GENERAL PERSONAL DATA PROTECTION POLICY

Introduction

Like any other company, ATELIERUL MARI ȘI MICI SRL (named hereinafter „ATELIERUL MARI ȘI MICI”) processes personal data. The proper protection of personal data is an important objective for ATELIERUL MARI ȘI MICI.

This policy is intended to summarize ATELIERUL MARI ȘI MICI approach as personal data controller (“The Policy”) and it is addressed to natural persons outside the organisation, with which ATELIERUL MARI ȘI MICI comes into contact, including those looking for employment / a job working at ATELIERUL MARI ȘI MICI, ATELIERUL MARI ȘI MICI clients, the visitors of the ATELIERUL MARI ȘI MICI website, partners or prospective partners, as well as contractual / legal representatives and the employees of any partners or prospective partners (any of these named hereinafter „you” or ”data subject”).

Practically, this document aims to provide the following information:

a) the identity and the contact details of the controller;

b) the contact details of the ATELIERUL MARI ȘI MICI personal data protection officer;

c) the purposes of the processing by ATELIERUL MARI ȘI MICI for which the personal data are intended as well as the legal basis for the processing. It is very likely that not all the purposes mentioned herein are relevant to you.

d) where the processing in based on the legitimate interests pursued by ATELIERUL MARI ȘI MICI, the specification of such interests;

e) the categories of personal data processed;

f) the recipients or categories of recipients of the personal data;

g) where applicable, the fact that ATELIERUL MARI ȘI MICI intends to transfer personal data to a third country or international organisation;

h) the period for which the personal data will be stored or the criteria used to determine that period;

i) the existence of your right to request from ATELIERUL MARI ȘI MICI access to and rectification or erasure of personal data, the existence of the right to data portability, the restriction of processing, the right to object to processing, as well as any exceptions and limitations of such rights;

j) the existence of your right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, as well as any exceptions and limitations of such right;

k) the right to lodge a complaint with a supervisory authority;

l) the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and what are the possible consequences of failure to provide such data;

m) the existence (where applicable) of automated decision-making, including profiling, and, in this case, information about the logic involved, the significance and the envisaged consequences of such processing for you.

The ATELIERUL MARI ȘI MICI Policy is based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC („The Regulation” or „GDPR”). The terminology used herein has the meaning ascribed in this Regulation; particularly, the terms mentioned in Section 4 have the meanings specified in that section.

The Policy may be updated from time to time to reflect changes in ATELIERUL MARI ȘI MICI practice concerning the processing of personal data or changes in the applicable legislation. The updated version will replace the previous version, being available at the same address.

This Policy was prepared with the intention of being easy to read and understand. For additional information or questions, please use the contact details provided in Section 1.2 hereunder.

1. General aspects of the personal data processing

1.1 The identity and contact details of the controller

1.2 Contact details of the personal data protection officer

To facilitate the interaction between ATELIERUL MARI ȘI MICI and you with regard to the protection of personal data, ATELIERUL MARI ȘI MICI appointed someone with attributions in the field of personal data protection (the personal data protection officer, hereinafter „DPO”).

The DPO’s contact details are:

• postal address: 29 Constructorilor, District 6, Bucharest, Romania
• e-mail address: atelier@mari-mici.ro
• telephone number: +4 0757 474 641

2. Types of personal data that may be processed by ATELIERUL MARI ȘI MICI

ATELIERUL MARI ȘI MICI may process, as applicable, (a) both personal data obtained from you, (b) and personal data that were not obtained from you (but from third parties / third party sources).

Most cases where personal data are processed are inherent to an economic activity, while others are entirely impossible to prevent, such as receiving an e-mail from a third party including in the body a chain of e-mails (which, of course, contain personal data).

Therefore, the personal data that ATELIERUL MARI ȘI MICI may process may include, as applicable:

a) Contact information, e.g., your postal address, e-mail address and phone number(s) (personal or work number), fax number, your name, your Messenger (Yahoo, Skype, etc.) user ID, LinkedIn ID, personal web page, the company where you work;

b) Identity information, such as marital status, data obtained from birth and marriage certificates, full name (including the patronymic or honorific), date and year of birth, place of birth, gender, photo/ image, voice, vehicle registration number, personal identification code, passport series and number, ID card number and expiration date or those of another similar document, signature;

c) Technical information, such as information generated as a result of cookies, your accessing of our websites or applications or related to the materials and notifications we send to you electronically (such as the IP address or similar identifiers of electronic devices, the type of internet browser used, the type of OS used by your device, the domain name from which you connect to the ATELIERUL MARI ȘI MICI website);

d) Information regarding employment and skills: occupation, domain/ specialization, position held in the workplace, employment history, number of working hours, employee evaluation, certifications, studies; permit / license series/ number; membership in associations/ groups/ unions; results-based commission; information on the number and travel expenses;

e) Financial information, such as information regarding payments, income, bank account;

f) Information regarding marketing preferences;

g) Information relevant to procedures regarding the acceptance of collaborations or new partners, including financial soundness and reputational matters;

h) Information on a person’s history, such as, CV information (other than already mentioned, interests, hobbies, skills), job title with other employers; employer; department where the work was performed; salary and details regarding remuneration in other places of employment; visa number (where applicable); work permit number (where applicable); information regarding emergency/special circumstances points of contact;

i) Other personal data provided to us by or on behalf of our contractual partners or generated by us during our activity and which may also include special categories of personal data;

j) Any other information concerning you that you may provide or that we may indirectly receive, even entirely independently of the ATELIERUL MARI ȘI MICI approach and that may include special categories of personal data.

3. Purposes and grounds of the processing of personal data

4. Legitimate interest pursued by ATELIERUL MARI ȘI MICI

As mentioned hereunder, most processing of personal data performed by ATELIERUL MARI ȘI MICI in relation to individuals outside the company concern purposes based on legitimate interests.

As applicable, these may include:

a) the legitimate interest in providing quality services to our clients;

b) the legitimate interest in promoting the services, brand and reputation or ATELIERUL MARI ȘI MICI or of others (such as entities affiliated to ATELIERUL MARI ȘI MICI);

c) the legitimate interest in developing and implementing productive relations with the contractual partners;

d) the legitimate interest developing and maintaining a modern infrastructure, including IT and communications, reported to the operational progress;

e) the legitimate interest in ensuring the safety and security of ATELIERUL MARI ȘI MICI personnel, spaces, assets and operations;

f) the legitimate interest in exercising legal and contractual rights and defending them in court and before the competent authorities;

g) the legitimate interest in drawing and procuring the skilled personnel necessary for the performance of ATELIERUL MARI ȘI MICI operations;

h) the legitimate interest in performing the financial and accounting activities required for ATELIERUL MARI ȘI MICI operations;

i) the legitimate interest in promoting ATELIERUL MARI ȘI MICI objectives in the industry and in relation to authorities and other relevant actors;

j) the legitimate interest in receiving, reviewing and resolving any complaints and claims against ATELIERUL MARI ȘI MICI operations or associates (e.g. employees);

k) the legitimate interest in ensuring the functionalities of the ATELIERUL MARI ȘI MICI website, thereby promoting its business;

l) the legitimate interest in developing and maintaining good community relations and promoting proper organisational values, creating and maintaining an agreeable work environment, organising festive/ cultural gatherings of ATELIERUL MARI ȘI MICI employees and their families;

m) ATELIERUL MARI ȘI MICI legitimate interest to cooperate with shareholders/ other group entities to discuss any important matters and determine the best approach;

n) ATELIERUL MARI ȘI MICI legitimate interest to analyse and monitor the purchase and sale of assets with regard to the ATELIERUL MARI ȘI MICI business or the establishment of new ones;

o) on a more general note, the legitimate interest in the smooth operation, development, security and promotion of its business, according to its registered economic activity;

p) other project-related legitimate interests pursued by ATELIERUL MARI ȘI MICI and the developments with which it must deal in a business context.

5. Categories of recipients

The categories of recipients of the personal data may include:

a) the competent tax authorities (e.g. The National Agency for Fiscal Administration);

b) other public authorities and institutions (e.g. the Ministry of Labour, the National Supervisory Authority for Personal Data Processing, the Competition Council, the National Trade Register’s Office, the National Agency for Cadastre and Real Estate Advertising, the Electronic Archive for Security Interests in Movable Property);

c) external legal, technical, IT advisers; bailiffs, public notaries, translators; other advisers or experts involved with the services we provide or wit other projects that involve us;

d) courts of law, criminal prosecution bodies, public order and national security bodies;

e) ATELIERUL MARI ȘI MICI contractual partners and contractors; recruitment agencies; entities providing security, protection, monitoring, intervention services; entities with which ATELIERUL MARI ȘI MICI works for IT management/ maintenance; entities operating in the advertisement/ PR industry;

f) entities providing public relations services, advertising services, design of information material, event management; entities providing marketing campaign design, implementation, and analysis services; entities/ services concerning networking sites and entities managing ATELIERUL MARI ȘI MICI accounts and communication platforms; entities providing IT design, website management and maintenance services; entities providing call placement/ text delivery / e-mail and message management services for ATELIERUL MARI ȘI MICI or e-mail and message answering services;

g) the individuals concerned by the correspondence received by ATELIERUL MARI ȘI MICI or others involved with the projects to which the correspondence referred;

h) other contractual partners and contractors thereof, as well as catering or event management companies or companies involved with sending out invitations or other communication;

i) group entities and affiliates;

j) entities involved with the (potential) purchase/ sale of assets and/or asset-related association, merger, absorption, split-up.

6. The transfer of personal data

In general, ATELIERUL MARI ȘI MICI doesn’t foresee and transfer to third countries outside the European Union or outside the European Economic Space.

In certain cases, the personal data processed within the audit and consultancy framework may be transferred from time to time outside Romania, in various circumstances, such as:

(i) for reporting purposes in compliance with the International Financial Reporting Standards (IFRS) or the US GAAP Standards;

(ii) for the purposes of providing assistance to non-resident and expatriate natural persons;

(iii) for the purpose of the sale and purchase of assets involving foreign parties or advisors;

(iv) for inter-company relations purposes.

In the specific cases when the personal data are transferred, they will be proportionate to the purpose and relevant needs, involving, to the extent necessary, personal data of the persons directly or indirectly involved in the relevant activities.

Moreover, ATELIERUL MARI ȘI MICI aims to comply with the applicable legal framework, therefore, without a decision to recognise the adequate security in a decision of the European Commission, such transfer will take place based on standard clauses on the protection of personal data adopted by the European Commission, based on binding corporate rules or on other grounds (e.g. your consent).

7. Storage period

Your personal data may be stored for periods determined based on the following criteria: (i) the durations provided by specific legislations (such as accounting legislation or the Law on National Archives); (ii) the maximum periods of time during which ATELIERUL MARI ȘI MICI may be held legally liable; (iii) until you exercise a right which prevents or restricts the processing of (certain) personal data by ATELIERUL MARI ȘI MICI; (iv) the period that is practically necessary after the expiry of legal or limitation periods for anonymissation or actual elimination, considering the difficulties in determining the moment when some data were collected; (v) the contractual term.

In the event where relevant legal action is initiated in court, ATELIERUL MARI ȘI MICI may continue to process personal data for an additional period of time, as necessary (i.e. until the end of the relevant proceedings regarding such action and until the expiration of the relevant limitation periods) and only if necessary.

In the particular case of data processing for recruitment purposes, ATELIERUL MARI ȘI MICI mentions that the personal data concerning the candidates are not stored only throughout the selection process; if the candidate is not accepted, ATELIERUL MARI ȘI MICI will store the personal data included in the CV for future recruitment for a period of 1 year after the end of the year when the selection process ended.

ATELIERUL MARI ȘI MICI intends to have a minimalist approach as regards the processing, including by storage, of personal data, therefore it considers the review from time to time of the practical options and the risks of deletion, anonymisation or similar measures concerning the personal data processed, usually in January – February of each year.

8. Rights of the data subjects and restrictions thereof

As data subject, you have the rights provided by law, within the limits mentioned therein and hereunder.

Where requests from a data subject are manifestly unfounded or excessive, ATELIERUL MARI ȘI MICI may either charge a reasonable fee or refuse to act on the request.

Furthermore, where ATELIERUL MARI ȘI MICI has reasonable doubts concerning the identity of the natural person making the request to exercise any rights, may request the provision of additional information necessary to confirm the identity of the data subject.

In general, the rights may be restricted under the Union or national law; such restrictions may be necessary to safeguard: a) national security; b) defence; c) public security; d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; f) the protection of judicial independence and judicial proceedings; g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority; i) the protection of the data subject or the rights and freedoms of others; j) the enforcement of civil law claims.

8.1. Right of access by the data subject

The right to obtain a copy of the personal data undergoing processing shall not adversely affect the rights and freedoms of others.

8.2. Right to rectification of personal data

8.3. Right to erasure („right to be forgotten”)

The right to data erasure is subject to the following restrictions: a) the existence of a legal ground for the processing or personal data other than consent; b) the existence of legitimate grounds for ATELIERUL MARI ȘI MICI to continue processing personal data; c) if the processing of personal data is necessary for exercising the right of freedom of expression and information; d) if the processing of personal data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority; e) for reasons of public interest in the area of public health; f) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; g) if the processing of personal data concerns the establishment, exercise or defence of legal claims.

8.4. Right to restriction of processing, only in the following cases:

a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or d) the data subject has objected to processing pursuant to Article 21(1) of the GDPR, pending the verification whether the legitimate grounds of the controller override those of the data subject.

8.5. Right to data portability

The right to data portability applies if all following is true : a) the processing is based on consent or on a contract and b) the processing is carried out by automated means.

8.6. Right to object

Basically, the right to object applies if the processing is based on legitimate interests or if the processing is necessary for the performance of a task carried out for reasons of public interest or in the exercise of official authority.

The right to object doesn’t apply if ATELIERUL MARI ȘI MICI demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

8.7. Right to lodge a complaint with a supervisory authority

In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing.

8.8. Right to withdraw consent

The right to withdraw consent doesn’t affect the lawfulness of processing based on consent before its withdrawal or processing based on different grounds (i.e. legitimate interest).