YOUTUBE

BIA HUMAN CAPITAL SOLUTIONS S.R.L

YOUTUBE PERSONAL DATA PROCESSING INFORMATION NOTICE

Effective as of December 15, 2021

In this document you find information on the following topics:

WHO WE ARE
CONTACT INFORMATION
WHAT DATA WE PROCESS ABOUT YOU
HOW WE SHARE INFORMATION
DATA TRANSFERS OUTSIDE THE EUROPEAN UNION
YOUR RIGHTS

WHO WE ARE BIA HUMAN CAPITAL SOLUTIONS S.R.L, headquartered in Bucharest, 61 – 81, Horia Macelariu, Bldg. B, Floor 1, District 1, Unique Registration Code 26715513, tax attribute RO, Trade Register no. J40/3290/2010 (hereinafter referred to as “BIA”, “we” or another similar term).

We collect and process various categories of personal data from you as a Youtube user interacting with posts on our BIA Youtube channel, available at this link https://www.youtube.com/channel/UC6tmwxD-JXFD5IKVZhmGioA ,which, in accordance with the EU General Data Protection Regulation, gives us the quality of data controllers for such data.

Also, as administrators of the Youtube channel, we collect and process various categories of personal data from you as a subscriber to this channel or when you leave comments on videos posted by us.

The protection of your personal data is very important to us. This Personal Data Processing Information Notice describes our practices regarding the collection and use of your personal data as a result of your interaction with posts on our channel. Please read this Information Notice carefully to understand how we process your personal data.

2. CONTACT INFORMATION Please address any data protection questions and any requests to exercise your rights to the following contact information of our Data Protection Officer: dpo@bia.ro. We shall investigate and attempt to resolve any such complaints or claims regarding your rights. If you are not satisfied with the response received, you can also file a complaint with the National Supervisory Authority for the Processing of Personal Data at the contact details listed below in section 6.

3. WHAT DATA WE PROCESS ABOUT YOU We are processing the following personal data on our Youtube channels:

if you subscribe to our YouTube channel or leave a comment on one of the videos posted by us, we have access to your public profile (which includes your username and, if you choose to upload it, the photo associated with your profile) as well as the content and date/time of that comment.
if you interact in another way with the videos posted by us (like, dislike or share), we can view your public profile (which includes your username and, if you choose to upload it, the photo associated with your profile) and your reaction to it.

When you interact with our channel, Google LLC (“Google”) as the owner of the Youtube platform processes certain personal data about you, based on which it provides us with aggregated statistics about the video material posted by us. The data can be combined to provide different conclusions about the performance of our channel (e.g. how many people in Bucharest aged 20-30 liked a video posted by us). This information does not include personal data, but represents anonymous statistics limited to:

time spent watching;
average length of time spent watching;
date of watching;
the number of views;
the number of likes and dislikes of the videos;
the number of comments;
the number of shares;
the number of channel subscribers;
geographical location (regions and countries);
gender (female, male);
age;
traffic source (external or within a playlist);
site of viewing (Youtube channel or view pages or external web pages or applications where Youtube videos are can be viewed embedded)
the type of device used for viewing;
the operating system of the device;
use of the translation function for titles, descriptions or subtitles of videos;
the language in which the subtitles, closed captions, titles or descriptions were viewed;
the average percentage of the video watched;
the traffic source (Youtube website searches, direct hits, unknown sources, video suggestions, external, other Youtube functions, YouTube channel pages, playlist pages, external applications, Google searches, browser functions);
interaction with the Youtube Card functionality (inserting links, images or text)

The above data is processed in our legitimate interest to promote our brand or services, as well as to prove, if necessary, the exchange of comments with you. The data are kept as long as our Youtube page is running. You must understand that all these data, and more, are available at any time to Google, as the owner of the platform (and implicitly the controller of your personal data). For details on Google’s processing, please access https://support.google.com/analytics/answer/9012600. We do not use your data to send you marketing communications unless you expressly opt-in for such communication. Even in such cases, we ensure that you have a simple option to unsubscribe (withdrawal of your consent) at any time, either in the communication itself or by contacting us as indicated in Section 2. Providing personal data is not mandatory, but you must understand that Youtube works in a consistent way for all video channels and all users, so if you interact with our channel (you are also free not to interact with our channel), we may automatically have access to certain data about you as described above.

4. HOW WE SHARE INFORMATION We shall disclose your personal data only for the purposes and to the third parties described below. We shall take appropriate measures to ensure that your personal data are processed, secured and transferred in accordance with the legal requirements in force. For more details, please access the Google policy at https://policies.google.com/privacy?hl=ro.

4.1 Disclosure of data to third parties We shall share the necessary part of your personal data only to the extent necessary and only to the following categories of third parties: (a) Google, which is a data controller associated with your data; (b) Third party entities that may administer the page (e.g. marketing agencies); (c) Other entities such as public authorities and institutions, accountants, auditors, lawyers and other external professional advisors, if their work requires knowledge of this data or if the law requires us to disclose it; (d) companies offering us products and services (processors), such as IT systems providers and related support service providers, telecommunications service providers, backup and disaster recovery, computer security services.

We shall also disclose your personal information to third parties: (a) If you request it or give us consent to do so; (b) To persons who can demonstrate that they have the legal authority to act on your behalf; (c) If the page is transferred, which may take place in our legitimate interest in expanding or developing our business, such as: (i) in the event of an enterprise transfer (we sell part of the activity or certain goods) related to the page you are following, the buyer will take over the page and your data; (ii) if BIA (or a substantial part of its assets) is acquired by a third party, in which case our Google pages will constitute one of the assets transferred; (d) if we are required to disclose your personal data in order to comply with a legal obligation, any legal request from governmental or executive authorities, and as may become necessary to meet certain national security or law enforcement requirements or to prevent certain illegal activities; (e) to respond to any claims, to protect our rights or those of third parties, to protect the safety of any person or to prevent any illegal activity; or (f) to protect the rights, property or safety of BIA, its employees, customers, suppliers or others.

Google may also disclose your data to third parties without our involvement or control. For more details, please access the Google policy https://www.facebook.com/privacy/explanation.

Some of these recipients may use your data in countries outside the European Economic Area. Please see section 5 below for more details on this topic.

4.2 Restrictions regarding the use of personal data by recipients Third parties to whom we provide your personal data as specified above are limited (by law and contract) as to how they may use your personal information for the specific purposes identified by us. We shall always ensure that any third parties with whom we choose to share your personal data are subject to privacy and security obligations in accordance with this notice and the applicable law. However, to avoid any doubts, this provision is not applicable if disclosure is not our decision, including the processing carried out by Google. Except as detailed above, we shall not disclose any of your personal data to any third party without notifying you.

5. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION As a general rule, your data are not transferred by us to recipients outside the European Union. However, if this happens, we shall take appropriate measures to ensure that the recipient protects your personal information adequately, such as the conclusion of standard contractual clauses approved by the European Commission, and we shall update this information notice.

Google may also transfer your data outside the European Union. Please consult the Google policy on this matter.

6. YOUR RIGHTS As a data subject, you have specific legal rights related to the personal data we collect from you. BIA shall observe your rights and respond appropriately to your requests.

Although we are controllers associated with Google, there is no really joint data processing between us and Google, so we can only handle your requests in connection with our own processing. If you wish to exercise any of your rights in connection with Google, please contact Google as indicated in its policy.

(a) Right to withdraw consent: If you have given your consent to the processing of your personal data, you can withdraw it at any time.

(b) Right of access: You can request information about the personal data we have about you, including information relating to the categories of data we store or control, what they are used for, the source where we collected them, if we have obtained them indirectly and to whom they are disclosed, if at all. We shall provide you with a copy of your personal data upon request. If you request multiple copies of your personal data, we may charge you a reasonable fee based on administrative costs. You have the right to information about our safeguards for the transfer of your personal data to a country outside the EU and the European Economic Area if we transfer your personal data to such a country.

(c) Right to rectification: You can obtain from us the rectification of your personal data that we process. We make reasonable efforts to maintain the personal data in our possession that are continuously used, accurate, complete, up-to-date and relevant, based on the latest information at our disposal.

(d) Right to restriction: You can obtain from us the restriction of your personal data processing if: i) you challenge the accuracy of your personal data for a period that enables us to verify the accuracy of the personal data, ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead, iii) we no longer need your personal data but you require them to establish, exercise or defend legal claims, or iv) you object to the processing while we verify whether our legitimate grounds override yours.

(e) Right to portability: You have the right to receive your personal data that you have provided to us, and if it is technically feasible, to request that we transmit your personal data (which you have provided us) to another organisation. These two rights are rights that you have if, cumulatively: We process your personal data by automated means, We rely, in the processing of your personal data, on your consent or our processing of your personal data is necessary for the conclusion or performance of a contract to which you are a party; the transmission of your personal data shall not adversely affect the rights and freedoms of others.

(f) Right to erasure: You have the right to request that we erase the personal data we process about you. We must comply with this request if we process your personal data, unless the data are necessary: to exercise the right of freedom of expression and information; to comply with a legal obligation that we have; for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes; or to establish, exercise or defend legal claims.

(g) Right to object: You may object at any time to the processing of your personal data for reasons relating to your particular situation, provided the processing is not based on your consent but on our legitimate grounds or those of a third party. In this case, we shall no longer process your personal data unless (i) we can demonstrate compelling legitimate grounds justifying the processing and overriding your interests, rights and freedoms, or (ii) or the establishment, exercise or defence of legal claims. If you object to the processing, please specify whether you also want your personal data to be erased, otherwise we will only restrict them. You can object at any time to the processing of your personal data for direct marketing purposes based on our legitimate interest, regardless of your reasons. If the marketing was based on your consent, you can withdraw your consent.

We shall try to fulfil your request within 30 days. This period may be extended for specific reasons related to specific legal rights or the complexity of your request. In any case, if this period is extended, we will inform you of the extension period and the reasons for the extension. Restriction of access: In certain situations, we may not be able to grant you access to all or part of your personal data due to legal restrictions. If we refuse your request for access, we will inform you of the reason of this refusal. Failure to identify: In some cases, we may not be able to identify your personal data due to the identification elements you provide us in the request. In such cases, if we cannot identify you as a data subject, we cannot act on your request under this section unless you provide us with additional information to allow us to identify you. We shall inform you and give you the opportunity to provide us with such further details. Exercising your rights: To exercise your rights, please contact us in writing (including electronically) at the contact details provided in section 2 above.

h) Right to lodge a complaint. If you have a complaint about the way we process your data, we would prefer that you contact us directly so that we can solve your problem. However, you can contact the National Supervisory Authority for the Processing of Personal Data through their website (www.dataprotection.ro), or you can write to: Name: Address: Phones: Fax: Email: National Supervisory Authority for the Processing of Personal Data B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania +40.318.059.211 +40.318.059.212 +40.318.059.602 anspdcp@dataprotection.ro