Privacy and Cookies Policy

A. Privacy Policy

I. General provisions

This Privacy and Cookie Policy is applicable to One United Properties SA ("One") as well as to any existing or future company within One Group and/or Skia Group (hereinafter referred to as "we", "us", "our" or "One"). This website https://www.one.ro/ referred to as the "Site" is owned and operated by One.

This Privacy Policy informs you about how we collect, use and disclose personal data that we receive from certain categories of persons, such as users of the Site, buyers, prospective buyers, tenants, employees and collaborators/contractual partners of One.

One will process personal data in accordance with the provisions of this document.

The purpose of this policy is to explain to you what data we process, why we process it and what we do with it when you enter into a legal relationship with One (including, without limitation, when you rent/promise to buy/purchase properties from us or when you visit this Website).

II. Purposes, bases and categories of personal data

In accordance with the provisions of the General Data Protection Regulation 2016/679 (“GDPR”), personal data processed by One may be used for purposes such as:

1. Taking the necessary measures for the conclusion and execution of contracts and the fulfillment of legal obligations, as well as for the realization of One’s legitimate interests, which also include operations such as requesting an offer, making payments and drawing up financial and accounting documents based on art. 6 para. (1) letters b), c) and f) of the GDPR.

For this purpose, we will process personal data such as name and surname, ID card data of contractual partners or potential contractual partners (including, but not limited to, buyers, prospective buyers, tenants, suppliers, contractors, etc.), signature, contact details (email address, telephone number), property data and bank details.

Through this website, we may also collect personal data of potential buyers who have requested an offer from us / real estate agents / tenants, as well as personal data of land owners who decide to purchase or join a joint venture to transfer the value of the current land into shares for the future project, be it residential, office or mixed-use.

At the same time, we collect personal data to carry out due diligence activities in the event that a business relationship will be concluded between us and the company you represent, in accordance with art. 6 para. (1) letter f) of the GDPR, namely the legitimate interest in entering into business relationships with trusted partners.

2. Management and maintenance of this website, which involves the storage of cookies as described in section B below, based on Art. 6 para. (1) letters a) and f) of the GDPR.

When using our website, we may ask you to provide us with certain personal data that can be used to contact you or identify you.

This personal data may include, but is not limited to, your first and last name, email address, information that your browser sends whenever you access our website (“Log Data”).

Log data may include information such as your computer’s Internet Protocol (“IP”) address, browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages and other statistics.

3. Providing advice, upon request, to identify the right financing offer for the desired property and facilitating the obtaining of a financing offer, based on the analysis of solutions in the banking and non-banking market (IFN) based on art. 6 para. (1) letters a) of the GDPR.

For this purpose, we collect the data provided through the “Discuss with a financial consultant” form located here: https://skia.one.ro/ro/finantare/, namely: name, surname, e-mail address, telephone number as well as the information you communicate to us later in the discussions (e.g. estimated budget, preliminary information about income/employer).

The collected data will be processed by Skia Financial Services S.R.L., a Romanian legal entity, with its registered office in Bucharest, Sector 1, Str. Maxim Gorki no. 20, registered in the Trade Register under no. J40/2418/2024, with CIF 49536088, a company that is part of One Group and/or Skia Group, which will transmit the data to: i) banking and non-banking institutions (IFN) for the purpose of obtaining a financing offer, ii) contractual partners acting as independent operators or, as the case may be, authorized persons (lead providers, companies, brokerage firms authorized/registered under applicable law and, where applicable, authorized/registered with ANPC for credit intermediation activities).

4. Carrying out marketing and advertising activities, including subscribing to our newsletters based on art. 6 para. (1) letter a) of the GDPR. For this purpose, we will process personal data, such as your name and surname, email address, image and voice, if applicable.

You may opt out of receiving any or all newsletters, marketing or promotional materials and other information from us that may be of interest to you by following the unsubscribe link or instructions provided in any email we send.

The sending of our newsletters and event-related emails is carried out via “MailChimp”, an email delivery platform owned by the American company Rocket Science Group, LLC, 675 Ponce de Leon Ave NE # 5000, Atlanta, GA 30308, USA. The email addresses of our recipients are stored on MailChimp servers in the USA. MailChimp uses this information to send and evaluate emails on our behalf. MailChimp’s data policy can be viewed here.

5. Ensuring the security of One’s people, premises and/or goods by CCTVs based on Art. 6 para. (1) letter f) of the GDPR.

For this purpose, we may process personal data such as your image, first and last name (if identifiable) and vehicle registration number, if applicable.

6. Management and maintenance of the Home Smart application, which involves the processing of personal data of apartment owners located in residential buildings, based on art. 6 para. (1) letter a) of the GDPR.

For this purpose, we will process personal data, such as name and surname, address, financial information, bank details and contact details. We process the aforementioned personal data both for the use and proper management of residential buildings.

7. Management of employment relationships, which involves the processing of data for the execution of employment contracts, the fulfillment of One’s legal obligations in relation to these contracts and/or the realization of the One Group’s legitimate interests arising from employment relationships based on art. 6 para. (1) letters b), c) and f) of the GDPR.

For these purposes, we will process personal data of our employees, such as name and surname, identity card data, contact details and bank details.

8. Compliance with legal obligations to which we are subject. We process personal data to comply with a number of legal obligations and statutory requirements (anti-money laundering, tax, health and safety legislation, etc.).

For example, you are aware of the rules and regulations. which require us to verify your identity before accepting you as a customer.

At the request of the authorities, we may report transactions carried out by customers.

9. To provide you with the most suitable home or apartment furnishing products for rent or sale.

We disclose or receive data from third party service providers who assist us and allow us to use personal data to support the delivery of your contract with us, for example, consultants who can advise you on your project.

10. Resolving your requests, questions or complaints based on art. 6 para. (1) letters a) and b) or / and f) of the GDPR.

For this purpose, we will process personal data, such as name, surname, e-mail address, telephone number as provided to us through the "Schedule a visit" form or by message sent to [email protected] or communicated by phone call to 0726 000 026 or other telephone numbers intended for communication.

11. Communication with our collaborators and contractual partners, as well as access to our headquarters based on art. 6 para. (1) letters b) and f) of the GDPR.

For this purpose, we will process personal data, such as name, surname and contact details.

We will not process children's personal data without the prior consent of their parents / legal representatives.

If we intend to use your personal data for a purpose other than that for which they were collected, we will inform you in advance about the secondary purpose and provide you with any other information required under the GDPR.

III. Security

The security of your personal information is important to us, but please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee the absolute security of them. We constantly try to ensure the most adequate level of protection of your personal data and, with a view to this end, we have implemented appropriate technical and organizational protection measures. We are constantly working to improve our security measures.

IV. Data retention and categories of recipients of personal data 

One stores your personal data no longer than is absolutely necessary. After the expiry of the retention period, the personal data will be destroyed or deleted from all media (whether physical or electronic). To the extent that they must be used for scientific or statistical research purposes, the personal data will be rendered anonymous, in strict compliance with the provisions of the GDPR.

Personal data are processed mainly by One staff and collaborators who are in charge of processing these data.

We will disclose your personal data where required, for example by law or subpoena or if we believe that such action is necessary to comply with the law and reasonable law enforcement requests or to protect the security or integrity of our website.

There are situations when your data is transmitted to competent authorities and institutions, at their request.

There are also situations when your personal data is sent to companies in our groups and our contractual partners, which may be:

1. third parties (for example, contractors, real estate agents, manufacturers, accounting firms, audit firms, service providers, maintenance companies, post offices, couriers);

2. lawyers, notaries public, auditors, bailiffs, translators, real estate brokers, safety and security firms;

3. banks and financial institutions, insurance companies and insurance brokers;

4. investors or potential investors;

5. buyers and tenants.

Whenever we use subcontractors, acting either as data controller or processor under the GDPR, we ensure that the requirements set out in the GDPR are met and that your personal data are processed in an appropriate manner.

In principle, your personal data will not be transferred to a third country or to an international organization.

In any case, such a transfer only takes place as part of a data processing agreement, your express consent or based on a legal obligation, taking into account the respective legal safeguards.

V. Social networks

We cooperate through several networks, such as Facebook, Instagram, LinkedIn, Google Maps.

While you are using this service, your browser will automatically connect to the respective social network and transmit your IP address and other information, such as cookies, if you have previously visited the respective platform. As far as possible, we avoid this type of data transfer until you interact directly with one of these platforms. By clicking on the corresponding symbol (e.g. the Facebook logo), you indicate that you want to communicate with the platform you have selected (in this case, Facebook) and you agree that information about you, such as your IP address, will be transmitted to this social network.

The plug-in establishes a direct connection between your browser and the servers of the respective social networks.

We have no influence on the type and size of data that the plug-in transfers to the social network servers.

VI. Rights of data subjects

According to the GDPR, the data subject may benefit from the following rights with regard to personal data processing:

1. right to be informed – the right to receive a minimum content of information in relation to the processing activities performed by One, in accordance with the GDPR;

2. right of access to data – the right to obtain from One, upon request and based on the conditions set by the GDPR, confirmation as to whether or not your personal data are being processed, and, where that is the case, access to the personal data and information on the processing;

3. right to rectification - the right to obtain from One, without undue delay, the rectification of inaccurate personal data concerning you;

4. right to erasure of data – you can exert your right to erase the data from One’s files, in accordance with the data protection provisions;

5. right to restriction of processing – may be exerted if one of the following applies: the accuracy of the personal data is contested by you, the processing is unlawful and you oppose the erasure of the personal data, One no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims, you have objected to processing pending the verification whether the legitimate grounds of the controller override yours;

6. right to data portability - the right to receive the personal data from One in a structured, commonly used and machine-readable format;

7. right to object - the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, save for contrary legal provisions. This right may be exerted in the following conditions: you request in written to One the exertion of this right, you specify the data and the legitimate grounds relating to your particular situation;

8. right not to be subject to an individual decision - the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In relation to a decision based solely on automated processing, you have the right to obtain human intervention and to contest the decision, to the contact details specified in this policy;

9. right to contact the supervisory authority, namely the National Supervisory Authority for Personal Data Processing; and

10. right to lodge a complaint with the competent courts of law.

The rights listed above are not absolute. There are exceptions, which is why each request received will be analyzed to decide whether it is well-founded or not.

If the request is well-founded, we will facilitate the exercise of your rights. If the request is not well-founded, we will reject it, but we will inform you of the reasons for such rejection and of the right to lodge a complaint with the supervisory authority or the competent courts.

VII. Whom can you contact?

To exercise your rights, you can send a written request to our headquarters or to the e-mail address [email protected].

We will try to respond to your request within 30 days. However, the deadline may be extended in accordance with the GDPR, depending on the complexity of the request, the large number of requests received during the relevant period or the inability to identify you in a timely manner. Given that we strive to make every effort and are unable to identify you, and you do not provide us with additional information to identify you, we are not obligated to respond to your request.

B. Cookies Policy

This Website uses cookies in order to ensure the proper functioning of the Website and to optimize its content, as well as in order to analyse traffic and offer the visitors a better experience when browsing the Website.

The information presented below aims at providing users with more details on the placing and use of the cookies used by this Website.

Cookies are files with small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer's hard drive.

Like many websites, we use cookies to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Website.

In addition, we may use third party services such as Google Analytics that collect, monitor and analyse this type of information in order to increase our Website's functionality. These third-party service providers have their own privacy policies addressing how they use such information.

Our Website uses the following types of cookies:

For cookies which are not strictly necessary, as provided at Sections B – D inclusively above, you may withdraw your consent at any time by accessing the links below. It is important to note that the deactivation or refusal to receive certain types of cookies can make certain sections of the website difficult to view and use.

All the modern browsers offer the possibility to change the settings of cookies. You can configure the settings of the cookies following the instructions by accessing the links below:

• Settings Cookie in Internet Explorer

• Settings cookie in Firefox

• Settings cookie in Chrome

• Settings cookie in Safari.

C. Changes to the Privacy and Cookies Policy

We reserve the right to update or change our Privacy and Cookies Policy at any time and you should check this Privacy and Cookies Policy periodically. Your continued use of the Service after we post any modifications to the Privacy and Cookies Policy on this page will constitute your service acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.

If we make any material changes to this Privacy and Cookies Policy, we will notify you either through the email address you have provided us, or by placing a prominent notice on our Website.