Romanian Air Transport Company TAROM SA, Romanian legal entity headquartered in Otopeni, Calea Bucuresti, no. 224F, Unique Identification Code RO477647, registered with the Trade Register under no. J223/1298/2003 (“TAROM”), registered with the National Supervisory Authority for Personal Data Processing as a personal data operator under no.4082, informs you that as of May 25th 2018, Regulation 2016/679/EU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter "the Regulation") will also apply in Romania.
TAROM will process personal data collected from its passengers based on a contractual or legal basis, on TAROM's or third party's legitimate interest, or on the consent expressed in relation to the processing of data. Personal data are processed either directly by TAROM or by authorized entities processing data in the name and on behalf of TAROM.
1. What is personal data and how it is collected by TAROM
Personal Data ("Personal Data") is any information about an identified or identifiable natural person; an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identification element such as name, identification number, location data, online identifier, or one or more specific elements, of his physical, physiological, genetic, psychic, economic, cultural or social identity.
TAROM collects personal data through the www.tarom.ro website, TAROM agencies in the country and abroad, as well as through travel partner agencies selling airline tickets and other services provided by TAROM. TAROM can also collect personal data in every interaction with its passengers or any other concerned person, interested in TAROM services, both through the call center and by e-mail or written mail.
2. The purpose and legal basis of the processing of personal data
When choosing to travel with TAROM, the airline will be able to process the personal data you provide (both yours and your family members and other people you travel with) for the following purposes:
a. Providing air passenger transport or freight air services, i.e. issuing and modifying the flight ticket, providing check-in and boarding service, as well as providing additional services;
b. Providing packages of tourist services through TAROM Tours;
c. Getting miles on Flying Blue fidelity cards;
d. Providing special services for persons with disabilities or those in need of special medical care;
e. Provision of on-board catering services to passengers requiring a special diet;
f. Confirmation of services purchased on-line and provision of additional services (notifications regarding program changes, route, operating program, etc.);
g. Invoicing and collecting the amount of services ordered by you and making payments online;
h. Ensuring transaction security / online payment by applying anti-fraud filters to online payment;
i. Immigration control and customs control to ensure transport safety and legality;
j. Responding to requests and complaints;
k. Carrying out surveys on customer satisfaction, performance of statistics aimed at improving the quality of TAROM services;
l. Submitting offers, advertising and marketing messages about the products or services provided by TAROM or its partners to measure the success of our advertising campaigns or personalize the services according to your needs;
The processing of personal data for the purposes set out in points a) to j) is required for the provision of air transport services (performance of the contract), the fulfillment of the legal obligations of TAROM or the legitimate interest of TAROM or third parties. The processing of personal data for the purposes set out in points (k) and (l) will only take place with the express consent of the person concerned.
3. Categories of processed data
In order to achieve the above goals, TAROM processes the following categories of personal data:
a. Passenger identification data: first and last name, home/residence address,e-mail address, personal identification number, fixed / mobile phone number, ID number and series, passport series /number, visa data;
b. Information about the services you have purchased (provided directly by TAROM or the partner agencies);
c. Data on the loyalty cards used and the number of miles accumulated;
d. Data on credit / debit cards used for payment, bank accounts;
e. Details of your trip (e.g. booking details and additional services requested and provided);
f. Information about your communication with TAROM and TAROM staff.
4. Processing of special categories of personal data
In some cases, TAROM processes passenger health data to ensure optimum travel conditions and to provide special services for people with disabilities or those in need of special medical assistance (e.g. when you are applying for a diet in particular, you need medical assistance or assistance to travel to and from the aircraft, etc.). For processing these categories of data, passengers must express their consent to this effect. Refusal to provide such consent will make TAROM unable to provide the required services.
These data may also be used by TAROM to establish, exercise or defend a right in court, and when processing is necessary for reasons of major public interest.
5. Recipients of personal data
TAROM may disclose personal data of passengers to third parties in order to meet a legal obligation of the air operator to perform the transport contract as well as to provide the services purchased or where such actions are necessary to protect and defend the property rights TAROM or emergency response to protect the personal safety of passengers.
These data recipients can be:
a. Travel agencies and other providers from whom you have purchased services (such as travel insurance; airport transfer services) through TAROM;
b. TAROM partners in whose loyalty programs you have signed up;
c. Banks and other payment service providers to process payments initiated by you;
d. Providers of handling and catering services;
e. External call-center service providers and TAROM customer support;
f. Market research companies, customer satisfaction studies and marketing and advertising services, etc.;
g. TAROM's contractual partners, in order to promote the products and services marketed by them;
h. Public authorities (General Customs Directorate, Border Police, Gendarmerie, Directorate for Investigating Organized Crime and Terrorism etc.), in accordance with the legal obligations established by TAROM;
i. International bodies (EUROPOL, INTERPOL, IATA);
j. Courts of arbitration or arbitral tribunals and competent authorities to investigate criminal offenses;
k. Other subcontractors of TAROM.
6. Retention period of data
Personal Data collected by TAROM can not be kept longer than is necessary for the purposes for which they are processed, in compliance with applicable law.
After this period, your personal data will be completely deleted from the systems or converted to anonymous data in accordance with the company's procedures.
Personal Data collected for the purpose of transmitting commercial communications will be processed until the date of withdrawal of the consent expressed by the data subject.
7. Transfer of personal data outside Romania
Your personal data may be transferred outside of Romania under legal or contractual obligations.
The recipient companies processing the personal data of TAROM passengers within the European Union/ European Economic Area are subject to the same legal provisions and offer the same level of protection as that offered by TAROM. However, if the fulfillment of the objectives set by TAROM will require the transfer of passengers' personal data to recipients outside the European Union / European Economic Area or to States which do not provide adequate protection, TAROM will require the respective recipients to protect personal data in accordance with the requirements of the Regulation.
8. Rights of data subjects
Data subjects whose personal data are processed by TAROM may exercise the following rights set out in Regulation:
a) The right to be informed about Personal Data processed by TAROM;
b) The right to obtain from TAROM confirmation that it processes the Personal Data of the data subject and, if so, access to that data and information such as the purposes of the processing, the categories of personal data concerned, the recipients or the categories of recipients, where possible, the expected storage period. If Personal Data is not collected directly from the data subject, the source of such data as well as, where appropriate, the existence of an automated decision making process including the creation of profiles;
c) The right to rectify inaccurate Personal Data or to fill them out;
d) The right to delete Personal Data, in accordance with the provisions of the Regulation;
e) The right to restrict processing when one of the following cases applies: the data subject disputes the accuracy of the data, the processing is illegal, the data subject opposes the deletion of the data when TAROM no longer needs Personal Data for processing but the data subject seeks for the establishment, exercise or defense of a right in court or where the data subject opposes processing for the period of time to verify whether the legitimate interests of TAROM prevail over those of the data subject;
f) The right to data portability, which consists in requesting TAROM to transmit Personal Data provided by the data subject in a structured format that is currently used and readable automatically, and the data subject sends it to another operator (within the limits set by the Regulation and provided that the necessary technical means are available to secure this right);
g) The right to object to the processing of Personal Data at any time, free of charge and without justification for situations such as: (i) personal data processing activities, for situations where the consent of the data subject does not need to be obtained; (ii) adopting an automated decision, including profile creation; (iii) conducting processing activities necessary for the fulfillment of a legitimate interest of TAROM. In case of unjustified opposition, TAROM is entitled to further process Personal Data. If the data subject repeatedly and unjustifiably exercises his right to object, TAROM reserves the right to cease responding to such requests. The right of opposition shall not be exercised with respect to the processing of the Personal Data required for the execution of the air transport contract or the fulfillment of the legal obligations of TAROM;
h) The ability of the person concerned to request TAROM not to be the subject of a decision based solely on automatic processing, including profile creation and producing legal effects that affect the data subject or significantly affect it. With regard to the adoption of a decision based solely on automatic processing, the data subject has the opportunity to express his/her point of view, to request the intervention of a human operator and the possibility of challenging such a decision in the manner described in this information; We inform you that TAROM does not apply decision-making procedures based solely on automatic processing;
i) If the data is processed based on your consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing performed up to that point;
j) The right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP);
k) The right to appeal to justice.
In order to exercise the rights, set forth in subparagraphs a) - i) above, you may submit to TAROM a written, dated and signed request at the email address firstname.lastname@example.org.
Complaints regarding the processing of personal data may be addressed to the National Supervisory Authority for Personal Data Processing.