Protection of personal data is very important for appreciate-me and we approach it very seriously. We process personal data pursuant to our obligations arising from the relevant legislation applicable in the European Union and in the Romania and observe the principles of secure processing of personal data.
Legislation applicable to data processing
Starting from May 25, 2018, Regulation no. 679/2016 on the protection of individuals regarding the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (hereinafter referred to as GDPR) is applicable in all Member States of the European Union.
Information regarding the personal data controller
GDPR applies to the www.appreciate-me.com Platform, aiming to inform its users about the processing of personal data by APPRECIATE-ME.COM SRL, as a data controller, located in Bucharest, Avionului Street no. 26, District 1, Romania, registered with the Trade Registry in Bucharest under no. J40/66/2016, sole registration code 35378751.
If you have any questions or requests regarding the processing of your personal data, you can contact us by sending us an e-mail to: email@example.com.
What does "processing" mean according to European Regulation no. 679/2016 (GDPR)
"Processing" means any operation or set of operations performed on personal data or on personal data sets, with or without the use of automated means, such as the collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, deletion or destruction.
Simply accessing the Platform generates a personal data processing operation.
Who is the data subject
The notion of "data subject" refers to any natural person whose data can be processed by accessing the Platform.
In the case of the User profile, the data subject may be the natural personal acting as a representative of a legal entity in relation to appreciate-me, respectively any other natural person who creates an account on our platform
What categories of personal data does Platform process
appreciate-me collects, based on thevoluntarysupply of the data subject:
• Personal data related to user accounts for accessing the platform and use our services. Upon creating your user account in the platform and in the course of using the platform, we ask you to disclose to us certain personal date, without which it would be impossible to use our services: the name and surname, the e-mail address.
After registration a user will be able to complete his profile with date of birth, country and city, he can add profile and cover photos, he will share his accounts on social platforms (Twitter, Facebook, Linkedin, Tiktok, Instagram).
• Personal date provided for identity verification purposes when you create a fundraising campaign on appreciate-me: the name and surname if you are a natural person/artist or business name if you are a company, Fiscal identification code., email address, bank account details, respectively as any other data necessary for the development of the campaign. In some cases, appreciate-me may request that you provide health information (with your consent) to raise the money needed for an operation or other health problems.
Also, we collect the information you choose to provide us in relation to your campaign, for example, you can provide a campaign title, choose a campaign category, upload images and describe your campaign.
• Personal data when you make a contribution for a project, we collect: the name and surname, email, zip code, country and any information you choose to provide us (such as a description of why you have donated).
Also, our payment processors collect your credit card details and other information necessary to process the donation.
• Other personal data, can we collect:
You can post comments, leave feedback, send thank-you notes or otherwise communicate with other users through our Platform. Any content, including such comments, feedback, and notes are you choose to post through our platform appreciate-me are available to the public by default. You may also contact us via a contact form, email, or by other means (for example, with questions about our services, for customer support, or to let us know your ideas for new products or modifications to existing products). When you do so, we collect the information you choose to provide us, such as your contact details, any images you choose to upload and the contents and nature of your message.
Please remember that any information that is disclosed in these areas becomes public information for both us and other users to use and share. Please be considerate and respectful of others while using the community to share your opinions. We reserve the right, but do not have the obligation, to review and monitor such posting or any other content on our Services, and to remove postings or content that may be viewed as inappropriate or offensive to others.
You can choose to provide us with information relating to third parties. For example, if you choose to share your campaign on the Platform with family and friends, we request access to information stored in your email and mobile device address books, such as names, email addresses, or phone numbers of your contacts (collectively, “Third-Party Data”).
The basis for data processing by the Operator
appreciate-me processes the personal data provided through the Platform based on the following legal grounds:
execution of contracts (in case of communications / requests related to the pre-contractual and contractual phase), for the contracts related to the services provided through the Platform;
based on his legitimate interest to present its products and services in the online environment based on a relevant relationship with the Users (existence of an account), to honor the requests of any kind sent by the data subjects, to keep its good reputation and image;
the legal obligations of the operator, in relation to the specifics of the activity carried out in the online environment, in relation to its object of activity, GDPR, fiscal and accounting regulations, etc;
based of consent, such as to send you certain information, including marketing communications, to share your information with partners when you have requested we do that, or to collect and process your information for research purposes if you have contributed to a campaign, or otherwise agreed.
The duration of the processing
Personal data collected through the Platform processed by appreciate-me or appreciate-me collaborators (on behalf of and in the interest of appreciate-me based on data processing agreements) is retained for a certain period, depending on the purpose of collection:
• data collected involuntarily by the operator for a period of no more than 3 years from the time of collection;
• the data related to the user accounts, until the date of deleting the account, or of the data associated in any way with the user account (without deleting the account), directly by the user, or through a request sent for this purpose to appreciate-me. Not accessing the account for an indefinite period does not lead to the deletion of personal data.
Users have the ability to directly delete any data they have associated with the user account and which is not essential for the existence of the user account.
• the data collected through any communications sent by the data subjects to the contact data provided on the site, for a period of 5 years from the moment of collection;
• the data related to the documents through which the operator can prove before the competent supervisory authorities the way of solving the notifications / complaints / requests of the data subject, made personally or by proxy, will be kept for at least 3 years, regardless of the established duration for processing , strictly in view of the possibility of the operator to prove before the supervisory authorities the development of a compliant processing and the observance of the rights of the data subject.
Who has access to the data collected by appreciate-me
The data that appreciate-me collects will be accessible to the administrator of the Platform, or as the case may be, to the eventual collaborators / partners involved in the administration of the Platform who through the provided services ensure the fulfillment of the legal or contractual obligations of the company.
Their access to the data processed by appreciate-me is realized only after the prior signing of some data processing agreements, by fully assuming the company's policies and procedures regarding the protection and confidentiality of personal data.
The access of these persons is limited to the data that interests the relations in which they are engaged towards the persons concerned on behalf of appreciate-me.
Any data transfer to external partners is carried out in safe technical and organizational conditions, in order to prevent any unauthorized intervention on the transmitted data.
The rights of the data subject. Means of exercising.
Any data subject has the following rights in relation to the personal data controller:
Theaccess right means the right of the data subject to obtain a confirmation from appreciate-me regarding the existence of the processed data and if so, access can be obtained to the respective data and to information on the way in which the data are processed.
The data portability right refers to the right to receive personal data in a structured, commonly used and automatically readable format and to the right to have this data transmitted directly to another operator, but only if this is feasible from a technical point of view.
Opposition right refers to the right of the data subject to oppose the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it considers a legitimate interest of the controller. When the processing of personal data is aimed at direct marketing, the data subject has the right to object to the processing at any time.
Correction right refers to the correction, without undue delay, of inaccurate personal data. The rectification will be communicated to each recipient to whom the data were transmitted, unless this proves impossible or involves disproportionate efforts on the part of appreciate-me.
The data subject may at any time update / modify the data related to the Users profile.
Data deletion ("the right to be forgotten") means certain persons concerned by a request for any personal data, without undue delay, under conditions of care, in the case one of the following reasons can be applied: they are no longer important for fulfilling the purposes for which the care was collected or processed; the person concerned decides to withdraw his or her consent if there is no other legal basis for the processing; the person concerned opposes to the processing and there are no legitimate reasons to prevail; the personal data was processed illegally; personal data must be deleted in order to comply with legal obligations.
Restricted processing right can be exercised in case the accuracy of the data processed by appreciate-me is contested, for a period that allows the verification of the correctness of the data; the processing is illegal, and the person in question opposes the deletion of personal data, instead requesting the restriction; if appreciate-me no longer needs the personal data for the purpose of processing, but the person in question requests them for the finding, exercise or defense of a right in court; if the person has objected to the processing for the period of time in which it is verified whether the legitimate rights of appreciate-me prevail over those belonging to the data subject.
The right to complaint with the competent supervisory authorities. If it is considered that the rights recognized by Regulation no. 679/2016 have been violated, any data subject has the possibility to address to the supervisory authority by submitting a complaint.
If you would like:
•to receive information on whether and which personal data are processed by us within the framework of our operations and how;
•to request the rectification, amendment, or complementation of your personal data if they are incorrect, incomplete, or insufficient;
•to submit objections against the processing of your personal data for the purposes of direct marketing or for processing your personal data based on a specific situation, if such processing is based on appreciate-me’s legitimate interest;
•to restrict the processing of your personal data (if you have disputed the accuracy of the data, your data are no longer needed by appreciate-me for the purposes of processing, and you are not interested in the deletion of your data or if you have submitted an objection against the processing of your personal data);
•to request the transfer of your personal data to another data controller in compliance with the applicable legislation,
•to express other wishes or submit other applications related to the processing your personal data or if you require further information about the processing, please contact us by sending an e-mail to firstname.lastname@example.org.
Measures and Warranties
In the processing of personal data, appreciate-me and each collaborator and partner of appreciate-me will act legally, equitably and transparently, in compliance with all the principles imposed by the legislation in force.
Data processing is performed for specific, explicit and legitimate purposes.
The processing of data is adequate and limited, only in relation to the need to achieve the purpose for which it was collected. The personal data will be retained only for the time necessary to fulfill the purposes for it is processed, and the processing will be performed in an appropriate manner to ensure the security and integrity of the data. No data transfer will be performed without proper precautions.
In order to ensure the legality of the processing of personal data, appreciate-me assumes the responsibility of implementing and maintaining appropriate technical and organizational measures for protection against unauthorized access, use, alteration or destruction of personal data according to international and national legal provisions on data protection.
These security measures include (but are not limited to) - securing digital data storage spaces (passwords, security alerts, system access notifications, antivirus), limiting access to personal data strictly to persons with specific responsibilities according to the purpose of processing, information, accountability and adequate guidance of employees, partners, collaborators who are allowed access to data, establishing specific responsibilities in contracts and job descriptions of employees, concluding data processing agreements with external collaborators / outsourced departments / service providers and any other persons who are allowed access to data or to whom data is transferred.
appreciate-me will not disclose personal data collected through the platform, except to authorized employees, appreciate-me partners or persons authorized by appreciate-me or appreciate-me partners who need this data to process it on behalf of appreciate-me or if the obligation to disclosure is a legal obligation or a legitimate request of a competent authority in charge of appreciate-me and / or its partners, collaborators, employees.
Requests / complaints / notifications regarding personal data and the Security Incident - management, solution, communication and cooperation.
Any requests / complaints / notifications regarding personal data will be addressed in writing to the operator, through one of the contact ways available on the Platform and with the provision of a contact address to which the answer / information related to it can also be communicated in writing. The same procedure will be followed in the case of requests / communications related to previous requests / complaints / notifications.
When addressing any request / complaint / notification, the claimant will be properly identified, in order to prevent compromising the confidentiality of data, taking measures at the request of unjustified / unauthorized persons or endangering / violating in any way the rights and legitimate interests of persons targeted in relation to the data for which the request is made.
In the case of requests formulated by a proxy, the appropriate identification of the proxy and the verification of his quality will be carried out.
Requests sent by telephone or requests in which the only available contact date is the telephone number of the data subject will not be considered, until they are sent in writing, under the conditions specified above. Similarly, if the request is made in conditions that raise a suspicion of the operator regarding the identity of the applicant or regarding the legal nature of the request, the operator may suspend the solution until providing reasonable additional information / data to confirm the identity and / or the quality of the claimant.
We correlate this requirement with the legal obligation of appreciate-me and its legitimate interest to prove the respect of the rights according to GDPR and of all the legal norms in the matter of data protection.
The solution of any request will be made within 30 days from its receipt.
The response to the request and / or any related communications will be sent in writing to the person concerned or to the person authorized by him, in the manner in which the operator received the request (example - for the request sent by e-mail, it will be answered by e-mail, for the request by physical correspondence, it will be answered by physical correspondence), or in another written way, expressly and reasonably requested by the person concerned / by the proxy.
The security incident
The security incident is a violation of the security of personal data, which involves unauthorized processing in any of the ways listed in the definition of processing above.
In case of a security incident, appreciate-me, following a detailed internal analysis, may address the Romanian supervisory authority - ANSPDCP without undue delay and, if possible, within 72 hours from the date on which it became aware of it, except the case in which it is unlikely to pose a risk to the rights and freedoms of individuals.
If the security incident is likely to pose a high risk to the rights and freedoms of individuals, the operator shall inform adequately and in accordance to the law including the data subject, without undue delay.
Exceptionally, informing the data subject in case of an incident will not be done if:
• adequate technical and organizational protection measures have been adopted regarding the data covered by the incident, whereby these data have become unintelligible to any person who is not authorized to access them;
• the operator has ensured, through appropriate subsequent measures, that the high risk to the rights and freedoms of the data subjects is no longer likely to materialize;
• information would require a disproportionate effort. In this situation, a public information will be made - through the operator's website and, possibly, in another way that will be considered necessary by the authority or that would ensure an equally efficient way of informing the data subjects.
In the phase prior to solving any request / complaint / notification and during its resolution, as well as in case of any possible security breach, the relations between the operator with the data subject and the supervisory authority will be characterized by transparency and openness to cooperation in order to resolve any incident.
If a change to the present privacy rules is required, appreciate-me will publish those changes to ensure accurate and complete information about the data collected and the use of such data.