AD AUTO TOTAL S.R.L. (hereinafter referred to as “the Operator”), headquartered in Bucharest, st. Tincani nr. 8, p. Z18, sc. A, et. 10, p. 66, sector 6, order number in the Register of Commerce J1994029340409, CUI RO 6844726, with address for correspondence at the workplace in Bucharest, Splaiul Unirii nr. 96, sector 4 – entrance through str. Version no. 16, is a personal data operator.
The processing of personal data is carried out in accordance with the applicable legislation, in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR).
The data subject is the foreign employee who submits a report and/or complaint to the Controller by using the online reporting form or any other communication channel made available for submitting such report or complaint.
The Controller processes personal data for the purpose of registering, investigating, and resolving reports and complaints submitted by foreign employees employed by the Controller.
The Controller processes the personal data collected from data subjects pursuant to Article 6(1)(c) GDPR, namely where “processing is necessary for compliance with a legal obligation to which the controller is subject”, specifically the legal obligation to examine and resolve reports and complaints submitted by foreign employees in accordance with the provisions of Government Emergency Ordinance No. 32/2026.
The Controller processes the following personal data: the data subject’s full name, e-mail address and/or telephone number, where such information is provided by the data subject.
In addition, the Controller may process any other personal data contained in the report or complaint submitted by the data subject through the reporting form or by any other communication channel used to submit the report or complaint.
Personal data will be collected directly from the data subject, namely the foreign employee submitting the report through one of the communication channels made available by the Controller.
The personal data collected from the data subject are intended for use by the Controller. Where necessary, such data may be disclosed to the Controller’s professional advisers (for example, external legal counsel) or to competent public authorities if the reported matter requires legal or other actions to be taken by the Controller.
Personal data will be retained in accordance with the provisions of Government Emergency Ordinance No. 32/2026, as follows:
• for reports and complaints submitted by identified employees, personal data will be retained for five (5) years from the termination of the employment relationship of the employee who submitted the report or complaint;
• for anonymous reports that cannot be linked to an employment relationship, the relevant documentation will be retained for five (5) years from the closure of the case.
The retention period may be extended where necessary in connection with an investigation, legal proceedings, or any other legal obligation requiring the preservation of such data.
Data subjects benefit from the following rights under the GDPR:
i. the right to be informed and the right of access to their personal data;
ii. the right to request the rectification of inaccurate or incomplete personal data;
iii. the right to request the erasure of personal data and/or the restriction of processing, subject to the conditions laid down by the applicable legislation;
iv. the right not to be subject to a decision based solely on automated processing. The Controller does not carry out any processing activities involving automated decision-making, including profiling.
Furthermore, data subjects have the right to lodge a complaint with the competent supervisory authority, namely the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
These rights may be exercised in accordance with the conditions and limitations established by the GDPR. To exercise their rights, data subjects may submit a written, dated and signed request by e-mail to gdpr@autototal.ro or by post to the Controller’s correspondence address indicated above.
For further information regarding the exercise of the above rights and the processing of personal data, the data subject may consult the General Privacy Notice available through the link provided above.