GDPR

Information on the processing of personal data

Date of entry into force: 02.09.2019

Operator identification data:

iFactor Brokerage SRL, headquartered in B-dul Dimitrie Cantemir no. 2B, Sector 4, Bucharest, Romania, Unique Registration Code (CUI): 35793952, registration number in the Trade Register J40/3728/2016, Telephone: +40 265250955, Fax: +40 265250207, e-mail: contact@ifactor.ai (“iFactor”, “Operator”, “We”)

1. The purpose of the information note

Please read this information about the processing of personal data (“Information”) carefully to understand our policies and practices regarding your personal data and how we use it. The information applies to individuals who interact with iFactor’s services as data subjects (“you”, “you”) and explains how your personal data is collected, used and disclosed by iFactor. The Information also explains how you can access and update your personal data and how you can exercise certain rights with respect to how it is used.

The information covers our data collection activities both online and offline, including personal data that we collect through various channels, such as websites, applications, third-party social networks and events.

If you do not provide us with the necessary personal data, we, our partners or our service providers may not be able to provide you with our services.

This Information may change from time to time and will be published in an updated form on our website.

The activity of iFactor complies with the laws and legal regulations applicable to the protection of personal data. Therefore, through this Information you can find the measures we take to protect personal data when you access our website and use our services, as well as in situations where you interact in any way with us and it is necessary to we process personal data.

The activity of processing personal data is carried out in accordance with the following principles:

• Existence of a legal basis for the processing of your data;
• Transparency regarding the purposes for which we use the data;
• Collection and use of appropriate data, relevant and limited to what is necessary in relation to the purpose pursued, thus respecting the principle of “minimum data processing”;
• Keeping your data safe;
• Respecting the rights of personal data holders;
• Keeping personal data up to date, accurate and complete;
• Storage of personal data for a certain period, even if the national legislation does not stipulate a deadline;
• Transfer of personal data outside the European Union only to countries that have an adequate level of protection.

2. Types of information collected and how it is collected

Depending on how you interact with iFactor (online, offline, by phone, etc.), we collect different types of information from you, as described below:

Personal contact information. This includes any information you provide to us (personal or professional) that allows us to contact you, such as your name, postal address, e-mail address, if applicable or your telephone number, your position in that company. , as the case

Registration information (account creation) as a seller / buyer (according to their definitions in the terms and conditions accessible here: https://ifactor.ai/termeni-si-conditii-de-utilizare/.

In addition, for the effective access to financing solutions within the digital platform, iFactor requests and processes personal data such as: name and surname, telephone number, e-mail address, CNP, number and CI series, home address.

Account login information. Any information that is needed to give you access to your account-specific profile. Examples include authentication / email address, username, unrecoverable password, and / or a security question and answer.

Computer / mobile device information: Any information about the computer system or other technological device that you use to access our services, such as the Internet Protocol (IP) address used to connect your computer or mobile device to the Internet, such as operating system and web browser type. The website automatically collects certain information and stores it in log files. Information may include Internet Protocol (IP) addresses, the region or general location from which your computer or device accesses the Internet, browser type, operating system, device type, and other information about your use of the website, including page history. accessed. The information thus obtained is used to help us improve the website to better suit the needs of users. At the same time, the IP address can also be used to help identify our server malfunctions and to manage the website, to analyse trends and visitor movements, as well as to gather demographic information that can help us identify visitor preferences. For more details please browse our cookies policy available at https://ifactor.ai/politica-cookies/. to analyzed visitor trends and movements, as well as to gather demographic information that can help us identify visitor preferences. For more details please browse our cookies policy available at https://ifactor.ai/politica-cookies/. to analyse visitor trends and movements, as well as to gather demographic information that can help us identify visitor preferences. For more details please browse our cookies policy available at https://ifactor.ai/politica-cookies/.

Registration for alerts sent by e-mail

To register for the alerts sent, the contact form requires your first and last name, e-mail address and a security password. To register in the alerts section, iFactor will process the name and email address that were provided directly by you. This data is processed for the purpose of transmitting information about news at iFactor level based on your consent which can be withdrawn at any time following the instructions provided in our communications or by contacting us by e-mail.

iFactor does not request or process sensitive personal data in order to access its website and / or services and implicitly the financing solutions.

3. Use of your personal data

The following section describes the different purposes for which we collect and process your personal data, as well as the different types of personal data that are collected for each purpose. Please note that not all processing below will be relevant to each user.

Accessing and registering on the website operated by iFactor is done in order to provide financing services, send communications about the services offered through the platform, exercise the rights of users of the website, as well as specific processes such as: procedures for knowing customers, performing checks on the eligibility of registered users, specific credit scoring activities, as well as making reports related to the checks considered, processing for the transmission of promotional materials and / or the transmission of commercial messages.

4. Disclosure, storage and / or transfer of your personal data

4.1. In the context of processing operations carried out for the purpose mentioned in Section 3 above, the personal data of users will be transferred / disclosed to the following third parties, only to the extent necessary and exclusively to the categories mentioned below:

a) to other companies part of the same group to which iFactor belongs. In this regard, processing purposes are taken into account such as: ensuring access to IT systems and applications, statistical reports, which are owned by iFactor or other group companies;

b) to other companies in commercial relations for the supply of goods or services, as well as but not limited to: suppliers of the computer system, respectively storage of computer data, including archiving e-mails, making backup copies and retrieving disaster, electronic communications service providers, other providers that maintain the electronic systems used by iFactor;

c) to competent authorities with express role and attributions under the legislation in force (ex: state authorities with specific attributions in the financial-accounting sphere, investigation and criminal prosecution bodies, as well as other authorities with investigation and control attributions) or accountants , auditors, lawyers, tax consultants, if personal data are necessary for the activity performed by them;

d) if we have any other legal obligation to disclose personal data or to respond to any claims, to protect our rights or those of a third party, the safety of a person or to prevent any illegal activity.

4.2. Personal data are processed only for the specified purposes and are kept only as long as necessary for their realisation. The storage time is set as follows:

a) personal data will be stored in our electronic databases and in the physical archives for a period of 12 months after the moment when a user logs for the last time in his account within the website;

b) if the same categories of data will be processed through contracts concluded with our business partners, personal data will be kept for the duration of the contracts and for a period of 1 year from their termination;

c) in case any of these personal data will be subject to storage / archiving, based on a legal obligation, the data will be kept for the period established by law.

5. Your rights

As a data subject, you have specific rights regarding the personal data we process. iFactor respects individual rights and treats each situation accordingly.

• Right to withdraw consent: if you have given your consent for the processing of your personal data, it can be withdrawn at any time, by e-mail sent to contact@ifactor.ai;
• Right to rectification: personal data may be rectified by their holder. iFactor makes reasonable efforts to maintain the accuracy, completeness, timeliness and relevance of continuously used personal data in our possession or control, based on the latest information available. In some cases, we may provide automated internet portals where users have the opportunity to verify and modify their personal data. As a registered user, you can access, modify or update the information you have sent us by sending an e-mail to contact@ifactor.ai.  We will process your data during the period when the account is active for accessing the website and, subsequently, in order to fulfil specific legal obligations or to achieve a legitimate interest;
• Right to restrict processing: the user has the right to obtain a restriction on data processing if:

– it disputes their accuracy for the period necessary to verify their accuracy;

– the processing is illegal and the user opposes the deletion of the data, but requests that its use be restricted;

– iFactor no longer needs the personal data for the purpose of processing, but the data subject requests it for the establishment, exercise or defense of the rights in court or if it is              verified whether the legitimate rights of iFactor prevail over the rights of the data subject;

• Right to information: The holder of personal data may request information on the data that iFactor keeps, as well as what category of personal data he has in his possession or control, the purpose of their use, where they were collected in case which were not directly collected by iFactor and to which they were disclosed, if any. At the user’s request, iFactor will provide a copy of their personal data. If you request additional copies, iFactor may charge a reasonable fee for the administrative costs incurred in submitting such a copy.
• Right to data portability: the user has the right to receive his personal data provided to iFactor and, when technically feasible, to be transmitted from iFactor to another organisation.

The last two rights are taken into account when:

• the data are processed by automatic means;
• the processing of data is done on the basis of consent or the processing of data is necessary for the execution or performance of a contract to which the user is a party;
• the data were provided by their user;
• the transmission of personal data is without prejudice to the rights and freedoms of others.

The user’s right to receive their own personal data must not affect the rights and freedoms of others. This situation is also applicable if the transmission of personal data to another organisation also involves the transmission of data to other persons (who have not consented).

The right of the user to request the transmission of his personal data from iFactor to another organisation is valid as long as this transmission is technically feasible.

• Right of deletion: the user has the right to request the deletion of personal data that are processed by iFactor in connection with it. iFactor must comply with the user’s request to delete personal data, unless the data is necessary for:

– Exercising the right to free expression and information;

– Compliance with mandatory legal provisions;

– Archiving information in the public interest, for the purposes of scientific or historical research or for statistical purposes;

– Finding, exercising or defending a right in court.

•  Right to object: the user has the right to object at any time to the processing of his data for reasons related to a particular situation in which he is, when the processing is not based on his consent, but on the legitimate interests of iFactor or a third party. In this case, iFactor will no longer process the user’s personal data, unless it can demonstrate legitimate and compelling reasons justifying the processing or when the purpose is to establish, exercise or defend a right in court.

– The user may object at any time, for any reason, to the processing of personal data when the processing is aimed at direct marketing on which our legitimate interest was based. If the activity was carried out with the consent of the holder, he may be withdrawn.

In exercising the above rights, please consider the following:

•  iFactor will make every effort to respond to your request within 30 days. This period may be extended for specific reasons inherent in this right or the complexity of the application. In all cases, if the period is extended, iFactor will notify the holder of the extension of the original period and of the reasons for such extension.
• Restricting access: In certain situations, iFactor will not be able to provide access to all or part of your personal data due to legal provisions. In this case, iFactor will inform you of the reason for the refusal.
•  Non-identification: In some cases, iFactor may not be able to identify your personal data due to the references provided. In such cases, when the Company will not be able to identify you as the data subject, it will not be able to provide the requested information based on user rights as presented above, unless iFactor receives additional information that may allow the identification of concerned. The company will inform you about this request, giving you the opportunity to provide the necessary additional information.
• o Exercise of rights: In order to exercise your legal rights, please contact us in writing (including in electronic format) at the contact details indicated in Section 11.

6. The right to lodge a complaint

If you wish to file a complaint regarding the processing of personal data, we prefer to contact you directly to resolve the identified issue, through one of the specific means included in the “Contact Us” Section of this Policy. of Privacy.

However, the above does not limit your right to:

• to the National Authority for the Supervision of Personal Data Processing, using the contact methods indicated on their website: http://www.dataprotection.ro/;
• The personal data protection authority of the Member State of the European Union where you have your habitual residence;
• to the Personal Data Protection Authority of the State where you have your place of employment within the European Union;

7. Technical and organisational measures implemented in order to ensure the security of personal data.

iFactor has specialised security teams that review and improve the measures it takes to protect personal data in order to protect against unauthorised access, accidental loss, disclosure or destruction.

The data requested and transmitted by you are collected on the website or through dedicated, secure electronic mail channels.

Communications made over the Internet (such as e-mails) are secure as long as they have been encrypted. User communications may go through several countries before being delivered due to the way the internet works. Moreover, the rights of access to this data and information are limited, being assigned in order to operate the iFactor platform and provide the proposed financing solutions. In this regard, iFactor has taken steps to ensure that any natural person acting under its authority and having access to personal data processes them exclusively upon request and within the limits mentioned by iFactor. We cannot be held responsible for unauthorised access or loss of personal data that cannot be controlled by us.

Our site may contain links to third party sites. We do not assume responsibility for the security and content of third party sites. Therefore, make sure that you have read the privacy policy and cookie policy available on these sites before using or transmitting personal data on their sites.

Likewise, this applies to any site or content owned by a third party using our services.

8. Retention of your personal data

Personal data will be kept for a period not exceeding the time necessary to achieve the purposes for which they are processed, unless otherwise provided by applicable law (for example, in relation to the personal data in dispute).

Thus:

• Regarding the alerts sent by e-mail, we will keep the personal data in our database for the period in which the user wants to be subscribed or until we receive instructions from him that he does not want to receive alerts from iFactor;
• Regarding the analysis of the interaction with the iFactor site, personal data will not be kept for more than 1 year or until the receipt of instructions according to which the user no longer wishes to be part of the database;
• The cookies placed on our site have different lifetimes, as indicated in the Cookies Policy available here https://ifactor.ai/en/politica-cookies/.

We do not store or access the information stored in the user’s device (computer, phone, tablet, etc.) without his prior consent or when these operations are performed only for the purpose of transmitting communications through an electronic communication network or are strictly required to provide a service information requested expressly by the user (for example, for storing information about the activities carried out within the website for easier use in the future).

For the use of cookies for which the prior consent of the user is required, the website will request the consent of users through a message displayed when it is accessed. This message will contain a link to the privacy policy and offers the possibility to accept cookies or the option to refuse them. If the user initially agreed, they can change their consent using the internet browser settings to delete the stored information or to refuse cookies.

8.1. Restrictions on the use of personal information by recipients

Any third parties to whom we choose to share personal data in accordance with the above are limited (by law or by the contract between us and them) to use the data only for the specific purposes identified by iFactor. iFactor will always ensure that third parties to whom it transmits personal data are subject to the obligations of confidentiality and security of this Information, as well as applicable laws. However, for the avoidance of doubt, this provision does not apply when disclosure is not our decision. In this regard, we mention that the data can be transmitted to state authorities with the role of verification / finding,

Except as expressly set forth above, iFactor will not distribute, sell or rent personal data to third parties without prior notice or consent of users.

8.2. Transmission of information outside the European Union

Personal data may be processed by personnel operating outside the European Economic Area working for iFactor, other members of our group or by third parties for the purposes mentioned above.

If we provide personal data to such members of our group or to other third parties who are not part of the European Economic Area, we will take all necessary measures to protect the data in accordance with this Information. These measures will include:

• In the case of service providers based in the USA, the conclusion of standard contractual agreements or the assurance that they are a party to the EU-US Security Shield (https://www.privacyshield.gov/welcome) or to any other agreement that may replace. In this regard, we mention that the data may be transmitted to service providers who store data outside the territory of the European Union: ex: Amazon USA; or
• In the case of service providers based in countries other than the European Economic Area:

– Concluding standard contractual agreements, based on the European Commission’s guidelines, with them; or

– Ensuring that the beneficiary country is recognized by the European Commission as providing adequate protection.

Further details may be requested at any time regarding the measures that iFactor takes to protect personal data in such cases through a request made in accordance with Section 2.

9. The confidentiality of minors

iFactor knowingly does not collect personal data from persons under the age of 18 through the website. We encourage both parents and guardians to spend time online with their children and to participate in the interactive activities offered by the sites accessed by their children. If a parent or guardian becomes aware that the minor has provided personal data without their consent, they must contact iFactor using the details indicated above. If iFactor becomes aware that a minor under the age of 18 has provided personal data, iFactor will delete this information from the database.

10. Changes to the Information

iFactor may update this Information. When the change takes effect, we will review the “update” date at the beginning of the Information. Users should periodically access the “Privacy Policy” Section to be informed of the latest changes; continued access to the website after the change of Information constitutes your agreement to these changes.

11. How can you contact us?

Your opinion matters to us – if you have any questions about this Information or want to exercise your rights in this regard, you can email us at contact@ifactor.ai.