Security Policy of personal data

According to the provisions of Law no. 677/2001 for the protection of the persons regarding the processing of personal data and the free movement of these data, VOLO RENT A CAR processes personal data, in compliance with the principles mentioned below, for legitimate purposes. The processing of personal data is done by mixed means (manual and automatic), in compliance with legal requirements and under conditions that ensure the security, confidentiality and respect of the rights of the data subjects.

EXTRAS from Law no. 677/2001, for the protection of persons regarding the processing of personal data and the free movement of these data (published in the Official Gazette no. 790 of December 12, 2001); amended and supplemented by Law no. 102/2005 of May 3, 2005 (M.Of., Part I no. 391 of May 09, 2005)

Chapter IV
The rights of the data subject in the context of the processing of personal data

Informing the data subject
Article 12
(1) If the personal data are obtained directly from the data subject, the operator is obliged to provide the data subject at least the following information, unless this person already owns the respective information:
a) the identity of the operator and his representative, if any;
b) the purpose for which the data processing is done;
c) additional information, such as: the recipients or categories of recipients of the data; if the supply of all the requested data is obligatory and the consequences of the refusal to provide them; the existence of the rights provided by the present law for the data subject, in particular of the right of access, of intervention on the data and of opposition, as well as the conditions under which they can be exercised;
d) any other information whose provision is required by the disposition of the supervisory authority, taking into account the specificity of the processing.

(2) In case the data are not obtained directly from the data subject, the operator is obliged that, at the time of data collection or, if they intend to disclose them to third parties, at the latest until the time of first disclosure, to provide the data subject at least the following information, unless the data subject already possesses the respective information:
a) the identity of the operator and his representative, if any;
b) the purpose for which the data processing is done;
c) additional information, such as: the categories of data concerned, the recipients or categories of recipients of the data, the existence of the rights provided by the present law for the data subject, in particular the right of access, intervention on the data and opposition, as well as the conditions under which they can be exercised;
d) any other information whose provision is required by the disposition of the supervisory authority, taking into account the specificity of the processing.

(3) The provisions of para. (2) does not apply when data processing is carried out exclusively for journalistic, literary or artistic purposes, if their application would give indications on the sources of information.

(4) The provisions of para. (2) does not apply if the data processing is done for statistical, historical or scientific research purposes, or in any other situations where the provision of such information proves impossible or would involve an effort disproportionate to the legitimate interest that would it could be harmed, as well as in situations where the recording or disclosure of data is expressly provided by law.

The right of access to data
Article 13
(1) Any data subject has the right to obtain from the operator, upon request and free of charge for one request per year, confirmation of the fact that the data concerning him are or are not processed by him. The operator is obliged, in the situation in which he processes personal data concerning the applicant, to communicate it, together with the confirmation, at least the following:
a) information regarding the purposes of the processing, the categories of data envisaged and the recipients or categories of recipients to whom the data are disclosed;
b) the communication in an intelligible form of the data that is the object of the processing, as well as of any available information regarding the origin of the data;
c) information on the principles of functioning of the mechanism by which any automatic processing of data concerning the respective person is performed;
d) information regarding the existence of the right of intervention on the data and the right of opposition, as well as the conditions under which they can be exercised;
e) information on the possibility to consult the register of records of the processing of personal data, provided in art. 24, to file a complaint with the supervisory authority, as well as to address the court for appealing the operator's decisions, in accordance with the provisions of the present law.

(2) The data subject may request from the operator the information provided in par. (1), by a request made in written, dated and signed form. In the application the applicant can indicate if he wants the information to be communicated to a specific address, which can also be by e-mail, or through a correspondence service that will ensure that the delivery will be done only personally.

(3) The operator is obliged to communicate the requested information, within 15 days from the date of receipt of the request, in compliance with the possible options of the applicant expressed according to para. (2).

(4) In the case of personal data related to the state of health, the request provided in par. (2) may be introduced by the data subject either directly or through a medical professional who will indicate in the application the person on whose behalf it is introduced. At the request of the operator or the data subject the communication provided in par. (3) can be done through a medical framework designated by the data subject.

(5) If the personal data related to the health status are processed for the purpose of scientific research, if there is not, at least apparently, the risk of infringing the rights of the data subject and if the data are not used to collect decisions or measures towards a certain person, the communication provided in par. (3) it can be done also in a term greater than the one provided for in that paragraph, insofar as it could affect the good progress or the results of the research, and not later than the moment when the research is completed. In this case, the data subject must have given his / her express and unequivocal consent for the data to be processed for the purpose of scientific research, as well as for the possible delay of the communication provided in para. (3) for this reason.

(6) The provisions of para. (2) does not apply when the data processing is performed exclusively for journalistic, literary or artistic purposes, if their application would give indications on the sources of information.

The right to intervene on the data
Article 14
(1) Any data subject has the right to obtain from the operator, upon request and free of charge:
a) as the case may be, the rectification, updating, blocking or deletion of data whose processing is not in conformity with the present law, especially of incomplete or inaccurate data;
b) as the case may be, the transformation into anonymous data of data whose processing is not in conformity with the present law;
c) notification to third parties to whom the data of any operation performed according to letter has been disclosed. a) or b), if this notification does not prove impossible or does not involve an effort disproportionate to the legitimate interest that could be harmed.

(2) For the exercise of the right provided in par. (1) the data subject shall submit to the operator a request made in written, dated and signed form. In the application the applicant can indicate if he wants the information to be communicated to a specific address, which can also be by e-mail, or through a correspondence service that will ensure that the delivery will be done only personally.

(3) The operator is obliged to communicate the measures taken pursuant to par. (1), as well as, if applicable, the name of the third party to whom the personal data relating to the data subject were disclosed, within 15 days from the date of receipt of the request, in compliance with the possible option of the applicant expressed according to para. (2).

The right of opposition
Article 15
(1) The data subject has the right to oppose at any time, for well-founded and legitimate reasons related to his particular situation, as data that aims to be the object of processing, except in cases where there are contrary legal provisions. In case of justified opposition the processing can no longer address the data in question.

(2) The data subject has the right to oppose at any time, free of charge and without any justification, that the data aimed at it will be processed for the purpose of direct marketing, on behalf of the operator or a third party, or be disclosed to third parties for such purpose.

(3) In order to exercise the rights provided in par. (1) and (2) the data subject will submit to the operator a request made in written, dated and signed form. In the application the applicant can indicate if he wants the information to be communicated to a specific address, which can also be by e-mail, or through a correspondence service that will ensure that the delivery will be done only personally.

(4) The operator is obliged to communicate to the data subject the measures taken under para. (1) or (2), as well as, if applicable, the name of the third party to whom the personal data regarding the data subject were disclosed, within 15 days from the date of receipt of the request, in compliance with the possible option of the applicant expressed according to par. (3).

Exceptions
Article 16
(1) The provisions of art. 12, 13, of art. 14 paragraph (3) and of art. 15 does not apply in the case of the activities provided for in art. 2 paragraph (5), if by their application the efficiency of the action or the objective pursued in fulfilling the legal attributions of the public authority is prejudiced.

(2) The provisions of para. (1) are strictly applicable for the period necessary to reach the objective pursued by carrying out the activities mentioned in art. 2 paragraph (5).

(3) After the cessation of the situation that justifies the application of par. (1) and (2) the operators who carry out the activities provided for in art. 2 paragraph (5) will take the necessary measures to ensure respect for the rights of the data subjects.

(4) The public authorities keep records of such cases and periodically inform the supervisory authority on how to solve them.

The right not to be subject to an individual decision
Article 17
(1) Everyone has the right to request and obtain:
a) the withdrawal or annulment of any decision that produces legal effects regarding him, adopted exclusively on the basis of personal data processing, carried out by automatic means, designed to evaluate some aspects of his personality, such as professional competence, credibility, behavior or other such aspects;
b) reassessment of any other decision taken with respect to it, which significantly affects it, if the decision was adopted exclusively on the basis of a data processing that meets the conditions stipulated in letter. a).

(2) Respecting the other guarantees provided by this law, a person may be subject to a decision of the nature referred to in par. (1), only in the following situations:
a) the decision is taken within the framework of the conclusion or execution of a contract, provided that the request to conclude or execute the contract, introduced by the data subject, has been satisfied or that some appropriate measures, such as the possibility to support his point of view , to guarantee the defense of their own legitimate interest;
b) the decision is authorized by a law specifying the measures that guarantee the defense of the legitimate interest of the data subject.

The right to address justice
Article 18
(1) Without prejudice to the possibility of addressing a complaint to the supervisory authority, the data subjects have the right to address the justice for the defense of any rights guaranteed by this law, which have been violated.

(2) Any person who has suffered an injury as a result of processing of personal data, carried out illegally, can address the competent court for its repair.

(3) The competent court is the one in which the territorial radius domiciles the applicant. The court application is exempt from stamp duty.