Levis Automobile SRL Privacy Policy on the Processing and Protection of Personal Data According to Law No. 677/2001

1. Introduction

The purpose of this Privacy Policy is to explain what data we process, why we process it, and what we do with it. We take your privacy seriously and never sell lists or email addresses. Fully aware that personal information belongs to you, we do everything possible to store it securely and process it carefully. We do not provide information to third parties without informing you.

2. Other Services

This Privacy Policy does not cover applications and websites of third parties that you may access through links on our website. This is beyond our control. We encourage you to review the Privacy Policy of any site and/or application before providing personal data.

3. Who We Are

LEVIS AUTOMOBILE SRL, based in Cluj Napoca, Str. Arțarului, no. 46, ap.2, Cluj County, Unique Registration Code: 27807313 (hereinafter referred to as “Levis Automobile SRL”) is responsible for processing your personal data that we collect directly from you or from other sources. According to the legislation, our company is a personal data controller. To ensure the safe processing of your data, we have made every effort to implement reasonable measures to protect your personal information.

4. Who Are You? According to the legislation, you, the natural person benefiting from our products or the person involved in any kind of relationship with us, are a "data subject," meaning a natural person who is identified or identifiable. To be fully transparent regarding data processing and to allow you to easily exercise your rights at any time, we have implemented measures to facilitate communication between us, the data controller, and you, the data subject.

5. Changes We may change this Privacy Policy at any time. All updates and changes to this Policy are effective immediately upon notification, which will be made by posting on the website and/or sending an email notification.

6. Questions and Requests If you have any questions or concerns regarding the processing of your data or wish to exercise your legal rights related to the data we hold, or if you have concerns about how we handle any privacy matters, you can write to us at the email address office@levisautomobile.ro.

7. Our Commitment Protecting your personal information is very important to us. Therefore, we are committed to adhering to the following principles:

• Legality, fairness, and transparency – We process your data lawfully and fairly. We are always transparent about the information we use, and you are properly informed.
• Control belongs to you – Within the limits of the law, we provide you with the ability to examine, modify, and delete the personal data you have shared with us, as well as to exercise your other rights.
• Data integrity and purpose limitation – We use data only for the purposes described at the time of collection or for new purposes compatible with the initial ones. In all cases, our purposes are compliant with the legislation. We take reasonable steps to ensure that personal data is accurate, complete, and up-to-date.
• Security – We have implemented reasonable security and encryption measures to protect your information. However, please note that no website, application, or internet connection is completely secure.

8. What Kind of Information Do We Collect About You? You can use the Platform without disclosing personal data. However, if you wish to benefit from our services, you will be required to provide your data during the registration process. The requested data may include: full name, phone number, email address, home address. We may collect data through cookies or other similar technologies, such as IP address, browser, ads you have clicked on, location, and the web pages you access on our site.

9. Why Do We Collect This Information? We collect your information for specific and legitimate purposes, including but not limited to the following:

• To conclude or execute a contract between you and us;
• Account registration;
• To respond to your questions and requests;
• For marketing purposes, but only if we have your prior consent;
• To offer and improve the services and products we provide;
• To diagnose or fix technical problems;
• To provide you with advertising and personalized content;
• To defend against cyber-attacks;
• For account creation and/or maintenance;
• To comply with the law;
• For the identification or enforcement of a right in court.

10. What Are the Legal Grounds for Data Processing?

• Your consent for processing personal data – Please note that you can withdraw your consent at any time by following the "unsubscribe" instructions in each email or by sending a written request to the email address office@levisautomobile.ro.
• Processing is necessary for the conclusion or execution of a contract between you and us – For example, the execution of a contract regarding the sale or purchase of one or more services, or to take steps at your request before concluding a contract.
• Processing is necessary to fulfill a legal obligation – For example, the retention of accounting documents for a period of 10 years.

11. How Do We Disclose Your Data? Levis Automobile SRL may transfer data by disclosing or granting access rights remotely, only through secure applications, to third parties, such as affiliated entities and other business partners of Levis Automobile SRL, who act as data processors, processing personal data on behalf of Levis Automobile SRL (e.g., data storage on "cloud" servers, legal and financial consultants, technical service providers, or shipping assistance providers), with whom Levis Automobile SRL has entered into the necessary contractual agreements in accordance with EU and national regulations. We may also disclose your data to business partners as part of a joint effort to offer a product or service. We will transfer data to third parties only to the extent necessary to fulfill the applicable Processing Purposes for which your data is collected and processed. Personal data collected and processed for the Processing Purposes described in this Privacy Policy may be stored on servers located abroad or transferred to affiliated entities based outside the European Union. In the event of data transfer to third countries, Levis Automobile SRL will communicate its intention to transfer data, as well as the third countries involved, the purpose of the transfer, and request consent when such consent is necessary according to the applicable legal provisions. Levis Automobile SRL may disclose data to comply with legal requirements or in response to a request from a court or another public authority.

11. For How Long Do We Store Your Data? The personal data collected by Levis Automobile SRL will be stored for a period of 5 years from the termination of the contractual relationship or any longer period required by law, regulations, or applicable standards regarding the retention of accounting documents or requests from public authorities. Immediately after the applicable storage period expires, the data will be:

• Deleted or destroyed; or
• Anonymized; or
• Transferred to an archive (unless this is prohibited by law or applicable regulations regarding the retention of records).

Personal data collected and used for creating your Account will be deleted immediately if you close your account. To ensure that data is not kept longer than necessary, Levis Automobile SRL will periodically review the data and, if necessary, delete it.

12. What Security Measures Have We Taken? As part of managing the Platform, we have implemented technical and organizational measures to ensure an appropriate level of security corresponding to the risks involved in processing the data, especially concerning improper use, accidental destruction, illegal or unauthorized access, loss, alteration, disclosure, manipulation (intentional or accidental), third-party access, deletion, and modification. To this end, we have developed and implemented data security policies and other privacy practices. Additionally, our security procedures are continuously reviewed based on technological advancements. For additional information about our security practices, please complete the contact form in the Contact section of the Platform. You will be notified of any data breach within a reasonable period after discovering such a breach, unless a competent public authority determines that the notification would interfere with a criminal investigation or endanger national security. In this case, the notification will be delayed, following the instructions of such authority. We will promptly respond to any questions you have regarding such a data breach.

13. What Are Your Rights?

• Right to Withdraw Consent The data subject has the right to withdraw consent when consent is the legal basis for processing (e.g., when processing is not based on other legal grounds such as a legal or contractual obligation). Before we exclude your data from processing, we must confirm that consent is the legal basis for processing. If it is not, the request may be rejected on the grounds that processing does not require the data subject's consent. Otherwise, the request should be granted. In many cases, providing and withdrawing consent will be available electronically online, and this procedure will not be necessary. When consent relates to a child (defined by the GDPR as a person under 16), the consent expression and withdrawal must be authorized by the person responsible for the child's parental duties.
• Right to Be Informed About Data Processing When personal data is collected from the data subject or obtained from other sources, there is an obligation to inform the data subject about the purpose of using this data and about the rights they have over it.
• Right to Access Your Data The data subject has the right to request the company to provide information about what data it processes about them, to have access to such data, and to the following information:
  • The purpose of the processing;
  • The categories of personal data involved;
  • The recipients or categories of recipients of the data, if any, especially third countries or international organizations;
  • The duration of storage of personal data (or the criteria used to determine this period);
  • The data subject’s rights to rectification or deletion of their personal data and limitations or opposition to its processing;
  • The data subject’s right to lodge a complaint with a supervisory authority;
  • Information about the data source, if not obtained directly from the data subject;
  • If personal data will be subject to automated processing, including profiling, and, if so, any potential consequences involved;
  • If the data is transferred to a third country or an international organization, information on the guarantees applied.

Right to Rectify Inaccurate or Incomplete Data If personal data is inaccurate, the data subject has the right to request the correction and completion of incomplete personal data based on the information provided. If necessary, we will take steps to validate the information provided by the data subject to ensure its accuracy before modifying it. Right to Erasure ("Right to be Forgotten") We offer the data subject the right to request the erasure of personal data without undue delay in relation to one of the following situations:

• The personal data is no longer necessary for the purposes for which it was collected or processed;
• The data subject withdraws consent on which the processing is based and there is no other legal ground for processing;
• The data subject objects to processing and there are no legitimate grounds for overriding the objection;
• The personal data has been processed unlawfully;
• The personal data must be erased to comply with legal obligations;
• The personal data was collected in connection with providing online services to children.

We will decide on each request and determine whether the request can or should be rejected for one of the following reasons:

• The data is necessary for the exercise of the right to freedom of expression and information;
• The data is necessary for fulfilling a legal obligation;
• For reasons of public interest in the field of public health;
• For archiving purposes in the public interest;
• For the establishment, exercise, or defense of a legal claim.

Right to Restriction of Processing The data subject can exercise the right to restrict processing in the following situations:

• The data subject contests the accuracy of the data, for a period that allows the controller to verify the accuracy of the data;
• The processing is unlawful, and the data subject opposes the erasure of personal data, requesting instead the restriction of its use;
• The controller no longer needs the personal data for processing purposes, but the data subject requests it for the establishment, exercise, or defense of a legal claim; or
• The data subject has objected to processing for the period during which it is verified whether the legitimate rights of the controller override those of the data subject.

Right to Restrict Processing If processing of personal data is restricted, the data will remain stored but cannot be processed without the data subject's consent. However, there are exceptions where data may still be processed, such as for the establishment, exercise, or defense of legal claims or for the protection of another individual's or entity's rights, or for important public interest reasons under Union or Member State law (provided the data subject is informed of this). Other organizations processing data on our behalf must also be informed of the restriction. Right to Data Portability The data subject has the right to request that their personal data be provided in a "structured, commonly used, and machine-readable" format (Article 20 of the GDPR) and to transfer the data to another data controller, such as a different service provider. This applies to personal data where processing is based on the data subject's consent, on a contractual basis, or where processing is carried out by automated means. Right to Object to Processing The data subject has the right to object to processing based on the following legal justifications:

• For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• For the legitimate interests pursued by the controller.

Once the objection is made, the organization must justify the reasons for processing and suspend processing until a decision is made. The organization will not process the personal data further unless it can demonstrate compelling legitimate grounds for the processing that override the data subject's interests, rights, and freedoms, or if the purpose is the establishment, exercise, or defense of legal claims. If personal data is used for direct marketing, the organization will cease processing the data. Right Not to Be Subject to Automated Decision-Making, Including Profiling The data subject has the right not to be subject to decisions made solely on automated processing, including profiling, where such decisions have significant or legal effects on them. The data subject also has the right to express their point of view, request human intervention, and contest the decision. There are exceptions to this right, when the decision:

• Is necessary for the performance or conclusion of a contract;
• Is authorized by national or European law;
• Is based on the explicit consent of the data subject.

In situations described in points (1) and (2), the organization will implement appropriate measures to protect the data subject’s rights, freedoms, and legitimate interests. This includes at least the right to obtain human intervention from the controller, express their viewpoint, and contest the decision. Right to Access the Judiciary The data subject also has the right to seek justice if they believe their rights have been violated. Right to Lodge a Complaint with a Supervisory Authority It is important to know that:

• If you have given consent for direct marketing, you can withdraw it at any time by following the unsubscribe instructions in each email, SMS, or other electronic message.
• If you wish to exercise your rights, you can do so by sending a written, signed, and dated request to the email address: office@levisautomobile.ro.

The rights listed above are not absolute, and there are exceptions. Therefore, each request will be assessed to determine whether it is justified. If the request is justified, we will facilitate the exercise of your rights. If the request is unfounded, we will reject it, but we will inform you of the reasons for the refusal and your right to lodge a complaint with the Supervisory Authority and seek judicial remedies. We will try to respond to your request within 30 days. However, the deadline may be extended depending on various factors, such as the complexity of the request, the large number of requests received, or the inability to identify you in a timely manner. If, despite our best efforts, we are unable to identify you, and you do not provide additional information to help us identify you, we are not obliged to fulfill your request. Questions, Requests, and Exercising Rights If you have any questions or concerns regarding the processing of your information, or if you wish to exercise your legal rights, or if you have any other privacy-related concerns, you can write to us at the email address office@levisautomobile.ro.