Privacy policy of MTR

Privacy policy of mediaTRUST.
Last update: 06.04.2026.

1. This personal data protection policy for mediaTRUST partners (hereinafter referred to as the “Policy”) defines the rules for processing personal data by mediaTRUST, headquartered in Bucharest (hereinafter referred to as the “Data Controller”), with regard to:
   a) natural persons who are partners of the Data Controller or who intend to enter into cooperation with the Data Controller in the course of their business activity;
   b) natural persons who are employees of partners (regardless of the form of employment), designated by the partner to cooperate with the Data Controller or to establish such cooperation – hereinafter referred to as “Representatives.”
2. This Policy applies to personal data collected by the Data Controller (or on its behalf), either from the Representative’s employer or directly from the Representative (hereinafter referred to as “personal data”).
3. This Policy fulfills the obligations set out in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).
4. From the moment personal data is collected, the Data Controller assumes the role of Data Controller of the Representatives’ personal data within the meaning of the GDPR.
5. The Data Controller is authorized to process the following data of the Representatives: first name, last name, workplace, official position within the company, contact details (mailing address, phone number, email address, social media accounts).
6. The legitimate interest of the Data Controller constitutes the legal basis for processing the Representatives’ personal data – namely, the possibility to initiate and continue cooperation or to contact the partner through its Representatives (Article 6(1)(f) of the GDPR).
7. The Representatives’ personal data will be processed until the definitive termination of cooperation between the Data Controller and the partner. Personal data may be deleted earlier if the Data Controller receives a prior request from the Representative objecting to the processing of personal data, or if the Data Controller determines that the data is no longer necessary for achieving the legitimate purpose (contact with the partner).
8. Personal data will not be deleted by the Data Controller as described above if their storage and processing are required by law or are necessary for accounting purposes or for pursuing claims related to cooperation with the partner or the partner’s Representative.
9. The Data Controller may make personal data available to entities providing services to it (e.g., third-party IT service providers, courier services, HR services, accounting services, and other contractors). Personal data may also be shared with other interested parties (independent from the Data Controller) if the Representative has made such data available in a manner that clearly indicates it may be used by third parties to contact the Representative for business purposes.
10. Each Representative has the right to:
    – be informed about the processing of personal data, including the purposes and potential recipients;
    – request correction of inaccurate personal data or completion of incomplete data;
    – request deletion or restriction of processing of personal data – in which case the request will be fulfilled if the legal requirements are met;
    – object to processing – where processing is based on the Data Controller’s legitimate interest (Article 6(1)(f) GDPR);
    – data portability – by receiving their personal data from the Data Controller in a format that allows transfer to a third party of their choice;
    – lodge a complaint with the supervisory authority – the National Supervisory Authority for Personal Data Processing, Bd. G-ral Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest – if they believe that personal data is being processed in violation of the law.
11. Any questions, suggestions, or requests related to the processing of personal data should be addressed to office@mediatrust.ro.
12. Each partner of the Data Controller is obliged to inform its Representatives about this Policy.