The legal framework for the activity of the Alternative Banking Dispute Resolution Centre (the Centre/ABDRC) established under the Government Ordinance no. 38/2015, so that the complaints against traders could be voluntarily referred by consumers (natural persons/users) to the entities that apply alternative dispute resolution procedures in an independent, impartial, transparent, effective, fast and balanced manner, in order to ensure a high level of protection of consumer and smooth functioning of the market.

ABDRC’s mission is to arrange settlement, following ALS procedures, of the disputes between consumers, as such are defined under art. 2 item 2 of the Government Ordinance no. 21/1992 on consumer protection, republished, as subsequently amended and supplemented, and traders whose business is regulated, authorized and supervised/monitored by the National Bank of Romania, as well as the branches of traders which carry out businesses in the Romanian territory in the banking field.

 

    1. GENERAL

ABDRC collects the personal data of the users/consumers (of financial, banking and non-banking services) pursuant to the provisions of Law no. 677/2001 on the protection of persons with regard to the processing of personal data and on the free movement of such data. Effective 25 May 2018, the personal data of the users shall be processed in accordance with the Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

ABDRC has taken technical and organizational security measures to protect the data under its control against any accidental or intentional handling, loss, destruction or against the access of any authorized persons.

 

    2. WHY IS PERSONAL DATA PROCESSED?

ABDRC processes personal data in order to facilitate the alternative dispute resolution procedures, under the applicable legal framework established in the Government Ordinance no. 38/2015.

Furthermore, the following personal data: full name of the user (name and first name), email address and phone number can be processed for marketing purposes in connection with the services of ABDRC, to send out newsletters or contact consumers to be interviewed on promotion of the services of ABDRC via the website (testimonials) or in TV shows (TV news);

  • ABDRC shall seek the express consent of consumers to processing of their personal data for marketing purposes. Consumers may withdraw their consent at any time by sending an email to the email address of ABDRC ([email protected]) or by clicking on the link to unsubscribe from the receipt of any marketing information/newsletters received provided in any email received from ABDRC. Withdrawal of the consent by the user shall have no effect whatsoever on performance of the ADR procedures and/or provision of the services to the consumer, nor shall this affect the lawfulness of consent-based processing before the withdrawal thereof.

 

    3. WHAT PERSONAL DATA IS PROCESSED?
  • The information provided by you and which is required in the application form as mandatory for requesting the services of ABDRC. Similarly, by providing the documents you find relevant (not requested by ABDRC) for the settlement of the dispute referred to us, you agree to processing thereof by ABDRC (storage, disclosure to trader);
  • ABDRC processes the special data (National Identification Number – CNP) the consumer is required to supply for identification in the document management system and matching the identity thereof with that provided by the trader concerned;
  • Information we receive from the trader in connection with the dispute/issue referred to us. Considering that the settlement of the dispute referred to us requires involvement of both parties (the user and the trader), you assume the fact that the bank may supply to ABDRC any documents/information in connection with the contractual relation between you and such trader, and which are related to the aspects referred to us;

            Provision of this personal data is voluntary. Nevertheless, it does stand for a fundamental condition for ABDRC to be able carry out the settlement of the dispute referred by you smoothly, and for you to be rendered the services of the Centre. The failure to provide the personal data shall render impossible for ABDRC to carry out the settlement process and to provide the services to you.

Similarly, by accessing our website, you assume the fact that, via third parties, ABDRC involuntarily processes (stores), in addition to the data above, the IP address, the time of visit, the access place, the name and version of the Internet browser, the operation system, including other parameters supplied by the Internet browser used to access the website.

 

  • Considering that ABDRC deals with dispute resolution, the terms for keeping the personal data will be in line with the terms set out for the courts of law (considering that this falls into the same scope of services);
  • Some personal data shall be processed by ABDRC during or after the end of provision of the services to users in order to meet the legal requirements laid down under the Ordinance no. 38/2015 as regards the reporting to the competent authorities, as well as to other state authorities, when the law requires this;
  • The personal data shall be processed for the legitimate interests pursued by ABDRC or by a third party provided that such legitimate interest does not override the interests or the fundamental rights and freedoms of the user;

 

    4. WHOM DO WE DISCLOSE PERSONAL DATA TO?
  • ABDRC may disclose personal data to providers of services to the Centre. The services that can be requested are, for instance, provision of IT infrastructure and services, provision of customer services, improvement of the Centre’s operations, optimization of the website. Unless this is strictly necessary or imposed under the binding legislation, these are not authorized to disclose or use for personal purposes the personal data of the users, and will act in the name of, and according to the instructions of ABDRC.
  • Furthermore, ABDRC may disclose your personal data to courts of law, prosecutor’s offices or other public authorities for legal compliance purposes or in the course of binding legal proceedings (such as a search warrant or a court judgment).

 

    5. YOUR RIGHTS

In performance of its activities, ABDRC intends to allow individuals to exercise their rights under the law as to their personal data, which are equal to those defined under the laws of the European Union.

 

REGULATION (EU) No 2016/679

 

  • 13 (for when data is collected from the data subject), and art. 14 (for when data has been obtained from other sources, than the data subject). The right to information: natural persons the data of whom is collected need to be informed about: processing of this data, identity of the controller, purpose of its collection and legal grounds of processing, recipients or categories of recipients of personal data, data storage period or, should this not be possible, criteria applied to determine this period, rights of natural persons and any data transfers (information should occur before the data processing operations) à the information about the aforementioned matters shall be published on the website, under the “Privacy Policy” section, and shall be provided directly to the data subjects when the procedure provides as such, or when these request to be provided any such information;
  • 15 The right of access to personal data: allows a natural person to obtain information about all of their personal data being processed, irrespective of the medium, and also to obtain from the controller a copy of the personal data processed à this right is granted to data subjects by authorizing their access to their own accounts with ABDRC, where they can view all the information and documents submitted to the Centre;
  • 16 The right to intervene on the data: grants a natural person the right to correct, supplement, update or erase any incomplete, inaccurate or obsolete data or the data the collection, use, disclosure or storage of which are prohibited.
  • 17 The right to erasure (the right to be forgotten): allows the natural person to request erasure of the personal data that concerns him/her, in observance of the legal limitations;
  • 18 The right to restriction of processing: the natural person has the right to request restriction of personal data processing during the entire period of the purpose for which such restriction has been applied;
  • Pursuant to art. 19, ABDRC is under the obligation to inform the recipients of personal data about any data erasure/rectification/restriction, unless this involves disproportionate effort. Furthermore, at request, the controller shall inform the data subject of the data recipients.
  • 20 The right to data portability: allows the natural person to request provision of all the data stored by the controller, in a structured and easily accessible format, directly to the data subject or another controller with the same scope of business, where this is technically feasible;
  • 21 The right to object: allows a natural person to object, for grounded reasons, to processing of their personal data. This right does not apply to processing of the data required to settle the dispute referred by the individual to ABDRC, because it would render impossible for the Centre to carry out its work in optimal conditions. Natural persons may also object, without reasons, to the use of personal data for direct marketing purposes, including profiling, insofar as this is in connection with the respective direct marketing.

                 

To exercise their rights, data subjects will file a written (handwritten or by electronic means) and signed application to ABDRC. In this application, the applicant may indicate whether they want to be sent the information to a particular address, which can also be an email address, or by mail or courier with personal delivery. ABDRC is required to make known the measures taken in accordance with the above articles, as well as, if applicable, the name of data processors and/or the third party/parties the personal data about the data subject has been disclosed to. Such communication shall take place within 15 days of receiving the request, in observance of the applicant’s choice of the means of submission, and indicating the term for addressing the request, taking into account the complexity of the operation.

To exercise you rights under the effective legislation, you may submit your request by email to [email protected] or by mail to Str. Sevastopol, nr. 24, 2nd floor, District 1, Bucharest.