PRIVACY POLICY

1. Introduction

COMPANIA NATIONALA DE ADMINISTRARE A INFRASTRUCTURII RUTIERE S.A. (“we”, “the operator”) considers the protection of personal data a fundamental commitment and treats the confidentiality of users’ information with the utmost responsibility.

This Privacy Policy explains how we collect, use, store, transfer, and protect your personal data when you use the eTarifGiurgiuPod mobile application and our website https://e-tarifgiurgiu.ro/.

Personal data processing is carried out in accordance with:

• Regulation (EU) 2016/679 regarding the protection of natural persons with regard to the processing of personal data (“GDPR”);
• applicable national data protection legislation;
• applicable fiscal, accounting, and information security regulations.

We reserve the right to periodically modify this Privacy Policy to reflect legislative changes or updates regarding the way data is processed. The updated version will be published on our website and will take effect from the date of publication.

By creating an account and using our services, you confirm that you have read and understood this Privacy Policy, as well as the applicable Terms and Conditions.

2. Data Controller

The personal data controller is:

COMPANIA NATIONALA DE ADMINISTRARE A INFRASTRUCTURII RUTIERE S.A., headquartered at Bd-ul Dinicu Golescu, no. 38, District 1, Bucharest, registered with the Trade Register under no. J/40/552/2004, fiscal identification code no. RO16054368.

3. What Personal Data We Collect

In general, we collect data directly from you, and its transmission is carried out through secure and encrypted connections (HTTPS).

3.1 Data Collected When Creating an Account

When registering in the eTarifGiurgiuPod application, we may collect the following data:

• first and last name;
• email address;

This data is used for creating and managing the user account and for authentication within the application.

3.2 Billing Information

In the “Billing Information” section, you may provide additional information necessary for invoicing:

• company name;
• tax identification number (VAT/CUI);
• billing address (country, county/state, city, etc.)

3.3 Vehicle Data

In the “Vehicles” section, you may enter:

• vehicle registration number;
• vehicle category;

This information is used for:

• access and identification through LPR (License Plate Recognition) systems;
• issuing and managing access permissions.

3.4 Payment Data

Payment for access tickets is processed through an external payment processor. Bank card details are entered exclusively on the secure page of the payment processor and are not stored or processed by COMPANIA NATIONALA DE ADMINISTRARE A INFRASTRUCTURII RUTIERE S.A.

3.5 Technical Data and Error Logs

In the event of technical errors within the application, we may automatically collect technical information regarding:

• device type;
• application version;
• operating system;
• application error and performance data.

This information is used exclusively for diagnosing and resolving technical issues.

3.6 Cookies and Similar Technologies

The “eTarifGiurgiuPod” mobile application does not use cookies.

4. Purposes and Legal Bases of Processing

We process personal data for the following purposes:

4.1 Service Provision

For:

• creating and managing accounts;
• processing orders and tickets;
• service validation and invoicing;
• providing technical and operational support;

Legal basis: performance of the contract and compliance with legal obligations.

4.2 Security and Fraud Prevention

For:

• protecting the application and IT infrastructure;
• preventing and detecting fraud;
• managing security incidents;
• defending the legitimate rights and interests of the operator.

Legal basis: the legitimate interest of the operator.

4.3 Legal Obligations

Certain data may be processed in order to comply with fiscal, accounting, or obligations imposed by competent authorities.

Legal basis: legal obligation.

5. How Long We Retain Data

Personal data is retained for the duration of your account’s existence within the “eTarifGiurgiuPod” platform.

After account closure, certain data may be retained for the periods required by applicable legislation or for defending the legitimate rights and interests of the operator.

6. Who We Share Data With

We may disclose personal data to:

• public authorities, where there is a legal obligation;
• contracted service providers;
• online payment processors;
• IT and security service providers.

All contractual partners are required to comply with legal requirements regarding confidentiality and data protection.

7. Data Transfers

Currently, personal data is stored and processed within Romania.

If certain services involve international data transfers, such transfers will be carried out in compliance with GDPR requirements and by implementing appropriate safeguards.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data against:

• unauthorized access;
• loss;
• destruction;
• unauthorized disclosure or modification.

Data is transmitted through encrypted connections and stored on secure servers. However, the transmission of information over the internet cannot be guaranteed as completely secure, as there are inherent risks associated with the use of public networks.

9. Your Rights

According to GDPR, you benefit from the following rights:

• the right to information;
• the right of access to data;
• the right to rectification;
• the right to erasure (“right to be forgotten”);
• the right to restriction of processing;
• the right to object;
• the right to data portability;
• the right to withdraw consent;
• the right not to be subject to automated decision-making;
• the right to lodge a complaint with the competent authority.

To exercise these rights, you may contact us at:

Email: registraturacnair@andnet.ro

10. Complaints

If you believe that your rights have been violated, you have the right to lodge a complaint with:

National Supervisory Authority for Personal Data Processing

You may also address the competent courts.

11. Contact Details

For questions regarding this Privacy Policy or the way personal data is processed, you may contact us at:

COMPANIA NATIONALA DE ADMINISTRARE A INFRASTRUCTURII RUTIERE S.A., headquartered at Bd-ul Dinicu Golescu, no. 38, District 1, Bucharest

Email: registraturacnair@andnet.ro