POLICY FOR PERSONAL DATA PROCESSING

Below we explain to you the Confidentiality Policy of our partner’s online Offers, available on their website https://swissgroupinternational.com/or at their agents and within our website, www.stareast.net. 

By ”Offer” we mean our partner’s business, which consists in one ore several services such as: organization of air transportation services, booking, intermediation and sale of flight tickets, additional services, or association of such services for the general public and/or commercial customers. Our Offers are not for contracting by persons aged under 18 years.

We, Star East Airline SRL or Star East Ltd., namely the group of companies Star East, with the main headquarters in Bucharest, 67A, Somesul Rece St., district 1, with registration number with the Trade Register J2017002010401, fiscal code RO37088193, EU Identifier (EUID) within Business Registers Interconnection System (BRIS) ROONRC.J2017002010401 are a personal data processor for you, as user of our Offers, within the meaning of data protection regulations.

Our contact coordinates:
Bucharest, district 1, 
67A, Somesul Rece St., 
phone +40314.334.448, 
e-mail: [email protected] 

Star East respects confidentiality and will process personal data in technical and organizational conditions that are adequate in terms of security, according to the Data Processing Policy, adopted in accordance with the Regulation (EU) 2016/679 (”GDPR”).
By this document, we want to inform you about (i) nature of the personal data that we process for our online and offline Offers, (ii) purpose of processing and (iii) the legal reason for processing. 

You may contact the Data Protection Officer at the address [email protected]. !!! This address is monitored by our DPO and no request, other than data protection related, will be replied to.

Personal data is any information related to a natural person identified or identifiable. A person is identifiable if the identification can be made directly or indirectly, particularly by reference to an identification element such as surname, given names, identification number, localization data, an online identifier, or to one or several elements specific to her/his physical, physiological, genetic, psychic, economic, cultural or social identity. Information that cannot be associated to your identity (such as the number of accessing for an Offer or other statistical data) is not personal data. 
In principle, you may examine our Offers without disclosing personal data. Nevertheless, using the online contact form implies disclosure of personal data.
In general, we collect personal data directly from the persons concerned. If your personal data were provided to us by a third party or reached us by error, all the remedies stipulated by law for such a purpose are available to you, to erase the data.

Your data are stored by our means, on servers with special protection. The data are protected by the technical and organizational measures that we have taken in order to prevent loss, destruction, unauthorized access, alteration and dissemination. Access to your data is allowed only to a limited number of authorized persons. The authorized persons are responsible for the technical, commercial or operational management of the servers and of the Business.
Your data that are sent by Internet are encrypted. We use an SSL (Eng. Secure Socket Layer) certificate to send data.

If we obtain your consent to process personal data, Article 6 para. (1) let. a) of GDPR serves as the legal reason for our processing.
If we process personal data because they are necessary for us to implement a contract or in a quasi-contractual framework (for example, to send you a tailor-made Offer, suitable to your needs), then Article 6 para. (1) let. b) of GDPR serves as legal reason for us to process the data.
If we process personal data to fulfill an obligation that we have according to the law, then Article 6 para. (1) let. c) of GDPR serves as legal reason for us for such processing.
Article 6 para. (1) let. f) can serve for us as legal reason if processing of personal data is necessary to serve a legitimate interest of Star East or of a third party, only to the extent to which your interests, rights and fundamental freedoms are not affected. 
By this Data Processing Policy, we will present to you step by step our legal reason for each category of personal data processed.

In general, we erase personal data if they have been processed for a single purpose, which has been reached. Nevertheless, certain personal data may be subject to certain obligations to store them for certain periods of time, according to the applicable legal provisions. Star East erases or restricts or other ways limits the access to personal data in safe conditions until the end of those periods of time is reached.

Each time our Offers are accessed, we collect the following data regarding the device used for access: device used, IP address, web navigator used and the date and hour of the access. We collect information regarding the Offer viewed, version of web navigator, operating system and Internet service provider. We also monitor the websites from which you have been redirected to that Offer. 
We use such processing to support our legitimate interest, to be able to display the accessed pages in a manner compatible with the device you use for accessing. Among other things, we process such data with the purpose to find certain errors, quantify the interest generated by certain Offers and proceed with adapting or improving the Offers. This purpose justifies our legitimate interest, legally based on Article 6 para. (1) f) of GDPR.
IP address is kept only during the session and it is erased or encrypted at the end of the session. All the data processed for this purpose are stored for limited durations.

We use cookies to personalize content and ads, provide social network functions and analyze the traffic. In addition, we offer to our social network, advertisement and analysis partners information regarding the way in which you use our website. They may combine it with other information provided by you or collected after using their services. In case you choose to continue to use our website, you agree with the use of our cookie modules. 
We invite you to read our Cookies Policy in order to express your options. 

In view of initiating a contractual relation with us or with our partner, for provision of certain services by us, you will be redirected to their website, where the partner’s policies will be fully applicable, so we are encouraging you to read those attentively and make sure you fully understand them prior to any further personal data disclosure.
The personal data disclosed in this way are processed by our partner for the duration necessary to fulfill the contract. We may process such data also in order to fulfill some obligations after the contract ends, such as provision of post-sale services or fulfillment of commercial or legal obligations, for the period of time stipulated by law. The deadline stipulated by law for storing data is 10 years, starting with the year following the year in which the services were provided.
In the context of fulfilling its contractual and/or post-contractual obligations or of some services related to the Offer, Star East processes personal data directly, in association with other companies or governmental authorities, or it ensures the interface with the providers of related services.
To fulfill the contractual obligations that result from the acceptance of our Offer, we work with various companies specialized in provision of various services that compose our Offer or related to it (such services include, but are not limited to: booking of tickets, air transport, travel insurance, obtaining a travel visa, obtaining funds to pay the Offer, payment processing, document archiving, etc.).
Depending on the characteristics of the Offer, your personal data may be sent to entities with headquarters outside the European Union, including countries in which the European Commission has not recognized a proper level of protection of the personal data. We regard your option for an Offer as an express and unequivocal consent, of you and of the other beneficiaries of the Offer, for the transfer of personal data to such recipients. 
In this context, we are responsible only for the transmission of data necessary for fulfillment of contractual obligations. We cannot be held responsible for the manner in which such entities protect the personal data disclosed by us following your express option.
Despite the measures taken to protect your personal data, we caution you that sending information by Internet, in general, or by means of other public networks, is not entirely safe, and there is a risk for the data to be seen and used by unauthorized third parties. We cannot be held responsible for such vulnerabilities of the systems beyond our control. 
We monitor continuously our partners’ compliance with the provisions on personal data processing, at least at the same level as we do. The personal data that we disclose to them are limited only to the data necessary for providing the service included in or related to the Offer.

You have the possibility to contact us directly, by using the address indicated on the website. On the other hand, Star East may send you regularly information by e-mail, by means of our newsletter to which you may subscribe.

Contact 

You may contact us using any of the contact means that we have described in the introductory part of this Policy or any of the data presented on the website, namely by phone, e-mail, mail or courier. In this context, we will process exclusively the personal data related to the communication channel that you choose, namely: phone number, correspondence address, e-mail address or fax number, associated to your name.
We will use the personal data collected in this way only for the purpose to reply to your request or to remedy the issue submitted to us by any of such means.
During the time stipulated for storing personal data within such communications, you have the possibility to exercise any of the rights that we guarantee to the persons concerned, according to the law, as detailed in this Policy.
Exception from the duration of processing mentioned above is the case when such requests generate commercial or fiscal obligations for us. In such cases, the personal data relevant for replying to the request will be stored by observing the applicable legal deadlines. 
The legal reason of the processing of personal data during the communications with us is Art. 6 para. (1) let. b) of GDPR.

You may unsubscribe from such commercial communications by pressing ”Unsubscribe” in any of the communications that we will send to you. Accessing the Unsubscribe option is a valid and sufficient withdrawal of your consent.

On our website you find connections to the websites of our partner, depending on your interaction options. Accessing these connections leads you outside our website. Our Data Processing Policy does not apply also to such websites. You may find details regarding the data proccesing policy for each of these connections at their corresponding links.

Under GDPR, the persons concerned have several rights. If you want to exert any of these rights or to obtain additional information regarding the processing of personal data, please contact us. The main rights of the persons concerned are as follows:

1. Right to be informed means that you are informed about the purpose, means and duration of the processing conducted by us on your personal data. By this Policy we consider that we have informed the persons concerned about the processing conducted. If you think you are not fully informed by the publication of this Policy and by the information provided, we invite you to exert one of the rights below: 

2. Right of access means you have the right to obtain access to the personal data processed by us and in relation to the purpose, means and duration of processing. To exert this right, we recommend you to fill in the application form;

3. Right to data rectification enables you to intervene, according to Article 16 of GDPR, whenever your personal data processed by us are incorrect or incomplete. To exert this right, we recommend you to fill in the application form;

4. Right to restriction of processing enables you, according to the provisions of Article 18 of GDPR, to ask us to restrict the processing of certain personal data related to you. To exert this right, we recommend you to fill in the application form;

5. Right to object to processing gives you the possibility to object to processing whenever the processing of your personal data by us is made by having your consent as sole legal reason for processing those data. To exert this right, we recommend you to fill in the application form;

6. Right to data portability can be exerted only in relation to the personal data processed by automated means and it enables you to receive data processed by us in a structured, commonly used and machine-readable format. To exert this right, we recommend you to fill in the application form;

7. Right to data erasure can be exerted within the limits described at Article 17 of GDPR and it enables you to ask from us, on certain conditions, to erase the personal data related to you. To exert this right, we recommend you to fill in the application form.

We are obliged to reply to any of your requests related to the exertion of a right, within 30 days after the date of receiving the full request. In case you have not received a reply from us by the deadline, you have the right to contact the National Supervisory Authority for Personal Data Processing: 
www.dataprotection.ro 
28-30, G-ral. Gheorghe Magheru Bvd., District 1, postal code 010336, Bucharest, Romania, 
e-mail: anspdcp[at]dataprotection.ro 
fax: +40318.059.602.
When we think it is opportune or the law imposes it on us, we reserve the right to amend the data protection practices, and to update and amend the Data Processing Policy any time. This Data Processing Policy is updated on the date written in the upper side of a document, and the previous versions are available below.