact details of representatives of our clients and external partners, for whom there are commercial collaboration contracts, and the transfer is made with the consent of all parties and individuals involved through the signing of documents.

There may be situations where personal data of some clients are processed through platforms containing specialized applications provided by suppliers outside the European Union, in countries not on the EU adequacy list. In such cases, the application provider acts as the data processor for personal data processed by SMARTREE as the data controller. Responsibility for the safety of data processed through such applications lies with the provider. In all these situations, the legal basis for international data transfers through simple hosting in an application/platform is ensured by the Standard Contractual Clauses approved by the European Union and concluded by the manufacturer with each user.

We will always take steps to ensure that any international transfer of personal data is managed carefully. Transfers to service providers and other third parties will always be protected by contractual commitments and, where applicable, by other safeguards, such as the Standard Contractual Clauses issued by the European Commission or certification schemes.

13. HOW WE ENSURE THE SECURITY AND CONFIDENTIALITY OF PERSONAL DATA
SMARTREE takes reasonable steps to ensure the security and confidentiality of personal data by implementing appropriate technical and organizational measures to secure your information and protect it from unauthorized or illegal use, as well as accidental loss or destruction, including:

Sharing and providing access to your data only to the minimum extent necessary, subject to confidentiality restrictions where applicable and anonymously whenever possible.
Personal data collected by SMARTREE are stored on secure servers located in protected rooms with limited physical access.
Transmission of your personal data is done using state-of-the-art encryption algorithms.
Verifying the identity of any person requesting access to information before granting access.
Transferring your data only through a closed system or encrypted data transfers.
Following generally accepted standards to store and protect the personal data we collect, both during transmission and once received and stored, including using encryption where applicable.
Personal data may be stored on our storage, archiving, and backup systems, on the systems of our subcontractors, or in physical form, most often printed. We have adopted all necessary measures regarding both the people who come into contact with the data, the spaces where the data is processed, and the equipment and solutions used to process the data, to ensure that the data is processed securely, ensuring confidentiality and integrity.

Through the updating of specific clauses in current contracts, we require our partners to meet the same security and confidentiality conditions for personal data processing. If, based on your consent, we communicate data to third parties, they are obliged to comply with the same legal requirements for personal data processing, in accordance with their processor responsibilities (data processors) assumed through collaboration contracts.

Despite the measures taken to protect your personal data, we draw your attention to the fact that transmitting information over the Internet, in general, or by attaching documents to public or social network communication tools is not completely secure, and there is a risk that the data may be seen and used by unauthorized third parties. We cannot be held responsible for the vulnerability of data transmitted through systems not under our control.

14. HOW WE RESPECT YOUR RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
Under Regulation (EU) 2016/679 of April 27, 2016, for the protection of individuals regarding the processing of personal data and the free movement of such data, as data subjects, you have the following rights:

Right to information – You have the right to receive details about the processing activities carried out by SMARTREE, as described in this document.

Right of access to data – You have the right to obtain from SMARTREE confirmation of whether or not we process personal data, whether we hold your data, and to request access to that data and the following information: what data we process, for what purpose, if it has been disclosed to third parties and to whom, as well as the retention period for this data. You have the right to receive a free copy of the personal data that is the subject of processing. For any additional copies requested, we reserve the right to charge a fee. You may request the above information in electronic format, in which case the data will be provided in an electronic format we commonly use unless you request it in another format.

Right to rectification – You have the right to obtain from SMARTREE the correction, without unjustified delay, of inaccurate or unjustified personal data, as well as the updating of incomplete data. The rectification/update will be communicated to each recipient to whom the data has been transmitted, except in cases where this proves impossible or involves disproportionate effort. We may also attempt to verify the accuracy of the data before rectifying it.

Right to data deletion (“right to be forgotten”) – You have the right to request the deletion of your personal data without unjustified delay in the following cases:

The data is no longer necessary for the purposes for which it was collected or processed.
You withdraw your consent and there is no other legal basis for processing.
You object to processing, and there are no legitimate reasons to prevail.
The personal data has been processed unlawfully.
The data must be deleted to comply with a legal obligation. We will not be able to comply with your data deletion request if processing is necessary for:
Compliance with a legal obligation regarding the retention period of certain documents, such as essential documents from employee files, payroll records of our employees, invoices, and other commercial documents, etc.
The establishment, exercise, or defense of a legal claim.
Other cases where there are solid legal and organizational grounds for retaining certain types of personal data for different periods. There may also be situations where, following a request to delete data, SMARTREE applies procedures to remove any elements identifying your person through anonymization or pseudonymization techniques, in which case encrypted data is no longer subject to GDPR.
Right to restrict processing – to the extent that:

You are in a position to challenge the accuracy of the data, requesting the restriction of processing for a period that allows us to verify its correctness.
You do not wish to have the personal data deleted, but you may impose conditions regarding the restriction of its use.
Although SMARTREE no longer needs personal data for processing purposes, you may request the retention of the data to establish, exercise, or defend a legal claim.
You have objected to processing based on our legitimate interest (other than direct marketing) and we have suspended the processing of your data for the period during which a legitimate interest analysis is conducted to determine whether your rights as a data subject prevail over our legitimate interests.
Right to data portability – i.e.:

The right to receive personal data in a structured, commonly used, and machine-readable format.
The right to have this data transmitted by SMARTREE to another data controller, as long as the conditions provided by law are met.
Right to object – There may be situations where, for reasons related to your particular situation, you object to the processing of your personal data. In these conditions, we will stop processing your data except in cases where we have legitimate, compelling, and demonstrable reasons justifying the processing and that prevail over your interests, rights, and freedoms or if the purpose of processing is the establishment, exercise, or defense of a legal claim. You also have the right to object to processing at any time when the purpose of processing is direct marketing, including marketing profiling.

Right not to be subject to an automated individual decision – You have the right not to be subject to a decision made solely on the basis of automated processing activities, including profiling, that produces legal effects or significantly affects you.

Right to withdraw consent – represents the right to withdraw permission for the use of personal data for any processing activity carried out by SMARTREE for which you have given consent (e.g., newsletter subscription). It is important to understand that withdrawing consent for a specific type of personal data processing applies only to processing carried out from the moment the withdrawal of consent is announced, does not affect the processing carried out during the validity of the consent, and does not affect the consent given for other activities or services. To exercise this right, simply contact us using the methods listed below, and your request will be resolved as quickly as possible.

Right to contact the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania, which can receive complaints from data subjects at: B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, email: anspdcp@dataprotection.ro, or through the online platform www.dataprotection.ro

Right to address the courts, to defend any rights guaranteed by this law that have been violated, as well as in situations where you believe that the data controller or the competent Authority has not paid sufficient attention to your request to exercise the rights stated.

Through this policy, SMARTREE assures you that we will always prioritize respecting your fundamental rights as a data subject. We are confident that any request you send us will be resolved as quickly as possible, in accordance with domestic and international legislation and GDPR requirements. In this spirit, SMARTREE has developed and implemented a special procedure for resolving data access requests from data subjects (customers and partners).

Any of the rights mentioned above can be exercised through a written request sent to SMARTREE at: Expo Business Park, Str. Aviator Popișteanu no. 54A, Building 2, 4th floor, sector 1, Bucharest 012244. According to our current procedures, we may ask you to prove your identity to prevent unauthorized disclosure of data.

Please note that if your request for access to information is unfounded, unreasonably repetitive, or excessive, the applicable legislation allows us to charge a reasonable fee to cover the effort of allocating resources in such circumstances. We will inform you of any applicable fees before processing your request. We also have legal grounds not to respond to an access request if it would negatively affect the fundamental rights and freedoms of other data subjects.

15. OUR CONTACT INFORMATION
Please be reminded that you can contact SMARTREE’s Data Protection Officer at any time by submitting your request through any of the following methods:

By post or courier to SMARTREE’s address at Expo Business Park, Str. Aviator Popișteanu no. 54A, Building 2, 4th floor, sector 1, Bucharest 012244.
By email at dpo@smartree.com with the subject: “Attention: Data Protection Officer.”

16. HOW WE UPDATE THE PRIVACY POLICY
This Privacy Policy was last updated in October 2022. We reserve the right to periodically update and modify this Policy to reflect any changes in how we process your personal data or any changes in legal requirements.

In the event of any such changes, we will display on our website the date of publication of the most recent version of the Privacy Policy, so please check the content of the webpage dedicated to the Privacy Policy periodically.