{# seconds timestamp #}

Politica de confidențialitate

PRIVACY POLICY REGARDIND PROCESSING OF PERSONAL DATA

CREDIDAM or the "Data Controller", is committed to ensuring the protection of personal data and safeguarding the right to privacy in accordance with Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation – GDPR), as well as the applicable national legislation.

Should you have any questions, concerns or requests regarding this Privacy Policy or the way CREDIDAM processes your personal data, we encourage you to contact us using the following contact details:

Data Controller	CREDIDAM
Registered Address	34 C.A. Rosetti Street, Sector 2, Postal Code 020015, Bucharest, Romania
Data Protection Officer – e-mail address	dpo@credidam.ro

This Privacy Policy is intended to inform you of the purposes for which CREDIDAM processes your personal data, the categories of personal data collected, the legal grounds for such processing, and the way your personal data is used and protected. Furthermore, this Privacy Policy explains your rights under the applicable data protection legislation and the way you may exercise those rights.

This Privacy Policy applies to the personal data processing activities carried out by CREDIDAM in the performance of its responsibilities as a collective management organisation, as well as to the processing activities conducted through the online platform available at www.credidam.ro.

I. COLECTION OF PERSONAL DATA

The processing activities described in this Privacy Policy are provided for illustrative purposes only and are not intended to be exhaustive.

CREDIDAM collects personal data primarily directly from data subjects when they interact with the Association through the communication channels made available by CREDIDAM, including telephone, e-mail, online forms, social media platforms, or through direct interactions at CREDIDAM's registered office or at the locations where its activities are carried out.

Personal data may be collected directly in the following situations, including but not limited to:

when you communicate with CREDIDAM by telephone, e-mail, online forms, or through social media platforms;
when you provide personal data required for the conclusion and performance of contracts or agreements (for example, registration as a member, collaborator, or contractual partner);
when you interact with us in your capacity as a CREDIDAM member (performing artist);
when you interact with us in your capacity as a user (legal representative, authorised delegate, or any other authorised representative of a legal entity);
when you use the online platform made available by CREDIDAM;
when you contact CREDIDAM in your capacity as the successor of a performing artist;
when you apply for a vacant position or participate in a recruitment process;
when you visit CREDIDAM's registered office or attend events organised or supported by CREDIDAM;
when you act as a representative of a public authority, a contractual partner, or a supplier of goods or services.

By virtue of its collective rights management activities, CREDIDAM may also obtain personal data indirectly from the following sources:

from a legal representative or authorised agent acting on behalf of the rights holder;
from repertoire declarations and the supporting documentation submitted by other rights holders or producers, where such documentation contains information regarding the performing artists participating in the fixation of the performance;
from reports submitted by users concerning the use of the repertoire, in fulfilment of the obligations established under Law no. 8/1996 on Copyright and Neighboor Rights;
from partner collective management organisations established abroad, pursuant to reciprocal representation agreements and international data exchange arrangements;
from documents submitted for the purpose of resolving discrepancies or disputes concerning the repertoire or the status of a rights holder;
from publicly available sources, to the extent strictly necessary for the identification of rights holders whose performances have been used, for the purpose of allocating and distributing the remuneration to which they are entitled.

CREDIDAM has a legal obligation to ensure the accuracy and updating of the personal data it processes. For this purpose, it may periodically carry out data verification and updating activities and shall rectify or supplement personal data whenever inaccuracies or errors are identified.

The Data Controller processes personal data exclusively on the basis of one of the following legal grounds, which is specifically identified for each processing activity described in this Privacy Policy:

compliance with a legal obligation to which the Data Controller is subject, in particular the obligations imposed on collective management organisations under Law no. 8/1996 on Copyright and Neighboor Rights, as well as obligations arising under tax, accounting, employment, and associations and foundations legislation;
the performance of a contract to which the data subject is a party or the taking of steps at the request of the data subject prior to entering into a contract;
the legitimate interests pursued by the Data Controller, provided that such interests do not override the fundamental rights and freedoms of the data subject;
the data subject's consent, where such consent is requested explicitly and separately.

II.SCOPE OF PROCESSING, CATEGORIES OF PERSONAL DATA, AND APPLICABLE LEGAL BASES

1.CREDIDAM membership registration

Processing activities carried out for this purpose	Receipt, registration, verification and assessment of applications for membership of CREDIDAM; verification that the statutory requirements and the conditions established by CREDIDAM's internal regulations for acquiring membership have been fulfilled; identification of the applicant and validation of the submitted documentation; examination and resolution of the membership application; communication of the decision approving or rejecting the application; registration of the new member in CREDIDAM's records; and performance of all administrative operations necessary for the acquisition and exercise of membership rights.
Categories of personal data	First name, surname, pseudonym (stage name), Personal Numerical Code (CNP), permanent address, residence address, place of birth, e-mail address, telephone number, nationality, artistic profession, image and voice (as contained in the declared artistic performances), date of birth, signature. Repertoire-related data.
Data collected through supporting documentation	Membership Application (Deed of Accession), copy of identity document, IBAN, photograph, proof of payment of the membership fee, declaration regarding social security contributions and income tax, declaration on honour concerning the rules governing the collection and distribution of remuneration.
Legal basis for processing	Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party. Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

2.Repertoire administration and repertoire declarations

Processing activities carried out for this purpose	Receipt, registration and verification of repertoire declarations submitted by performing artists; verification of the documents evidencing participation in the fixation of the artistic performance and the assignment of the rights administered by CREDIDAM; review of audio and audiovisual materials or web links provided for the purpose of determining whether the performance falls within CREDIDAM's scope of activity; validation and updating of the repertoire recorded in CREDIDAM's registers; establishing the correspondence between the declared performances and the reported uses; and resolving discrepancies relating to the declared repertoire.
Categories of personal data	First name, surname, pseudonym (stage name), CREDIDAM membership card number, signature. Performance-related data: title of the phonogram or audiovisual production, type of performance, the capacity in which the performing artist participated, year of fixation, producer, ensemble/orchestra/theatre company/band of which the performing artist is a member. Image and voice, as contained in the audio or audiovisual materials, or accessible through the web links submitted as evidence of the artistic performance.
Data collected through supporting documentation	Repertoire declaration forms, contracts evidencing participation in the fixation of the artistic performance, copies of album cover, audio and audiovisual recordings, or verifiable web links.
Legal basis for processing	Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party. Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

3.Issuance of non-exclusive licences/authorisations

Processing activities carried out for this purpose	Issuance and administration of licences and authorisations for the broadcasting of phonograms embodying performances by performing artists, the use of artistic performances in the audiovisual sector, as well as their use as background music (ambient use) or for commercial purposes.
Categories of personal data	User's legal representative: first name, surname, position, e-mail address, CREDIDAM membership card number (where applicable), telephone number, and signature.
Legal basis for processing	Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

4.Collection of remuneration and processing of usage reports submitted by users

Processing activities carried out for this purpose	Receipt, verification and processing of information and usage reports submitted by users concerning the use of the repertoire administered by CREDIDAM; monitoring the collection of remuneration due; issuing payment documents; maintaining records of outstanding amounts and payments received; and matching the reported uses with the declared artistic performances for the purpose of remuneration distribution.
Categories of personal data	Data relating to users' legal representatives or contact persons: first name, surname, position, telephone number, e-mail address, and signature. Data relating to performing artists contained in usage reports: first name, surname, pseudonym (stage name), artistic performance used, date of use, and duration of use.
Legal basis for processing	Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party. Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

5.Payment of remuneration to CREDIDAM performing artists and their successors

Processing activities carried out for this purpose

Verification and validation of the information and documentation required to establish entitlement to remuneration, including documents evidencing the successor’s status; calculation, allocation and payment of remuneration to CREDIDAM members or, as applicable, to their successors; management of the related financial, accounting and tax records; recording and validation of succession rights; and resolution of any discrepancies concerning the determination and payment of remuneration.

Categories of personal data

Data relating to performing artists: first name, surname, pseudonym (stage name), Personal Numerical Code (CNP), identity document series and number, date of issuance, issuing authority, date of birth, nationality, place of birth, surname before marriage (where applicable), permanent address, residence address, telephone number, e-mail address, artistic profession and the ensemble/orchestra/theatre/ballet company of which the artist is a member, IBAN bank account details, performing artist's signature.

Data relating to successors: successor's first name and surname, Personal Numerical Code (CNP), place of birth, permanent address, nationality, IBAN bank account details, successor's signature.
Information contained in certificates evidencing the successor’s status / inheritance certificates, which may include information regarding the estate, as well as personal data relating to third parties.

Legal basis for processing

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

6.Disclosure of the list of CREDIDAM members

Processing activities carried out for this purpose	Making the list of members available upon users' request, as well as periodically updating such list, to ensure transparency regarding the activities of the collective management organisation and to provide information on the persons holding membership status.
Categories of personal data	First name, surname, pseudonym (stage name), date of acquisition of membership status and, where applicable, the date on which the mandate was revoked/restored. successor's first name and surname.
Legal basis for processing	Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

7.Reporting information held by CREDIDAM

Processing activities carried out for this purpose	Preparation, verification and submission of reports, statements and information to the competent public authorities and institutions, in compliance with the applicable legal obligations, as well as the provision of information requested by such authorities in the exercise of their statutory powers.
Categories of personal data	Identification and contact details of members, successors, users and legal representatives; data relating to membership status, the mandate granted to CREDIDAM, remuneration allocated and paid, and financial, accounting and tax-related data.
Legal basis for processing	Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

8.Management of appointment requests and information requests

Processing activities carried out for this purpose

Receipt, registration, review and handling of appointment requests, requests for legal advice, and requests for information submitted to CREDIDAM by its members.

Categories of personal data

First name, surname, permanent address, CREDIDAM membership card number, telephone number, e-mail address, subject matter of the appointment request, date on which previous requests were submitted (where applicable), and signature.
Information and personal data voluntarily disclosed during such requests.

Legal basis for processing

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

9.Handling and resolution of complaints and requests

Processing activities carried out for this purpose	Registration, review and resolution of applications, requests or complaints submitted by other interested persons through CREDIDAM's communication channels.
Categories of personal data	First name, surname, e-mail address, voice (where communications are made by telephone or voice messages), the content of the application, request or complaint, and any documents accompanying the submitted application or request.
Legal basis for processing	Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

10.Press releases. Information. Cultural Promotion and photo/video materials

Processing activities carried out for this purpose

Preparation and publication of press releases; dissemination of information regarding CREDIDAM's activities and matters of public interest, including information relating to litigation.

Creation, publication and maintenance in the website archive and on CREDIDAM's official video-sharing channel of audio-visual materials and photographs dedicated to performing artists, including interviews, career profiles, presentations of artistic performances, and materials produced as part of campaigns promoting the rights of performing artists.

Taking photographs and making audio-visual recordings during events organised, supported or attended by CREDIDAM, and publishing such materials in the Association's informational and promotional materials.

Publication of materials relating to the artistic activities of performing artists and the cultural events in which they participate, including announcements concerning performances, festivals, exhibitions, premieres, launches and awards.

Publication of anniversary features and commemorative materials dedicated to performing artists.

Receipt and publication of materials provided by performing artists, event organisers or partners involved in cultural projects.

Dissemination of published materials through CREDIDAM's social media pages and its official video-sharing channel.

Categories of personal data

Identification data: first name, surname and, where applicable, pseudonym (stage name).

Date of birth information: date of birth and/or name, where relevant to anniversary publications.

Litigation and legal proceedings data: court, case number, date of the judgment, subject matter of the proceedings, procedural capacity of the individual, judgment rendered, procedural stage, available remedies (appeals), and the period to which the claims relate.

Financial data: amounts awarded by the court, including legal costs, professional fees and, where applicable, amounts claimed as remuneration differentials.

Membership and mandate data: information relating to membership status, the mandate granted to CREDIDAM, and information concerning artistic activities and repertoire, where these form part of the subject matter of the proceedings.

Artistic activity and repertoire data: artistic profession, genre and type of performances, ensemble, orchestra, theatre company or band of which you are a member, information regarding your career, performances, distinctions and cultural events.

Image and voice: photographs and audio-visual recordings depicting you, created by CREDIDAM, provided by you, or obtained from event organisers, as well as photographs and audio-visual recordings made during events in which you participate.

Legal basis for processing

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

Article 6(1)(a) GDPR – processing is based on the data subject's consent.

11.Account registration/log-in for performing artists and users

Processing activities carried out for this purpose

Enabling members to access their dedicated online accounts to view the status of remuneration distributions, submitted playlists and invoices, as well as enabling users to access their dedicated accounts to view licences, authorisations and invoices.

Categories of personal data

Account credentials: username and password.

Representative's data (for users): first name, surname, position, and telephone number.

Legal basis for processing

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

12.Use of social media platforms and content-sharing platforms (YouTube)

Processing activities carried out for this purpose

Accessing and managing CREDIDAM's Facebook page, including users' navigation of the page and the publication of comments on CREDIDAM's posts.

Publishing content relating to CREDIDAM's activities.

Reviewing and, where appropriate, moderating comments, messages and reactions posted by users, including hiding or removing content that violates the platform's rules, applicable law, or the rights of third parties.

Receiving and handling requests submitted through private messages or comments, including redirecting such requests to CREDIDAM's official communication channels.

Reviewing aggregated audience and engagement statistics made available by the platforms in relation to the pages and channel administered by CREDIDAM.

Embedding videos hosted on the YouTube platform into the CREDIDAM website through the video gallery and dedicated web pages.

Categories of personal data

Identification data: first name and surname, or the pseudonym used on the platform, and the account name.

Image: profile photograph and any other public information contained in your profile, as displayed by the relevant platform.

Correspondence and request content: the content of comments, reactions, recommendations and messages submitted, together with the date and time of publication.

Public interaction data: information relating to your interaction with the pages and channel administered by CREDIDAM, including subscriptions to the channel or following the page, to the extent that such information is publicly displayed by the platform; the type of reaction expressed in relation to a post, as made available by the platform, and any likes or similar interactions with video materials.

Technical and browsing data: data relating to access to the pages of the CREDIDAM website on which embedded video content is displayed.

Aggregated audience and engagement statistics: statistical information made available by the platforms in a form that does not permit the identification of individuals.

Legal basis for processing

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

13.Recruitment

Processing activities carried out for this purpose	Receipt, review and assessment of applications submitted by candidates for vacant positions within CREDIDAM; organisation and conduct of the recruitment process, including verification of candidates' eligibility, communication with candidates, scheduling of interviews, and communication of the recruitment outcome to candidates.
Categories of personal data	First name and surname, telephone number and e-mail address. Where you submit your curriculum vitae (CV), we may process personal data including your first name and surname, address, telephone number, e-mail address, information relating to your education, qualifications, certifications and professional experience, photograph (if included in the CV), any other personal data that you voluntarily provide during the recruitment process, the results of any assessments or tests completed as part of the recruitment process, and the recruiter's notes.
Legal basis for processing	Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.

14.Employment relationship management

Processing activities carried out for this purpose

Collection and verification of the documents required for employment (identity documents, educational certificates, medical certificates and supporting documents), execution and signing of the individual employment contract and any addenda thereto, registration and updating of employee data in the General Register of Employees (REGES), and preparation and maintenance of the employee personnel file throughout the employment relationship.

Recording and monitoring working hours, absences and leave for the preparation of monthly timesheets; calculation of salaries, allowances, bonuses, reimbursements and other monetary entitlements provided for by law or contract; payment of salaries; and withholding and remittance of taxes and mandatory social contributions.

Organisation of occupational health examinations, management of sick leave, and handling matters relating to occupational health and safety.

Conducting periodic employee performance evaluations, administration of professional training, termination of the employment relationship, issuance of the relevant employment documents, and archiving of the employee personnel file.

Categories of personal data

Identification data: first name, surname, Personal Numerical Code (CNP), identity document series and number, date of birth, permanent/residential address, telephone number, e-mail address and handwritten signature.

Employment-related data: job title, organisational unit/department, job responsibilities, type of employment contract, working time arrangement, information relating to education, qualifications and professional experience.

Working time data: hours worked, overtime, rest days, authorised leave, absences, annual leave, sick leave and other types of leave, late arrivals and timesheet records.

Salary data: basic salary, allowances, bonuses, deductions, social contributions, tax deductions, and total gross and net remuneration.

Financial data required for salary payments: bank account details (IBAN) and the name of the banking institution.

Health data relating to fitness for work: medical certificates, occupational health assessments, and sick leave documentation.

Performance evaluation data: performance appraisal reports, evaluation ratings, professional objectives, and evaluator's observations.

For further information regarding these processing activities, please refer to the Privacy Notice on the Processing of Personal Data in the Context of Employment Relationships.

Legal basis for processing

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

15.Negotiation of contracts signed by CREDIDAM

Processing activities carried out for this purpose

Collection and processing of personal data required for the negotiation, execution, performance and administration of contracts signed by CREDIDAM with suppliers, business partners or other third parties.

Categories of personal data

First name, surname, job title, telephone number, e-mail address, and signature.

Legal basis for processing

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

16.Relations with representatives of public authorities

Processing activities carried out for this purpose	Establishment and management of CREDIDAM's relationships with representatives of public authorities with whom it interacts during its day-to-day activities (for example, cultural authorities, tax authorities, regulatory authorities, or other relevant public institutions).
Categories of personal data	First name, surname, job title, telephone number, e-mail address, and signature.
Legal basis for processing	Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

17.Handling Data Subject requests

Processing activities carried out for this purpose	Registration and handling of requests submitted by data subjects pursuant to the General Data Protection Regulation No. 679/2016, in connection with the exercise of their rights of access, rectification, erasure, restriction of processing, or objection in relation to their personal data.
Categories of personal data	First name, surname, e-mail address, content of the request, signature, other identification data provided or requested for verification purposes, and any documents accompanying the submitted request.
Legal basis for processing	Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

18.Video surveillance of premises

Processing activities carried out for this purpose

Video surveillance of CREDIDAM's indoor and outdoor premises, including its assets and equipment, for the purpose of ensuring the security of employees, members, collaborators and visitors, as well as the protection of CREDIDAM's property and premises.

Categories of personal data

Image: physical appearance of individuals within the cameras' field of view, clothing and items carried, movement and behaviour captured on camera, as well as interactions with other persons simultaneously recorded.

Time and location data: date, time and camera that captured the recording, as well as the area of the premises where you were located at the relevant time.

Vehicle-related data: for cameras covering outdoor areas, information regarding the appearance of the vehicle, to the extent that such information is legible.

Security-related data: records of access to the premises, which may include first name, surname, status/capacity and time of access, as well as records of persons who have viewed or extracted recordings.

Video recordings may accidentally contain elements that could indirectly reveal information relating to an individual's private life, such as: aspects concerning health status or the existence of a disability, where a person uses a medical device, an adapted mobility aid or displays a visible condition; racial or ethnic origin; religious beliefs, where a person wears religious symbols or clothing with religious significance; aspects of private life or personal relationships that may be inferred from the simultaneous presence of several individuals and their interactions.

CREDIDAM does not seek to obtain such information. The video surveillance system is used exclusively for the purpose of ensuring the security of individuals, assets and premises. Recordings are not analysed, categorised, indexed or interpreted to infer characteristics of recorded individuals, are not combined with other categories of data for this purpose, and do not form the basis of any decision concerning data subjects.

In the exceptional situation where a recording becomes necessary for the establishment, exercise or defence of a legal right before a court, or for the documentation of an incident, and such recording contains elements falling within the scope of Article 9 of Regulation (EU) 2016/679, the processing shall be based on Article 9(2)(f) GDPR – processing is necessary for the establishment, exercise or defence of legal claims – and shall be strictly limited to what is necessary for this purpose.

Legal basis for processing

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller.

19.Use of Cookies

The website www.credidam.ro uses cookies to improve users' browsing experience and to ensure the optimal functioning of the platform. These cookies enable the automatic collection of technical information that may lead to the indirect identification of users, such as the IP address, the type of browser used, the operating system, as well as the domain or internet service provider through which the website is accessed.

Cookies are used primarily for the following purposes:

ensuring the proper functioning of the website;
ensuring the correct display of content;
personalising the interface and ensuring the security of the website against fraudulent activities or unlawful use;
generating statistics to understand users' interaction with and response to the website content.

For further information regarding the cookies used on the website, please consult the Cookie Policy.

III.DURATION OF PERSONAL DATA PROCESSING

CREDIDAM complies with the principles relating to the processing of personal data set out in Article 5 of the General Data Protection Regulation No. 679/2016, concerning the collection of data only for specified, explicit and legitimate purposes, ensuring that processing is adequate, relevant and limited to what is necessary in relation to the stated purposes, as well as retaining data for no longer than is necessary for the purposes for which the personal data are processed.

Personal data are stored for specified periods of time, in accordance with applicable legal retention obligations, as well as other applicable laws, regulations or specific provisions. In addition, the following criteria shall apply:

retention periods established by applicable legislation;
the period necessary for the expiry of statutory deadlines and/or limitation periods applicable under law;
internal retention periods and procedures;
the period necessary for the anonymisation or effective deletion of data following the expiry of statutory retention periods or internally established retention periods.

Where processing activities are based on consent, such consent is expressly obtained and documented separately for each individual processing activity. The termination of such processing shall occur either upon expiry of the declared retention period or upon withdrawal of consent.

For further information regarding the retention period applicable to your personal data, we recommend contacting the Data Protection Officer in writing at 34 C.A. Rosetti Street, Sector 2, Postal Code 020015, Bucharest, Romania, or by using the following e-mail address: dpo@credidam.ro.

IV.DISCLOSURE OF PERSONAL DATA. RECIPIENTS

In order to achieve the purposes described above, the Data Controller may use the services of contractual partners. Such partners act as Data Processors, and certain personal data may be provided to them solely within the scope of the obligations undertaken towards CREDIDAM and in accordance with our instructions regarding the processing of such data.

Personal data may be disclosed to the following categories of recipients:

providers of IT services, maintenance services and administration of IT infrastructure;
providers of hosting, cloud and data storage services;
providers of e-mail and electronic communications services;
providers of archiving, document management and document destruction services;
providers of accounting, audit, legal consultancy and tax consultancy services;
payment service providers, to the extent necessary for processing payments;
courier and postal service providers;
providers of cybersecurity and IT systems monitoring services;
partner collective management organisations in Romania and abroad, in the performance of reciprocal representation agreements;
other service providers processing data on behalf of CREDIDAM, insofar as such processing is necessary for achieving the purposes described in this Privacy Policy.

Personal data may also be disclosed to public authorities or institutions where there is a legal or contractual obligation to do so, upon their explicit written request, or in cases involving suspicions regarding the commission of a criminal offence.

The public authorities and institutions to which your personal data may be disclosed include, by way of example: the Romanian Copyright Office (ORDA), the Territorial Labour Inspectorate, the National Agency for Fiscal Administration (ANAF), the National Supervisory Authority for Personal Data Processing, and the courts of law.

We make continuous efforts to ensure that personal data are processed in a safe and secure manner.

V.TRANSFER OF PERSONAL DATA

In the event of any transfer of personal data, we assure you that CREDIDAM undertakes all necessary technical and organisational measures to ensure an adequate level of protection and compliance with applicable legal requirements regarding personal data, in accordance with the provisions of the General Data Protection Regulation No. 679/2016.

In the performance of reciprocal representation agreements and through participation in international databases operated within the network of collective management organisations for the rights of performing artists, the personal data of performing artists represented by CREDIDAM may be transferred to collective management organisations established in countries outside the European Economic Area. Such transfers are carried out exclusively for the purposes of identifying rights holders, collecting and transferring the remuneration due for uses occurring outside the territory of Romania, based on the agreements concluded with the respective organisations and the safeguards provided under Chapter V of the General Data Protection Regulation.

When accessing CREDIDAM's official Facebook page, your personal data may be transferred by Meta Platforms Ireland Limited, the operator of the platform, to Meta Platforms, Inc., established in the United States of America, outside the European Economic Area. Such transfer is carried out based on the mechanisms provided under the General Data Protection Regulation, for the purposes determined by the platform operator, including the provision, personalisation and optimisation of the services offered. For detailed information regarding the manner in which Meta collects, processes and protects such data, as well as for managing your privacy preferences, we recommend consulting Meta's Privacy Policy.

YouTube. When accessing CREDIDAM's official YouTube channel, as well as when viewing video materials embedded on the CREDIDAM website, your personal data may be transferred by Google Ireland Limited, the operator of the platform, to Google LLC, established in the United States of America, outside the European Economic Area. Such transfer is carried out based on the mechanisms provided under the General Data Protection Regulation, for the purposes determined by the platform operator, including the provision, personalisation and optimisation of the services offered. For detailed information regarding the manner in which Google collects, processes and protects such data, as well as for managing your privacy preferences, we recommend consulting Google's Privacy Policy.

For further information regarding transfers of personal data, we recommend contacting the Data Protection Officer in writing at 34 C.A. Rosetti Street, Sector 2, Postal Code 020015, Bucharest, Romania, or by using the following e-mail address: dpo@credidam.ro.

VI.DATA SUBJECTS RIGHTS

In the context of the processing of personal data, data subjects benefit from the following rights:

Right of access to processed personal data: the right to obtain confirmation as to whether or not personal data concerning them are being processed by CREDIDAM and, where applicable, to request a copy of such data.
Right to rectification: the right to request the rectification or completion of inaccurate or incomplete personal data.
Right to restriction of processing: the right to obtain restriction of processing where:

the accuracy of the personal data is contested, for a period enabling CREDIDAM to verify the accuracy of such data;
the processing is unlawful, but the data subject does not wish to have the personal data erased and instead requests the restriction of their use;

CREDIDAM no longer needs the personal data for the purposes for which they were processed, but the data are required by the data subject for the establishment, exercise or defence of legal claims; or

the data subject has objected to processing, for the period during which it is verified whether the legitimate grounds of CREDIDAM override the rights and interests of the data subject.

Right to erasure of processed personal data: the right to request the deletion of personal data where one of the following grounds applies:

the data are no longer necessary for the purposes for which they were collected or processed;
the data subject withdraws consent on which the processing is based and there is no other legal ground for continuing the processing;

the data subject objects to the processing and CREDIDAM has no overriding legitimate grounds for continuing the processing;

the personal data have been unlawfully processed; or
erasure is necessary for compliance with European Union or national law.

Right to withdraw consent: the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing activities carried out before the withdrawal.
Right to object: the right to object, on grounds relating to the data subject's particular situation, to the processing of personal data, as well as the right to object at any time to the processing of personal data for direct marketing purposes, including profiling.
Right not to be subject to automated decision-making: the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.
Right to data portability: the right to receive personal data provided to CREDIDAM in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another data controller, where processing is based on consent or on the performance of a contract and is carried out by automated means.
Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): data subjects may submit a complaint using the following contact details of ANSPDCP: address: 28-30 G-ral. Gheorghe Magheru Boulevard, Sector 1, Postal Code 010336, Bucharest, Romania; e-mail addresses: anspdcp@dataprotection.ro, dpo@dataprotection.ro. Further information regarding the submission of complaints or notifications to the Authority is available at www.dataprotection.ro.
Right to bring proceedings before the competent courts.

We hereby inform you that, within the processing activities described in this Privacy Policy, CREDIDAM does not carry out profiling activities and does not adopt decisions based solely on automated processing of personal data.

To exercise any of the rights listed above, or to submit requests or complaints, please contact us using the following contact details:

Data Controller	CREDIDAM
Registered Address	34 C.A. Rosetti Street, Sector 2, Postal Code 020015, Bucharest, Romania
Data Protection Officer – e-mail address	dpo@credidam.ro

Within one month from receipt of your request or complaint, CREDIDAM shall provide a response and communicate it to you. This period may be extended by an additional two months where necessary, taking into account the complexity and number of requests.

Where CREDIDAM has reasonable doubts concerning the identity of the individual submitting a request for the exercise of data subject rights, it shall be entitled to request the provision of additional information necessary to confirm the identity of the data subject.

Where a request is submitted electronically, the information shall be provided in electronic form where possible, unless you request another format. All requests shall be handled without undue delay, in accordance with applicable legislation and free of charge.

Where requests are manifestly unfounded or excessive, in particular due to their repetitive nature, CREDIDAM shall have the right to: charge a reasonable fee, taking into account the administrative costs of providing the information or communication, or of taking the requested action; or refuse to act on the request.

Updates to the Privacy Policy

This Privacy Policy may be updated periodically, depending on developments in the activities carried out by the Data Controller or in the context of legislative amendments or new regulatory requirements that require adjustments to the manner in which personal data are processed.

The updated version of the Privacy Policy shall be made available on the CREDIDAM website (credidam.ro), in the dedicated section.

Updated version: 31 July 2026