The company A10 BY ARTMARK S.R.L., headquartered in Bucharest, C.A. Rosetti St., no. 5, Body A, ground floor, room 39, district 1, registered with the Trade Register Office under no. J40/17654/2018, Unique Registration Code 40284718, (hereinafter "A10") a company controlled directly or indirectly by ARTMARK HOLDING S.R.L. (hereinafter "ARTMARK"), headquartered in Bucharest, district 1, C.A. Rosetti St., no. 5, body A, registered with the Trade Register Office under no. J40/12823/2008, Unique Registration Code 24235977, is a member of the ARTMARK group of undertakings ("ARTMARK Group"), together with the following companies: Art Safari S.R.L., Art Games S.R.L., I.M.A. Institutul de Management al Artei (Art Management Institute), Lava Cow S.R.L., in accordance with the provisions of Article 4 (19) of Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"). 

For the purposes of the GDPR, controller in relation to personal data we hold means A10 as well as ARTMARK, referred to both individually and together throughout this information notice as the "Controller". 

The Controller shall process, in accordance with the provisions of the legislation in force, under secure conditions and only for the specified purposes, the data you provide us, for the purpose of 

(i) compliance with legal obligations to which the Controller or other companies in the ARTMARK Group is/are subject; (ii) concluding and performance of the contracts; (iii) the promotion of ARTMARK Group products and services; (iv) the supervision of the safety of persons and goods in the building located in Bucharest, C.A. Rosetti St., no. 5, district 1, as well as in the locations where ARTMARK Group companies carry out their activities. 

We hereby inform you about how your personal data is processed by the Controller; processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

Personal data means any information relating to an identified or identifiable natural person (referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to physical, economic, cultural or social identity of that natural person. 

1. CATEGORIES OF DATA PROCESSED 

The Controller processes the following categories of personal data: name and surname, age, home/residence address, delivery address, professional address, date of birth, personal numerical code, data related to the national identity card (series and number, date of issue and validity, issuer), data related to the passport (series, date of issue and validity, issuer), telephone number, e-mail address(es), bank account, place of work, profession, image, voice, IP and type of device used by you to visit the Controller's website, www.artmark.ro, pages visited, duration of use, search history, buying patterns/preferences. 

2. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA 

• We will process personal data for the following purposes: 

registration for participation at the auction in the auction room, online, by phone, written bid; data collection will be done by filling in the auction contracts (registration contracts); 

execution of contracts (including receiving of payments), invoicing and delivery of goods or provision of services purchased; data collection will be done either by filling in the auction (registration) contracts, award forms, by email or telephone, or by video recordings of auctions; compliance with legal reporting obligations; advertising, marketing and publicity of ARTMARK Group products and services, via email, SMS, telephone, auction catalogues, invitations, related to upcoming events and/or other forms of publicity; data collection will be done by subscribing to the newsletter, by filling in the contracts for participation in the auction; selling/offering tickets/permissions to ARTMARK Group events; data collection will be done by special purchase forms, i.e. those created for offering tickets/permits; 

CCTV video surveillance for the purpose of monitoring the security of persons, premises and/or goods inside the building in Bucharest, C.A. Rosetti St., no. 5, district 1. 

• We process personal data on one of the following grounds: 

your intention to contract or the contract concluded with you, for the execution of which we need to be in possession of data absolutely necessary for compliance with the Controller's legal obligations regarding customer knowledge, for issuing the invoice and the delivery of the good(s) or the provision of the service(s) purchased; the legitimate interests of the ARTMARK Group, e.g. prevention of fraud, maintenance of the security of goods, presentation in the most accessible manner of the content of the websites, direct marketing. Whenever we rely on this legal basis to process your data, we assess our interests so that they do not override your rights, you being entitled to object to such use at any time; compliance with a mandatory legal requirement, including, for example, accounting and tax requirements, requirements concerning know-your-customer and money laundering prevention which are subject to strict internal policies; consent which you give when there is no other basis for the processing and which can be withdrawn at any time by you. 

3. STORAGE PERIOD OF PERSONAL DATA 

Personal data will be stored for the duration of the relationship with the customer, plus a period of 5 years after termination, respectively the period required by law. After the expiration of this period the personal data will be deleted and/or destroyed. The personal data processed will be reviewed by the Controller at least every 2 years and inaccurate or amended data will be corrected or deleted, except in situations where the law requires that inaccurate or amended data be kept. 

4. COOKIES 

Cookies are small text files placed on the terminal. Whenever a person accesses a particular website, it may write or read in the cookie it has placed on the terminal various information that the reader has transmitted, directly or indirectly. Cookies play an important role in the viewing activity of our websites. They retain information about how web pages have been viewed, such as the language in which pages are displayed, font size, the region of the world in which the user is located, security settings and more. By using the cookies, you will benefit from a better browsing experience on our websites, which without them would not be possible or would be significantly weaker. However, if you prefer, through the settings made in the browser with which you browse the Internet, you can allow cookies to be set or blocked. The Controller's cookie policy is available and can be found at https://www.artmark.ro/ro/politica-cookies . 

5. DATA PROCESSING AND DISCLOSURE OF PROCESSED PERSONAL DATA 

Personal data are processed by the Controller's employees who, given their position that they have at the Controller, have prerogatives for collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting, using, disclosing by transmission, dissemination or making available, restricting, deleting or destroying personal data. 

Access to personal data processed by the Controller is limited to those employees who need to be in possession of this information in order to achieve the purposes for which this data is processed. 

Personal data may also be disclosed to third parties, personal data controllers or processors, such as service providers: third parties that manage email newsletter, SMS marketing or other marketing, customer support or sales activities, including transport service providers, couriers, insurers, information technology system providers and support, including email archiving, telecommunication providers, back-up and disaster recovery services and cyber security services. Disclosure may also be made to accountants, auditors, lawyers and other external consultants whose work involves a need to know or where disclosure is required by law. We ensure through contractual regulations that these service providers (processors) process personal data in accordance with European data protection legislation to guarantee a high level of data protection. There may also be other recipients, where there is a legal obligation to inform the competent public authorities or institutions when required by law (e.g., investigation of fraud; prevention of money laundering; submission of declarations or financial statements to tax authorities, etc.), or the transfer of data to the courts of law for the purpose of defending a right in court, or before other public authorities. 

Some of these recipients (including our affiliates) may use your data in countries outside the European Economic Area. 

The images of individuals present in the building in Bucharest, C.A. Rosetti St., no. 5, district 1, as well as in the locations where auctions are held are intended for use by the Controller and may be communicated to the following recipients: the data subject, the courts of law and criminal prosecution authorities, as well as the Controller's lawyers. 

Personal data may be disclosed if it is in our legitimate interest, for administrative reasons for example, or for auditing and monitoring our internal processes, or when providing products and services such as information technology within the ARTMARK Group. 

6. TRANSFER OF DATA WITHIN THE GROUP OF UNDERTAKINGS 

In accordance with the GDPR, for reasons of business administration, management of customer and employee needs, including for the purpose of processing personal data, the Controller transmits personal data within the group of undertakings, the ARTMARK Group. 

7. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION 

Personal information may be processed by staff operating outside the EEA (European Economic Area, which includes the countries of the European Union, Iceland, Liechtenstein and Norway; they are deemed to have equivalent data protection and privacy laws) of third-party personal data controllers for the purposes mentioned above. 

In the case of provision of personal data to entities outside the EEA, appropriate measures for the security of the processing will be taken on a contractual basis. 

8. YOUR RIGHTS 

Right to information: the data subject is entitled to know, even at the time of collection, how the data will be used, to whom it will be disclosed or transferred, what rights the data subjects have with regard to the data processed. 

Right of access to data: the data subject can obtain confirmation as to which personal data are being processed and, if so, you have the right of access to those data. 

Right to erasure of data (right to be forgotten): the data subject may obtain the erasure of data without undue delay (there are also exceptions, such as: some data are processed to provide the public with the right to information, some data are processed for statistical or archiving purposes, some data are processed for compliance with a legal obligation, or data are processed for the establishment or defense of a legal claim). 

Right to rectification: the data subject may obtain, without undue delay, the rectification of inaccurate personal data (e.g., the right to obtain the completion of incomplete personal data). Right to restriction of processing: the data subject has a temporary right to obtain restriction of processing if one of the following applies: (a) you contest the accuracy of the data, for a period that allows us to verify the accuracy of the data; (b) the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of their use; (c) we no longer need the personal data for the purpose of processing, but you request them from us for the establishment, exercise or defense of legal claims; (d) you have objected to the processing in accordance with Article 21 (1) of the GDPR for the period of time during which it is verified whether our legitimate rights override those of yours. 

Right to object: the data subject has the right to object to the processing of their personal data by the Controller when it is processed for marketing purposes. If you no longer wish to receive marketing messages about our events, you can opt-out of all marketing communications or only selected methods (email, SMS, MMS, telephone or mail). 

There are several ways to opt-out of receiving marketing messages: 

• Log in to your account and change your preferences; 

• Email datepersonale@artmark.ro for instructions; 

• Click on the link at the end of an email or marketing text received by SMS to unsubscribe; Right to data portability: the data subject has the right to receive personal data concerning him or her in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controller without hindrance from us if: 

1. the processing is based on consent pursuant to point (a) of Article 6 (1) or point (a) of Article 9 

(2) of GDPR or on a contract pursuant to point (b) of Article 6 (1) of the Regulation and 

2. the processing is carried out by automated means. 

The right not to be subject to a decision based solely on automated processing where that decision produces or significantly affects legal effects and is based solely on automated processing of data intended to evaluate certain personal aspects. 

The right to lodge a complaint with The National Supervisory Authority for Personal Data Processing. 

9. SECURITY OF PERSONAL DATA 

The Controller shall ensure a high level of protection and security against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access in connection with operations on personal data, by appropriate technical and organizational measures. 

Organizational measures include controlling physical access to our premises, training staff and locking physical files in storage lockers. Technical measures include the use of encryption, passwords for access to our systems, the use of SSL security certificates to encrypt data in transit, etc. 

In case you provide personal data via the Internet, although the Controller makes every effort to protect the data provided, the transmission will not be completely secure (e.g., third parties may observe the transmission activity; thus, the security of personal data transmitted via the Internet cannot be guaranteed). 

10. EXERCISING THE RIGHTS 

In order to exercise your legal rights, please contact us via the e-mail address datepersonale@artmark.ro or/and in writing to the correspondence address at C.A. Rosetti St. no. 5, district 1, Bucharest. 

We will try to respond to your request within 30 days and we may extend this period for reasons justified by the complexity of the request. In all cases, if this period is extended, there is an obligation to inform you of the deadline and the reasons for the extension. 

If it is impossible for us to properly identify you and therefore, we will not be able to respond to you, we will ask you for any additional information leading to your identification. 

11. UPDATE 

The Controller may update the content of this Information Note at any time. All updates and changes are effective immediately upon notification, which we will make by posting on the website and/or by email, to the extent such date is available. 

12. INQUIRIES AND CLAIMS 

If you have any questions or concerns about the processing of your data or wish to exercise your legal rights in relation to the data we hold, or if you have concerns with regard to the way we manage any privacy issue, you can address a request to datepersonale@artmark.ro or/and in writing to the correspondence address C.A. Rosetti St., no. 5, body A, district 1, Bucharest. 

We will investigate and attempt to resolve any request or complaint regarding the use or disclosure of your personal information. 

If you are not satisfied with our response, you can lodge a complaint with The National Supervisory Authority for Personal Data Processing. For more information: https://www.dataprotection.ro/index.jsp?page=procedura_plangerilor&lang=en