PRIVACY POLICY OF THE WEBSITE www.valetino.ro

1. Personal Data Controller Information

For EU VALETING SERVICES SRL the confidentiality of your personal data is of great importance. To this end, we have developed this commitment to respect the confidentiality of your data, by means of which we explain what categories of personal data we process as a Controller, as well as how those data are used and the purpose for which they are subject to processing operations.

This Privacy Policy relates only to your personal data that EU VALETING SERVICES SRL processes through the website www.valetino.ro and the Valetino mobile application.

We want to assure you that, at the level of the Controller, all the necessary measures have been taken to ensure the confidentiality of your data, as these are processed only by our staff, which are regularly trained in the processing of personal data and authorized for this purpose.

! For the avoidance of doubt, this Policy applies only to data processing performed by the Controller EU VALETING SERVICES SRL and its proxies, such as the valet or other service providers (for example, IT service providers), and the Controller’s partners, who provide the final service to the beneficiary (e.g. car wash, auto repair shop, etc.), will be responsible for the ways and purposes for which they process your personal data. The data subject will be duly informed about the processing that involves a data transfer between Valetino and any company that provides services to the Controller.

The controller that processes your personal data when you browse the online platform www.valetino.ro or use the Valetino mobile application is EU VALETING SERVICES SRL (hereinafter referred to as "Valetinobased in Constanta, Constanta County, str. Tudor Vladimirescu, Nr. 28A, ground floor, registered at the Trade Register under no. J13 / 1791/2021, with TIN RO44349534, as author, owner and administrator of the website www.valetino.ro.

For any questions/concerns regarding the protection of personal data, you are invited to send a request to the postal address: Constanta, Constanta County, str. Tudor Vladimirescu, no. 28A, ground floor, or at the e-mail address: office@valetino.roafter having written on the envelope, or in the subject of the e-mail respectively, the mention "Protection of personal data", "Personal data" or "GDPR”.

As a data subject, you will receive a reply within 30 days of the communication of your request to Valetino, and an extension of this time will be given only in exceptional situations. In such cases, we assure you that you will be duly informed of this deadline.

2. Definitions

• The term "personal data" means, within the meaning of applicable national and international law, any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

! For the purposes of this policy, the personal data that will be processed belong to the user who interacts with our website or our mobile application either by simply browsing them, or by registering on the platform, as a result of creating a user account or in the context filling out the forms available on the website.

• The term "processing of personal datameans any operation or set of operations performed on personal data by automatic or non-automated means, such as collecting, recording, organizing, storing, adapting or modifying, extracting, consulting, using, disclosing to third parties by transmission, dissemination or in any other way, joining or combining, blocking, deletion or destruction.

! For the purposes of this policy, the data processing refers to the processing performed at the time of your browsing on the website www.valetino.ro, of the interaction with this web page or of the use of the Valetino mobile application.

• "Controller" or "Personal data controller" means the person who, alone or in conjunction with others, sets out the purposes and means of the processing of personal data.

! For the sake of clarity, for the purposes of this Privacy Policy, the Controller is Valetino.

• "Data subject" means a person whose personal data are being processed and may be an identified or identifiable natural person.

! The person covered by the data processing described in this Privacy Policy is the user of the website www.valetino.ro or of the Valetino mobile application.

• The term "consent" of the data subjects means any manifestation of their specific, informed, and unambiguous expression of the data subjects’ free will, by which they accept, by an unequivocal statement or action, the personal data concerning them to be processed.

! The consent, as a basis for the processing of personal data, will be requested from the users in the context of, for example, their subscription to the newsletter.

• “Third party" means any natural or legal person, public authority, agency or body, other than the data subject, the controller, the controller’s proxies or the persons who, under the direct authority of the controller or the controller’s proxies, are authorized to process personal data.
• "Controller-authorized person" means the person who processes personal data on behalf of the controller.

! For the purposes of this policy, the persons authorized by the controller are the valets registered on the Controller’s platform, and his service providers (e.g., legal services, IT, accounting, etc.).

3. Categories of processed personal data

Browsing the website www.valetino.ro or using the Valetino mobile application involves the processing of two categories of personal data, namely:

1. personal data that you voluntarily disclose to the Controller (e.g. by creating a user account and logging into this account, followed by a valet request, by placing an order for products available in the store, by filling out the newsletter subscription form, etc.), data that are collected individually;
2. data that you provide unintentionally, by simply browsing our website. This data collection is described in detail in our website’s Cookies Policy.

Valetino collects, based on the voluntary provision of the data subject, the following personal data, depending on the operation performed by the user:

1. In the context of placing an order for products available in the Valetino store, the data processed may refer to: name and surname, e-mail address, telephone number, postal address, postal code, bank details, gender (indirectly), data regarding the vehicle (registration number, make, model), as well as any other data that the data subject makes available to the Controller by filling in the box specific to the additional observations related to the order placed.
2. By subscribing to the newsletter, the data subject provides the following personal data, which will be processed by the Controller: e-mail address.
3. Creating a user account involves processing the following categories of personal data - username, password, email address, gender, first name, last name, mobile phone number.
4. By filling out a request, the following personal data is provided: first name, last name, e-mail address, telephone number, vehicle data (registration number, make, model, description of each part of the car - photos with total kilometers, chassis series, front, back, left and right side), as well as access to its documents (car liability insurance policy, Periodic Technical Inspection note, pink slip, road tax sticker).

The Controller manages, in addition to the online platform www.valetino.ro, both the Valetino mobile application and the Valetino.ro Facebook page - associated with the website www.valetino.ro, but also the Valetino.ro Instagram page - also associated with the website www.valetino.ro.

Through the social media channels mentioned above, the Controller can process a series of personal data such as: name/nickname - the name of the social media user profile, data transmitted through messenger/messages, etc., as well as any other information made public voluntarily by the data subjects through these networks.

In the context of processing this data, Valetino is strictly limited to the expectations of users of these media channels and does not use the data thus collected for purposes other than statistics or maintaining contact with users (profile views, likes, story views/messages, etc.). When the user expresses a desire to use the Valetino services or to order the products available on the online platform, the aforementioned processing rules for placing online orders are taken into account.

Apart from the data collected through the forms available on the site and which were previously specified, the Controller may process other data belonging to the data subjects, in order to complete orders and resolve any complaints, as well as to provide additional information on services listed on the website and which may refer to: voice (in the context of making telephone calls) or other identification data necessary to actively maintain the connection of the Controller, as a professional and the data subject, as a beneficiary of the services offered by the Controller. In general, such processing is performed outside of our online platform, which is why specific processing rules will apply to them, and not the provisions of this Policy.

Regarding the website/mobile application, the categories of data processed through it are limited to those listed above.

The controller may inadvertently collect other personal data belonging to you, namely: IP address, website visit time, platform access location, site searches, device used, hardware model, name and version of the internet browser, operating system, time spent on our website, etc. This information will not be used to identify individuals and will not be made public otherwise than under the terms of the Privacy Policy, supplemented by the Cookies Policy.

Your personal data may be communicated by the Controller, for processing, to persons authorized to process the data, including service providers, institutions, authorities, competent bodies and institutions or courts, at their request.

The Controller reserves the right to request additional information, accompanied by supporting documents, by e-mail or in physical format, printed or in any other way deemed appropriate by the Controller, in order to honor its obligations to provide services, but also in order to resolve any complaint received from you.

The provision of the aforementioned personal data is necessary for Valetino to fulfill its obligations to manage and honor the requests received. A refusal by the data subject to provide this data will make it impossible for the Controller to honor the requests and orders issued, to put you into contact with a valet, to provide any additional information requested, as well as to resolve the complaints sent.

Valetino may store your personal data even after the registration of a request for deletion of this data, if the storage is for one of the following purposes:

1. honoring the requests sent by you;
2. fulfillment of a legal obligation which allows processing under European Union law or domestic law applicable to the controller;
3. exercising the right to free expression and information;
4. protecting the vital interests of the data subjects;
5. fulfilling a task that serves the public interest;
6. archiving in the public interest, scientific or historical research or for statistical purposes;
7. the protection of the legitimate interests of the Controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject prevail, which require the protection of personal data, especially when the data subject is a child;
8. for finding, exercising or defending a right in court.

4. Purposes and grounds for processing personal data

Valetino processes your personal data for the following purposes and having the following legal grounds:

1. The processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding a contract - art. 6, para. (1), lett. b) of Regulation no. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR"). Specifically, the data subject's data will be processed so that Valetino can register, manage and honor the requests and orders sent by this person, in accordance with the Terms and Conditions displayed on the website.
2. The processing is performed based on the data subject’s consent - art. 6, para. (1), lett. a) of the GDPR, in order to improve the marketing activity (the possibility to communicate with the clients for the description of the experience they had regarding the relationship with Valetino, the possibility to send specific messages to members who have a user account or who subscribe to the newsletter, etc.)

Note: The consent given freely, unequivocally and in full knowledge of the facts is valid until its withdrawal. Valetino has taken all necessary steps to ensure that the rights and freedoms of data subjects are not affected by this type of processing. However, the data subject may ask, at any time, by sending a request to this effect to the addresses mentioned in this document, to stop the processing of personal data by the Controller for marketing purposes. Withdrawal of consent will not affect direct marketing actions performed until that date.

1. The data of the data subject are processed in the legitimate interest of the Controller, unless the interests or fundamental rights and freedoms of the data subject prevail, which require the protection of personal data, especially when the data subject is a child. - art. 6, para. (1), lett. f) of the GDPR, specifically for solving any complaints received from the data subjects, but also for providing them with additional requested information, as well as for solving any problems of any kind regarding the content of the website www.valetino.ro and for actions which involve interaction with the online platform or the mobile application.
2. Last but not least, the data processing performed by Valetino is necessary in order to fulfill a legal obligation incumbent on the Controller - art. 6, para. (1), lett. c) of the GDPR, specifically for drawing up the invoices related to the completed orders, archiving data in accordance with the applicable regulations in this matter and keeping the data from invoices/supporting accounting documents according to the applicable tax legislation, making the information available to the competent authorities and bodies, at their request, etc.

Your personal data will be processed by Valetino for the following purposes:

1. placing orders and requests regarding the services offered, subscriptions and honoring requests, in order to execute the contract remotely;
2. confirmation of requests, in order to execute the contract remotely;
3. conducting discussions regarding the request/order/modification of the request/order/cancellation of the request/order, etc. with the Valetino staff;
4. invoicing, in order to fulfill the legal obligations of Valetino, as a seller and service provider (collection made through the platform for the service provided by the valet and the platform commission, for the sale of products/subscriptions from the Valetino store, etc.);
5. improving the services provided by the platform valetino.ro;
6. improving the marketing activity, in legitimate interest, especially regarding the data processing through social media channels (Facebook, Instagram);
7. making statistical reports, in legitimate interest;
8. sending of marketing communications (newsletters on the discounts applied, various campaigns, achievements of the Controller, etc.) based on the free, specific, informed, unequivocal and explicit consent given by the user;
9. account management on the Valetino platform (website and mobile application);
10. sending requested information, at the request of the competent authorities, in order to fulfill the legal obligations incumbent on the controllers;
11. archiving information in order to demonstrate the processing of data exclusively for the aforementioned purposes;
12. protection of Valetino’s rights.

5. Duration of personal data processing

Personal data processed at the level of the Controller through the website www.valetino.ro and the Valetino mobile application are retained for a reasonable period of time in relation to the purpose of data processing, so as not to exceed the period necessary for their processing, which cannot exceed 10 years from the moment of collection (the maximum retention period will be taken into account for the financial-accounting documents for which the Controller has the legal obligation to apply this retention period).

The usual data processing for which there is no retention period imposed by law will be related to the general limitation period of 3 years as the maximum duration of storage in the databases belonging to the Controller.

Regarding the processing based on consent, the data will be retained until the moment of withdrawal of consent, but their duration of retention will not exceed the general limitation period indicated above.

6. Transfer of personal data

Your data is processed throughout the European Union, through secure internal servers.

Valetino undertakes that the data collected by it will be processed only in accordance with the stated purposes and not to make public, sell, rent, license, transfer, etc., in an unauthorized manner, the database containing information regarding the data of the data subjects to any third party not involved in the fulfillment of the declared purposes, except for the situation in which the transfer/access/view, etc., is requested by the competent bodies, in the cases provided by the regulations in force at the date of the event.

Your data may be disclosed to our partners, or end service providers, in order to complete your order, acting as independent data controllers, as well as to other companies with which Valetino may develop joint bidding programs on the market for products and services, service providers (marketing, payment/banking services, telemarketing, legal services or other services), including entities that assist Valetino in the processing of data as proxies, insurers, public authorities, (lawyers, the Prosecutor's Office, the Police, courts and other competent state bodies), based on and within the limits of the legal provisions and as a result of expressly formulated requests. This data will be transferred only on the basis of a confidentiality agreement from the aforementioned recipients, by which they guarantee that the data is kept secure and that the provision of this personal information is made in accordance with the legislation in force.

These entities are carefully selected so as to ensure that they meet the specific requirements for the protection of personal data. They have a limited capacity to use your information for purposes other than to provide us with services/to supply to you the products found on www.valetino.ro.

In addition to the disclosures described in this Privacy Policy, we may disclose information to third parties to whom you consent or request that such disclosures be made.

7. Special provisions related to minors

Valetino pays special attention to the data of minors that may be provided by them in order to place an order or send a request on the online platform www.valetino.ro or on the Valetino mobile application, to ensure that any personal data processing of minors is made only in accordance with the legal requirements and in strictly determined cases.

Thus, the Controller does not carry out promotional marketing activities directly to minors. However, if minors place an order/contact Valetino through the related platforms, it will be deemed that the minors have done so with the consent of their legal representative.

Minors are not allowed to request services or participate in contests or campaigns organized by the Controller.

In this respect, any persons who provide personal data to Valetino through the site or other applications or devices covered by this Policy guarantees that they are of age, respectively that they have full capacity to exercise.

In this respect, any persons who provide personal data to Valetino through the site or other applications or devices covered by this Policy guarantees that they are of age, respectively that they have full capacity to exercise.

8. Links, hyperlinks and third party sites

The Site www.valetino.ro links to third party sites that may, in turn, collect your personal data, including through cookies or other technologies. In the event of your connection to a third party website, the privacy policy of the Valetino Controller will not be applicable for your browsing of that site.

9. What are your rights as a data subject?

Any individual who browses our site or uses the mobile application, as a data subject, has the following rights in relation to Valetino, as a Personal Data Controller:

• The right of access means the right of the data subject to obtain a confirmation from the Controller that it processes or does not process their personal data and, if it does process them, access to the respective data and information regarding the way said data is processed.
• The right to rectification refers to the correction, without undue delay, of inaccurate personal data processed or to their supplementing, if they are incomplete. These can be modified by sending an e-mail to: contact@valetino.ro.
• The right to remove the data/the right to delete them from the database means the right of the data subject to request that their personal data be deleted, without undue delay, if one of the following reasons applies: they are no longer necessary for the fulfillment of the purposes for which they were collected or processed; withdraw their consent and there is no other legal basis for processing; oppose the processing and there are no legitimate reasons that prevail; personal data has been processed illegally; personal data must be deleted in order to comply with a legal obligation; personal data were collected in connection with the provision of information company services.

Note: The right to delete data, or the right to be "forgotten" is not an absolute one, so the specific circumstances of each request will always be analyzed. The personal data protection regulations allow the retention of such data in the event that it is necessary for the observance of the freedom of expression and the right to information, for the observance of a legal obligation, for the fulfillment of a task that serves a public interest or one that results from the exercise of the public authority with which the controller is vested, for reasons of public interest in the field of public health, for archiving purposes in the public interest, for scientific or historical research or for statistical purposes or for ascertaining, exercising or defending a right in a court of law.

• The right to restrict the processing may be exercised if the data subjects request the limitation of the processing of their personal data, in which case the data will be used strictly for the exercise of other legal rights of the data subjects, including to respond to any of their requests/complaints.
• The right to portability refers to the right to receive personal data in a structured, commonly used and automatically readable format and to the right to have this data transmitted directly to another controller, when the processing is based on consent or the execution of a contract and is carried out by automated means, if this is technically feasible.
• The right to object refers to the right of the data subject to oppose the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it takes into account a legitimate interest of the Controller.
• The right to object to the processing of data on the basis of individual automatic decisions refers to the fact that the data subject has the right not to be subject to a decision based exclusively on automatic processing, including the creation of profiles, which produce legal effects concerning the data subjects or affects them similarly to a significant extent. However, it will not be possible to exercise this right if the decision is necessary for the conclusion or execution of a contract between the data subject and the Controller, is authorized by the law applicable to the Controller, provided that adequate protection of rights, freedoms and interests of the data subjects is ensured; or is based on the consent of the data subject obtained in compliance with the legislation in force.
• The right to address the National Authority for the Supervision of Personal Data Processing. If data subjects consider that the rights provided above have been violated, they have the possibility to address NASPDP by filing a complaint.

The contact details of NASPDP are the following: Bucharest, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336; Phone: +40.318.059.211/+40.318.059.212; Fax: +40.318.059.602; e-mail: anspdcp@dataprotection.ro; website: www.dataprotection.ro.

In order to exercise the rights provided above, the data subject will address the Controller by sending a request to the postal address: Constanta, Constanta County, Tudor Vladimirescu Street, Nr. 28A, ground floor, or at the e-mail address: office@valetino.ro.

10. Final provisions

If the Controller Valetino considers that a change in privacy rules is necessary, it will publish those changes in order to inform the data subjects about the information it collects and how it uses it.

The provisions of the Privacy Policy are supplemented by the provisions of the Cookie Policy, available on the website www.valetino.ro.