AI TECHNOLOGIES AND RESEARCH FORUM

www.aiforum.ro

CHAPTER I. PURPOSE OF THE DATA PROTECTION POLICY

As part of its social responsibility, AI TECHNOLOGIES AND RESEARCH FORUM undertakes to comply with national and international data protection laws. This Data Protection Policy is based on principles accepted at European and global level regarding data protection. Ensuring data protection is the foundation of trustworthy business relationships.

The Data Protection Policy establishes the framework conditions necessary to ensure the appropriate level of data protection provided for by Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

CHAPTER II. SCOPE AND AMENDMENT OF THE POLICY

This Personal Data Protection Policy applies to all organizers of AI TECHNOLOGIES AND RESEARCH FORUM and to their employees. The Data Protection Policy extends to all processing of personal data.

Anonymized data, where available, used, for example, for statistical evaluations or other studies, is not subject to this Data Protection Policy.

The Policy is reviewed annually, and the most recent version approved by the General Manager shall be made immediately available to employees, clients and business partners alike.

CHAPTER III. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

Article 1. Fairness and lawfulness

When personal data is processed, the individual rights of data subjects must be protected. Personal data must be collected and processed lawfully and fairly.

Article 2. Purpose limitation

Personal data may be processed only for the purpose defined before the data is collected and communicated to the data subject. Subsequent changes to the purpose are possible only to a limited extent and require sound justification.

Article 3. Transparency

The data subject must be informed about how their data is handled. As a rule, personal data must be collected directly from the person concerned. When data is collected, the data subject must already know, or must be informed of:

• the identity of the data controller (the organization collecting the data);
• the purpose of the data processing;
• the third parties or categories of third parties to whom the data may be disclosed.

Article 4. Data reduction and data minimization

Before processing personal data, it must be determined whether and to what extent the processing of personal data is necessary to achieve the purpose for which it is carried out.

Where the purpose permits and the costs involved are proportionate to the objective, anonymous data must be used. Personal data may not be collected in advance and stored for potential future purposes unless this is required or permitted by national law.

Article 5. Erasure

Personal data that is no longer required after the completion of a legal or business process must be erased. There may be situations in which legal interests require such data to be retained for predefined periods. In such cases, the data must remain on file until the relevant legal retention obligations expire.

Article 6. Accuracy and currency of data

Personal data collected must be accurate, complete and, where necessary, kept up to date. Ongoing measures must be taken to ensure that inaccurate or incomplete data is erased, corrected, supplemented or updated.

Article 7. Confidentiality and data security

Within the organization, personal data is regarded as confidential information and is protected by appropriate organizational and technical measures to prevent unauthorized access, unlawful processing or distribution, as well as accidental loss, alteration or destruction.

CHAPTER IV. LAWFULNESS OF DATA PROCESSING

The collection, processing and use of personal data is permitted on the following necessary legal grounds. These legal grounds are also required where the purpose of collecting, processing and using personal data is changed from the original purpose.

Article 1. Client and partner data

Article 1.1. Data processing for a contractual relationship

The personal data of prospective clients, existing clients and partners may be processed for the purpose of entering into, performing and completing a contract. This also includes advisory services provided to a partner where such services are connected with the contractual purpose.

Before a contract is concluded, during its initiation stage, personal data may be processed in order to prepare offers or other documents that respond to various requests from the prospective contracting party in connection with the conclusion of the contract. Individuals may be contacted during the contract-preparation process using the personal information they have provided. Any restrictions requested by prospective clients must be respected. For advertising purposes, see Chapter IV, Article 1.2 below.

Article 1.2. Data processing for advertising purposes

If a data subject contacts AI TECHNOLOGIES AND RESEARCH FORUM to request information, for example to receive information materials about a product or service, processing the data in order to respond to that request is permitted.

Advertising activities are subject to additional legal requirements. Personal data may be processed for advertising, market research and public-opinion research purposes, provided that such processing is consistent with the purpose for which the data was originally collected. The data subject must be informed about the use of their data for advertising purposes.

If data is collected solely for advertising purposes, disclosure by the data subject is voluntary. The data subject must be informed that providing personal data for processing for advertising purposes is voluntary and that the data subject’s consent must be obtained in order to process such data for advertising purposes.

When consent is given, the data subject should have the opportunity to choose among the available methods, such as predefined printed forms, consent sent by email or consent given by telephone. For consent, see Chapter IV, Article 1.3.

If the data subject refuses the use of their data for advertising purposes, their data may no longer be used for those purposes and must be blocked from such use.

Article 1.3. Consent to data processing

Data may be processed on the basis of the data subject’s consent. Before giving consent, the data subject must be informed in accordance with Chapter III, Article 3 of this Data Protection Policy. The declaration of approval, namely the consent, must be obtained in writing or electronically and retained for documentation purposes.

In certain circumstances, such as telephone conversations, consent may be given verbally. The granting of consent must be documented.

Article 1.4. Data processing based on a legitimate interest

Personal data may also be processed on the basis of a legitimate interest of AI TECHNOLOGIES AND RESEARCH FORUM. Legitimate interests are generally legal in nature, for example the collection of unpaid debts, or commercial in nature, for example the prevention of contractual breaches.

Personal data may not be processed for the purpose of a legitimate interest if, in an individual case, there is evidence that the interests of the data subject require protection and override that interest. Before processing the data, it must be determined whether such a situation exists.

Article 1.5. Processing of sensitive data

Highly sensitive personal data may be processed only where required by law or where the data subject has given explicit consent. Such data may also be processed where this is necessary for the establishment, exercise or defense of legal claims concerning the data subject. If sensitive data is intended to be processed, the person responsible for personal data protection must be informed in advance.

Article 1.6. Automated individual decisions

Automated processing of personal data used to assess certain aspects may not be the sole basis for decisions that have adverse legal consequences or that may significantly affect the data subject. The data subject must be informed of the facts and results of automated individual decisions and must be given the opportunity to respond. To avoid incorrect decisions, an employee must carry out a review and plausibility check.

Article 1.7. User and internet data

Where personal data is collected, processed and used on websites or in applications, data subjects must be informed of this through a Privacy Notice and, where applicable, through information about cookies. The Privacy Notice and any cookie information must be integrated in such a way that they are easy to identify, directly accessible and continuously available to data subjects on www.aiforum.ro.

Where usage profiles or tracking mechanisms are created in order to evaluate the use of websites and applications, data subjects must always be properly informed in the Privacy Notice.

Where websites or applications provide access to personal data in an area restricted to registered users, the identification and authentication of the data subject must provide sufficient protection during access.

Article 2. Employee data

Article 2.1. Data processing for the employment relationship

Within employment relationships, personal data may be processed where necessary to initiate, perform and terminate an employment contract. When an employment relationship is initiated, applicants’ personal data may be processed.

Where an applicant is rejected, their data must be erased in accordance with the applicable retention period, unless the applicant has agreed that their data may remain on file for a future selection process.

During an existing employment relationship, the purpose of data processing must always be connected with the purpose of the employment contract unless one of the other circumstances permitting data processing applies.

If it is necessary during an application procedure to collect information about an applicant from a third party, the relevant legal requirements must also be observed.

Article 2.2. Data processing based on a legitimate interest

Personal data may also be processed where necessary to support a legitimate interest of AI TECHNOLOGIES AND RESEARCH FORUM. Legitimate interests are generally legal in nature, for example the filing, enforcement or defense of legal claims or the recovery of debts.

Control measures that require the processing of employee data may be implemented only where there is a legal obligation to do so or where a legitimate reason exists. Even where there is a legitimate reason, the proportionality of the control measure must always be examined.

The organization’s justified interests in implementing control measures, for example compliance with legal provisions and the organization’s internal rules and regulations, must be balanced against any employee interests requiring protection so that the control measures are appropriate.

Article 2.3. Processing of sensitive data

Sensitive personal data may be processed only under certain conditions. This includes data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, or data relating to criminal convictions and offenses. Such data may be processed where there is a legal obligation or where the data subject has given explicit consent.

Article 2.4. Automated decisions

If personal data is processed automatically as part of an employment relationship and specific personal data is automatically evaluated, for example in personnel selection or the assessment of skills profiles, such automated processing may not constitute the sole basis for decisions that may have an adverse impact on the employee concerned.

To avoid incorrect decisions, the automated process must be supported by a natural person who evaluates the substance of the situation, and that evaluation must form the basis of the decision. The data subject must also be informed of the facts and results of automated individual decisions and of the opportunity to respond.

Article 2.5. Telecommunications and internet

Telephone equipment, email addresses, the intranet and internet, together with internal applications, are provided by the organization primarily for work-related duties. They are tools and resources of the organization. They may be used within the limits of applicable legal regulations and the organization’s internal policies.

Where personal use is authorized, the provisions of the internal rules and procedures and the specific legislation concerning telecommunications must be observed. There shall be no general monitoring of telephone and email communications or of intranet or internet use.

To protect against attacks on the IT infrastructure or individual users, protective measures may be implemented for connections to the AI TECHNOLOGIES AND RESEARCH FORUM network that block technically harmful content or analyze attack patterns. For security reasons, the use of telephone equipment, email addresses, the intranet, the internet and internal applications may be monitored for a limited period.

CHAPTER V. TRANSFER OF PERSONAL DATA

The transfer of personal data to recipients outside or within AI TECHNOLOGIES AND RESEARCH FORUM is subject to the authorization requirements for the processing of personal data under this Policy. The recipient of the data may use the data only for the defined purposes.

Where data is transferred to a recipient outside the organization in a third country, that recipient and country must provide a level of personal data protection equivalent to that established by this Data Protection Policy and consistent with Regulation (EU) 2016/679.

Where data is transferred by a third party to the organizers of AI TECHNOLOGIES AND RESEARCH FORUM, it must be ensured that the data is used only for the intended purpose.

CHAPTER VI. PROCESSING OF DATA UNDER CONTRACTS

Processing by a service provider engaged to process personal data means that the provider must comply with Regulation (EU) 2016/679 and with this Policy, without assuming responsibility for the related business processes. In such cases, a personal data processing agreement must be concluded.

The provider may process personal data only in accordance with the client’s instructions. When the agreement is concluded, the following requirements must be met, and the department placing the order must ensure compliance with them:

• The provider must be selected on the basis of its ability to ensure the necessary technical and organizational protection measures.
• The processing order must be issued in writing. The instructions concerning data processing and the responsibilities of the client and the provider must be documented.
• The contractual standards for personal data protection supplied by the organization’s data protection officer must be taken into account.
• Before data processing begins, the client must be satisfied that the provider will comply with its obligations. A provider may document compliance with data-security requirements, in particular by presenting an appropriate certification. Depending on the risk associated with the data processing, certification reviews must be repeated regularly throughout the term of the contract.

In the case of cross-border processing of data under contracts, the requirements of Regulation (EU) 2016/679 and relevant national legislation concerning the disclosure of personal data abroad must be met.

In particular, personal data originating in the European Economic Area (EEA) may be processed in a third country outside the EEA only if the provider can demonstrate a standard of data protection equivalent to that established by this Data Protection Policy. Appropriate safeguards may include:

• an agreement incorporating the European Union Standard Contractual Clauses for the processing of data under contracts in third countries, concluded with the provider and any subcontractors;
• the provider’s participation in a certification scheme accredited by the European Union that ensures a sufficient level of data protection;
• recognition by the competent data protection supervisory authorities of the provider’s binding corporate rules as creating an adequate level of data protection.

CHAPTER VII. RIGHTS OF THE DATA SUBJECT

Every data subject has the rights set out below. The exercise of these rights must be dealt with immediately by the person responsible for personal data protection and may not result in any disadvantage to the data subject.

Article 1. The data subject may request information about which personal data concerning them has been stored, how the data was collected and for what purpose. Any additional rights to inspect employer documents, for example a personnel file, in the context of an employment relationship under applicable employment laws shall remain unaffected.

Article 2. Where personal data is transferred to third parties, information must be provided about the identity of the recipient or the categories of recipients.

Article 3. Where personal data is inaccurate or incomplete, the data subject may request its correction or completion.

Article 4. The data subject may object to the processing of their data for advertising, market research or public-opinion research purposes. The data must be blocked from these types of use.

Article 5. The data subject may request the erasure of their data where the processing has no legal basis or where the legal basis has ceased to apply. The same applies where the purpose of the processing has expired or has otherwise ceased to be applicable. Applicable retention periods and potential conflicts of interest must be taken into account.

Article 6. The data subject has the right to object to the processing of their data, and this objection must be taken into account where the protection of their interests, arising from a specific personal situation, overrides the interest of the data controller. This does not apply where a legal provision requires the data to be processed.

CHAPTER VIII. CONFIDENTIALITY OF PROCESSING

Personal data is considered confidential. Any unauthorized collection, processing or use of such data by employees is prohibited. Any data processing carried out by an employee who has not been authorized to perform it as part of their legitimate duties is unauthorized.

The need-to-know principle applies. Employees may have access to personal data only to the extent appropriate for the type and purpose of the relevant work task. This requires careful allocation and separation of roles and responsibilities, as well as their effective implementation.

Employees are prohibited from using personal data for private or commercial purposes, disclosing it to unauthorized persons or otherwise making it available. Department managers and the Human Resources Department must inform employees, at the beginning of the employment relationship, of their obligation to protect the confidentiality of personal data and information. This obligation remains in force even after the employment relationship has ended.

CHAPTER IX. SECURITY OF PROCESSING

Personal data must be protected against unauthorized access, unlawful processing or disclosure, as well as accidental loss, alteration or destruction. This applies regardless of whether the data is processed electronically or on paper.

Before new data-processing methods, particularly new information systems, are introduced, technical and organizational measures for protecting personal data must be defined and implemented. These measures must be based on the state of the art, the risks associated with the processing and the need to protect the data, as determined through the information-classification process.

In specific cases, the responsible department may consult the information security officer. The technical and organizational measures for the protection of personal data form part of the organization’s information-security management and must be continuously adapted to technical developments and organizational changes.

CHAPTER X. DATA PROTECTION MONITORING

Compliance with the Personal Data Protection Policy and applicable data protection laws is regularly verified through data protection audits and other controls. The person responsible for conducting these controls is the Data Protection Officer.

Upon request, the results of data protection controls shall be made available to the supervisory authority responsible for data protection. The competent data protection authority may carry out its own inspections in accordance with national law.

CHAPTER XI. DATA PROTECTION INCIDENTS

All employees must immediately inform their department manager or the Data Protection Officer of any breach of this Data Protection Policy or other rules concerning personal data protection.

In cases involving:

• improper disclosure of personal data to third parties;
• unauthorized access by third parties to personal data; or
• loss of personal data,

reports required under the organization’s information-security incident reporting and management procedures must be made immediately so that all reporting obligations under national law can be met.

CHAPTER XII. RESPONSIBILITIES AND SANCTIONS

Executive personnel, including department managers, are responsible for data processing within their area of responsibility. They are therefore required to ensure compliance with the legal data protection requirements and with the requirements contained in the Personal Data Protection Policy.

Management personnel are responsible for ensuring the organizational, technical and human-resources measures necessary for all data processing to be carried out in accordance with data protection requirements. Compliance with these requirements is the responsibility of every relevant employee.

If the supervisory authority carries out a data protection inspection, the Data Protection Officer must be informed immediately.

The Data Protection Officer is the contact person identified on www.aiforum.ro for matters relating to data protection. The Data Protection Officer may carry out checks and must familiarize employees with the content of the data protection policies. Relevant management support must be provided to the Data Protection Officer in carrying out these duties.

Departments responsible for business processes and projects must inform the Data Protection Officer in due time of any new processing of personal data. For processing operations that may present particular risks to the individual rights of data subjects, the Data Protection Officer must be informed before the processing begins. This applies in particular to highly sensitive personal data.

Improper processing of personal data or other breaches of data protection laws shall result in the sanctions provided for by internal regulations, Regulation (EU) 2016/679 and applicable law.

CHAPTER XIII. DATA PROTECTION OFFICER

The Data Protection Officer, acting independently in the performance of their professional duties, works to ensure compliance with national and international data protection regulations. The Data Protection Officer is responsible for the Data Protection Policy and supervises compliance with it.

Department managers must promptly inform the Data Protection Officer of any personal data protection risks that arise.

Any data subject may contact the Data Protection Officer at any time to ask questions, request information or submit complaints concerning data protection or personal data security matters. Where requests or complaints are submitted, they shall be handled confidentially.

If the Data Protection Officer is unable to resolve a complaint or remedy a breach of the Data Protection Policy, advice shall be sought from the competent supervisory authority.

Decisions taken by the Data Protection Officer to remedy data protection breaches must be supported by the organization’s management. Investigations and inspections carried out by the supervisory authority must always be reported to the organization’s management.