PRIVACY NOTICE ON FIRST AID ASSISTANCE

PRIVACY NOTICE ON FIRST AID ASSISTANCE

Through this Privacy Notice we want to provide you details about the processing of your personal data when:

You have been in an accident and you are given first aid;
You call for first aid services for various health problems, which are not always a medical emergency;
We ask you to disclose data about your health, in the context of compliance with the internal regulation and rules for the use of pool and atractions, in order to protect the health of both yourself and other visitors.

We pay particular attention to the processing of sensitive personal data, taking additional protection measures to prevent security incidents. We have also conducted a data protection impact assesement, in order to identify and mitigate the risks associated with the processing of these categories of data.

We recommend that you read this Privacy Notice together with the Privacy Policy, in order to obtain as much information as possible on how we process your personal data.

WHAT ARE THE CATEGORIES OF THE PERSONAL DATA THAT WE PROCESS?

Depending on the context and the nature of the situations presented above, we may process the following categories of personal data:

Identification and contact data of the person who is injured or who needs first aid assistance or to whom procedures are applied (first name and last name, gender, age, phone, access bracelet number, signature);
Identification and contact data of the guardian, when the person who needs first aid assistance is minor (first name and last name, telephone, signature);
Findings regarding the nature and context of the event that led to the need for first aid assistance, the location of the event etc.;
Medical data collected during first aid (blood sugar, temperature, blood pressure, blood oxygen level, allergies, treatment applied, existing diseases and conditions, other measures and procedures applied, other relevant information that you provide, as appropriate);

The mentioned data is recorded in the first aid form, which is completed within the first aid stations existing within the Therme complex.

WHY DO WE PROCESS THIS DATA?

We generally collect this information about you:

To fulfill legal obligations;
To fulfil contractual obligations to you and other visitors;
To respond to your needs when you access first aid points;
To give you first aid;
To determine the treatment that needs to be applied;
To protect your health and the health of other visitors;
To resolve complaints and defend Therme’s rights;
To justify the use of medicines and medical equipment.

WHAT ARE THE LEGAL GROUNDS ON WHICH WE PROCESS YOUR DATA?

The first aid points within the Therme complex operate in accordance with Government Decision no. 1136/2007 - methodological norms on the managing of public aquatic rescue services - lifeguard and first aid posts. Taking this into account, we process your data based on the fulfillment of legal obligations but also for the purpose of the execution of the contract with you, which provides for compliance with the rules of the internal regulation and rules for the use of pool and atractions.

Also, in accordance with the legal bases provided for in Article 9 of the General Data Protection Regulation no. 679/2016, the following legal bases apply:

Art. 9(2)(c) – processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

Art. 9(2)(f) – processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

Art. 9(2)(g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

Art. 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

WHO ELSE HAS ACCESS TO YOUR PERSONAL DATA?

The personal data is processed by our authorized personnel in maximum safety conditions. The transmission or disclosure of data to third parties without your consent is only done in exceptional circumstances, such as ambulance service, when necessary.

Where necessary, the data may also be transmitted to authorities, lawyers or other parties involved in handling complaints or in defending our rights in court.

HOW DO WE MANAGE INTERNATIONAL DATA TRANSFER?

For this processing activity, your personal data is stored and processed on servers and in physical locations within Romania and the European Union, secured and controlled entirely by us.

HOW LONG DO WE KEEP YOUR DATA?

When establishing the retention periods for these categories of data, we balance the need of keeping them taking into account the purposes and risks that each situation represents as follows:

For minor situations, where the risk of repercussions is unlikely, we consider that data retention for a maximum of 30 days is sufficient.
In cases where the data collected is related to a complaint or is subject to an investigation by an authority, is necessary for the defense of a right in court or for other similar situations, we will retain the data for a longer period, up to 3 years from the last communication with you, settlement of the complaint or issuing of a decision by an authority or court.
If your data is associated with contracts or payments made to you, the data will be kept in accordance with legal requirements.

After the expiry of the periods referred to in points 2 and 3, the data will be securely destroyed within a maximum of 1 year according to internal storage policies.

WHAT ARE YOUR RIGHTS?

For using your personal data for the purposes aforementioned, you have the following rights:

Right to be informed;
Right of access;
Right to rectification;
Right to erasure, under the conditions stipulated by law;
Right to restriction of processing;
Right to data portability to another controller, under the conditions stipulated by law;
Right to object to the processing of your personal data;
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly affects you to a significant extent, with the exceptions set out in data protection laws;
Right to lodge a complaint with a supervisory authority.

UPDATING THE PRIVACY NOTICE

The information presented in this Privacy notice will be reviewed periodically to reflect any changes in current processing activities.

Please visit this page periodically to make sure you always have up-to-date information.

However, if we intend to significantly change the way we use your personal data, we will notify you in advance.

Last update: April 2024