GDPR – Auto3P

Auto3P (Europe) Romania Policy on Personal Data Processing

EXTERNAL POLICY:

Policy content

1 Your controller identity and contact details

2Contact details of the data protection officer for your personal data

3 The categories of personal data we process..

4 The sources from which we obtain your personal data

5 The methods in which we process your personal data

6 The purposes of processing your personal data and the legal grounds for processing your personal data

6.1 Potential Clients / Clients / Former Auto3P (Europe) Clients and other related persons

6.1.1 Pre-contractual period

6.1.2 Contract term / post-contract term

6.2 Auto3P (Europe) Romania suppliers and other people in connection thereof

6.3 Auto3P (Europe) Romania partners and other people in connection thereof

6.4 Other persons

7 Recipients / categories of recipients of your personal data

8 Transferring your personal data outside the European Union.

9 Your rights.

10 Your obligation or your non-obligation to provide us with your personal data

11 No automated decision-making process

12 Amendment this Policy

13 The exclusive nature of this policy

VERY IMPORTANT:

You have the right, at any time, to oppose us processing your personal data.

The right of opposition may be exercised by the data subject (i.e. you) only in one of the following two cases:

1. "The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) of Article 6(1) of the GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims."

2. "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing."

1 Your controller identity and contact details

Auto3P (Europe) Romania S.R.L (Auto3P (Europe) Romania) is a data controller.

Auto3P (Europe) Romania S.R.L. is based in Bucharest, Sos. Bucuresti-Ploiesti Nr. 17, et.4, sector 1, is registered with the Trade Register under no. J40/12455/2010 and Tax Registration Number RO 27827370.

The contact details of Auto3P (Europe) Romania S.R.L. are the following:

Bucharest, Sos. Bucuresti-Ploiesti Nr. 17, et.4, sector 1

Phone: 031-710-20-85

Fax: 031-710-20-86

Email: dpo@auto3p.com.ro

2 Contact details of the data protection officer for your personal data

Auto3P (Europe) Romania has appointed a data protection officer and he / she can be contacted at the e-mail address dpo@auto3p.com.ro

If you do not wish to contact your personal data protection officer by email, you can use any other type of correspondence using the Auto3P (Europe) Romania contact details listed in par. 1 above.

3 The categories of personal data we process

Depending on the category of persons you are part of, and depending on how your personal data reach in our possession, we may process, in whole or in part, the following categories of personal data:

1. identification data (e.g. surname, first name address, etc.)

2. identification data by using remote means of communication (e.g. telephone number, email address, IP of a device)

3. job / occupational data (e.g. position, workplace, etc.)

4. data on how you carry out your activity (e.g. the time when you start your working hours, when you actually get to work, the routes you follow, how you negotiate a contract with us, the content of an email sent by you from an address in your workplace, etc.)

5. technical data about the vehicle you are driving (e.g. brand, model, registration number, Vehicle Identification Number, mileage, condition of the car, date of the last inspection, date of the next inspection, parts replaced, condition of the parts, wear degree of the parts, parts purchased, the date the parts were purchased, the car services visited, the services provided by the car services visited, the price paid for the parts / service, the date of the last periodical inspection for proof of technical condition, the date when the periodical inspection for proof of technical condition expired, etc.)

6. financial data about your vehicle (e.g. how much did the car purchase cost, when the car was purchased, the book value, the depreciation, the insurance costs, the lease costs, the costs of the technical inspections, the replacement costs, the gasoline costs, the costs of the daily journeys, operating costs, etc.)

7. data about your driving skills (e.g. whether you hold a driver's license or not, all the information contained in a driving license, if you hold the certificates / documents required by law / employer for driving a certain type of car, the date of the last medical check, the date of the next medical check, etc.)

8. data about your travels (e.g. departure point, arrival point, the route followed, the number of stops, the duration of stops, the locations where you stop, the meaning of the locations where you stopped, etc.)

9. data on how you drive (e.g., with what speed you are traveling at a given time - in real time, what is the average speed in a certain period / for a particular route, the period of stay, the period of travel, how many times you used the brakes, the kind of brakes - light / aggressive, how you take the turns - easy / aggressive etc.)

10. data on how you fit in a particular driving style (e.g., driving normally, driving aggressively, driving dangerously, etc.)

11. data on how you are classified towards other drivers (e.g. from the point of view of your driving style you range among the best drivers / optimum drivers, on the contrary, etc.)

12. data on how you are likely to behave in the future (e.g. you are prone to be fined / sanctioned, you are prone to cause an accident, you are prone to break the traffic rules, you are prone to be a danger to other road users etc.)

13. data about your fairness towards the employer (e.g. you start work according to the working hours established or not, you travel to the places imposed by the employer or not, you feed the car from the units imposed by the employer or not, you choose the shortest / optimal routes or not, you use the car for personal interest or not, you deliberately choose the longest / difficult / unreasonable routes or not, you illegally steel fuel or not, etc.)

14. graphoscopic data (e.g. your signature affixed to a contract signed with us)

15. biometric data (e.g., your image recorded by one of our cameras, your image contained in your identity document stored by us)

16. financial data (e.g. your bank account, the bank where it was opened, the date of a payment, the justification of a payment, the salary paid by your employer, the costs of employer in relation to your driving behavior, etc.)

17. location data (e.g., the place where you carry out your activity, your real-time location, the routes you take, the routes you are going to take, the location of your work place, the location of your points of interest, the location of your home, the places frequented, the period of time spent in frequented places, etc.)

18. your views (e.g. your opinion on a product provided by our company).

4 The sources from which we obtain your personal data

The sources from which we obtain your personal data are varied, on a case-by-case basis, and may consist of:

1. your person (e.g., you send us an email or contact us by phone, send us a resume for employment with our company, you start the GPS device, your behavior recorded by the equipment installed on the car you drive, your behavior recorded and processed by MultiFleet application, you use the MultiFleet application, etc.)

2. the company / entity where you are hired (e.g., your company sends us your personal data to contact you to engage in and carry on a dialogue on a particular topic, your company sends us your personal data to generate your account in the MultiFleet application, etc.)

3. echipamentele noastre montate pe autoturismul condus de dumneavoastra (ex. echipamentul GPS, sonda de benzina etc),

4. the MultiFleet application (the software / IT program) (e.g., application that records in real-time your location, an application that records in real time the routes you take, the routes being subsequently stored and can be reviewed, an application that contains information about you, such as the surname, first name, phone number, technical and financial details of the vehicle you are driving, an application that carries out your automatic profiling in terms of driving style and the way you behave towards your employer, etc.),

5. other applications (software / IT programs) that we use in connection with the MultiFleet application (e.g., servers that provide raw data, billing application, Admin MultiFleet, etc.),

6. the company / entity with whom you are engaged in a certain relationship (e.g., the company for which you provide certain goods and / or services without being its internal employee),

7. other people / entities that hold your personal data (e.g., a friend, a company you used to be employed, another client of us, etc.),

8. public sources (e.g., contact details from the Trade Register, search results displayed by a search engine, etc.).

5 The methods in which we process your personal data

Auto3P (Europe) Romania may process your personal data, in whole or in part, in the following ways:

1. collection (e.g., receiving a contract signed by you, receiving your location data in real time, receiving real time data about your driving manner / style, etc.)

2. storage (e.g., keeping an email received from you, storing your location data, storing your routes data, storing your driving style data, etc.)

3. recording (e.g., your recording in our customer base under a certain number, your recording as a driver for a particular MultiFleet car, etc.)

4. visualization (e.g., viewing your contact information in our database, either in real time or following a request from your employer)

5. modification (e.g. when you request us to change your contact details / data of your next medical checkup, etc.)

6. encryption (e.g. when we encrypt devices that store your personal data)

7. transmitere / divulgare (ex. cand transmitem datele dvs de contact unui curier, cand transmitem, in tot sau in parte, datele existente in aplicatia MultiFleet catre angajatorul dumneavoastra si/sau catre organele abilitate in conformitate cu dispozitiile legale în vigoare),

8. destruction (e.g. when we delete you from the active client database, when we delete the MultiFleet user account, when we delete the data that you have been the driver assigned to a particular car in the MultiFleet application, etc.)

9. any other operations performed on / about your personal data (e.g., access restriction, data pseudonymization, data anonymization, processing to generate roadmaps, reports, statistics, rankings, etc.).

6 The purposes of processing your personal data and the legal grounds for processing your personal data

Auto3P (Europe) Romania processes a series of personal data based on one or more purposes, as well as one or more legal grounds, as outlined below.

In order to understand the legal purposes and grounds for which we will process your personal data, please access the category of persons you belong to.

6.1 Potential Clients / Clients / Former Auto3P (Europe) Clients and other related persons

Auto3P (Europe) Romania processes the personal data of its potential clients / clients / former clients as well as other people in a certain relationship / connection with them such as:

1. individuals,

2. their representatives (e.g. director, general manager, economic manager, etc),

3. their employees (e.g., employees, civil servants, contract staff, etc.),

4. representatives of suppliers / partners / subcontractors / consultants / etc (e.g.: account manager, coordinating lawyer, etc.),

5. employees of the suppliers / partners / subcontractors / consultants / etc. (e.g.: the employee of the mobile phone service provider, etc.),

6. representatives of an authority / public institution in connection thereof (e.g., an ANAF [National Agency for Tax Administration] inspector, etc.),

7. employees of an authority / public institution in connection thereof (e.g., an inspector from the Environmental Authority, etc.),

8. any other individual who is in any way connected with them (e.g., a car mechanic who takes part in an intervention at one of our clients, etc.).

6.1.1 Pre-contractual period

The purposes of processing

Auto3P (Europe) Romania aims to offer its services and / or its products and / or solutions to as many people / entities as possible.

During the pre-contractual period, Auto3P (Europe) Romania will process your personal data for the following purposes:

1. in order to engage in and carry on a dialogue with you,

2. in order to present our products / services / solutions,

3. in order to obtain from you some information on the basis of which we can propose the products / services / solutions that best fit you,

4. in order to draft the documents related to the pre-contractual period (offer, contract template, etc.),

5. in order to understand the requirements and trends of the market (e.g., what products / services / solutions are being sought, by what categories of customers, at what prices, etc.),

6. in order to understand how we can improve our products / services / solutions (e.g., assessing internal staff, analyzing the opportunity to hire additional staff, etc.),

7. in order to understand the way we have to organize our business from all points of view (commercial / marketing / HR / IT / financial, etc.) (e.g., one month sales valuation compared to sales that could have been achieved, the assessment of the manner in which our internal employees perform their job duties, the assessment of the manner in which we present ourselves as a company, etc.),

8. in order to protect our rights and interests (e.g., if you consider yourself affected in any way by the manner in which we presented our products).

Legal bases of processing

The legal bases for processing your data:

1. the need to take action at your request (e.g., we prepare a contract template, we prepare an offer personalized to your needs, etc.),

2. our legitimate interests to achieve the goals outlined above.

In consideration of the above, Auto3P (Europe) Romania may contact you either on its own initiative (e.g., by sending an email) or at your own initiative (e.g., you contact us by phone, etc.) or at the initiative of another person / entity (e.g., both you and we receive an email from an intermediary).

To the extent that you become an Auto3P (Europe) Romania customer, your data is processed as described in the chapter 6.1.2. below.

Length of data storage

To the extent that you do not become an Auto3P (Europe) Romania client, your data will be permanently removed within 30 calendar days from when it becomes certain that you will not become our client (e.g., you send an email to inform us, you interrupt your communication with us for a time that exceeds a reasonable period of time, we inform you that we cannot provide the products / services requested, etc.).

6.1.2 Contract term / post-contract term

The purposes of processing

Auto3P (Europe) Romania provides / ensures services and / or products and / or solutions to its clients, fulfills a number of legal / conventional obligations and adapts its business strategy according to the requirements of the market.

During the pre-contractual period / post-contractual, Auto3P (Europe) Romania will process your personal data for the following purposes:

1. in order to execute the contract with you and / or the company you are employed with,

2. in order to process your personal data for the purposes of our clients (e.g., in order for your personal data to be collected by the company you are hired with so that the company may review the manner in which you fulfill your job duties etc.),

3. in order to engage in and carry on a dialogue with you and / or the company you are employed with,

4. in order to provide our customers with all the information collected / stored / processed in any way by the MultiFleet application (e.g., your real-time location, the routes you follow, the speed with which you travel in real time, your driving style, etc.),

5. in order to present our products / services / solutions other than those you have already contracted / which the company you are employed with has contracted,

6. in order to obtain from you / the company where you are employed some information based on which we may offer other products / services / solutions that might fit you, other than those already contracted and / or could fit the company where you are employed with,

7. to prepare the documents in connection with the contractual term (e.g., invoices, roadmaps, service reports, installation of GPS equipment, etc.),

8. in order to comply with legal obligations (e.g., the obligation to prepare and maintain primary accounting documents, etc.),

9. in order to understand the requirements and trends of the market (e.g., what products / services / solutions are being sought, by what categories of customers, at what prices, etc.),

10. in order to understand how we can improve our products / services / solutions (e.g., assessing internal staff, analyzing the opportunity to hire additional staff, etc.),

11. in order to understand the way we have to organize our business from all points of view (commercial / marketing / HR / IT / financial, etc.) (e.g., one month sales valuation compared to sales that could have been achieved, the assessment of the manner in which our internal employees perform their job duties, the assessment of the manner in which we present ourselves as a company, etc.),

12. in order to protect our rights and interests (e.g., if you do not pay the value of the invoices issued and we have to initiate a civil suit).

Legal bases of processing

The legal bases for processing your data:

1. your consent (e.g., you sign a document that you agree our processing your personal data, especially with regard to your location, via the GPS equipment mounted on your vehicle and with the MultiFleet application functionality),

2. processing is required to execute the contract signed with you (e.g., in order to provide monitoring services for the location of your cars by GPS it is necessary to have access to the GPS equipment installed and the data transmitted by it, etc.),

3. processing is necessary to meet legal obligations (e.g., the obligation to prepare and keep primary accounting documents, such as the contract concluded with you, the invoices issued to you, the GPS installation procedures, the reports on technical support interventions on GPS equipment etc.),

4. our legitimate interests (to achieve the goals outlined above).

Length of data storage

Your data is to be stored by us for the entire contractual period as well as after the termination of the contractual relations for a period of 5 calendar years, calculated from January 1st of the year following that in which the contract expires.

By way of exception, some of your data will be stored for a shorter period, i.e. 6 months, in case of for maps of your previous locations, maps of your previous routes.

By way of exception, some of your data will be stored either for a longer period or for a shorter period of time, should a regulatory / administrative norm incumbent upon us impose such an obligation (e.g., The National Archives Act imposes / may impose the storage of certain documents for a period of 20 years, the Tax Code imposes / could impose the storage of your data for a period of 7 years, etc.).

The reasons for storing the data for the period outlined above are the following:

1. during the period covered by the contract, the data are necessary to be able to know what parameters you have to observe towards you / the company you are employed with (e.g.: what we need to provide, where, under what conditions, at what costs etc.),

2. during the period covered by the contract, and thereafter, the data are contained in a series of financial and accounting documents that the law requires us to keep (e.g., the contract, invoices issued, payment orders, bank records, receipts etc.),

3. during the period covered by the contract and thereafter, the data are necessary for us to be able to inform you / to inform the company you are employed with about the opportunity to offer services / products / solutions that might fit you and / or better fit the company you are employed with, better than those initially contracted (e.g., we may also recommend you to purchase a MultiFleet module that stores information about the evolution of a car's operating costs over time or at leasing costs or accounting depreciation, etc.),

4. during the period covered by the contract and thereafter, the data are necessary to be able to analyze the viability / technical efficiency / cost effectiveness / possible technical problems regarding the products / services / solutions offered so that we can understand all the technical / economic aspects of the products / services / solutions provided (e.g., by analyzing how many repairs a particular equipment requires, the type / cost of repairs and at what time intervals, we can recommend a more efficient and effective technical / economic equipment, etc.),

5. during the period covered by the contract and thereafter, the data are necessary to understand the market trends, what type of products / services / solutions are being sought, what is available on the market, what are the costs that the clients are willing to allocate, etc., the knowledge of these information helping us to adapt our business strategy to stay on the market as competitive and as close as possible to your real needs and / or the company where you are employed with,

6. during the period covered by the contract and thereafter, there is the possibility of certain misunderstandings / disputes arising between our company and you / the company where you are employed with, regarding the execution of the contract, in which case the data are necessary to protect our rights (e.g., in the case of a trial we should be able to prove that we have fulfilled our obligations, in the case of non-payment of an invoice we should be able to prove that we have provided the services invoiced, etc.),

7. during the period covered by the contract and thereafter, the data are necessary for us to analyze our own activity and how we conduct it (internal analysis) so that we can adapt to the market in a most appropriate way (e.g., we analyze if new hiring is required, in which department, we review the efficiency of our employees, we assess the knowledge and professionalism of our employees, etc.),

8. After the contract is executed, it is possible that you / the company to which you are employed or we are subject to control by the tax authorities / other public authorities / institutions in which case we must be able to fully prove the contractual relations between us and how they were carried out both by you / the company you are employed with, and by us.

6.2 Auto3P (Europe) Romania suppliers and other people in connection thereof

Auto3P (Europe) Romania processes the personal data of its potential suppliers / suppliers / former suppliers as well as other people in a certain relationship / relationship with them, as they are nominated in the chapter 3.1.

Chapter 6.1.1. - 6.1.2. also applies to the suppliers of Auto3P (Europe) Romania.

6.3 Auto3P (Europe) Romania partners and other people in connection thereof

Auto3P (Europe) Romania processes the personal data of its potential partners / partners / former partners as well as other people in a certain relationship / relationship with them, as they are nominated in the chapter 3.1.

Chapter 6.1.1. - 6.1.2. also applies to the partners of Auto3P (Europe) Romania.

6.4 Other persons

Auto3P (Europe) Romania processes the personal data of other persons other than those mentioned to chapter 6.1. - 6.3., such as:

1. representatives of public authorities / institutions (e.g., inspectors from the Consumer Protection Authority, ANAF inspectors, etc.),

2. visitors of our headquarters and places of business,

3. visitors of our sites,

4. other people with whom we can get contact, etc.

The purposes of processing

Auto3P (Europe) Romania aims to provide / ensure its services and / or products and / or solutions to as many people / entities as possible, but also to meet the legal obligations incumbent upon it and to stay as visible and high-performing on the market.

Auto3P (Europe) Romania processes your personal data for the following purposes:

1. in order to engage in and carry on a dialogue with you / the company you are employed with,

2. in order to present our products / services / solutions,

3. in order to obtain from you / the company where you are employed some information based on which we may offer other products / services / solutions that best fit you / the company where you are employed with,

4. in order to draft the documents related to the pre-contractual period (offer, contract template, etc.),

5. in order to understand the requirements and trends of the market (e.g., what products / services / solutions are being sought, by what categories of customers, at what prices, etc.),

6. in order to understand how we can improve our products / services / solutions (e.g., assessing internal staff, analyzing the opportunity to hire additional staff, etc.),

7. in order to meet legal obligations (e.g., the obligation to provide the documents and information requested by a public authority / institution that initiates a control regarding us),

8. in order to understand the way we have to organize our business from all points of view (commercial / marketing / HR / IT / financial, etc.) (e.g., one month sales valuation compared to sales that could have been achieved, the assessment of the manner in which our internal employees perform their job duties, the assessment of the manner in which we present ourselves as a company, etc.),

9. in order to protect our rights and interests (e.g., if you do not pay the value of the invoices issued and we have to initiate a civil suit).

Legal bases of processing

The legal bases for processing your data:

1. processing is necessary in order to meet legal obligations incumbent upon us (e.g., if we are subject to tax control, we provide the tax inspector with the documents and information concerning you, etc.),

2. our legitimate interests (to achieve the goals outlined above).

Storage period

The storage period varies from case to case depending on the particularities of the data (e.g., the number of visitors to our website may be stored for a period of 3 months required to conduct a particular survey or may be held for a period of 1 year to analyze developments, etc.).

However, we will make sure that we do not store your data once the purpose for which we collected them was achieved.

7 Recipients / categories of recipients of your personal data

Your personal data may and, in some cases, depending on the circumstances, will be send by us to:

1. people who act under our close supervision (e.g., our employees),

2. our personal data co-operators (e.g., the company you are employed with, etc.),

3. people who act under the close supervision of our personal data co-operators (e.g., employees of the company you are employed with, etc.),

4. persons authorized to process personal data on our behalf (e.g., a courier company),

5. persons who act under the close supervision of persons authorized to process personal data on our behalf (e.g., a courier company),

6. you, insofar as you understand to exercise one of the rights provided by law (e.g., right of access),

7. any person / entity other than those set out in sections 1 to 6, for example a distinctive personal data controller (e.g., ANAF [National Agency for Tax Administration]).

Personal data will be transferred to the persons listed above only to the extent that this transmission:

1. is either imposed by the need of achieving the purposes for which we process personal data,

2. or it is imposed by law.

8 Transferring your personal data outside the European Union

Auto3P (Europe) Romania stores your personal data, either in physical form, in digital format or in both formats, across the European Union.

However, in some situations, Auto3P (Europe) Romania will transmit your personal data outside the European Union (e.g., by sending an email to your company owning your own email server outside of the European Union).

In these latter cases, Auto3P (Europe) Romania will ensure that the data transfer will be performed only to the extent that the conditions imposed by the European legislation on personal data protection are met (e.g., a conformity decision issued by the European Commission, there is an agreement to ensure the necessary guarantees, etc.).

9 Your rights

As far as your personal data is concerned, you have a number of rights:

1. the right to withdraw your consent to the processing of your data by us,

2. the right of access to your data,

3. the right to rectify your data,

4. the right to obtain the deletion of your data,

5. the right to obtain restriction of processing your data,

6. the right to oppose the processing of your data,

7. the right to data portability,

8. the right to lodge a complaint with the competent authority in the matter of processing personal data.

Auto3P (Europe) Romania will facilitate the exercise of your rights, so feel free to contact us at dpo@auto3p.com.ro

10 Your obligation or your non-obligation to provide us with your personal data

As a general rule, Auto3P (Europe) Romania will not compel you in any way to submit your personal data.

However, in certain situations, if you do not submit your personal data, we cannot fulfill our goals mentioned above.

For example, to the extent that you do not forward your contract with your signature, we cannot consider that a valid contract has been concluded between us.

For example, as long as you do not turn on the GPS, we cannot deliver the services contracted to our customers through the MultiFleet application.

11 No automated decision-making process

Auto3P (Europe) Romania does not own / use any automated decision-making process, including creating profiles for you, and all decisions / actions / inactions / measures taken / adopted / conducted by our company are based solely on the human factor.

Although we use a range of IT equipment, the decisions that we take for you are only taken by the people in our team, based on our own beliefs and appreciations, and not automatically, based on the information provided by IT equipment.

However, you need to know and understand that the MultiFleet application, by automatically collecting a series of information related to you (e.g., the degree of acceleration, the way you use the brake, the way you take the turns) is also able and makes an automatic profiling about you.

In other words, once our equipment is installed on the vehicle you drive and they are activated, they transmit a series of information to the MultiFleet application, in real time, that, by using some algorithms, will shape / determine, automatically, without any human intervention, certain features in terms of style of driving.

Currently, the algorithms through which the MultiFleet application creates profiles are as follows:

1. 1. Acceleration

a. between 0 and 2.30 = optimal driving style

b. between 2.31 and 4.60 = average driving style