1. General Information
A3 Biometric Connections SRL („A3BC”) with its headquarters in Romania, Bucharest, Boulevard Primaverii, No. 57, Office No. 10, Ap. P1 registered under Trade Registry Number J40/26900/2018, Unique Code of Registration 40209589, in its capacity as data controller, collects and processes your personal data that you provide directly, for the authentification in connection with your voluntary use of A3BC hardware related to payment services, as provided in the contract concluded between you and A3BC.

2. The processing purposes and grounds
Your personal data is collected and processed for the following purposes as based on the following ground:

2.1. With your consent, in accordance with Art. 6, para. (1), letter (a) in correlation with Art. 9, para. (2), letter (a) of General Data Protection Regulation (“GDPR”), for the following purposes: collecting and processing the biometric data for the payment services provided by A3BC in accordance with the contract concluded between you and A3BC.

2.2. For the contract performance, in accordance with Art. 6, para (1), letter (b), for the following purposes: execution of the contract concluded between you and A3BC, performance of the payment services.

2.3. In order to fulfil the legal obligations, in accordance with Art. 6, para (1), letter (c), for the following purposes: compliance with KYC legal requirements, combating money laundering and financing terrorism, avoiding fraud, ensuring the necessary security measures for the protection of personal data, including by implementing solutions of prevention of the unauthorized access to these data and information.

2.4. In order to accomplish the legitimate interests of A3BC, in accordance with Art. 6, para (1), letter (f), for complying with internal rules and policies, ensuring the proper functioning of the service, collecting feedback from the customers and improving the services based on feedback received.

3. Categories of personal data
A3BC collects and processes the following personal data: information contained in the National Identification Card/Passport (personal numeric code, citizenship, gender, name, first name, birth date, ID document type, ID document number, home address), e-mail address, mobile phone number, payment details and biometric data such as fingerprint and finger vein, as well as any other categories of data that you provide to us directly. Biometric data processed by A3BC will only be used for the core activity, meaning the authentication in connection with your voluntary use of A3BC hardware related to payment services, as provided in the contract concluded between you and A3BC. The personal data processed by A3BC are either provided directly by you, or are derived by A3BC based on the data processing received from you. The derived data will not involve your biometric data.

4. Disclosure of the personal data
In order to achieve the aforementioned purposes or facilitate/conduct certain commercial relations, A3BC will disclose your personal data to the following categories of recipients: central/local public authorities, as well as any other persons or entities to whom the disclosure is requested by you.

5. The personal data transfer
In the context of the envisaged purposes, your personal data will only be stored in Romania.

6. Providing the personal data
The provision of the personal data by you is necessary for both concluding the contract for payment services and afterwards for managing the contractual relations and to fulfil the payment. Moreover, such data are necessary for the fulfilment of the legal obligations incumbent upon A3BC in its capacity as controller.

7. The duration of the processing
Personal data are stored for processing during the contractual relation and afterwards, as required by the internal policies of A3BC and in compliance with the legal requirements, including, but without limitation to, keeping for a duration of 10 (ten) years accounting documents (e.g., accounting registers) the archiving-related requirements.

8. Your rights
Your rights related to the data processing are as follows:
• the right to be informed, namely the right to receive details on the processing activities carried out by A3BC, as described herein;
• the right of access the data, namely the right to obtain the confirmation from A3BC concerning the personal data processing and details on the processing activities;
• the right to rectification, namely the right to obtain rectification by A3BC of the inaccurate data and supplement the incomplete data;
• the right to erase the data (“right to be forgotten”), to the extent the legal conditions are met – however, following the data erasure request, A3BC reserves the right to make said data anonymous (by depriving them from the personal nature).
• the right to restrict the processing to the extent the legal conditions are met;
• the right to data portability, namely (i) the right to receive the personal data in a structured, commonly used and machine-readable format , and (ii) the right to request that the data are sent by A3BC to another data controller, to the extent the legal conditions are duly met;
• the right to object, for good reasons and under the conditions provided by the law, to the future processing of the data;
• the right not to be subject to an automated individual decision, including profiling, which produces legal effects concerning the data subject or a similarly affects it in a significant way, made only based on automated processing activities
• the right to withdraw your consent at any time for the processing activities performed by A3BC. In such a case, the processing activity will be affected only for the future; and
• the right to address the National Authority for Supervising the Processing of Personal Data or the relevant courts of law, to the extent you consider necessary. For any questions related to the processing of your personal data (including concerning the manner in which you can exercise the rights above), please contact the Data Protection Officer at a3bc.dpo@a3bc.org We will periodically update the present Privacy Notice and we will keep you informed on such updates through email.