Privacy Policy for ecotrav platform

Dear user

What is this document?

This privacy policy aims to inform the Users defined in the Terms and Conditions of the Platform ("Users") that the activity of ECOTRAV SISTEM SRL concerning the administration of this platform is done in accordance with the requirements of the Regulation. (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("GDPR").

Who are we?

We are the company ECOTRAV SISTEM SRL, based in Bucharest, RAMS business center; Soseaua Dudesti Pantelimon No. 42 e-mail: office@ecotrav.net. We refer to ourselves as "ECOTRAV".

What are personal data?

Personal data is information about an identified or identifiable individual. An identifiable individual is considered to be a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an e-mail address, a telephone number, an address, an online identifier, etc. or more specific elements of its physical, physiological, genetic, psychic, economic, cultural or social identities.

What is the processing of personal data?

The processing of personal data means any transaction or set of transactions carried out on personal data or sets of personal data with or without the use of automated means, such as collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or otherwise the provision, alignment or combination, restriction, erasure or destruction.

What is a personal data operator?

A Personal Data Operator (hereinafter referred to as "Operator") is a person or legal person, a public authority, an agency or another entity which, alone or with others, establishes the purposes and means of personal data treatment.

What is a person authorized by the Operator?

A person authorized by the Operator is a person or legal person, public authority, agency or other entity that processes personal data on behalf of the Operator.

What is our role?

We, ECOTRAV, are a legal person authorized by the companies that are in contractual relationship with us (hereinafter referred to as the "Companies") and who are the Operators of your personal data. ECOTRAV processes your personal data by following only the documented instructions of the Company.

What are the objectives of the processing of personal data?

We treat your personal data exclusively for the following purposes:

1. For tourism services requests as part of your professional activity. ecotrav is the interface between companies and travel agencies that allows you to identify the most interesting offer of tourism services in the context of your professional activity.
2. If the treatment is necessary for purposes that are in the legitimate interest of ECOTRAV or its employees:
   • Operation of the platform;
   • Provide users of the ecotrav platform with the services described in the Platform Terms and Conditions
   • Respond to requests for technical assistance from users or facilitate litigation;
   • Perform a technical analysis to identify ways to improve the platform and the services it provides
   • Monitor the activity on the platform, for example, identify a potentially fraudulent activity and ensure compliance with the terms of use applicable to the platform;
   • Manage your relationship with users (for example, respond to comments or questions received by email or phone)
   • Manage legal and operational activities (including risk management related to personal data and fraud);
   • Train staff on how to provide optimal service to users;
   • Improve the platform and the service offered;
   • Perform general administrative functions.
3. For the purposes provided by law.
4. In order to respond to requests from the government, from a police or repressive authority

What categories of personal data are we dealing with?

In order to provide the services offered by ECOTRAV through the ecotrav platform, used exclusively under the Terms and Conditions, the following personal data is processed, personal data that is not sensitive or perceived as sensitive:

1. For the users of the company
   1. Identity data: Gender, surname and first name;
   2. Identification data: username and password;
   3. Data relating to professional life: e-mail address, department, cost center, name and company data, roles, details of tourism service offers
   4. loyalty cards
   5. Connection data: IP address, logs, proof of acceptance of terms and conditions, personal data processing policy and consent to the processing of personal data;
2. For travel agency users
   1. Identity data: Gender, surname and first name;
   2. Identification data: username and password;
   3. Data relating to the professional life: e-mail address, roles, name and data of the travel agency, the details of the tourist offers;
   4. Professional telephone number.
   5. Connection data: IP address, logs, proof of acceptance of the terms and conditions, personal data processing policy and consent to the processing of personal data.

Only data that is appropriate and strictly necessary for the purposes listed above are collected and processed.

What is the nature of the processing of personal data?

We perform the following personal data processing:

• Registration of data and their structuring;
• Data retention (hosting with backup and duplication);
• Adapting or modifying data (for example, updating data from a user account)
• Extraction of data for reporting;
• pseudonymisation and encryption of data;
• Deletion of data;
• Data consultation;
• Sending e-mails (temporary passwords, password reset, tourism services offers, technical support);
• Telephone contact (technical support).

No decisions based solely on automatic processing, including profile creation, will be made.

How do we collect your personal data?

1. The following personal data relating to the Users are provided to us by the Companies that are in contractual relation with ECOTRAV, on the basis of the consent obtained from each individual User or the contract of which the User is part:
   1. Identity data: gender, surname and first name;
   2. Identification data: username;
   3. Business data: e-mail address, department, cost center, company name and data, roles.
2. The following personal data relating to the Users are collected during the use of the Platform by them:
   1. When entered by users in the platform:
      • Identification data: password
      • detail on requests and offers of tourism services
      • If a user makes a request for a third person, the user must have the consent of the latter.
   2. When modified by users in the platform:
      • Identity data: first and last name;
      • Identification data: email and password;
      • Data related to professional life: e-mail address, department, cost center, roles.
   3. Automatically:
      • Connection data: IP address, logs, proof of acceptance of terms and conditions, personal data processing policy and consent to the processing of personal data.
3. The phone number, email address or postal address may be collected if Users contact us for technical support or other operations necessary to provide services under the Company Agreement.

By contacting ECOTRAV by any means (e-mail, telephone, mail, etc.) involving indirect or direct communication between you and ECOTRAV, you understand and agree that your data will be processed by us. ECOTRAV agrees not to process this data for any purpose other than to fulfill your request, unless your express consent is for use for other purposes.

Who are the recipients of the personal data?

ECOTRAV may disclose your personal data to service providers / service providers for the purpose of operating and managing the ecotrav platform (eg hosting, technical support, IT development, etc.). In these circumstances, ECOTRAV will take the necessary steps within the GDPR to ensure that your data is processed by these individuals in accordance with the purpose and means indicated by ECOTRAV.
Any disclosure of data will be done in accordance with the principles and rules set out in the GDPR.

ECOTRAV may disclose your personal data to the Company for which you work only for the purposes listed above, the Company is the operator of your personal data:

• Users with Company Master status have access to the data of all Users in the company
• Users with the status Department Master have access to the data of all Users of the department in question.
• Users with Company Employee status only have access to their own data.

ECOTRAV may disclose your personal data to travel agencies that have a contract with the Company for which you work and with ECOTRAV for the purposes listed above.

How will we transfer personal data to other countries?

To achieve the above objectives, we may transfer your personal data to countries belonging to the European Economic Area or countries that have been recognized by the European Commission as offering an adequate level of protection of personal data ( for example Switzerland).

ECOTRAV does not intend to transfer data to third countries other than those mentioned above. However, in exceptional circumstances, if such a transfer would be necessary for the purposes described above, we will ensure that such international transfers are subject to appropriate safeguards (for example, based on standard contractual clauses approved by the European Commission) as required by the GDPR or other applicable legal provisions.

How long do we keep your personal data?

1. We retain the following data during the contractual relationship with the Companies in order to operate and manage the ecotrav platform in accordance with the Terms and Conditions:
   1. Identity data: Gender, surname and first name;
   2. Identification data: username and password;
   3. Business-related data: for Company Users: email address, department, cost center, roles, company name and data, details of tourism offers; For travel agency users: e-mail address, roles, name and travel agency details, details on tourism service offerings;
   4. For Company Users: loyalty card
   5. Telephone number for telephone support for technical support;
   6. Login data: proof of acceptance of the terms and conditions, policy of processing personal data and consent to the processing of personal data.
2. We keep the IP address and the logs for a period of 6 months.
3. Accounts of Users who have not logged in for 12 months will be automatically deleted.
4. We will delete the personal data of the User when exercising his right of opposition, in accordance with the provisions of Art.15 / Clause 2 of the GDPR.

What is the safety of the treatment?

ECOTRAV has adopted technical and organizational data processing measures requested by the GDPR, in order to protect the personal data against any action of unauthorized access, misuse or disclosure, unauthorized modification, destruction or accidental loss. All ECOTRAV employees and collaborators as well as third parties acting on behalf of ECOTRAV are required to respect the confidentiality of the information as well as the requirements of the GDPR.

What are your rights?

Subject to certain legal provisions which may limit these rights or justify a certain type of response on our part, you have certain rights with regard to the personal information processed by ECOTRAV:

1. Right of access to processed data: You have the right to access your personal data and to obtain copies. Unreasonable, excessive or repeated requests may not receive answers.
2. The right to rectify data: You can request that your data be rectified if inaccurate or obsolete and / or completed if they are incomplete. You can exercise this right directly on the platform by accessing your account.
3. The right to delete data ("right to be forgotten"): in some cases you have the right to have your data erased or destroyed, for example when you have withdrawn your consent, when the treatment is no longer necessary or contrary legal provisions.
4. Right to limit treatment: You have the right to request the restriction of the processing of your data. This means that your data processing is limited so that we can keep the data, but not use or process it. This right applies in the specific circumstances foreseen by GDPR, namely:
   1. The accuracy of the data is disputed by the data subject (you), in this case the processing is limited to a period that allows us to verify the accuracy of the data;
   2. The treatment is unlawful and the person concerned (you) opposes their erasure and instead requires the limitation of their use;
   3. Ecotrav no longer needs personal data for the purposes of processing but it is still necessary for the data subject (you) to find, exercise or defend legal rights;
   4. The data subject (you) objected to the processing, during the verification as to whether the legitimate interest pursued by ECOTRAV take precedence over those of the data subject.
5. Right of objection: You may object at any time to the processing of your data as such processing is based on your consent or on the legitimate interest of ECOTRAV.
6. The right to withdraw consent at any time: You can withdraw your consent to the processing of your data as this treatment is based on consent. The withdrawal of the consent does not affect the legality of the treatment on the basis of the consent prior to its withdrawal.
7. The right to lodge a complaint with the competent supervisory authority: You can lodge a complaint with the relevant data protection authority, namely the National Supervisory Authority for the processing of personal data.

How can you exercise these rights?

You can exercise one of these rights on the personal data processed by ECOTRAV by sending a simple request by e-mail: office@ecotrav.net. In such a situation, it is very possible to ask for proof of your identity.

What type of cookies does the ecotrav platform use?

The ecotrav platform uses only functional cookies to preserve the language settings initially selected by you and your login data. Please refer to the cookie policy available at the bottom of each Platform page for more details.

How can you contact us?

If you have any questions or concerns about the way we process your personal data or if you want to exercise your rights, please contact us by email: office@ecotrav.net.