Information regarding the processing of personal data in the commercial activity

CFR Călători processes your personal data according to the provisions of GDPR, of the local and European laws on data protection, as well as according to the purposes for which they were collected.

CFR Călători, as a personal data operator, will determine the purposes and methods of processing the collected personal data.

The information we collect about you and how we collect it may vary depending on the services you use and which you subscribe to or what we have obtained from a third party who was allowed to share information with us.

1. Purpose of processing

Your personal data are processed:

a. To issue tickets with transport facilities for: students, pensioners, people with disabilities, revolutionaries and descendants of martyr heroes, veterans and war widows, persecuted people for political, ethnical reasons, inhabitants of Apuseni Mountains ("Moți"), MPs and academics;

b. To issue CFR Calatori offers: monthly season-ticket, weekly season-ticket, VSD pass, week-end ticket, group ticket, circuit ticket, TrenPlus pass, PRM assistance, refund of transport tariffs;
c. To issue online tickets;

d. To submit and solve complaints;

e. To issue passes and book of coupons for the employees of railway structures, free passes for their family members, as well as free passes for railway pensioners and their family members. To issue FIP tickets in international traffic for the above mentioned beneficiaries.

f. To settle the facilities granted for transport;

g. To sanction contraventions;

h. To provide ancillary services, compensation for delay, return of coupons, seat reservation for groups, etc.;

i. To supervise/for the security of people, premises, assets used by CFR Călători; in this context, CFR Călători can video monitor some parts of the premises in which the company operates, to ensure the security and protection of people, goods and values, buildings and their fences;

j. To issue tickets in international traffic;

k. For the management and handling of contract;

l. For statistical purposes.

2. Categories of personal data processed

The categories of personal data that are requested and processed are the following: last name, first name, Social Security Number, ID/Passport series and number, gender, date and place of birth, signature, pension file number, profession, job, contact details - personal phone number, email address, home/residence address, driving license data, education (diplomas, studies, etc), image, voice, bank details, citizenship, data from civil status documents.

3. Special data of employees

CFR Călători does not process special personal data revealing racial or ethnic origin, political views or philosophical beliefs, biometric data, genetic data processing for the unique identification of an individual, data on the sexual life or orientation of an individual.

4. Legal basis of data processing

The lawfulness of the collection and processing of personal data for the purposes mentioned at section 1 is established as follows:

a. For the purpose established at section 1 point a, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

b. For the purpose established at section 1 point b, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

c. For the purpose established at section 1 point c, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

d. For the purpose established at section 1 point d, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

e. For the purpose established at section 1 point e, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

f. For the purpose established at section 1 point f, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

g. For the purpose established at section 1 point g, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

h. For the purpose established at section 1 point h, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

i. For the purpose established at section 1 point j, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

j. For the purpose established at section 1 point k, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

k. For the purpose established at section 1 point k, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point b - „processing is necessary for the performance of a contract to which the data subject is a party or to make arrangements at the requests of the data subject before concluding a contract".

l. To carry out statistical studies, based on art. 9 par. (2) point (j) of GDPR.

Categories of recipients of personal data

Personal data of the employees are intended for use by the operator and are communicated to the following recipients established according to the processing purposes identified at section 1:

a. For the purpose established at section 1 point a, your personal data may be disclosed to the following categories of recipients:

- data subject, personal data may appear on the ticket issued by CFR authorized staff;

- state institutions to carry out the settlement of facilities granted for transport;

- state authorized institutions if they expressly request to conduct investigations.

b. For the purpose established at section 1 point b, your personal data may be disclosed to the following categories of recipients:

- data subject, personal data may appear on the ticket issued by CFR authorized staff;

- state authorized institutions if they expressly request to conduct investigations;

- authorized staff of CFR Calatori involved in solving PRM requests, refunding the transport tariffs or issuing the TrenPlus pass.

c. For the purpose established at section 1, point c, your personal data may be disclosed to the following categories of recipients:

- authorized staff of CFR Calatori, as lists, for your identification onboard as a holder of a valid ticket;

- state authorized institutions, if they expressly request to conduct investigations.

d. For the purpose established at section 1, point d, your personal data may be disclosed to the following categories of recipients:

- authorized staff of CFR Calatori, responsible for solving complaints;

- organisations under the authority of the Ministry of Transport, responsible for solving complaints.

e. For the purpose established at section 1, point e, your personal data may be disclosed to the following categories of recipients:

- the data subject/legal representatives of the data subject, personal data may appear on the ticket, pass, international FIP pass, issued by the authorized staff of CFR;

- the employer of the data subject

- state authorized institutions, is they expressly request to conduct criminal investigations.

f. For the purpose established at section 1, point f, your personal data may be disclosed to the following categories of recipients:

- state institutions for calculating the settlement of the transport facilities;

- institutions authorized to conduct inspections regarding the legal conformity of conducting this activity;

g. For the purpose established at section 1, point f, your personal data may be disclosed to the following categories of recipients:

- the data subject, receiving a copy of the Contravention Report;

- the authorized staff of CFR Calatori;

- state institutions authorized in damage recovery.

h. For the purpose established at section 1, point h, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori, with resolution responsibilities.

i. For the purpose established at section 1, point j, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori;

- state authorized institutions, if they expressly request to conduct investigations;

j. For the purpose established at section 1, point k, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori for fulfilling their service duties;

- state authorized institutions, if they expressly request to conduct investigations;

k. For the purpose established at section 1, point k, your personal data may be disclosed to the following categories of recipients:

- data subject employer and its' contract partners;

- state authorized institutions, if they expressly request to conduct investigations;