IMPORTANT: When you confirm that you have read and understood this Policy, we consider that you understood how your DCP (“DCP”) are used within the Donate with Pago feature.

This Policy is meant to present to you as clear and transparent as possible the way your DCP are processed by us (we, the “Company”, defined below), as a data controller when using the Donate with Pago feature.

Should you have questions or need clarifications with regard to the content of this Policy, you may contact us at datepersonale@pago.ro.

This Policy is completed with the terms and conditions for use of the Pago App (as defined in the Terms), available for consultation here (“Terms”) and with the General Policy on processing DCP, available here (“General Policy on processing DCP”).

Timesafe SRL, a Romanian legal entity, with headquarters in Voluntari, Ilfov county 87-2F Erou Iancu Nicolae Road, registered with the Trade Registry under no. J23/1658/2016, UIC 35968582 (hereinafter referred to as the "Company") observes the private character and the security of DCP processing of each user of this application, having the quality of DCP controller, according to the provisions of European Union General Regulation on DCP Processing no. 2016/679 (“GDPR”).

In this document, the words used in capitals will have the following meanings:

• a) “DCP” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, according to the definition from the “GDPR”;
• b) "User" means any natural person, over 18 years old who uses the Donate with Pago feature, accepting these terms. For the avoidance of any doubt, Donate with Pago is not meant for the natural persons who do not meet the conditions described in this definition and, explicitly, is not meant to the use by the minors (in the sense of the legislation applicable to a certain user);
• c) "Donate with Pago" is the Company's campaign through which Users have the possibility to make donations to certain Non-Governmental Organizations (as defined below);
• d) "Non-Governmental Organization" is a non-profit non-governmental organization such as an association, foundation or federation selected to participate in the Donate with Pago campaign in accordance with the Regulation available here or that uses the Donated with Pago feature within its website.

With regard to processing of DCP in the context of the Donate with Pago feature, the Company processes the following DCP, based on the performance of a contract:

• first name, last name and e-mail address of the User and the amount donated (to be able to send confirmation of donation); also, based on the User's consent, we will transfer this data to the Non-Governmental Organization.
• the card details of the User (in order to be able to make a donation through Donate with Pago); this data shall be processed in accordance with sections 3.2.2 and 7.2.4 of General policy on processing DCP.
• e-mail address of the user (so that we can send news about the Non-Governmental Organizations and about Donate with Pago); this data is processed based on the user’s consent.

• 4.1. Transfer of DCP
  We will tranfer the DCP to the Non-Governmental Organizations, as indicated in Section 3. Also, in processing the DCP we will use processors as indicated in the General policy on processing DCP.

• 4.2. The term of DCP processing
• 4.2.1. As regards the DCP processed in relation to Donate with Pago, the storage duration differs depending on the context of the processing. We store the DCP strict for the period necessary to fulfill the purposes for which DCP were collected. As a rule, the DCP processed in the context of the donation will be stored for 5 years. For more information regarding the storage duration, please contact us at datepersonale@pago.ro.

The Users beneficiate from the following rights in relation with the DCP belonging to them, which they may exercise by sending an e-mail to datepersonale@pago.ro:

Access right: You have the right to obtain from us confirmation that your DCP is processed by us, as well as information on the specific processing, such as: the purposes of processing, categories of processed DCP, recipients of DCP, the period for which DCP is stored, if we transfer the DCP abroad and how we protect it, your rights, the right to lodge a complaint before the supervisory authority, the source of your DCP.

Right to rectification: You have the possibility to request rectification of your DCP, provided that the applicable legal requirements are met. In the event of errors, after notification, we will immediately correct your DCP.

Right to erasure: In certain cases, you have the possibility to request the deletion of DCP, namely when: (i) the DCP are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent on which the processing is based according and where there is no other legal ground for the processing; (iii) you exercise the right to object to the processing; (iv) the DCP have been unlawfully processed. We are not obliged to comply with your request when the processing is necessary (among others) for compliance with a legal obligation or for the establishment, exercise or defense of legal claims. There are also other circumstances in which we are not obliged to comply with this request for the deletion of DCP.

Restriction of processing: You may request us to restrict the processing of your DCP in the following circumstances: (i) you contest the accuracy of the DCP, for a period enabling us to verify the accuracy of the DCP; (ii) the processing is unlawful and the you oppose to the erasure of the DCP and request the restriction of their use instead; (iii) we no longer need the DCP for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; (iv) you have objected to processing, pending the verification whether our legitimate grounds override yours. However, we can continue to process your DCP (i) when you consent; (ii) for the establishment, exercise or defense of legal claims or (iii) for the protection of the rights of another natural or legal person.

Right to data portability: Insofar the DCP is processed based on your consent or on the execution of the agreement and the processing is carried out by automated means, you have the right to have your data DCP provided to you in a structured format, which is currently used and can be read automatically and you have the right to request us to transfer this DCP to another controller. This right shall not adversely affect the rights and freedoms of others.

Right to opposition: In certain situations, such as when we process your DCP on the basis of a legitimate interest or for sending marketing messages, you have the right to object to the processing of your DCP by us. In the event of unjustified objection, the Company is entitled to continue processing DCP.

Revocation of consent: Insofar you consented to the processing of your DCP, you can at all times revoke your consent, without affecting the lawfulness of processing based on consent before its withdrawal.

Right not to be subject to any automatic individual decisions: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Such right cannot be exercised when the decision: (i) is necessary for entering into, or performance of, a contract between you and us; (ii) is authorized by law which lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or (iii) is based on your explicit consent.

Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with The National Supervisory Authority for DCP Processing (“DPA”) in relation to any breach of your rights regarding the processing of your DCP. The contact details of the DPA are: 28-30 Gheorghe Magheru Boulevard, District 1, Postal Code 010336, Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.

• 5.1. Correspondence
• 5.1.1. In view to exercising the rights provided above, the User may contact the Company at the address datepersonale@pago.ro.
• 5.1.2. The Company will analyze each individual request and will communicate with the User in order to comply to its requests in a manner as close as possible to the User’s expectations.
• 5.1.3. The Company will answer to all the requests of the Users within 30 calendar days as from the receipt of the request. Insofar as it is necessary to extend this term, the Company will inform the applicant User about this need, before the expiration of the initial term.

The security of your DCP is important to us. Your DCP will therefore be processed by applying reasonable technical and organizational measures to protect DCP, such as limiting access to DCP, encryption or anonymization of DCP, storage on secure environments. For more information, please access the General policy on processing General Policy on processing DCP.