Introduction

ELEVEN ACCESS INTERNATIONAL SERVICES SRL (“ELEVEN ACCESS”, the “Company”, “we”, “our”) is committed to protecting personal data and ensuring transparency regarding how personal information is collected, used, stored, disclosed and otherwise processed.

This Personal Data Privacy Policy (“Policy”) describes how ELEVEN ACCESS processes personal data in accordance with Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR) and any other applicable data protection legislation.

This Policy applies to the personal data of:

• website visitors;
• employees and former employees;
• job applicants and candidates;
• clients and their representatives or employees;
• suppliers, subcontractors, carriers and other business partners and their representatives or employees;
• individuals whose personal data is provided to ELEVEN ACCESS in connection with the services performed by the Company.

This Policy may also be used as a general data protection framework for internal compliance and external transparency purposes.

Data Controller

The controller responsible for the processing of personal data is:

ELEVEN ACCESS INTERNATIONAL SERVICES SRL
Romania

For any questions regarding personal data processing or for the exercise of data protection rights, individuals may contact us at:

Email: dpo@elevenaccess.com

ELEVEN ACCESS has assessed the legal requirements applicable to its activities and currently is not required to appoint a statutory Data Protection Officer. However, the Company uses the above contact address as its dedicated privacy contact point.

Terminology

For the purposes of this Policy, the following definitions apply:

“Employee(s)” means any individual who is or has been employed by ELEVEN ACCESS, or who applies for employment with ELEVEN ACCESS, including administrative staff, temporary staff, volunteers, interns, self-employed collaborators, persons working under collaboration agreements, and legal representatives where applicable.

“Personal data” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

“Sensitive personal data” / “special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction.

“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Filing system” means any structured set of personal data which is accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.

“Controller” means the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

“Recipient” means a natural or legal person, public authority, agency or another body to which personal data are disclosed, whether a third party or not. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with law shall not be regarded as recipients.

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person, such as facial images or fingerprint data.

“Representative” means a natural or legal person established in the Union who, designated by the controller or processor pursuant to Article 27 GDPR, represents the controller or processor with regard to their respective obligations under the GDPR.

“International organization” means an organization and its subordinate bodies governed by public international law, or any other body set up by, or on the basis of, an agreement between two or more countries.

Abbreviations Used

DPO – Data Protection Officer
GDPR – General Data Protection Regulation, Regulation (EU) 2016/679
EEA – European Economic Area
EU – European Union

Objective of the Policy

This Policy aims to provide a general framework for ensuring an appropriate level of protection for the personal data processed by ELEVEN ACCESS.

In particular, this Policy is intended to ensure that ELEVEN ACCESS:

• complies with applicable data protection legislation, including GDPR;
• protects the rights and freedoms of individuals whose personal data is processed;
• ensures transparency regarding the collection, use, storage and disclosure of personal data;
• implements adequate technical and organizational measures to prevent unauthorized access, disclosure, loss, misuse or unlawful processing of personal data;
• reduces compliance, reputational and operational risks related to the processing of personal data.

All personnel who have access to personal data are required to process such data in accordance with this Policy and with applicable law.

Scope of Application

This Policy is mandatory for:

• all ELEVEN ACCESS employees;
• contractors, suppliers, clients, subcontractors and their employees or representatives, where they process data on behalf of or in connection with ELEVEN ACCESS;
• all persons who have access to personal data processed by ELEVEN ACCESS in the context of its business activities.

This Policy covers, without limitation, the processing of personal data relating to:

• employees and former employees;
• job applicants and candidates;
• clients and customer representatives;
• suppliers, subcontractors, carriers and business partners;
• representatives of public authorities;
• website users and persons submitting inquiries through the website.

Categories of Personal Data We Collect

Depending on the relationship with ELEVEN ACCESS, the Company may collect and process the following categories of personal data:

7.1 Website visitors

When individuals visit our website, we may collect:

• IP address;
• browser type and version;
• device information;
• operating system;
• cookies and similar tracking data;
• browsing activity and website usage information.

7.2 Clients and business partners

For contractual and business relationship purposes, we may collect:

• name and surname;
• company name;
• job title or position;
• email address;
• telephone number;
• business address;
• billing and contractual information;
• signature and related transactional records.

7.3 Recruitment and job applicants

If an individual applies for a position with ELEVEN ACCESS, we may collect:

• name and surname;
• contact details, including email address and phone number;
• CV/resume and employment history;
• education, qualifications and certifications;
• driving licences or professional permits where relevant;
• references and recommendations;
• interview notes and recruitment assessment information;
• any other information voluntarily provided for recruitment purposes.

7.4 Employees

Employee data may include, without limitation:

• identification data (name, surname, address, date of birth, ID/passport details, personal identification number where required by law, photos);
• marital or family-related information where legally necessary;
• education records, diplomas, certificates, licences, visas or residence permits;
• employment history, recruitment records, evaluations, promotions, disciplinary records, attendance or absence records;
• payroll, tax, insurance and pension-related information;
• bank account/IBAN details;
• business email usage and company communication records where permitted by law and required for legitimate business or compliance purposes;
• work-related logs, access records or security-related information relevant to Company operations.

7.5 Project-related access data

In connection with specific projects, including restricted-access or military-related locations, ELEVEN ACCESS may process personal data required for access authorization, such as:

• full name;
• date of birth;
• ID/passport details;
• nationality;
• vehicle details where applicable;
• professional qualification or role;
• any additional information required by the contracting authority, legal obligations or site-access rules.

Purpose of Processing Personal Data

ELEVEN ACCESS processes personal data for one or more of the following purposes:

• management of employment and collaboration relationships;
• recruitment and candidate evaluation;
• conclusion and performance of contracts with clients, suppliers and business partners;
• provision of transportation, recruitment, manpower, logistics and related services;
• handling inquiries submitted through the website or other communication channels;
• compliance with legal, regulatory, tax, labour, accounting and contractual obligations;
• access control and security requirements related to projects, sites, bases or restricted locations;
• protection of Company assets, systems and operations;
• administration of the website and improvement of its functionality and performance;
• direct marketing or business communications, where legally permitted and, where required, based on consent;
• establishment, exercise or defence of legal claims.

Legal Basis for Processing

ELEVEN ACCESS processes personal data on one or more of the following legal grounds:

• the processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract;
• the processing is necessary for compliance with a legal obligation to which ELEVEN ACCESS is subject;
• the processing is necessary for the purposes of the legitimate interests pursued by ELEVEN ACCESS or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject;
• the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Where processing is based on consent, the data subject has the right to withdraw that consent at any time.

GDPR Principles Applied by ELEVEN ACCESS

ELEVEN ACCESS is committed to complying with the GDPR principles, namely:

10.1 Lawfulness, fairness and transparency

Personal data shall be processed lawfully, fairly and in a transparent manner. ELEVEN ACCESS will ensure that individuals are informed in a clear and accessible way about how their data is processed.

10.2 Purpose limitation

Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

10.3 Data minimization

ELEVEN ACCESS will collect and process only the personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

10.4 Accuracy

ELEVEN ACCESS will take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date. Inaccurate personal data will be corrected or deleted without undue delay.

10.5 Storage limitation

Personal data shall not be kept for longer than necessary for the purposes for which it was collected and processed, except where retention is required by law or justified by legitimate archival or legal reasons.

10.6 Integrity and confidentiality

ELEVEN ACCESS applies appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage.

10.7 Accountability

ELEVEN ACCESS is responsible for, and able to demonstrate, compliance with the GDPR principles.

Special Categories of Personal Data

ELEVEN ACCESS does not intentionally collect or process special categories of personal data unless such processing is lawful and strictly necessary.

Where applicable, special categories of personal data may be processed only if:

• the data subject has given explicit consent, where such consent is legally valid;
• processing is necessary for carrying out obligations and exercising specific rights in the field of employment, social security or social protection law;
• processing is necessary for the establishment, exercise or defence of legal claims;
• processing is required for reasons of substantial public interest under applicable law;
• the data has manifestly been made public by the data subject;
• another legal basis under Article 9 GDPR applies.

Consent

Where processing is based on consent, ELEVEN ACCESS will ensure that consent is:

• freely given;
• specific;
• informed;
• unambiguous;
• capable of being demonstrated.

Individuals will be informed about:

• the identity of the controller;
• the purpose of processing;
• the categories of data processed;
• the right to withdraw consent;
• any applicable automated decision-making;
• any relevant risks related to international data transfers, where applicable.

ELEVEN ACCESS will keep records where necessary to demonstrate that valid consent has been obtained.

Consent may be withdrawn at any time by contacting:

dpo@elevenaccess.com

Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Direct Marketing

ELEVEN ACCESS may send direct marketing or business communication messages only where permitted by applicable law and, where required, on the basis of valid consent.

Individuals may object to direct marketing communications or withdraw their prior consent at any time. Once such a request is received, ELEVEN ACCESS will stop sending direct marketing communications to that individual, unless another lawful basis applies.

ELEVEN ACCESS does not sell personal data to third parties for direct marketing purposes.

Data Sharing

Personal data may be shared, where necessary and lawful, with:

• employees and authorized personnel of ELEVEN ACCESS;
• clients, project partners and contracting entities, where required for service delivery or contractual compliance;
• suppliers, subcontractors, carriers and other business partners involved in the performance of services;
• recruitment partners or hiring-related service providers;
• IT service providers, software providers, hosting providers and cloud storage providers;
• accountants, auditors, legal advisors and other professional advisers;
• public authorities, regulators, courts or law enforcement bodies where required by law or for the protection of legal rights.

All third parties processing data on behalf of ELEVEN ACCESS are required to respect confidentiality and comply with applicable data protection laws.

International Transfers

In certain circumstances, personal data may be transferred outside the EEA.

Where such transfers occur, ELEVEN ACCESS will ensure that appropriate safeguards are in place, including, where applicable:

• transfer to countries recognized by the European Commission as providing an adequate level of protection;
• Standard Contractual Clauses approved by the European Commission;
• other lawful transfer mechanisms available under GDPR.

Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal, contractual or regulatory obligations.

Indicative retention periods may include:

• recruitment data: up to 12 months after completion of the recruitment process, unless a longer period is justified or consented to;
• employee and HR data: for the duration of employment and thereafter in accordance with labour, tax and archival requirements;
• contractual and accounting data: 5 to 10 years, depending on legal requirements;
• marketing-related data: until consent is withdrawn or objection is raised;
• project access and compliance records: for the period required by the relevant contractual, legal or security framework.

At the end of the applicable retention period, personal data will be securely deleted, destroyed or anonymized.

Data Security

ELEVEN ACCESS implements appropriate technical and organizational measures to ensure the security of personal data, including protection against unauthorized access, disclosure, alteration, loss, destruction or misuse.

Such measures may include:

• restricted access based on job role and need-to-know basis;
• password protection and access controls;
• secure IT infrastructure and software systems;
• encrypted transmission where appropriate;
• confidentiality obligations for employees and contractors;
• secure storage of physical documents;
• internal procedures for incident reporting and breach response;
• staff awareness and training on data protection.

Employees and authorized personnel must:

• access only the personal data necessary for their duties;
• not disclose personal data to unauthorized persons;
• keep passwords confidential;
• secure computers and offices when unattended;
• report suspected security incidents without delay.

In the event of a personal data breach, ELEVEN ACCESS will assess the incident and notify the competent authority and/or affected individuals where required by law.

Personal Data Accuracy

ELEVEN ACCESS will take reasonable steps to ensure that personal data is accurate, complete and up to date.

All persons involved in processing personal data must take appropriate measures to correct inaccuracies as soon as they are identified.

Where feasible, personal data shall be stored in as few locations as possible in order to reduce duplication and inconsistency.

Notification and Transparency

ELEVEN ACCESS provides information to individuals about the processing of their personal data through this Policy, recruitment notices, contractual documentation, website notices, email communications and other appropriate means.

Where personal data is not collected directly from the data subject, ELEVEN ACCESS will provide the required information within a reasonable period, and at the latest within one month, unless an exception permitted by law applies.

Recruitment Privacy Notice

If an individual applies for a job with ELEVEN ACCESS, the personal data provided will be used exclusively for recruitment-related purposes, including:

• reviewing the application;
• contacting the candidate;
• evaluating qualifications and suitability for available positions;
• conducting interviews and recruitment assessments;
• keeping records of the recruitment process.

If the application is unsuccessful, the candidate’s data may be retained for future opportunities for a period of up to 12 months, unless the candidate requests earlier deletion or unless longer retention is justified under applicable law.

Candidates should avoid providing unnecessary sensitive personal data unless specifically requested and legally justified.

Cookies and Website Tracking

Our website may use cookies and similar technologies to:

• ensure proper website functionality;
• improve performance and user experience;
• analyze website traffic and visitor interaction;
• maintain security and website administration.

Further details may be provided in a separate Cookie Policy available on the website.

Responsibilities

All ELEVEN ACCESS personnel involved in the collection, use, storage or disclosure of personal data are responsible for complying with this Policy.

Management is responsible for:

• reviewing and maintaining this Policy periodically;
• ensuring appropriate reporting and oversight mechanisms;
• supporting the implementation of technical and organizational data protection measures;
• ensuring adequate training and awareness;
• ensuring that business operations involving personal data are conducted in accordance with GDPR and internal procedures.

Rights of Individuals

Under GDPR, individuals have the following rights, subject to applicable legal limitations:

23.1 Right to be informed

Individuals have the right to be informed about how their personal data is collected and used.

23.2 Right of access

Individuals have the right to obtain confirmation as to whether their personal data is being processed and, where that is the case, access to the data and related information.

23.3 Right to rectification

Individuals have the right to request correction of inaccurate or incomplete personal data.

23.4 Right to erasure

Individuals have the right to request deletion of their personal data in certain circumstances, including where the data is no longer necessary, consent has been withdrawn and no other legal basis applies, or the processing was unlawful.

23.5 Right to restriction of processing

Individuals may request the restriction of processing in certain situations, such as where the accuracy of the data is contested or the processing is unlawful but erasure is not requested.

23.6 Right to data portability

Where applicable, individuals have the right to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

23.7 Right to object

Individuals may object to processing based on legitimate interests, including direct marketing.

23.8 Right not to be subject to automated decision-making

Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where permitted by law.

23.9 Right to withdraw consent

Where processing is based on consent, individuals may withdraw that consent at any time.

23.10 Right to lodge a complaint

Individuals have the right to lodge a complaint with the competent supervisory authority, including the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

Requests relating to personal data rights may be submitted to:

dpo@elevenaccess.com

Updates to this Policy

ELEVEN ACCESS may update this Policy from time to time in order to reflect legal, regulatory, operational or organizational changes.

The latest version of this Policy will be made available on the Company’s website and may also be communicated internally or to relevant business partners where appropriate.

Contact

For any questions regarding this Policy, the processing of personal data, or the exercise of GDPR rights, please contact:

ELEVEN ACCESS INTERNATIONAL SERVICES SRL
Email: dpo@elevenaccess.com