In accordance with the provisions of the General Data Protection Regulation (hereinafter referred to as "GDPR"), Corporate Counseling Services SARL (or "the Company") has the obligation to process personal data (as defined by the applicable law) in safe conditions, for the general purposes specified in this Policy, in the context of providing the medical/psychological services that you benefit from within our clinics
I. GENERAL INFORMATION
This Policy wishes to explain to you how your personal data is processed by Corporate Counseling Services S.A.R.L. and by ensuring that your personal data is processed responsibly and in accordance with the applicable data protection laws.
Personal data (representing any information that may lead to the identification of a natural person) is detailed in section 6 below, being defined in consideration of the applicable legal provisions.
For the purposes of this Policy, we hereby notify you that Corporate Counseling Services S.A.R.L. is a Personal Data Operator, as defined by GDPR.
Our intent is to provide you with sufficient information, presented in an easy manner, to ensure understanding of the processing operations that Corporate Counseling Services S.A.R.L. performs them, ensuring that their confidentiality is respected in the applicable legal context.
For any details that may be required to understand this Policy or the processing of your personal data, we offer you the opportunity to communicate any concerns or requests you may have, using the contact details indicated at the end of this Policy.
II. OPERATOR IDENTITY AND CONTACT DATA
III. Reasons for collecting and processing information about you
Corporate Counseling Services S.A.R.L.may collect information about you because you are a patient or client of hers. She processes the data because it is in her legitimate interests as clinical psychologist to do so. As a psychologist, she needs to see and analyse documents containing this information to provide her expert advice, to carry out an assessment or to deliver psychological intervention.
Another lawful reason for her processing your data may be Legal Obligation. If Corporate Counseling Services S.A.R.L.is processing “special category data” about you, this is her second lawful reason to do so. This is likely to apply in regards to a litigation claim.
As a client or patient of Corporate Counseling Services S.A.R.L.their lawful reason for processing “special category data” is that it is necessary for the purposes of the provision of health or social care or treatment.
The processing of personal data is done in optimal security conditions and for legitimate purposes mainly related to the performance of medical / psychological services, financial and / or legal consignment, specific to the operator's activities, as well as related financial-accounting activities , the ones related to the human resources activity or necessary in the relationship established by the contract of services rendered with the employer of the targeted persons, Every time we request the collection, subsequent processing and eventual transfer of personal data, the use will be made only for the mentioned purpose, for other purposes, your agreement will be requested.
Your personal data indicated in section 6 below will be processed for the following purposes:
- Provision of psychological / financial / legal counseling services through the EAP service:
Provide the psychological / financial / legal counseling services requested by you, establish a diagnosis / financial / legal situation, record the services provided, communicate with you about the services provided, inform you about the services provided, activate and / or adjust your subscription to our services, appointments, your identification and the services you have accessed. The operator provides EAP services to employees of the Beneficiaries for whom they provide these services (hereinafter referred to as "patients" or "Users") to study, prevent, reduce or eliminate the exposure of Users psychosomatic risks at work and in their personal environment.
The contractual relationship is established between the Operator and the Employers, while the users are employees of the Beneficiaries or close relatives of the Patients.
- Medical statistics:
Processing for this purpose will be done only at the written request of the status institutions with attributions in the field of statistics. Your personal data remains secure and confidential and is not disclosed to third parties.
- Compliance with legal obligations:
Processing to meet the various legal obligations of our Company (such as financial, health, security, archival storage or other obligations imposed by applicable laws).
- Improving services:
Identify issues or possible relevant issues related to existing services in order to improve them, implement new services or enhancements to existing ones, resolve your complaints.
- Call-center Telephone Call Recording:
The Call Center of our Society is a support service for the provision of psychological counselling services for appointments, requests/notifications/information provision, etc.
- Settlement of disputes:
The persons empowered by us with your data processing assume responsibility and ensure security only for that information, personal data and special categories of personal data (physical and mental health data, genetic data, if applicable, data biometrics) that are offered and processed by our staff (including psychologists) exclusively and by the cumulation of the following coordinates:
- in the clinic of the processors, empowered by us
- in computer and/or electronic systems/instruments/devices, hardware and software, our records and forms and
- within the work schedule of our company.
Our company is not responsible for the processing carried out in any form beyond the above-mentioned coordinates (including the exchange/recording of personal information/data in psychological and patient talks).
IV. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
The legal bases of the processing operations of the Personal Data developed by us are the following:
1. Legal grounds for the processing of personal data falling within the category of personal data categories (according to Article 6 of GDPR). Personal data that does not include special categories of personal data (as defined in Article 9 of the GDPR) is processed by Corporate Counseling Services S.A.R.L. based on the following legal bases:
- principally to take action upon your request, based on your explicit and unambiguous consent - this agreement is requested:
- before your initial phone call with our call-center operator. Through this conversation, you ask the operator for a psychological evaluation / counseling schedule. Before you start a call with our operator, you will hear a message that will contain summary informations about our data processing policy, if you accept, you will press a key on the phone, indicated in the message, meaning your agreement, a positive and unequivocal action for the processing of personal data by the controller. The data collected by our operator will be minimal, such as name, surname, employer, psychological issues expressed in the easiest way. Based on these data, you will receive a schedule.
- by filling in a form in the clinics of the processors empowered by us or by the psychologists' cabinets, after a notice informs you of the provisions of our data processing and confidentiality policy.
- call-center calls are recorded on the basis of the prior written consent of the caller, the processing aimed at preventing misinterpretation of the informations transmitted by any of the participants in the conversation, the clarification of some situations exposed in the telephone communication in case of doubt or confusion, handling situations in which conversations contain indications of what can be done to the security and integrity of the person and property
- In view of the other purposes for which we process your personal data, the basis for such processing may be the fulfillment of the Company's legal obligations (including archiving, health, security, keeping records, requesting a public authority and other obligations which legislation imposes);
- In certain circumstances, we will process your personal data under a legitimate interest of Corporate Counseling Services S.A.R.L. or of a third party (such as: preparing medical records, recording appointments in our electronic system, solving claims and complaints received from patients, providing emergency medical assistance, concluding and executing contracts for the provision of medical services with partner clinics to provide it with as much territorial coverage as possible and a range of medical services, video camera surveillance to ensure the security of goods and people.
Processing is necessary to allow the establishment, exercise or defense of a right in court, since, during the relationship established with our Company, such situations can not be excluded in the context of the services provided (to the extent that such disputes are addressed to the courts).
- considering certain situations in which you may be (physically or legally) in difficulty to express your consent for processing (for example, emergency situations), your personal data will be processed to protect your vital interests or other individuals;
- processing is necessary for reasons of public interest in public health (such as: protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicines or medical devices, pursuant to European Union law or national law); and / or health or social care services;
2. Legal bases for the processing of personal data falling within the special data category (according to Article 9 of GDPR)
In considering the specific activity / services provided by Corporate Counseling Services SARL, we will process your personal data that falls under the special data category (as defined under Article 9 of the GDPR) on the basis of the following legal bases will apply in addition to the detailed grounds of Article 6 of GDPR):
- in order to establish a diagnosis for the provision of psychological assistance
- establishing treatment, or managing health care systems and / or services or psychological assistance;
- providing financial assistance;
- providing legal assistance.
V. PERSONAL DATA CATEGORIES. CONSEQUENCES OF THE REFUSAL OF THE PROVISION OF PERSONAL DATA
What type of personal data is collected and processed
Data source. The personal data that concerns you that will be processed by us are:
- data obtained from your employer,
- data obtained directly from you in the context of the services provided, or
- data / results obtained as a result of providing services by the Corporate Counseling Services Company S.A.R.L. (and / or data processors)
The personal information you provide on telephone, e-mail, or clinic (name, surname, phone, email, date of birth, symptoms, data on the analyzes and investigations you have or you wish to perform, National Identification Number) are registered and processed by Corporate Counseling Services SARL only to the extent that this information was provided by you without any constraint and prior information.
Corporate Counseling Services S.A.R.L. assume no responsibility for the incorrect information / data / data you provide us. You have the obligation to submit any changes that occur to personal data so that they are permanently accurate and current. If Corporate Counseling Services S.A.R.L. has suspicions about the authenticity of the documents or information provided, is entitled to notify the public authorities / institutions with investigation, supervision and control competencies.
Personal data includes the following categories of data:
- Identification / contact details such as: name and surname, home address / residence, telephone (fixed and / or mobile) and / or fax number, e-mail address, correspondence address;
- Personal data, such as: date of birth; sex; age; series and ID number; national identification number, other information included in the identity card; video images (obtained from video recordings made in our rooms, where video surveillance cameras are mounted); voice (based on call records made through the Corporate Counseling Services S.A.R.L.), signature;
- Medical data (physical or mental - also included in the category of special data), such as health data for services rendered (such as: services you visit in our partner clinics; we do or provide you with the treatment that we prescribe or administer to you, the psychologist you have or you have accessed, medical recommendations, symptoms, medical history, previous diseases, information you provide with look at your family members, if any); physical characteristics (various affections); genetic data (if applicable); genetic data; biometric data; biological samples;
- Financial-accounting data, whether or not necessary for the data subject;
- Data of a legal nature, belonging to or necessary to the data subject;
Please note that, in principle, there is no obligation for you to provide us with your personal data indicated in this Policy. However, insofar as you do not provide us with your personal information described above, we will not be able to provide you with the requested services and / or you will not be able to take advantage of all the facilities that Corporate Counseling Services S.A.R.L. (for example: failure to communicate the telephone number / email address will not allow us to communicate with you regarding the confirmation / possible changes to the schedules or to send you the result of the medical services performed, situations in which communication or lifting results will be done at the receptions of our partner clinics).
If, in the context of services that Corporate Counseling Services S.A.R.L. provide you with personal information about others other than you (such as the possible affections that were found in the family), we will inform you that we will treat this information as confidential and we will only use for the purpose of rendering services to you.
At the same time, we are committed to ensuring that we take all necessary measures to ensure the proper protection of this information, also taking into account the obligation of Corporate Counseling Services S.A.R.L. professional secrecy.
VI. DESTINATIONS OR CATEGORIES OF DATA DESTINATIONS PERSONAL
Who we might share personal information with
In principle, your personal data will only be processed by Corporate Counseling Services S.A.R.L.
Considering both the complexity of services made available to you by our Company, the need for Corporate Counseling Services S.A.R.L. to appeal to certain external partners that support our business, we wish to inform you that your personal data may also be forwarded to other individuals or legal entities to be processed for the purposes detailed in this Policy.
Taking into account the context of relationships established by Corporate Counseling Services S.A.R.L. with its partners, as well as the possibility of making changes regarding these relationships, it is not feasible to identify all these partners nominally, which will be generically mentioned, depending on the established / potential relationship with Corporate Counseling Services S.A.R.L.
In this regard, your personal data may be forwarded to:
- Processors - collaborators psychologists and accredited psychological services providers.
- Psychological services can also be provided through accredited specialist service providers - partner psychologists and partner clinics of Corporate Counseling Services S.A.R.L. - from the country or abroad.
- In this respect, we inform you that your health data / information, regardless of its content or volume, will be communicated to accredited healthcare providers in the country or other countries (whether it be a state in the European Union or outside the European Union), in accordance with the applicable legal provisions.
- Corporate Counseling Services S.A.R.L. makes every effort to ensure that collaborating psychologists and other accredited providers comply with the provisions of the legislation on personal data protection. Prior to performing the service provided, where required by law, you will receive the Consent Form through which you will be provided with data and information about the Company's partner, and the context in which your personal data are processed by the processors.
- The situation of the institutions and / or the judicial, research, supervision and control authorities
- To the extent that, in accordance with the legal provisions in force, personal data / information is requested by our Society of various bodies and / or institutions (for example: criminal investigation bodies, police, financial control, tax, social security, courts of law and any other supervisory and control institutions and / or authorities), Corporate Counseling Services SARL has the obligation to provide the requested data / information without requesting prior consent, including in case you oppose or do not express your point of view. In addition, it may be necessary in certain circumstances such data / information to be made available without prior request of these institutions, bodies and / or authorities, in which Corporate Counseling Services S.A.R.L. will transmit the necessary data / information in accordance with legal requirements.
- Other physical / juridical persons who have access to your data
- To your personal data also has access to other physical / legal persons, such as IT service providers or technical and organizational services related to maintenance related medical equipment, payment services, archiving services, legal consultants , auditors, financial-accounting consultants or other Company's consultants, in connection with extraordinary business operations (for example, in the case of mergers, acquisitions, etc.) with which the Company will enter into confidentiality agreements accordingly (to the extent that certain statutory and / or statutory and / or statutory requirements and / or guarantees will not apply to them) Your personal data may also be transmitted to other natural or legal persons in Romania or abroad the context necessary for the establishment, exercise and / or defense of a Corporate Counseling Services S.A.R.L rights.
The Company will exercise due diligence in selecting service providers and / or its partners and will require that these suppliers / partners maintain appropriate technical and organizational security measures to protect your personal data that they have access to and processed in accordance with the applicable legal provisions.
If the personal data processing operations are to be performed by Corporate Counseling Services S.A.R.L. by means of processors, our Company will ensure that the specific requirements imposed by the provisions of art. 28 of GDPR, ensuring, among others, that:
- the respective personal data processing operations are performed on the basis of a contract / agreement regulating the issues specific to the processor - operator relationship, according to the GDPR and
- the processors to affect the processing of personal data on the basis of the Corporate Counseling Services S.A.R.L instructions.
What we will NOT do with your personal information
We will not share your personal information with third-parties for marketing purposes.
VII. TRANSFER TO THIRD COUNTRIES
In certain specific situations, your personal data will be transferred to entities located in other countries within the European Union and / or the European Economic Area.
There are also situations when your personal data will be transferred to entities outside of the European Union and / or the European Economic Area (such as Canada, Australia, New Zealand). In such cases, we will ensure that appropriate safeguards are in place to enable the transfer properly, in accordance with the requirements of the legislation on the protection of personal data (safeguards that may include: the application of standard contractual data protection clauses or the existence of a Commission decision European Union adopted in this respect).
In each case, in order to effect the actual transfer, you will fill in the Consent Form to express your explicit consent to the situation imposed by the service, the health status, etc.
VIII. THE PERIOD FOR WHICH THE PERSONAL DATA SHALL BE STORED
How long your personal information is stored for
We keep your personal data accurate and up-to-date. We also strive to keep your personal data no longer than is necessary to fulfill the purposes listed in this Policy or the obligations set forth in applicable law.
In this respect, we inform you that we will store your personal data for the entire period of your established relationship with your Employer and then for a certain period of time, considering the applicable legal provisions. Thus, personal data will be retained for a period of time below:
- Special data collected by data processors, psychologists, psychology clinics, psychological services providers will be kept for the years from the end of the therapy. Only you and the psychologist will have access to them. They will then be deleted or destroyed in accordance with the CCS SARL Data Storage Policy. During the retention period by the person empowered, this will be done under conditions of maximum security according to the legislation in the field.
- To the extent that certain personal data are included in or relate to certain Company accounting records for which a specific retention period (eg 5 or 10 years) has to be respected, such personal data will be retained for those applicable periods.
- With regard to images obtained through video surveillance, they shall be kept for a maximum of 30 calendar days from the date of the filing, except where a longer period is permitted or required by the applicable law.
- Calls made through the Corporate Counseling Services S.A.R.L., are recorded and maintained for a period of 3 years from the date of registration, except when a longer period is permitted or enforced under the applicable law.
- Minimum data, name, first name, employer, number of therapy sessions will be communicated by the Corporate Counseling Services SARL, who will use them to report the services offered to the targeted persons, their employer with whom he has signed a contract providing services. These data will not be used for other purposes. The retention period is set according to the contractual reporting period, can’t be longer than 1 year.
- Consignment Forms will be archived, and kept for 3 (three) years.
IX. YOUR RIGHTS IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA
Corporate Counseling Services S.A.R.L.are committed to protecting your rights to privacy. They include:
- Right to be informed about what we do with your personal data
- Right to have a copy of all the personal information we process about you
- Right to rectification of any inaccurate data we process, and to add to the information we hold about you if it is incomplete
- Right to be forgotten and your personal data destroyed
- Right to restrict the processing of your personal data
- Right to object to the processing we carry out based on our legitimate interest
- Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing and refer the matter to the competent courts of law.
In your request, you can tell if you want your information to be communicated to a specific address (which may also be an e-mail address) or a mailing service to ensure that the handover is done personally.
The requested information will be communicated within 30 days from the date of receipt of the request, with respect to your possible communication option. If it is not possible to comply with the above-mentioned term, you will be informed of the reason for the postponement of the response, also communicating the procedure that is being considered for the settlement of your claim as well as the estimated term.
X. THE ABSENCE OF AN AUTOMATIC DECISION PROCESS
Considering the specific relationship established between Corporate Counseling Services S.A.R.L. and you, we inform you that you will not be the subject of a decision based exclusively on automatic processing, including profile creation, which produces legal effects that affect you or similarly affect you to a significant extent.
XI. PROCEDURE APPLICABLE IN THE EVENT OF INFRINGING PERSONAL DATA
In the case of a personal data breach, the Controller shall notify the competent Supervisory Authority without undue delay and, if possible, not later than 72 hours from the date of becoming aware of it, unless a violation of personal data is unlikely to lead to a risk to the rights and freedoms of individuals. If the notification to the Supervisory Authority is not made within 72 hours, it shall be accompanied by the reasons for the delay. Corporate Counseling Services S.A.R.L has developed an own procedure applicable to security breaches, which can be consulted on request.
XIII. RIGHT TO SUBMIT A COMPLAINT TO THE SUPERVISORY AUTHORITY
If you are not satisfied with the way we process your data, we would prefer you to contact us directly in order to be able to resolve your issue. However, if you still have any complaints, you may contact the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro ):
XIV. PUBLICATION OF THE CONFIDENTIALITY POLICY
The Operator will publish this Policy on its website ( www.ccsint.com ). In the case of a particular request by a person, the Operator will send this Policy directly to that person
XV. FINAL PROVISIONS
This Policy enters into force on the date of its publication.
The provisions of this policy will also apply to data processed at the time of entry into force of this Policy.
From the date of entry into force, this policy replaces and abrogates the previous data processing policies in force with the Operator.