The data controller is ALD Automotive S.R.L., a company with a share capital of RON 58,230,750, having its head-office in Bucharest 1, 1-7 Ion Mihalache Blvd., 3rd floor, zip code 011171, Trade Registry number J40/20912/15.12.2004, Fiscal Registration Code RO17043227, hereinafter referred to as “Ayvens”, “we” or “us”, a mobility solutions provider mainly active in full service leasing and fleet management services. Ayvens is a member of the Ayvens Group which is a subsidiary of the Société Générale Group.

At ALD Automotive S.R.L., the contact email address for the data privacy policy is gdpr.ro@aldautomotive.com.

ALD Automotive understands your concerns regarding the confidentiality of your personal information. Below we describe how we acquire and use that information and outline your rights. Please read this carefully, so that the process is as fair, transparent and secure as possible.

The following principles are central to how we process your personal information

• •
  Transparency and fairness: When we collect and process your personal information, we inform you as to who collects and receives these data, and the reasons for this. When required by law, we always seek your prior consent (e.g. before collecting any sensitive information or sending any direct marketing material). We never use your personal information for purposes that are incompatible with the purposes outlined here.

• •
  Legitimacy: ALD Automotive does not collect or process personal information without a lawful reason. We use your personal information only for appropriate business purposes (e.g. to provide services, manage relationships with customers, manage customer vehicle fleets, and perform accurate invoicing, or for marketing activities, profiling to better serve customers, to conduct satisfaction surveys or draft reports and comply with our legal obligations).

• •
  Minimization: We only collect the personal information strictly necessary for data processing, as set out in this document. We collect sensitive information only where relevant. We take all reasonable measures to ensure that your personal data on record is accurate, complete and up to date.

• •
  **Privacy: **We endeavor to ensure privacy when implementing personal data processing. To this end we also carry out privacy impact assessments to ensure that our safeguards are appropriate and that your information is protected.

**How long do we keep your personal information? ** We retain your personal information only as long as you enjoy a business relationship with ALD Automotive, or the term applicable under local law since our last contact, or as required to comply with ALD Automotive legal obligations.

In case of litigation, we may keep your personal information until the end of such legal action, including any potential periods for appeal. We will then either delete or archive it according to the law in force.

In any event, your personal information will not be kept in a form that allows you to be identified for any longer than necessary by ALD Automotive for achieving the purposes for which it was - collected or processed, or according to the relevant laws in force.

**How do we ensure the security and integrity of your personal information? ** We protect your data through technical and organizational security measures (including education and training of relevant personnel) against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Only those teams and employees who need to know your information within our company can access it. We make sure to implement administration rights and policies within our company, and we take all measures to ensure that employees, advisers and service providers keep your files confidential.

How can you express your preferences on the use of your personal information?

To exercise the rights set out in the following section at any time, please contact us at gdpr.ro@aldautomotive.com. Withdrawal. In cases where you have given your previous consent for your information to be processed, you can withdraw that consent any moment.

Access. You can request access to your personal information we maintain about you. If you make such a request, we will provide you with all the information on the purposes of the processing, categories of data processed, categories of recipients, data retention term, your rights to rectify, delete or restrict the data accessed if applicable. Where possible, we will provide remote access to a secure system which would provide you with direct access to your personal data.

Portability. You can also obtain a copy of any personal information that we hold about you in our records in a format compatible and structure to allow you to exercise your right to data portability.

Restriction. You can request a restriction in the following cases:

• •
  for a period enabling ALD Automotive to verify the accuracy of your personal data in the event you contest the accuracy of your personal information;
• •
  if the processing is unlawful and you wish to restrict your personal information rather than deleting it;
• •
  if you wish ALD Automotive to keep your personal information because you need it for your defense in the context of legal claims;
• •
  if you have objected to the processing but ALD Automotive needs to check whether it has legitimate grounds for such processing which may override your own rights.

Rectification / Erasure. You may also request that we correct, amend, erase, any information which is incomplete, out of date or inaccurate.

You can request the deletion of your personal information in the following cases:

• •
  if your personal information is no longer necessary for the purpose of the data processing;
• •
  if you have withdrawn your consent for data processing based exclusively on such consent;
• •
  if you objected to the data processing;
• •
  if the personal information must be erased to comply with a legal obligation applicable to ALD Automotive. We will take reasonable steps to inform other ALD Automotive entities which might be involved in the data processing of such erasure.

Objection. You can also object to the processing of your personal information at any time when used for marketing purposes or profiling to send you targeted advertising or to object to the sharing of your data with third parties or within the Ayvens Group.

Complaint. You also have the right to** lodge a complaint **with the competent supervisory authority.

You can also provide your instructions regarding the storage, deletion or disclosure of your personal information after your death. Such instructions may be general or specific.

Am I required to provide Personal Data?

As a general principle, your granting of any consent and your provision of any personal data hereunder for processing based on the data subjects consent is entirely voluntary; there are generally no detrimental effects on you if you choose not to consent or to provide personal data. However, there are circumstances in which ALD Automotive cannot take action without certain personal data, for example because this personal data is required to process your inquiries, your orders or provide you with access to an offering or newsletter. In these cases, it will unfortunately not be possible for ALD Automotive to provide you with what you request without the relevant personal data.

Please refer to the “How do we use your personal information?” section below for details on data processing purposes and legal grounds of such processing.