ALEXANDRION GRUP ROMANIA SRL, a Romanian legal entity headquartered in Bucov Commune, Pleasa Village, Prahova County, registered with the Trade Registry under no. J29/1028/2000, unique registration code 13575086, hereby informs you through this Policy about the processing of personal data, such as: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or destruction, when you access/use our website. We may change this Privacy Policy at any time. All updates and amendments to this Policy become effective immediately upon notification, which we will provide by posting on the website and/or by email notification.

1. What categories of personal data do we collect?

• email address;
• information regarding your use of the Website, such as the date and time you accessed the Website, including your public IP address, public Device ID, and similar data about you.

Alexandrion Grup Romania collects personal data in the following ways: directly from you (provided on the website, by email), from traffic reports recorded by the servers hosting the website, and through cookies.

2. For what purposes do we process your personal data?

We process your personal data to enable marketing activities, including: using your personal data to send you news about our products and services or to carry out promotional activities, if you subscribe to our newsletter. You may unsubscribe from these marketing communications at any time, quickly and easily. You only need to click the “Unsubscribe” link included in every newsletter.

Alexandrion Grup Romania also processes your data to ensure the functionality of the website and the secure administration of the IT system.

3. Legal basis for processing personal data

a) Legitimate interest to ensure the proper functioning of the website and to improve the quality of our products and services;

b) Consent for carrying out direct marketing activities;

c) Legal obligations, for fulfilling obligations related to tax law, accounting law, or certain requests from public authorities.

4. Data transfers and recipients

Your personal data will be disclosed to the following recipients:

• Alexandrion Grup Romania employees with marketing and communication responsibilities;
• IT service providers for the administration and improvement of the website.

Your data will not be transferred outside the European Economic Area. Should such transfers occur, they will be carried out solely in accordance with the EC Standard Contractual Clauses agreed upon by the parties.

5. Retention period

Your data is kept for as long as necessary to achieve the purposes mentioned above, as follows:

• in the case of fulfilling legal obligations;
• in the event of a dispute, personal data may be retained for the entire duration of the dispute and thereafter, for a period of up to 3 years, representing the general statute of limitations;
• if you subscribe to our newsletter, your data will be retained until you unsubscribe.

6. Data security

The Company will process the personal data below lawfully, fairly, and in a transparent manner towards you, and will take all necessary safeguards to ensure respect for your right to privacy. In addition, the Company will implement and maintain reasonable technical and organizational measures to protect your personal data against loss, misuse, and unauthorized access, disclosure, alteration, and destruction.

The website may contain links or references to other websites deemed useful with respect to its content, which are not under its control or guidance. If you use such links or references, the general terms of use applicable to those websites will apply.

7. Your rights

If you have given your consent for certain processing activities, you may withdraw this consent at any time with future effect. Such withdrawal will not affect the lawfulness of processing carried out before the withdrawal of consent.

Right of access to personal data

You may obtain confirmation from us that we are processing your personal data, as well as details about the processing (purpose of processing, categories of personal data concerned, recipients of the data, etc.). You also have the right to request a copy of the personal data we hold about you.

Right to rectification of personal data

If the data we hold about you is inaccurate, incomplete, or imprecise, you have the right to request its rectification.

Right to restriction of processing of personal data

You have the right to obtain from the controller the restriction of processing where one of the following applies:

• (a) the accuracy of the data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data;
• (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• (c) the controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise, or defense of a legal claim; or
• (d) the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

You may receive the personal data you have provided to the controller in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another entity without objection from us.

Right to object

You have the right, at any time, to object, on grounds relating to your particular situation, to processing where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of a legal claim.

Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, except where you expressly accept the automated decision.

Right to erasure

In certain situations, you may request the erasure of your personal data, for example if it is no longer necessary for the purpose of processing. However, there may be situations where this is not possible, for example:

• processing is necessary to comply with freedom of expression and information;
• to comply with a legal obligation;
• there are other grounds of public interest justifying the retention of the data, such as those related to public health or scientific and historical research;
• we must retain the personal data for a potential legal claim.

The rights mentioned above may be exercised by submitting a written, dated, and signed request to Alexandrion Grup Romania at the postal address 19A Nicolae Grigorescu Street, Otopeni, Ilfov, Romania, for the attention of the Data Protection Officer, or at the email address dpo@alexandrion.ro. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing.

Please note that:

• The rights listed above are not absolute. There are exceptions, which is why every request received will be reviewed in order to determine whether it is well-founded. To the extent the request is well-founded, we will facilitate the exercise of your rights. If the request is unfounded, we will reject it, but we will inform you of the reasons for the refusal and of your right to lodge a complaint with the Supervisory Authority and to seek judicial remedy.
• We will try to respond to your request within 30 days. However, this period may be extended as permitted by law, depending on various factors, such as the complexity of the request, the large number of requests received, or the impossibility of identifying you within a useful timeframe.