According to articles 13th and 14th from the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016), in the case we obtain your personal data directly from you, through a representative or through any other legal entity, we inform you of the following:

  1. As a personal data processing entity, BAAR contact address is: Str. Lascar Vasile, 40-40Bis, Bucuresti - District 2, Bucharest 020502, phone no. – 031 130 0800, e-mail –
  2. Data Protection Officer (DPO) contact is:

    Fax: 021/312.31.82;

  3. The purpose of your personal data processing action is to fulfill BAAR’s obligations established by Law no. 132/2017 and regulations issued for its application by the National Financial Supervisory Authority in Romania. According to this purpose BAAR’s roles are, without limitations:
    • National Motor Bureau,
    • Border Insurance administrator,
    • Body for claims payment;
    • Information Center;
    • Compensation Body;
    • Allocation of insured persons with high risk profile,
    • Administrator and developer of MTPL database,
    • Creating and publishing of MTPL insurance studies, analysis and statistics
    • Claims history statement (according to art. 23, alin. 1, lit. c from 2009/103/CE Direction; art. 18 alin. 10 of Law no. 132/2017; art. 17 alin. 1 of Norms no. 20/2017)

The basis for the data processing is, in most cases, a legal requirement, a contract obligation or a legitimate interest, but in some cases is the consent of the respective person.

  1. The categories of the processed personal data are the following, if the case: first and last name, personal identification number, identity document number or driving license, home address, bank account, image, voice, holographic signatures, copy of identity document, telephone number, email address, correspondence address, family ties, age, gender, health status, criminal convictions, heritage data - including motor vehicles, real estate, or, as the case may be, income or education level, MTPL and CASCO damages history, or for other insurance type, cookies, IP addresses and other types of personal data retained by documents issued by public authorities in the country or abroad, including courts and investigations authorities, or by statements of natural or legal persons.
  2. The categories of recipients of your personal data are, as the case may be, the following: companies specialized in claims assessment, lawyers, authorities empowered to investigate motor vehicle accidents, driving license and car registration authority, people registration and databases administration authority, translators, banking units, courts, technical experts and legal executors, providers of accounting services, audit and IT services from Romania or abroad and even outside the European Economic Area, insurers and reinsurers from Romania or abroad, established, as the case may be, in or outside the European Economic Area and their representatives, Green Card Offices established in countries that are part of or within the European Economic Area, Compensation Authority and counterpart guarantee funds to support the payment of damages, postal service operators and courier, the Policyholders Guarantee Fund and the Financial Supervisory Authority and other local public authorities that keep track of the registered vehicles, natural or legal persons who have suffered an injury and which justify a legitimate interest in obtaining such information.

For situations in which BAAR exports personal data to international organizations or to countries outside the European Economic Area, upon request we will be able to provide the evidence regarding the appropriate established guarantees.

  1. Personal data will be kept until the purpose is achieved and as long as BAAR justifies a legitimate interest in keeping them. Without limiting us, the generally applied rule concerns the minimum periods for claims files storage, information regarding the insurance policies and the claims history provided by the specific legislation. Personal data may be stored in order to preserve the exercise of a court right or to provide the necessary evidence for the fulfillment of legal obligations.
  2. The legitimate interests of BAAR concerns the solving of claims made by victims and, if the case, the BAAR and/or other legal persons represented by BAAR right of regression, fraud prevention, preserving rights of defense by providing evidence on execution of obligations or, as the case may be, the improvement of the internal processes and the increase of the speed of claims solving or legal requirements fulfilling;
  3. Without affecting the legal obligations of BAAR or of those that BAAR represents, you can request the access to personal data, to rectify or delete them or to restrict its processing, having the right to oppose the processing, as well as the right to data portability;
    • The right of access to personal data - Allows you to obtain from us a confirmation of whether or not BAAR is processing personal data that concerns you and what such data are processed. If the personal data concerning you are not collected directly from you, any information available regarding their source, in cases where we do not have a legal prohibition regarding the source disclosure.
    • Right to rectification - It implies the right to request the rectification or updating of inaccurate or incomplete personal data that concerns you or their completion, when they are incomplete.
    • The right to delete data or the "right to be forgotten" - It implies the right to request the deletion of personal data concerning you, in certain circumstances, such as (i) the personal data are no longer necessary for the purposes which they were collected or processed, (ii) your data has been processed illegally, (iii) the data processing has taken place based on your consent, and it has been withdrawn.
    • The right to withdraw your consent - The consent can be withdrawn at any time, when the processing of personal data that concerns you has been carried out based on your consent.
    • The right to restrict the processing - It implies the right to request and obtain the restriction of the processing of personal data concerning you, in certain circumstances, such as (i) you question the accuracy of the data, during the period that would allow us to verify the accuracy of those data, ( ii) your data have been processed illegally, and you oppose their deletion, requesting that their use be restricted.
    • The right to data portability - It implies the right to receive personal data concerning you and which you have provided to us, with the right to transmit them to another operator, if (i) the data processing has been carried out, based on your consent or of the contract concluded with us, and the processing of personal data was done by automatic tools. This right can be exercised only to the extent that the processing of the data provided has been performed exclusively by automatic tools and only where the extraction of such data is feasible in terms of the technical capabilities used by the Operator.
    • Right to Opposition - Assumes that, at any time, you have the right to oppose the processing of personal data, for reasons related to the particular situation you are in and in certain circumstances, such as (i) the processing has been carried out in our legitimate interest, or (ii) the processing is intended for direct marketing, including the creation of profiles based on those provisions.
    • The right not to be the subject of a decision based solely on the automatic processing of your data, including the creation of profiles that produce legal effects or which significantly affects you, implies that you have the right to request human intervention from the Operator, to express your point of view and to challenge the decision.
    • The right to fill in a complaint with us and / or the competent data protection authority.
    • The right to sue.
    • In the event that your personal data are processed by BAAR on the basis of your express consent or in relation to other entities, you have the right to withdraw that consent directly in relation to BAAR.
  4. Your data have been obtained following the notification of a damage (claim) or other direct interaction with BAAR, including through your agents, from the injured persons, the competent authorities to investigate vehicle accidents, courts, Green Card Offices established in states that are part of the European Economic Area or, as the case may be, outside of it, Clearing Bodies and Homologous Guarantee Funds, damage management entities, the Financial Supervisory Authority and other public authorities, from insurers in the country or abroad, or their representatives, from documents issued by public authorities and courts in the country or abroad, statements or other documents communicated by natural or legal persons, by accessing you our information systems, or by consulting certain databases on the history of damages, registration of vehicles, population record, cadastral office and others like that.
  5. Data processing is not achieved through an automated decision-making system including profiling.

Privacy policy regarding personal data Access

Application form rights person concerned Access