CONFIDENTIALITY POLICY

 NOTICE

on the processing of personal data

7card Program

  • Who are we:

We are Benefit Seven S.A. (a joint-stock company based in Roşiorii de Vede, Mărăşeşti Street, S111, ground floor, Teleorman county, mailing address 11 Zării Street, lower ground floor, ground floor and first floor, District 5, Bucharest, registered with the Trade Register under No J34/387/2004, sole registration code RO16696040, subscribed and paid up share capital of 100,000 RON), and this Notice is intended to inform all the 7card current and future subscribers on the conditions of their personal data processing in the framework of their participation to the 7card Program, beginning with the enrolment into the 7card Program.

You can contact us any time at:

Address: 11 Zării Street, district 3, Bucharest

Phone: +40 21 539 7770

E-mail: 7card@benefitseven.ro

The services provided by Benefit Seven S.A. to the 7card subscribers are established via contracts concluded between Benefit Seven S.A. and each employer of the Employee (“Client”), including items such as the cost of services, limits of the 7card use (e.g. allowed visits per day); Benefit Seven S.A. maintains a contract with each of these Client, which sets out the terms in which the Client’s employees (and their Companions/Friends) can access the 7card Program, also considering the 7card Program Rules and the 7card Program Enrolment Rules.

This Notice has been prepared in accordance with legislation on the processing of personal data which is directly applicable in Romania (mainly Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) and Law No 506/2004 on the processing of personal data and protection of privacy in the field of electronic communications (“Law 506/2004”).

Benefit Seven S.A. assumes in relation to the Subscribers, on their processing of personal data as per the GDPR, specific obligations as a data processor of the Client, and if applicable and for limited purposes, specific obligations as personal data processor.

  • The categories of data subjects (people whose personal data we process in relation to the 7card Program)
  1. Employee – individual with whom the Client has a contractual relationship based on a labour agreement, mandate agreement, management agreement, service agreement or other civil law contract with similar legal implications.
  2. Companion/Friend – individual designated by the Employee to benefit from the 7card in the same usage conditions as the Employee. The Companion/Friend is not an employee of the Client and may be any individual. The Companion/Friend is subject to the rules and regulations applicable to the Employee. The Employee will not enrol in the 7card Program a person who does not agree with the 7card Program Rules (Conditions of Use).
  3. Underage Companion/Friend – individual under 16 years of age, a child of the Employee, designated by the Employee to benefit from the 7card in the same usage conditions as the Employee. The underage companion takes part in the 7card Program only by the initiative and after completion of the enrolment procedure by their parent (an Employee of the Client), who, by enrolling the underage companion in the 7card Program, expressly consents that the latter takes part in the 7card program; moreover, the Employee Parent of the Client takes full responsibility for complying with the 7card Program Rules by the underage companion and consents to their processing of personal data by Benefit Seven SA according to the Notice.

Notes:

Data of minors. The protection of the privacy of minors is of major importance to us. Benefit Seven S.A. only processes the data strictly required to ensure the access of underage companions to the services of the 7card Program, according to the 7card Program Rules. We will not process the personal data of minors in order to create profiles or to send customized offers by SMS, e-mail or other communication channels, monitoring via cookies or other online tracking techniques required to send customized offers.

  • Categories of personal data that we process

The personal data processed by Benefit Seven S.A. in relation to the participation of Subscribers to the 7card Program according to the 7card Program Rules are the following:

  • For the Employee: full name, mobile phone number, home address, work address, work e-mail, gender, date of birth, sole Subscriber code (allocated by Benefit Seven SA upon enrolment in the Program);
  • For the Companion/Friend: full name, mobile phone number, e-mail address, home address, gender, date of birth, sole Subscriber code (allocated by Benefit Seven SA upon enrolment in the Program);
  • For underage companion/friend (individuals below 16 years of age), the personal data processed by Benefit Seven SA is the following: full name, gender, date of birth – they will be exclusively supplied by the parent of the underage companion upon enrolment in the Program, sole Subscriber code (allocated by Benefit Seven SA upon enrolment in the Program);
  • Transactional communications – communications by push-notifications in the 7card app, SMS, email on the status of a certain initiative/action of the Subscriber;
  • History of visits/access of Employees to the Partner locations – gyms/clubs/other recreational activities;
  • Online identifiers: The IP address of the device the Subscriber uses to access www.7card.ro and/or the 7card application; the internet browser they are using and the version of the operating system of the browsing/application accessing device; HTTP/HTTPS protocol data;
  • Benefit Seven S.A. will process, exclusively for informing the Subscriber on their proximity to a Gym/Recreational club/Partner, location data of the Subscriber’s device (location of the mobile phone whose number was filled out upon enrolment) at that specific time, only with the express agreement of the Subscriber expressed immediately before the time of showing the location of the gym/club in their proximity. Benefit Seven SA will not store/keep equipment location data.

The personal data which is mandatory since the 7card Program requires the issuance of 7card cards / nominal application codes: full name, mobile phone number (not required for underage companions), home address, work e-mail (not required for underage companions), date of birth; failure to provide such personal data will prevent the nominal 7card from being issued and the access to the Program benefits (situations which will not be the fault of Benefit Seven SA or its Partners – gyms and suppliers of other recreational activities).

  • How we collect the personal data of Subscribers

We collect the personal data of Subscribers both directly from them (when they directly provide us with their enrolment/updating data on the 7card platform and/or application), and via the Client (when they provide us with the 7card subscriber data as employers of these Subscribers). Moreover, in certain situations, we can collect the enrolment/updating data of the 7card subscriber partly from the Customer, partly from the 7card Subscriber. We always collect data from the 7card Subscriber based on our responsibilities and the instructions from our Clients.

The Companion data is provided by the Subscribers; Benefit Seven S.A. informs the companion on the conditions required to enrol in the Program, including in relation to the terms on the processing of personal data according to this Notice, as soon as possible after the registration of the companion’s data into the 7card platform.

We automatically collect location data, exclusively if the 7card Subscriber is logged-in or our clients allowed the device to display the location, strictly for indicating their position relative to the Partner locations in their proximity, in order to give support/recommendations in the relation between the parties. We do not store location data. The location can be deactivated from the settings of the device used for accessing the client user account.

When the 7card subscribers access the Partner locations, we collect data on the access/visits of Subscribers/Friends to the Partners, via the devices from the Partner locations, and via the specific documentation available in the Partner locations (“enrolment form” at the Partner).

The data automatically collected via cookies is regulated in the cookies policy; however, we cannot identify you from the data collected via such cookies.

Moreover, we collect data of the Subscriber’s activity on the Benefit Seven SA website, about: the log-on IP, the accessing of our website pages.

The data collected upon the participation of the Subscribers in contests/raffles organized by Benefit Seven S.A., according to the Subscriber’s decision to participate, and details on such initiatives/projects/events are available in the regulation of each such event/project.

Benefit Seven S.A. does not collect (directly or indirectly) and does not process special data (e.g. data on the Subscribers’ health) and does not monitor/assess the participation of Subscribers to the activities in the framework of the 7card, performed according to the 7card Program Rules.

Data which the Subscribers provide, at their own choice and without being requested by Benefit Seven SA (e.g. conversations, assessments, feedback via the 7card application and/or website www.7card.ro and/or the correspondence between the Subscriber and Benefit Seven S.A., including via Facebook). Benefit Seven S.A. will only process such data to answer the requests of these Subscribers, within the time limits required to clarify the respective situations.

  • The purposes for which we process the personal data of 7card subscribers and the grounds for processing:
Purposes for processingGrounds for processing
Informing the subscriber on the 7card ProgramPerformance of the obligations under the Rules in relation to the 7card Program, and pre-enrolment formalities
Ensuring the Subscriber’s access to the facilities provided under the 7card Program (e.g. access to Partner locations at better prices and their preservation as described below).Performance of the obligations under the Rules in relation to the 7card Program
Validation of the Program enrolment, creation of the nominal Subscriber’s card, mailing of the 7card to the Subscriber, invoicing of services, notifications on the account status/invoice/outstanding paymentsPerformance of the obligations under the Rules in relation to the 7card Program
Authentication of the Subscriber at the time of connecting to the 7card linked account (including when accessing the 7card app on the browsing device)Performance of the obligations under the Rules in relation to the 7card Program (including the 7card pre-enrolment stages)
Validation of the Program enrolment, generation of the 7card account, invoicing of services, notifications on the account status/invoices/payments, including by push-notifications in the 7card app/e-mail/SMS.Performance of the obligations under the Rules in relation to the 7card Program
Processing of the payments for the subscriber’s participation to the 7card Program

The legitimate interest of Benefit Seven S.A.

Performance of the obligations under the Rules in relation to the 7card Program

Steps to solve card cancellations or any other issues under the 7card program, including the Program changes (e.g. enrolment of new gyms/sports clubs/recreational activities as Partners, removal of other Partners)Performance of the obligations under the Rules in relation to the 7card Program
Contacting/correspondence with the Subscriber, upon request/according to our customer relations policiesPerformance of the obligations under the Rules in relation to the 7card Program
Contacting/correspondence with the Subscriber in aspects related to customer relationsPerformance of the obligations under the Rules in relation to the 7card Program
Ensuring the Subscriber’s access to contests organized by Benefit Seven SA for SubscribersThe legitimate interest of Benefit Seven S.A.
Tracking the Subscriber’s behaviour and the statement of payments for the services under the 7card Program, in order to improve and diversify the services and benefits provided by Benefit Seven S.A. via the 7card Program.The legitimate interest of Benefit Seven S.A. (business operations)
Assessment of the products and services provided by Benefit Seven S.A. and the performance of statistics/statements by Benefit Seven SA in order to improve and diversify the services provided by Benefit Seven S.A.The legitimate interest of Benefit Seven S.A. (business operations)
Settlement of costs, as applicable, between: (i) Benefit Seven S.A. and Partners, (ii) Benefit Seven SA and Subscribers, (iii) between Benefit Seven SA and Customers.The legitimate interest of Benefit Seven S.A. (business operations)
Statistics, reports and statements on the use of the 7cardThe legitimate interest of Benefit Seven S.A. (business operations)
Prevention of and fight against fraud (the card is nominal and may only be used by its holder)The legitimate interest of Benefit Seven S.A. (business operations)
Improving and diversifying the services of Benefit Seven S.A. based on the profiling procedure

The legitimate interest of Benefit Seven S.A. (business operations)

Details on the profiling for this purpose are available in the “Profiling” section below If a Subscriber deems he/she has appropriate reasons to oppose the processing of their personal data for purposes of our legitimate interests, including the use of profiling in relation to them, the Subscriber may at any time exercise the right to oppose as per the section “Rights of Subscribers” under this Notice.

Maintenance and securization of the www.7card.ro website / application / platform.The legitimate interest of Benefit Seven S.A.
Company transactions (e.g. purchases, sales) which involve audits / analyses on the contractual relations and/or platforms / databases of Benefit Seven S.A.The legitimate interest of Benefit Seven S.A.
Defence of our rights (e.g. recovery of outstanding amounts, or when we protect our interests against unwarranted claims/complaints)The legitimate interest of Benefit Seven S.A.
Submission of customized offers based on profiling, for direct marketing purposes, via communication channels such as SMS / email / phone / push-up notifications in the 7card application

The consent of the Subscriber to profiling and the submission of customized offers via the preferred communication channels of the Subscriber (SMS and/or e-mail, push notifications in the 7card application)

More details on how we do profiling for direct marketing purposes are set out at the “Profiling” section below. The Subscriber may oppose profiling at any time, as per the section “Rights of Subscribers” under this Notice.

Submission of general commercial communications on the services/facilities provided by Benefit Seven S.A.

Consent of the Subscriber

The Subscriber may at any time withdraw their consent to receive such communications by accessing the link at the end of the e-mail, or by e-mail to 7card@benefitseven.ro.

The submission of customized offers on the products/services of Benefit Seven S.A., on the basis of the browsing and behaviour of the Subscriber on www.7card.ro, as monitored by cookies

Cookie consent

The Subscriber who does not want to be monitored via cookies for being sent online ads (banners) based on their interests, may reject the setting of a browser cookie for this purpose, by deactivating the browser’s automatic acceptance of cookies. The Subscriber can also reject cookies for the advertising services of browser service suppliers (e.g. Google), by setting the browser to reject cookies originating from the respective domain. For this purpose, Subscribers are asked to read www.youronlinechoices.com/ro/optiunile-mele.

The option to opt-out from targeted online advertising will not stop advertisements from displaying, but they will not be customized according to the Subscriber’s interests.

Submission of customized offers based on personalized audiences (per customer lists) in Facebook

Consent of the Subscriber

The consent may be easily withdrawn by the Subscriber at any time, by e-mail to 7card@benefitseven.ro

The submission of commercial communications on the services/products of Partners or other collaborators of Benefit Seven S.A.

Consent of the Subscriber

The consent may be easily withdrawn by the Subscriber at any time, by e-mail to 7card@benefitseven.ro

The verification of participation, validation of winners and handing out of awards for the online contests carried out on www.7card.ro and from the 7card Program official Facebook page (we also process to this extent: first name, email address, phone number).

We publish the full name of winners on the official Facebook page of Benefit Seven S.A. and/or on our website www.7card.ro.

Consent of the Subscriber in order to take part in the contests organized by Benefit Seven S.A. and receive the respective prizes
Annual financial auditing, submission of tax statements and accounting books with the tax authorities.Legal obligations of Benefit Seven S.A.

Procedures and investigations by the authorities and/or legal bodies (exceptionally also under official legal procedures)

Legal obligations of Benefit Seven S.A.

Profiling

We can use certain profiling techniques, i.e. a method for automatic processing of Subscriber data, mainly consisting in the analysis and interpretation of their personal data required to assess or forecast some aspects relative to their preferences, interests when accessing the sports/recreational activities via the 7card. Benefit Seven S.A. does not process the Subscriber’s sensitive health, religious faith or political affiliation data for the purposes of profiling.

The behaviour and personal preferences of the Subscriber related to certain sports/recreational activities are shown in their history of visits to Program partners and the usage of the 7card mobile application, by the age of the Subscriber, the preference for certain days/periods of participation to sports/recreational activities, and other personal interests and common interests with those of other customers.

Concretely, Benefit Seven S.A. creates the profile of a Subscriber as follows:

  • based on their history of access to the gyms/recreation centres of Partners (including preferred days, hourly periods, months of the year),
  • based on the date on the recurrence of these accesses/visits,
  • based on demographic data: age, gender, city
  • based on the subscription period.

When profiling, we collect data from sources such as: access to locations of Partners and providers of advertising related services we cooperate with.

We use the profiling technique when we send the Subscribers customized offers via direct marketing channels (SMS, e-mail, push-up notifications), in a manner that is relevant and useful for the subscribers.

Each Subscriber may oppose the profiling for direct marketing purposes via any of the communication channels they previously consented to, by withdrawing the consent for unsubscribing from a certain communication channel they previously opted for. For more details, see your “Rights and options” section.

Profiling Subscribers into segments/groups according to their preferences greatly helps us to personalize our offer for relevant services for Clients and Subscribers (e.g. we decide to open new partnerships with Partners for certain sports activities which are preferred by Subscribers), and therefore we can better respond to the needs and interests of subscribers (e.g. we decide to include new types of recreational activities that are relevant for the Subscribers in the 7card Program).

This step taken by Benefit Seven S.A. is based on our legitimate business interest to permanently improve and diversify our services.

We believe that the profiling for this purpose does not affect and jeopardize the interests, rights and liberties of our Subscribers.

Under no situation will the personal data of Underage Companions be subject to personalize under the direct marketing activities of Clients Benefit Seven SA, the online publishing by Benefit Seven SA, nor the processing via electronic messaging. The introduction/accessing via our secured link of the underage companion data will be performed exclusively by the legal representative of the minor, who has to authenticate with an unique password of their own.

  • Who do we share Subscriber data with

The above mentioned personal data will be shared by Benefit Seven SA (in compliance with safety and security measures and confidentiality) with the following groups of recipients:

  1. The Employer (Customer), for and for the performance of the rights and obligations from the Program Rules and the contract between Benefit Seven S.A. and the Employer;
  2. The companies and entities in the group of companies that Benefit Seven S.A. is a member of;
  3. Partners – gyms/sports clubs/recreational activities (they will only be provided with the full name of the data subject, exclusive for the settlement of visits and the services provided to them);
  4. Our suppliers who perform the following:
    • Document archival/storage services (including cloud storage service suppliers),
    • E-mail automated sending services;
    • SMS automated sending services;
    • IT development/maintenance services;
    • Invoicing services;
    • Other types of support services for Subscribers;
  1. Institutions, bodies and governmental authorities, courts of law or other public authorities, if we have such a legal obligation;
  2. If going through reorganization or sales procedure, we will communicate the Subscriber data to the buying company.
  3. Third parties, for common campaigns with that third party (for Subscribers who agreed to that extent – such third parties will have to comply with the applicable data protection legislation);
  • Duration of processing Subscribers’ data

The personal data of subscribers (including the history of their participation to sports/recreational activities) will be stored in the Benefit Seven S.A. platform (and those on paper format will be archived by authorized third parties) for a maximum period of 3 (three) years from the last day of validity of a subscription.

If the agreement between Benefit Seven S.A. and Client ceases, regardless of the reason, the 3 (three) year term runs from the termination of the contractual relation between Benefit Seven S.A. and the Client (with regard to the employee data of that Client / the companions of that Customer).

After this period, the personal data to be stored for longer periods (e.g. financial documents, invoices) will be safely stored for the duration provided by the law, and the rest will be anonymized/deleted (so that the data subject will no longer be identifiable), except where we are mandated by the law or it is in our legitimate interest to do so.

With regard to the data used with the prior consent of the data subject, we will process this data exclusively for the respective purpose only until the Subscriber withdraws their consent, except where we have an obligation to store the respective data for longer periods, according to the law, or for the purposes of investigations performed by relevant authorities or to safeguard our legitimate interests.

  • Transfer of data to third countries

Currently, our data is stored in locations from EU countries. If the subscriber data has to be transferred to companies/partners from non-EEA countries (the EEA countries are the EU countries plus Switzerland, Iceland, Liechtenstein and Norway – deemed to have equivalent confidentiality laws), if the storage place of our data or the location of subcontractors/partners is outside the EEA. If the subscribers’ data reach such non-EEA countries, we will always ensure an appropriate contract covering such a transfer is concluded pursuant to the relevant European Union standards. However, where the respective third party has no EU-equivalent data protection standards, we will always request the respective recipient third party to conclude a mandatory agreement reflecting the required standards.

  • Rights of Subscribers as data subjects

To ensure that each Subscriber is in control of the personal data concerning them, we ensure each data subject has the following possibilities, based on the available technologies:

  • they can manage their own account and change/delete/edit the data;
  • can delete/manage cookies from their own browser;
  • can choose their own options for their social media accounts (e.g. Facebook) regarding the distribution of data to other websites.

Moreover, as a data subject, according to Regulation EU 2016/679, the Subscriber benefits from rights set out below (we can request the Subscriber to prove their identity and capacity as holder of the 7card before processing their requests). We will try to reply as soon as possible to Subscribers’ requests, and no later than 30 days (or within a reasonable deadline, as per Regulation EU 2016/679).

Right to be informed. The subscriber is entitled to receive clear, transparent, easy to understand and easily accessible information on how we process their personal data, including details on their rights as a data subject. This information is presented in this Notice.

Right to access to personal data. The Subscriber is entitled to access their data that we process according to this Notice; we will not collect any fees for the first requests. If the Subscriber requests copies of the data already provided, we can collect a reasonable fee, taking into account the administrative costs for data provision. We reserve the right to reject excessive and/or repeated requests.

The request for access will be submitted by the Subscriber to:

  • E-mail: 7card@benefitseven.ro

Right to rectification. The subscriber who finds data regarding them and that we process is inaccurate, incomplete or incorrect:

  • Can send us a rectification request to e-mail 7card@benefitseven.ro;

Right to oppose direct marketing. The subscriber may oppose at any time and unsubscribe from our direct marketing materials. This can be done solely by either accessing the unsubscribe link in each communication that we send, or by written request sent to 7card@benefitseven.ro.

The withdrawal of consent (unsubscribing or written request) does not affect the legality of consent-based processing before the withdrawal occurs.

The right to oppose our processing based on legitimate interest. The subscriber may at any time oppose the processing based on our legitimate interest. In the section “Legal grounds” of the table above, you can easily identify the cases when we process personal data based on our legitimate interests. The subscriber can exercise their right to oppose by sending a written request to 7card@benefitseven.ro.

The right of erasure (right to be forgotten). The subscriber may request the erasure of personal data concerning them in any of the following situations: (a) the personal data are no longer necessary in relation to the purposes for which they were processed, (b) the Subscriber withdraws their consent on which the processing is based and we have no other legal grounds to continue processing, (c) the Subscriber opposes the processing for direct marketing purposes (including profiling for direct marketing purposes, if need be), (d) the Subscriber opposes the processing based on our legitimate interest and we are not able to provide a reason overriding their interests, rights and liberties, (f) the personal data was illegally processed, (g) the personal data must be erased for compliance with a legal obligation.

The right of erasure is not absolute. We can reject the request if (i) we have a legal obligation to store the data; or (ii) the data is required to assert, exercise or safeguard our rights in court.

The subscriber can request the erasure of data by e-mailing a request to 7card@benefitseven.ro.

Right to restriction of processing. The subscriber will have the right to obtain from Benefit Seven S.A. restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the Subscriber, for a period enabling Benefit Seven S.A. to verify the accuracy of the personal data;

(b) the processing is unlawful and the Subscriber opposes the erasure of the personal data and requests the restriction of their use instead;

(c) we no longer need the personal data for the purposes of the processing, but the Subscriber requests such data for the establishment, exercise or defence of legal claims;

(d) the Subscriber opposed the processing based on our legitimate interest pending the verification whether the legitimate grounds of the controller override those of the Subscriber.

The subscriber can exercise their right to erasure by e-mailing a request to 7card@benefitseven.ro.

Right to data portability. When we process the personal data of the Subscriber based on their consent or a contract, by automated means, the respective Subscriber can request the transfer of personal data which concerns him/her to: (a) the Subscriber, or (ii) another controller indicated by that Subscriber. The Subscriber can only request the transfer of personal data which the Subscriber themselves directly and actively provided us with (except any other data which we assumed or created/determined). The subscriber can exercise their right by e-mailing a request to 7card@benefitseven.ro.

Right to complain to ANSPDCP. If the Subscriber believes he or she was harmed by the processing of the data concerning them according to the terms of this Notice, the Subscriber can contact the Personal Data Protection National Supervisory Authority, at the website www.dataprotection.ro.

  • Technical and organizational measures on data processing

Benefit Seven S.A. undertakes to apply (and ensure their data processors also apply, acting in accordance with their instructions), in connection with the personal data mentioned herein, appropriate technical and organizational measures against the accidental or illegal destruction, loss, alteration or unauthorized access, particularly if the respective processing involves data transfer/transmissions within a network, and against any form of illegal processing.

Thus, we ensure the technical and organizational measures required to collect, process and store personal data safely, including against unauthorized access and processing. These measures amount to at least:

(i) administrative and organizational measures ensuring the confidentiality of persons who effectively access the data;

(ii) operational flows and procedures to ensure the exercise of rights by data subjects;

(iii) environments for safe hosting of data;

(iv) ensuring, by reasonable measures, the fact that our partners / subcontractors define and implement appropriate security measures on the personal data that we distribute.

Benefit Seven S.A. implements, in mutual agreement with each Customer, specific mechanisms and processes to fulfil the requests of Subscribers regarding the processing of personal data by Benefit Seven S.A.

  • Frequent questions regarding this Notice

We can answer any information request of a Subscriber in relation to this Notice. You can contact us as follows:

  • by e-mail, at: 7card@benefitseven.ro
  • by letter, at: 11 Zării Street, district 3, Bucharest
  • by phone, at: +40 21 539 7770
  • Relevant definitions

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data according to the law; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not;

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

“Subscriber / “7card Subscriber” / “User” – Employee or Companion, with the right to use the products and services within the 7card Program;

“7card Program” or “Benefit Program for Employees” or the “Program” – a set of offers selected by Benefit Seven SA, targeting the needs of the Employer (customer of Benefit Seven SA), products and services available for their Subscribers, provided for them during the validity period of the contract between the Employer of the Employee and Benefit Seven SA by the Partners of Benefit Seven S.A.

“Program Rules/Conditions of Use” – the entirety of instructions, rules and regulations on the access of Subscribers to the services from the Program contracted by the customer in their relation with Benefit Seven S.A.

This Notice enters into force on 25 May 2018. This Notice is available on www.7card.ro and into the 7card application. Benefit Seven S.A. may amend this Notice at any time, with prior notice to the Subscribers.

BENEFIT SEVEN S.A.