Processing of personal data

+40731990129 (M-S 8-20)
You can buy at least 6 hours before departure

Information regarding the processing of personal data in the commercial activity

CFR Călători processes your personal data according to the provisions of GDPR, of the local and European laws on data protection, as well as according to the purposes for which they were collected.

CFR Călători, as a personal data operator, will determine the purposes and methods of processing the collected personal data.

The information we collect about you and how we collect it may vary depending on the services you use and which you subscribe to or what we have obtained from a third party who was allowed to share information with us.

1. Purpose of processing

Your personal data are processed:

a. To issue tickets with transport facilities for: students, pensioners, people with disabilities, revolutionaries and descendants of martyr heroes, veterans and war widows, persecuted people for political, ethnical reasons, inhabitants of Apuseni Mountains ("Moți"), MPs and academics;

b. To issue CFR Calatori offers: monthly season-ticket, weekly season-ticket, VSD pass, week-end ticket, group ticket, circuit ticket, TrenPlus pass, PRM assistance, refund of transport tariffs;
c. To issue online tickets;

d. To submit and solve complaints;

e. To issue passes and book of coupons for the employees of railway structures, free passes for their family members, as well as free passes for railway pensioners and their family members. To issue FIP tickets in international traffic for the above mentioned beneficiaries.

f. To settle the facilities granted for transport;

g. To sanction contraventions;

h. To provide ancillary services, compensation for delay, return of coupons, seat reservation for groups, etc.;

i. To supervise/for the security of people, premises, assets used by CFR Călători; in this context, CFR Călători can video monitor some parts of the premises in which the company operates, to ensure the security and protection of people, goods and values, buildings and their fences;

j. To issue tickets in international traffic;

k. For the management and handling of contract;

l. For statistical purposes.

2. Categories of personal data processed

The categories of personal data that are requested and processed are the following: last name, first name, Social Security Number, ID/Passport series and number, gender, date and place of birth, signature, pension file number, profession, job, contact details - personal phone number, email address, home/residence address, driving license data, education (diplomas, studies, etc), image, voice, bank details, citizenship, data from civil status documents.

3. Special data of employees

CFR Călători does not process special personal data revealing racial or ethnic origin, political views or philosophical beliefs, biometric data, genetic data processing for the unique identification of an individual, data on the sexual life or orientation of an individual.

4. Legal basis of data processing

The lawfulness of the collection and processing of personal data for the purposes mentioned at section 1 is established as follows:

a. For the purpose established at section 1 point a, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

b. For the purpose established at section 1 point b, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

c. For the purpose established at section 1 point c, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

d. For the purpose established at section 1 point d, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

e. For the purpose established at section 1 point e, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

f. For the purpose established at section 1 point f, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

g. For the purpose established at section 1 point g, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point c of GDPR - for the fulfilment of a legal obligation incumbent on the operator.

h. For the purpose established at section 1 point h, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

i. For the purpose established at section 1 point j, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

j. For the purpose established at section 1 point k, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point f - „processing is necessary for the purposes of the legitimate interests pursued by the operator or a third party, unless the interests or fundamental rights and freedoms of the subject prevail, which require the protection of personal data, especially when the data subject is a child".

k. For the purpose established at section 1 point k, the lawfulness of the processing of your personal data is represented by article 6 par. (1) point b - „processing is necessary for the performance of a contract to which the data subject is a party or to make arrangements at the requests of the data subject before concluding a contract".

l. To carry out statistical studies, based on art. 9 par. (2) point (j) of GDPR.

Categories of recipients of personal data

Personal data of the employees are intended for use by the operator and are communicated to the following recipients established according to the processing purposes identified at section 1:

a. For the purpose established at section 1 point a, your personal data may be disclosed to the following categories of recipients:

- data subject, personal data may appear on the ticket issued by CFR authorized staff;

- state institutions to carry out the settlement of facilities granted for transport;

- state authorized institutions if they expressly request to conduct investigations.

b. For the purpose established at section 1 point b, your personal data may be disclosed to the following categories of recipients:

- data subject, personal data may appear on the ticket issued by CFR authorized staff;

- state authorized institutions if they expressly request to conduct investigations;

- authorized staff of CFR Calatori involved in solving PRM requests, refunding the transport tariffs or issuing the TrenPlus pass.

c. For the purpose established at section 1, point c, your personal data may be disclosed to the following categories of recipients:

- authorized staff of CFR Calatori, as lists, for your identification onboard as a holder of a valid ticket;

- state authorized institutions, if they expressly request to conduct investigations.

d. For the purpose established at section 1, point d, your personal data may be disclosed to the following categories of recipients:

- authorized staff of CFR Calatori, responsible for solving complaints;

- organisations under the authority of the Ministry of Transport, responsible for solving complaints.

e. For the purpose established at section 1, point e, your personal data may be disclosed to the following categories of recipients:

- the data subject/legal representatives of the data subject, personal data may appear on the ticket, pass, international FIP pass, issued by the authorized staff of CFR;

- the employer of the data subject

- state authorized institutions, is they expressly request to conduct criminal investigations.

f. For the purpose established at section 1, point f, your personal data may be disclosed to the following categories of recipients:

- state institutions for calculating the settlement of the transport facilities;

- institutions authorized to conduct inspections regarding the legal conformity of conducting this activity;

g. For the purpose established at section 1, point f, your personal data may be disclosed to the following categories of recipients:

- the data subject, receiving a copy of the Contravention Report;

- the authorized staff of CFR Calatori;

- state institutions authorized in damage recovery.

h. For the purpose established at section 1, point h, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori, with resolution responsibilities.

i. For the purpose established at section 1, point j, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori;

- state authorized institutions, if they expressly request to conduct investigations;

j. For the purpose established at section 1, point k, your personal data may be disclosed to the following categories of recipients:

- the authorized staff of CFR Calatori for fulfilling their service duties;

- state authorized institutions, if they expressly request to conduct investigations;

k. For the purpose established at section 1, point k, your personal data may be disclosed to the following categories of recipients:

- data subject employer and its' contract partners;

- state authorized institutions, if they expressly request to conduct investigations;

Storage period of personal data

The storage period of the personal data, which are processed for the purposes stated at section 1 varies depending on the nature of the processing, on the personal data type used in the company’s business processes and the legal basis for this processing, is established by CFR Calatori according to internal rules and provisions, as well as the legislation in force. Information regarding the storage period of personal data may be made available to the data subjects when they exercise their right to data access, guaranteed by Article 15 of Regulation EU 679/2016.

Your rights and how to exercise them

Regarding the data processed in the commercial activity, the following rights may be exercised under certain conditions provided by GDPR:

The right to be informed

This data protection notice provides the information you are entitled to receive.

The right of access to data

According to GDPR, information regarding your personal data owned by the employer may be requested. In this respect, a data access request shall be submitted. No taxes are to be charged for providing this information, unless the request is unjustified or excessive.

The right of rectification

Should you determine that your personal data are inaccurate, incomplete or incorrect, they may be rectified.

The right of deletion

You may exercise your right to delete your personal data in a number of situations (for instance, if the data are no longer necessary in respect to the purpose for which they were created or if you withdraw your agreement). The personal data collected according to the legislation in force may be deleted only after the established retention period expires.

The right to restrict the processing

The right to data portability

Your data are registered both in physical and electronic formats. CFR Călători makes every reasonable effort to provide information in a portable format.

The right to opposition

If possible, we shall stop the processing of your data should you oppose the processing on the basis of a legitimate interest or if personal situations that make you exercise this right (including profiling) arise. Should you oppose the processing for research and statistics purposes, we shall stop the processing of your data.  The right to opposition cannot be exercised when the processing is based on fulfilling legal obligations and stopping it would be against the legislation in force.