Privacy Policy

Who is the controller of personal data?

COMPLEXUL NATIONAL MUZEAL ASTRA SIBIU, located in Sibiu, Pădurea Dumbrava, nr. 16, Sibiu county, CUI 4406304, www.muzeulastra.ro, email: office@muzeulastra.com is the controller of the personal data you submit to us and is responsible for your personal data in accordance with applicable data protection legislation.

Why do we use your personal data?

We use your personal data to issue your access pass to the ASTRA National Museum Complex and to generate invoices (on request) for the services provided.

What types of personal data do we collect?

We will process the following categories of personal data: - name, surname, address, series and ID number, matric number (in the case of pupils/students), pension file number (in the case of pensioners), disability certificate number/disability decision number (in the case of persons with disabilities and accompanying person), unemployment card number, war veteran or former political prisoner card number.

Where do we store your data and for how long?

Your data is stored in an electronic database and is kept for the duration of the contractual relationship and, after its completion, at least for the period required by the applicable legal provisions in the field and for the period during which the institution is legally obliged to keep correspondence with third parties.

Who has access to your data?

The categories of recipients of personal data are: the data subject, the cashier of the institution, local or county public authorities or institutions in strictly determined cases in compliance with the law.

What is the legal basis for processing personal data?

• The collection, archiving and processing of data subjects' data for the purposes mentioned above are based on legal grounds:
  
  • the person's consent when agreeing to the issuing of the subscription or the issuing of the invoice;
  • the legal obligation of the C.N.M. ASTRA;
  • the legitimate interest of the C.N.M. ASTRA, for activities such as: carrying out statistical analysis and internal reporting or reporting to the relevant state or government authorities, institutions or agencies.

What are your rights?

Please be informed that you can exercise all your rights under Regulation 679/ 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, such as:

• Right of access to data: any data subject has the right to obtain from the ASTRA National Museum Complex, upon request (free of charge, for one request per year), confirmation as to whether or not his/her personal data are being processed by it, as well as the following information:
  
  • information on the purposes of the processing, the categories of data concerned and the recipients or categories of recipients to whom the data are disclosed;
  • communication in an intelligible form of the data undergoing processing and of any available information as to the origin of the data;
  • information on the principles of operation of the mechanism by which any automatic processing of data relating to that person is carried out;
  • information on the existence of the right to intervene on the data and the right to object, as well as the conditions under which they can be exercised;
  • information on the possibility to consult the register of personal data processing operations, to lodge a complaint with the supervisory authority and to appeal to the court against decisions, in accordance with the legal provisions.

The ASTRA National Museum Complex is obliged to provide the requested information within 30 days from the date of receipt of the request.

• Right of intervention on data: any person concerned has the right to obtain, free of charge, from the ASTRA National Museum Complex, by means of a written, dated and signed request:
  
  • rectification, updating, blocking or deletion of data whose processing is not in accordance with the law, in particular incomplete or inaccurate data;
  • anonymising data whose processing does not comply with the provisions of GDPR/2016;
  • notification to third parties to whom the data have been disclosed, unless such notification proves impossible or involves a disproportionate effort compared to the legitimate interest that might be harmed.

The ASTRA National Museum Complex is obliged to communicate the measures taken and, if applicable, the name of the third party to whom personal data relating to the data subject have been disclosed, within 30 days of receipt of the request.

Right to object: the data subject shall have the right to object at any time, by means of a written, dated and signed request, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, unless otherwise provided for by law. In case of justified objection, the processing may no longer concern the data concerned.

The data subject shall have the right to object at any time, free of charge and without justification, to the processing of data relating to him or her for direct marketing purposes on behalf of the controller or of a third party, or to their disclosure to third parties for such purposes.

The ASTRA National Museum Complex is obliged to inform the data subject of the measures taken and, where appropriate, the name of the third party to whom personal data relating to the data subject have been disclosed, within 30 days of receipt of the request.

The right to address the National Supervisory Authority for Personal Data Processing or the courts to defend any rights guaranteed by the GDPR/2016 that have been infringed.

How can you exercise your rights?

We attach great importance to the protection of personal data and therefore have dedicated customer service staff to handle your requests in relation to your rights mentioned above. Our staff is always available to you at dpo@muzeulastra.com

The right to lodge a complaint with a supervisory authority

If you are of the opinion that the ASTRA National Museum Complex is processing your personal data incorrectly, you can contact us. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or with the courts to defend any rights guaranteed by the GDPR/2016 that have been violated.

Privacy Notice Updates

We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website. We will communicate any significant changes to the Privacy Notice, for example the purpose for which we use your personal data, the identity of the controller or your rights.