PERSONAL DATA PROCESSING POLICY

OUR COMMITMENT TO YOUR PERSONAL DATA

The Personal Data Processing Policy describes the categories of your personal data that we process, the methods and purposes for which we collect them, the situations in which we transfer personal data, as well as the rights and options available to you in this regard. At the same time, the Personal Data Processing Policy details how we process personal data in managing client relationships, most often to keep you informed of the latest developments or events in your field of interest.

DATA CONTROLLER FOR YOUR PERSONAL DATA

The data controller in relation to your personal data is GIDRO&GIDRO SCA, located in Cluj, Cluj-Napoca, Tax ID RO 40373190, as the owner of the website www.gidro.ro.

CATEGORIES OF PROCESSED PERSONAL DATA

The personal data we process may include: • Contact information, such as your name, postal address, including residential address if provided, business address, phone number, mobile phone number, fax number, and email address; • Data resulting from your navigation on our website collected through cookies and similar technologies, where applicable. • In the event you send us an email requesting offers or legal assistance services, you implicitly consent to the processing of personal data provided through the email sent.

LEGAL BASIS FOR PROCESSING PERSONAL DATA

Any processing of your personal data will be carried out based on one of the legal bases below: • Processing is necessary for the conclusion or performance of a contract in which you are a party; • Processing is necessary for compliance with a legal obligation of the controller; • Processing is carried out based on your consent; • Processing is necessary to protect your vital interests or those of another natural person; • In the case of special categories of data, processing will be carried out if, in addition to a general legal basis for data processing, one of the following specific conditions for processing is met: o The consent of the data subject has been obtained; o We have a legal obligation to process these categories of data; o Processing is necessary for the establishment, exercise, or defense of a legal claim.

FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

We may use your personal data for the following purposes (“Permitted Purposes”): • Providing legal consulting services. • Managing and administering contractual relationships with our clients. • Compliance with our legal obligations. • Analyzing and improving our services and communications to you. • For any related and/or ancillary purpose to any of the above, or for any other purpose for which your personal data has been provided to us, in compliance with applicable laws. Also, based on your consent, we may send you various communications through the channels you have approved to keep you informed about GIDRO&GIDRO SCA’s services, products, events, and projects.

HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

GIDRO&GIDRO SCA has implemented technical and organizational measures for organizing the process and specific criteria for retaining your personal data (including according to our archiving procedures). We will cease processing personal data when they are no longer reasonably necessary for the Permitted Purposes, or when you withdraw your consent (if applicable) and there are no longer legitimate and compelling reasons for continuing the processing (including our legal obligation to continue storing the respective data) that outweigh your interests, rights, and freedoms.

YOUR RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA

Subject to certain legal conditions, you have the following rights regarding the processing of your personal data: • The right to request a copy of your personal data that we hold; • The right to rectify any incorrect or incomplete personal data; • The right to object to or restrict our use of your personal data; • The right to withdraw consent for processing based on consent; • The right to erasure of your personal data, in situations where you have withdrawn your consent, the processing is no longer necessary, or the processing is contrary to the law; • The right to data portability, allowing you to receive a copy of the processed data that we received from you or to transmit them to another entity indicated by you; • The right to withdraw consent for processing based on consent. The withdrawal of your consent will not affect the legality of processing based on the consent before its withdrawal. In cases where you withdraw your consent, GIDRO&GIDRO SCA will no longer process your personal data and will take appropriate measures to delete your personal data. GIDRO&GIDRO SCA may, however, process your personal data if there is another legal basis for such processing. If you wish to exercise the rights mentioned above, please contact us using the following contact details: • Cluj-Napoca, str. Constantin Dobrogeanu Gherea nr. 21, ap. 1, jud. Cluj • Email: [email protected] • Fax: 0264595989 To comply with our legal obligations regarding the security and confidentiality of the data, when you exercise any of the rights you have as a data subject, we may ask you to prove your identity by providing us with a copy of an identification document or any other necessary information to verify that the request comes from the relevant data subject. We will consider any requests or complaints we receive and will provide a response within the time frames provided by law. If you are not satisfied with our response or believe that the processing is in violation of applicable law, you can file a complaint with the data protection supervisory authority in Romania: The National Authority for the Supervision of Personal Data Processing, located at Bd. Gheorghe Magheru nr. 28-30, Bucharest, Romania.

UPDATES TO THIS PERSONAL DATA PROCESSING POLICY

We reserve the right to periodically update and modify the Personal Data Processing Policy to reflect any changes in the way we process your personal data or any changes in legal requirements. In the event of any such changes, we will post the modified version of the Personal Data Processing Policy on our website and/or make it available in another manner.