Last updated: SEPTEMBER, 2024
Within NOA RESTO CLUB and while accessing the website www.noarestoclub.ro (the “Controller”), your privacy is one of our fundamental commitments, and therefore, we take utmost care to process your personal data in accordance with the principles set forth in the applicable legislation, including without limitation the General Data Protection Regulation no. 679/2016 (“GDPR”). The Controller recognize the importance of maintaining the confidentiality, integrity and security of your personal information ("Personal Data") and have written this privacy policy (“Policy”) to explain how your Personal Data is collected, stored, used and disclosed by TOMCAT COMSERV SRL, a company incorporated under the Romanian law, having its headquarters at Movilei no. 3 Street, Bragadiru, Ilfov County ("Company", "Us" or the “Controller”), as a data Controller, with respect to the access to, and use of our website available at the URL noarestoclub.ro („Site”) and the access to, and use of the content of the Site including of the services provided by the Company (“Services”).
Each time we are required by the applicable law or, otherwise, want to use this legal basis, we will request your free, informed, specific and unequivocal consent for the processing of your Personal Data. By expressing your consent, you agree that we can collect, use, reveal, process and transfer your Personal Data in accordance with this Policy. We reserve the right to amend the provisions of this Policy from time to time. If we make changes to this Policy, we will make the updated version available on the Site and we will update the "Last updated” date. We will also inform you on the changes that have occurred, to ensure that you are aware of how we use your Personal Data. Any amendments to this Policy will apply on the date that they are made, with the exception of changes which require your prior consent, and which will apply as of the moment when you express such consent. For the avoidance of any doubt, we are not obliged to inform you, by using the contact details associated with your account on the Site, in respect to any and all of the changes to this Policy.
1. CATEGORIES OF PERSONAL DATA, PURPOSES OF PROCESSING, AND LEGAL GROUNDS
1.1 Contact
You can contact us in different ways: by support form, by mail, by telephone, or by using our chat.
In this case, in general, we will process the following Personal Data: first name, last name, telephone number, email and any other information you voluntarily provide when you contact us, depending on the topic of the chat, such as personal data resulting from the questions regarding our portfolio of locations that you may raise or any other subject of interest.
When you contact us by using our chat, we might also process your Personal Data included in your Site profile.
| Purpose of Processing | Legal Ground |
|---|---|
| In this situation, we will use your Personal Data only to contact you in connection with the requested offer or in connection with the resolution of the problem. |
Processing is necessary for compliance with a legal obligation to which the controller is subject –
providing an answer/feedback in relation with a customer/visitor of the website (art. 6 para. 1, let. c
GDPR);
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, let. b GDPR); |
1.2. Marketing messages - Newsletter
You can opt in to receive marketing messages via email.
| Purpose of Processing | Legal Ground |
|---|---|
| If you opt to receive such marketing messages and you provide us your e-mail address, we will use your e-mail address to send you marketing messages about our activities and promotions.At the same time, we shall process your name and surname whether your e-mail address contains such personal data, solely in relation with the e-mail address. |
Processing is necessary for compliance with a legal obligation to which the controller is subject –
providing an answer/feedback in relation with a customer/visitor of the website (art. 6 para. 1, let. c
GDPR);
Your consent. (art. 6 para. 1, let. a GDPR). |
You can revoke your prior consent at all times and without any costs, with altering consequences for the future.
1.3. BOOKING
Personal data collected when filling in the reservation form to book a table shall be processed for:
- in order for the Controller to be able to make the reservation on a certain person’s name and manage it afterwards
- in order to confirm the reservation by phone or email
- in order to ask details regarding the meals and drinks (such as potential allergies, foond and beverage preferences, number of persons at the table, special sitting etc.)
- in order for the Controller to be able to receive feedback afterwards.
| Purpose of Processing | Legal Ground |
|---|---|
| The personal data requested within the booking process shall be processed within the performance of the proceeding required for booking, in order to fulfill the requests submitted. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, let. b GDPR); |
1.4. CARREERS - RECRUITMENT
When you contact us for employment purposes, we will generally request the following personal data: your name, surname, e-mail address, age, date of birth and any other relevant personal resulting from your CV.
| Purpose of Processing | Legal Ground |
|---|---|
| The personal data requested within the recruitment process shall be processed within the necessary recruitment stages – interview, evaluation, employment. The personal data processed within the Labour Contract are regulated by internal registers of the Company. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6 para. 1, let. b GDPR); |
1.5. Analytical data
When using our Site, we process certain information regarding your activity in order to analyze the use of our Site. Such information includes, for example, your navigation, your IP or your geolocation.
This information is not collected in order to be associated to identified persons. However, insofar such information leads to the identification of a user, the provisions of this Policy shall become applicable.
| Purpose of Processing | Legal Ground |
|---|---|
| We use this data for the sole purpose of obtaining anonymous statistical information concerning the use of the Site. | Our legitimate interest in the improvement of our Site (art. 6 para. 1, let. f GDPR); |
1.6. Sensitive personal data
We do not collect any Sensitive Personal Data about you. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not collect any information about criminal convictions and offenses.
Where we are required to collect personal data by law, or under the terms of the contract between us and you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver goods or services to you). If you don’t provide us with the requested data, we may have to cancel a product or service you have ordered but if we do, we will notify you at the time.
We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. For more information on this please email us at noa@tomcathospitality.com In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.
We may process your personal data without your knowledge or consent where this is required or permitted by law. We do not carry out automated decision making or any type of automated profiling.
2. FAILURE TO PROVIDE PERSONAL DATA
You may refuse to provide certain Personal Data (indicated above) but, in such a case, you may not be able to benefit from certain Site services and features, including, but not limited to, Contact or Career Sections of the website.
3. PROCESSING PERSONAL DATA BASED ON OUR LEGITIMATE INTEREST
When we process on the lawful basis of legitimate interest, we apply the following tests to determine whether it is appropriate:
- The purpose test – is there a legitimate interest behind the processing?
- Necessity test – is the processing necessary for that purpose?
- Balancing test – is the legitimate interest overridden, or not, by the individual’s interests, rights or freedoms?
For more information on how we process the Personal Data on the lawful basis of legitimate interest, please contact us at noa@tomcathospitality.com
4. AUTOMATIC PROCESSING OF PERSONAL DATA
Your Personal Data will not be processed for taking decisions based solely on automatic processing that would result in legal effects concerning you or could similarly significantly affect you.
5. STORAGE PERIOD
As a rule, we will process your Personal Data within the required timeframe relevant for the purposes of the processing.
Personal Data collected based on your consent will be processed until the date of withdrawal of the consent.
In certain circumstances, we may retain your Personal Data for longer periods of time, for example if we are obliged to do so in accordance with the legal, regulatory, tax or accounting requirements.
We may also keep your Personal Data for longer periods of time so that we have accurate records of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your Personal Data or dealings.
6. TRANSFER OF PERSONAL DATA
Your Personal Data is filed and stored on the servers of our contractual partners that are helping us to provide our services to you.
We may transfer Personal Data, as far as necessary, to the following categories of recipients:
- contractual partners;
- subcontractors;
- payment processors;
- insurance companies;
- companies offering IT services;
- software or hardware vendors;
- market research companies;
- marketing companies;
- public authorities, courts of law or arbitral tribunals, and authorities competent to investigate criminal offence.
These recipients can be located in the European Union and/or in the European Economic Area.
7. SECURITY
The security of your Personal Data is important to us. Your Personal Data will therefore be processed by applying reasonable technical and organizational measures to protect Personal Data, such as limiting access to Personal Data, encryption or anonymization of Personal Data, storage on secure environments. However, despite our efforts, we cannot always guarantee the effectiveness of the security measures implemented, and therefore we cannot guarantee the security of Personal Data at any time.
8. RIGHTS IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA
8.1 Your rights
You have the following rights in connection with the processing of your Personal Data:
Access right: You have the right to obtain from us confirmation that your Personal Data is processed by us, as well as information on the specific processing, such as: the purposes of processing, categories of processed Personal Data, recipients of Personal Data, the period for which Personal Data is stored, if we transfer the Personal Data abroad and how we protect it, your rights, the right to lodge a complaint before the supervisory authority, the source of your Personal Data.
Right to rectification: You have the possibility to request rectification of your Personal Data, provided that the applicable legal requirements are met. In the event of errors, after notification, we will immediately correct your Personal Data.
Right to erasure: In certain cases, you have the possibility to request the deletion of Personal Data, namely when: (i) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent on which the processing is based and there is no other legal ground for the processing; (iii) you exercise the right to object to the processing; (iv) the Personal Data have been unlawfully processed. We are not obliged to comply with your request when the processing is necessary (among others) for compliance with a legal obligation or for the establishment, exercise or defense of legal claims. There are also other circumstances in which we are not obliged to comply with this request for the deletion of Personal Data.
Restriction of processing: You may request us to restrict the processing of your Personal Data in the following circumstances: (i) you contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy of the Personal Data; (ii) the processing is unlawful and then you oppose to the erasure of the Personal Data and request the restriction of their use instead; (iii) we no longer need the Personal Data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; (iv) you have objected to processing, pending the verification whether our legitimate grounds override yours. However, we can continue to process your Personal Data (i) when you consent; (ii) for the establishment, exercise or defense of legal claims or (iii) for the protection of the rights of another natural or legal person.
Right to data portability: Insofar the Personal Data is processed based on your consent or on the execution of the agreement and the processing is carried out by automated means, you have the right to have your data Personal Data provided to you in a structured format, which is currently used and can be read automatically and you have the right to request us to transfer this Personal Data to another controller. This right shall not adversely affect the rights and freedoms of others.
Right to opposition: In certain situations, such as when we process your Personal Data on the basis of a legitimate interest for the purpose of sending marketing messages, you have the right to object to the processing of your Personal Data by us. In the event of unjustified objection, the Company is entitled to continue processing Personal Data.
Revocation of consent: Insofar you consented to the processing of your Personal Data, you can at all times revoke your consent, without affecting the lawfulness of processing based on consent before its withdrawal.
Right not to be subject to any automatic individual decisions: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Such right cannot be exercised when the decision: (i) is necessary for entering into, or performance of, a contract between you and us; (ii) is authorized by law which lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or (iii) is based on your explicit consent.
Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with The National Supervisory Authority for Personal Data Processing (“DPA”) in relation to any breach of your rights regarding the processing of your Personal Data. The contact details of the DPA are: 28-30 Gheorghe Magheru Boulevard, District 1, Postal Code 010336, Bucharest, Romania; e-mail: anspdcp@dataprotection.ro
8.2. How to exercise your rights
To learn more about the manner in which you may exercise the aforementioned rights, please contact us at noa@tomcathospitality.com
Identity verification: We take utmost care of the confidentiality of all Personal Data and we reserve the right to verify your identity if you make a request in relation to your Personal Data
Fees: As a rule, you can exercise your rights free of charge. However, we reserve the right to request a reasonable fee if your claims are manifestly unfounded or excessive, in particular because of their repetitive nature.
Response Time: We make every effort to respond to your request within one month of receiving the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests, in which case we will inform you of any such extension and of the reasons for the delay
9. CONTACT
If you have any questions or concerns about this Policy or its implementation, you may contact us at noa@tomcathospitality.com
