Protection of personal data

Information Notice on the processing of personal data

OMRO IFN S.A., organized and operating according to the provisions of Law no. 93/2009 on non-banking financial institutions, with headquarters in Tirgu Mureş, B-dul. 1 Decembrie 1918, nr. 183, parter, Cod Postal 540528, judet Mureş, Tax Code no. 13617777, registered at the Trade Register Office under No. J26/687/2000, subscribed and paid-up share capital: 7,067,976 RON, registered in the General Register of the National Bank of Romania under no. RG - PJR - 27 - 110135/19.06.2007, in the Personal Data Processing Register no. 30094, as a Personal Data Operator, processes your personal data ("Personal Data") for the fulfillment of the purposes specified in this Information Notice, pursuant to the provisions of the (EU) Regulation no. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

You have provided Personal Data to this Financial Institution, belonging to you as customer, respectively as data subject, on the date of the contract conclusion with OMRO IFN SA and/or at the date of the request for the amendment of the loan and guarantee agreements during the contractual relationship.

1. PROCESSED PERSONAL DATA are as follows:

a) name and surname, Personal Identification Number, date and place of birth, gender, nationality, civil status, IC/IB series and number, other civil status record, address (domicile/residence/correspondence address) , telephone/ fax, e-mail, image, signature;

b) the status of studies, professional and tax address, occupation, function, workplace, type of residence (e.g. property, rent, etc.), data on penalties, where applicable, data on the real beneficiary;

c) source of funds, economic and financial status, data on owned assets, bank data, including information on purchased products, liquidity data, payment obligations, number of family members.

d) the personal data of the spouse/partner (guarantors), as mentioned above, the data of the guarantors and authorized persons in relation to the Financial Institution, the contact person, the litigations of the applicant and the guarantors, affiliation to a group of customers, other data (type of product, due dates, amounts and outstanding installments, default due date, number of delay days, amounts granted and due, credit currency, frequency of payments, paid amount, monthly rate, employer name and address etc); in the case of a group of customers, the Institution will also process the personal data of the persons belonging to the group with a risk exposure to the Financial Institution.


2. Personal data is processed by the Financial Institution for the following purposes:

a) the conclusion of the contractual relationship with the Financial Institution, based on your request for the supply of credit products;

b) performing the analysis of customer knowledge, risk analysis;

c) reporting to the NBR for the compliance with the monitoring and surveillance requirements;

d) collection of debts, recovery of debts, forced execution of amounts owed to the institution, administration of attachments and levies;

e) monitoring, offering security and guarding for persons, premises, goods, through video cameras located in the premises of the Financial Institution;

f) recording of communications by fax and e-mail, telephone, for the purpose of concluding and executing contracts with customers in optimal conditions as well as optimizing and improving the services provided to the customer.

g) performing reviews  that can lead to your profiling for direct marketing purposes (e.g., the calculation of some indicators in the solvability/credit risk assessment, etc.) and direct marketing, using the means of communication, including automated calling systems that do not require the intervention of a human operator, namely e-mail, sms, fax, such as for promoting the Institution’s products/services, in which you will consent to such a marketing agreement;

h) verifying customer satisfaction and the quality of the services and products purchased, based on the legitimate interest of permanently improving the services and products of the Financial Institution;

i) for statistical purposes.


3. Personal data are processed by the Financial Institution on the basis of the following legal GROUNDS:

a) In order to fulfill a legal obligation incumbent on the Financial Institution (e.g. reporting to competent authorities, customer knowledge to prevent money laundering and terrorist financing, etc.), pursuant to Article 6 para. (1) letter c) of the Regulation;

(b) for the execution of a contract to which the data subject is a party or to take action at the request of the data subject prior to the conclusion of a contract (e.g. credit products supply, communication with the data subject for the performance of the contract, etc.) pursuant to Article 6  para. (1) letter b) of the Regulation;

c) for the purposes of the legitimate interests pursued by the Financial Institution (e.g. recovery of claims relating to the contractual relationship concluded, ensuring the security of persons and property, etc.), but having in view the protection of interests, fundamental rights and freedoms of the person concerned, pursuant to Article 6 para. (1) letter f) of the Regulation;

d) based on your consent (e.g. for direct marketing), pursuant to Article 6 para. (1) letter a) of the Regulation;


4. Personal data is processed over the following periods of time:

a) for the duration of the contracts concluded with the Financial Institution plus 15 years from the termination of the contractual relationship, unless a legal provision requires storage for a longer period;

b) for a period of 5 years, if a contractual relationship has not been established with you, according to the law on the prevention and sanctioning of money laundering (Law 656/2002);

c) if the processing is carried out for direct marketing purposes - during the contractual relationship with the Financial Institution, plus one year after its termination. In case you withdraw your direct marketing consent, your data will no longer be processed for this purpose from the moment your consent is withdrawn.

5. Operators, Authorized Individuals and Addressees of Personal Data:

Personal data can be sent to the following categories of addressees: a) the data subject, the representatives of the data subject, b) the debt collection agencies/claims recovery, c) notaries public, bailiffs, d) lawyers, authorized evaluators, accountants, censors, auditors and other types of consultants, e) various service providers (e.g. IT, archiving, printing, couriers etc.), f) public authorities in Romania (e.g. National Bank of Romania, etc.).

Personal data transmitted to third parties will be appropriate, pertinent and not excessive in relation to the purpose for which they were collected and which allows the transmission to a specific third party.

6. The need for Personal Data Processing:

In case you refuse the processing of your Personal Data for the purposes set out above, the Financial Institution will be unable to initiate or to continue legal relationships with you as it will find itself unable to comply with the legal requirements in the financial and banking field (e.g. on customer knowledge, prudential requirements, etc.), it will be unable to review the request for services by the Financial Institution, to conclude/perform/execute the contract you requested.

If you object to the processing of your Personal Data for statistical purposes, we inform you that this option will be reviewed and, depending on the particular situation of the data subject, you will receive an answer under Article 21 of the Regulation, your objection to such an operation does not affect the continuation of the contractual relationship with the Financial Institution.

In the event that you do not consent to the processing of Personal Data for the purpose of direct marketing or for contacting you to obtain your opinion on the services and products offered or purchased, the contractual relationship between you and the Financial Institution will not be affected in any way.

7. As a data subject, you have the following RIGHTS with respect to exclusively your Data:

a) the right of access to data according to Article 15 of the Regulation;

b) the right to rectification of data, according to Article 16 of the Regulation;

c) the right to erasure of the data, according to Article 17 of the Regulation;

d) the right to restriction of processing, according to Article 18 of the Regulation;

e) the right to data portability, according to Article 20 of the Regulation;

f) the right to object, according to Article 21 of the Regulation;

g) the right of not being subject to an automated individual decision-making, including profiling, according to Article 22 of the Regulation;

h) the right to address to the National Supervisory Authority for Personal Data Processing and to the Court.


To exercise these rights, you may address a written, dated and signed request addressed to OMRO IFN S.A. at the address: B-dul 1 Decembrie 1918, Nr. 183, Parter, Tîrgu Mureș, Cod Poştal 540528, județ Mureş or by e-mail:

If you will submit a request for the exercise of your data protection rights, the Financial Institution will respond to this request within 30 days under the conditions set out in the Regulation.

Please note that this Information Notice is in accordance with Article 13 of the Regulation, respectively for your information.

© 2018 OMRO IFN S.A.