GDPR Data Subject Rights & Procedures
Ghidul și Procedurile pentru Exercitarea Drepturilor GDPR
Direct Data Protection Contact: contact@cristianvaduva.com
Under European data protection law, data subject rights are fundamental but not absolute. The applicability and extent of each right depend directly on the legal basis upon which personal data is processed (e.g., legal statutory obligations vs. contractual performance vs. consent) and applicable statutory retention duties under Romanian legislation.
Right of Access (Article 15 GDPR)
You have the right to obtain confirmation as to whether or not your personal data is being processed by the Controller, and where that is the case, access to the personal data and the specific processing parameters (purposes, categories, recipients, retention period, and source).
Right to Rectification (Article 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you, including the right to have incomplete personal data completed (such as updated contact numbers, changed address, or revised mandate parameters).
Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)
You have the right to request the permanent deletion of your personal data where the data is no longer necessary in relation to the original purposes, where you have withdrawn consent, or where you object to processing based on legitimate interest.
Important legal limitation: Erasure cannot be granted if continued processing is strictly required by statutory Romanian accounting, fiscal, or anti-money laundering (AML/KYC) compliance laws (Article 17(3)(b) GDPR).
Right to Restriction of Processing (Article 18 GDPR)
You have the right to request restriction of processing where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, or where we no longer need the data but you require it for the establishment, exercise, or defense of legal claims.
Right to Data Portability (Article 20 GDPR)
Where processing is carried out by automated means and based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g. JSON or CSV), and have the right to transmit that data to another controller.
Right to Object & Marketing Withdrawal (Article 21 & Article 7(3) GDPR)
You have the absolute, unconditional right to object at any time to the processing of your personal data for direct marketing purposes. Furthermore, where processing is based on consent, you may withdraw your consent at any time with immediate effect.
Automated Decision-Making & Profiling (Article 22 GDPR)
Our buyer request matching algorithms perform mathematical relevance scoring (criteria matching) strictly as an advisory assistance tool. We do not make any legal or significant decisions based solely on automated processing without human advisor review.
How to Submit a Data Protection Request
All requests are processed without undue delay and at the latest within one month (30 calendar days) of receipt under Article 12(3) GDPR. In complex cases, this period may be extended by two further months, with prior notification explaining the delay reasons.
Email: contact@cristianvaduva.com
Identity Verification: To protect client confidentiality and prevent unauthorized disclosures, we may request reasonable proof of identity before releasing sensitive files.
Fee: Requests are processed free of charge. Where requests are manifestly unfounded or excessive, we may charge a reasonable administrative fee or refuse to act.