**GDPR COMPLIANCE POLICY FOR QUANTUM MEDICAL SRL**
**Effective Date:** 2022 April
**1. INTRODUCTION**
1.1 **Purpose**. Quantum Medical SRL (“Company,” “we,” “us,” or “our”) is committed to complying with the General Data Protection Regulation (GDPR) (EU) 2016/679, which is designed to protect the privacy and personal data of individuals within the European Union (EU). This GDPR Compliance Policy (“Policy”) outlines how we collect, use, and protect personal data in accordance with GDPR requirements.
1.2 **Scope**. This Policy applies to all personal data processed by Quantum Medical SRL, including data collected through our website, PULSAR software, and any related services (collectively, “Services”). It applies to personal data of individuals within the EU and the European Economic Area (EEA) as well as any data that we process on behalf of others.
1.3 **Controller and Processor Roles**. Quantum Medical SRL may act as a data controller, data processor, or both, depending on the context of the data processing activities. As a data controller, we determine the purposes and means of processing personal data. As a data processor, we process personal data on behalf of another data controller.
**2. DATA PROTECTION PRINCIPLES**
Quantum Medical SRL adheres to the following principles when processing personal data:
2.1 **Lawfulness, Fairness, and Transparency**. Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
2.2 **Purpose Limitation**. Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
2.3 **Data Minimization**. Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
2.4 **Accuracy**. Personal data shall be accurate and, where necessary, kept up to date. Inaccurate personal data shall be erased or rectified without delay.
2.5 **Storage Limitation**. Personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
2.6 **Integrity and Confidentiality**. Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.
2.7 **Accountability**. We shall be responsible for, and be able to demonstrate compliance with, these principles.
**3. LEGAL BASES FOR PROCESSING**
3.1 **Consent**. We may process personal data where the data subject has given clear and explicit consent to the processing of their personal data for one or more specific purposes.
3.2 **Contractual Necessity**. Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
3.3 **Legal Obligation**. Processing is necessary for compliance with a legal obligation to which Quantum Medical SRL is subject.
3.4 **Legitimate Interests**. Processing is necessary for the purposes of legitimate interests pursued by Quantum Medical SRL or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
3.5 **Vital Interests**. Processing is necessary to protect the vital interests of the data subject or another natural person.
3.6 **Public Interest**. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
**4. DATA SUBJECT RIGHTS**
Under GDPR, data subjects have the following rights:
4.1 **Right to be Informed**. Data subjects have the right to be informed about the collection and use of their personal data. We provide this information through our Privacy Policy.
4.2 **Right of Access**. Data subjects have the right to access their personal data and receive a copy of it upon request.
4.3 **Right to Rectification**. Data subjects have the right to request the correction of inaccurate or incomplete personal data.
4.4 **Right to Erasure** (“Right to be Forgotten”). Data subjects have the right to request the deletion of their personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
4.5 **Right to Restrict Processing**. Data subjects have the right to request the restriction of processing of their personal data under certain circumstances.
4.6 **Right to Data Portability**. Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller.
4.7 **Right to Object**. Data subjects have the right to object to the processing of their personal data based on legitimate interests, direct marketing, or processing for research or statistical purposes.
4.8 **Rights Related to Automated Decision-Making and Profiling**. Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.
**5. DATA COLLECTION AND USE**
5.1 **Personal Data Collection**. We collect personal data in a manner consistent with the GDPR. This includes data provided directly by users, such as through forms on our website or software, and data collected automatically, such as IP addresses and browsing behavior.
5.2 **Purpose of Data Collection**. We collect personal data for specific, explicit, and legitimate purposes, including but not limited to:
– Providing and managing our Services.
– Communicating with users.
– Improving our Services and user experience.
– Complying with legal obligations.
– Marketing and promotional activities, where consent has been given.
**6. DATA SECURITY**
6.1 **Security Measures**. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and secure storage.
6.2 **Data Breach Notification**. In the event of a data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects. If the breach is likely to result in a high risk, we will also notify the affected data subjects without undue delay.
**7. DATA RETENTION**
7.1 **Retention Period**. Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. We regularly review our data retention practices to ensure compliance with GDPR.
7.2 **Data Disposal**. When personal data is no longer needed, we will securely dispose of it in a manner that ensures the data cannot be reconstructed or read.
**8. THIRD-PARTY PROCESSORS**
8.1 **Use of Third-Party Processors**. We may engage third-party processors to handle personal data on our behalf. All third-party processors are required to comply with GDPR and to provide sufficient guarantees to implement appropriate technical and organizational measures to protect personal data.
8.2 **Processor Agreements**. We enter into data processing agreements with all third-party processors, which outline their responsibilities and obligations with regard to personal data processing in compliance with GDPR.
**9. INTERNATIONAL DATA TRANSFERS**
9.1 **Data Transfer Outside the EEA**. Personal data may be transferred to, and processed in, countries outside of the EEA. In such cases, we ensure that the data is transferred in compliance with GDPR and that appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.
9.2 **Adequate Safeguards**. When transferring data outside the EEA, we will ensure that it is protected by adequate safeguards, such as:
– Binding corporate rules.
– Standard data protection clauses adopted by the European Commission.
– Approved codes of conduct or certification mechanisms.
10. DATA PROTECTION GOVERNANCE
10.1 Data Protection Responsibilities. Quantum Medical SRL has assigned specific responsibilities to ensure compliance with GDPR and the protection of personal data. These responsibilities are handled by our internal data protection team, which is committed to upholding data protection standards.
10.2 Data Protection Point of Contact. If you have any questions, concerns, or requests regarding data protection or this GDPR Compliance Policy, please contact our designated data protection point of contact at: [email protected] or +40 744 258 668.
**11. TRAINING AND AWARENESS**
11.1 **Employee Training**. We provide regular training to our employees on GDPR and data protection practices to ensure that they understand their responsibilities and how to handle personal data in compliance with the regulation.
11.2 **Awareness Programs**. We maintain ongoing awareness programs to keep our employees informed of the latest data protection practices, regulatory updates, and internal policies.
**12. DATA PROTECTION IMPACT ASSESSMENTS (DPIA)**
12.1 **When DPIA is Required**. We conduct Data Protection Impact Assessments (DPIAs) when processing is likely to result in a high risk to the rights and freedoms of individuals. This includes, but is not limited to, processing involving new technologies, large-scale processing, or systematic monitoring of public areas.
12.2 **DPIA Process**. The DPIA process involves:
– Identifying and assessing risks to data subjects.
– Implementing measures to mitigate identified risks.
– Consulting with the supervisory authority if necessary.
**13. CHILDREN’S DATA**
13.1 **Processing of Children’s Data**. Our Services are not intended for children under the age of 16, and we do not knowingly collect or process personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete the data as soon as possible.
13.2 **Parental Consent**. If the processing of personal data from children under the age of 16 is necessary, we will obtain verifiable parental consent in accordance with GDPR requirements.
**14. COMPLAINTS AND DISPUTES**
14.1 **Filing Complaints**. Data subjects have the right to file a complaint with a supervisory authority if they believe that their data protection rights have been violated.
14.2 **Internal Resolution**. Before escalating to a supervisory authority, we encourage data subjects to contact us directly to resolve any concerns or disputes related to personal data processing.
**15. CHANGES TO THIS POLICY**
15.1 **Policy Updates**. We may update this Policy from time to time to reflect changes in our practices, legal requirements, or other factors. We will notify data subjects of significant changes through our website or other communication channels.
15.2 **Continued Use**. Continued use of our Services after any changes to this Policy constitutes acceptance of the updated terms.
**16. CONTACT INFORMATION**
16.1 **Company Contact**. If you have any questions or concerns about this GDPR Compliance Policy or our data protection practices, please contact us at:
Quantum Medical SRL
Str Miron Costin Nr 61
+40 744 258 668
—
**By using our Services, you acknowledge that you have read and understood this GDPR Compliance Policy and agree to be bound by its terms.**
–