This Privacy and Personal Data Protection Policy (“Policy”) describes the framework applicable to personal data collected by ATP Trucks Automobile in Romania, i.e. by the following companies, each of which is individually and separately a controller:

ATP Trucks Automobile S.R.L. is a limited liability company under Romanian law, having its registered office in Baia Mare, b-dul Bucuresti nr. 65, jud. Maramures, registered at the ORC with registration number J24/712/2019, registration number40723236, referred to as the “Operator”, including the provisions of the General Data Protection Regulation (“GDPR”).

Personal data operator

ATP Trucks Automobile is the Personal Data Operator.

The personal data collected will be controlled and processed by ATP Trucks Automobile. Personal data may also be jointly processed or controlled by ATP Group affiliates (ATP Exodus SRL, ATP AUTOMOTIVE RO SRL, ATP Transit SRL, ATP Motors RO SRL, ATP SMART 4US).

This Policy applies to (1) recipients of our auto parts and accessories sales, vehicle sales, transportation services, vehicle maintenance and repair services, (2) our employees, (3) users of the sites and applications listed here (“Sites”), (4) representatives of our business partners, customers and suppliers, and (5) our candidates/applicants.

This Policy describes the categories of personal data or personal information we collect, how we use the information, how and for what purposes we process and protect the data we collect, the length of storage, when we transfer the data and to whom, and the rights and choices individuals have regarding the use of their personal data. We also describe how you can contact us about our privacy and data protection policies and how to exercise your rights. Our privacy and data protection policies may vary depending on the jurisdictions in which we operate to reflect local practices and legal requirements, and you can review specific local provisions by visiting our local websites.

Personal data we collect

We collect personal data about you in a variety of ways, such as through your access and visit to our websites, including by creating and updating the account you register through your use of the websites, as well as from various social media channels; at our events; by phone and fax; through applications for various jobs; in connection with various types of services provided by us; or in connection with our service providers or business partners. Colectăm date cu caracter personal care vă privesc în diverse moduri, cum ar fi prin accesarea și vizitarea de către dumneavoastră a site-urilor noastre, inclusiv prin crearea și actualizarea contului pe care îl înregistrați prin utilizarea site-urilor, precum și de pe diferite canale de social media; la evenimentele noastre; prin telefon și fax; prin aplicații pentru diferite locuri de muncă; în legătură cu diferite tipuri de servicii prestate de noi; sau în legătură cu furnizorii noștri de servicii sau partenerii noștri de afaceri.

• identification or contact details (such as name, surname, home address, business address, e-mail address, telephone number, job title);
• your username and password when you register on our sites;
• the information you provide about other people you want us to contact;
• other information you may provide to us, such as in surveys, follow-ups or through the “Contact Us” function on our websites.

In addition, if you are a candidate/applicant, an employee, submit your CV for a job or create an account to submit your CV for a job, we may collect the following types of personal data (under local law):

• data on education and professional experience;
• known foreign languages and other professional skills;
• the personal number or other personal data with an identifying function;
• date of birth;
• sex;
• nationality and work permits;
• benefit information;
• references about you;
• any other data contained in your CV that you provide on your areas of career interest and other data on your qualifications for employment;

And where required by law, based on your express consent:

• information about your disability and health;

In addition, we may collect information you provide to us about other people, such as information about people we can contact in an emergency.

If you visit us at our premises or at our local offices or if you write to us or telephone us in connection with various enquiries or matters of interest to you, we may collect your name and contact details as well as other personal data that you provide to us directly.

The Employee (hereinafter individually referred to as “Employee” and collectively as “Employees”), as applicable, understand and acknowledge that ATP Trucks Automobile, as employer, collects, processes and stores personal data of the Employee and his/her dependents for the purpose of entering into and performing his/her employment contract with ATP Trucks Automobile.

How we use the personal data we collect

The operator collects and uses the collected data for the following purposes (as permitted by applicable law):

a) managing relationships with our customers and suppliers;

b) creation and management of online accounts;

c) processing of guarantees, financing applications;

d) issuing insurance policies;

(e) to the extent permitted by applicable law, communicating and managing participation in events

specials, promotions, programmes, offers, surveys, competitions and market research;

f) providing answers to people’s questions and requests;

g) managing, evaluating and improving our work (including developing, analysing and

improving our services; managing communications; conducting data analysis and performing

accounting, audit and other internal activities);

h) protecting against fraud, identifying and prosecuting the prevention of fraud and other illegal activities; and

i) compliance with and enforcement of applicable legal requirements, applicable service standards, contractual obligations and our policies.

All processing will be carried out on the basis of appropriate legal grounds which could fall into several categories including:

a) the consent or express consent of the data subject, if required by applicable law;

b) to ensure that we comply with a legal or contractual requirement or a requirement necessary to enter into/amend/terminate a contract (for example, processing your personal data to ensure that your wages and taxes are paid).

c) the legitimate interest of the Operator (e.g. to enable the customer to benefit from the services we offer).

In addition to the activities listed above, if you are a person applying for a position or creating an account to apply for a position, to the extent permitted by applicable law, we use the information described in this Policy for the following purposes:

a) providing employment and work opportunities; and

b) assessing your skills and qualifications for different jobs;

We may also use the data for other purposes, in which case we will provide you with specific information at or before the time of collection.

If you are an Employee, ATP Trucks Automobile processes your personal data and that of your dependents, if applicable, for the following purposes:

1) For the purpose of concluding and executing the employment contract to which the Employee is a party, as well as amending or terminating the Employee’s employment contract.

2) In order to pay the salary to the Employee, as well as other bonuses, compensations, bonuses, vouchers for

meals, other benefits, etc. that the Employee could benefit from.

3) In order to fulfil ATP Trucks Automobile’s obligations in the field of employment and social security and social protection, as well as in order to fulfil ATP Trucks Automobile’s obligations in the field of occupational health and safety, emergency situations, occupational medicine, including the assessment of the Employee’s work capacity.

4) For the provision of training sessions, including e-learning / online training.

5) For the purpose of keeping records of all employees in the REVISAL register, including the Employee, in accordance with the employer’s labour law obligations.

6) In order to submit declarations, applications, documents to the competent authorities, including ANAF, Labour Inspectorate, General Inspectorate for Immigration, General Inspectorate for Emergency Situations, Pension House, Health Insurance House, for compliance with the employer’s legal obligations.

7) In order to issue certificates at the request of the Employee.

8) For the recovery of any debts owed by the Employee to the Employer or for the recovery of any debts owed by the Employee to third parties (under attachment proceedings).

9) For the preparation of certain reports to companies in the ATP Exodus Group for administrative purposes.

10) In order to monitor the location of the equipment used by the Employee in the performance of his/her duties.

11) In order to maintain the security of the information system and to prevent the transfer of ATP Trucks Automobile / ATP Exodus Group proprietary data or ATP Trucks Automobile / ATP Exodus Group trade secrets outside the company (security incidents) in accordance with ATP Trucks Automobile policies and procedures.

12) For the purpose of accessing location data via remote internet connection to ensure the security of the company’s IT system.

Legitimate interest

The operator may process personal data for certain legitimate purposes in the conduct of its business, which include some of the following:

• where the process allows us to improve, modify, customise or otherwise enhance our services/communications for the benefit of our clients, candidates and Employees;
• to identify and prevent fraud;
• to enhance the security of our network and information systems;
• to better understand how people interact with our sites;
• for direct marketing purposes;
• to provide you with mail/email communications that we believe may be of interest to you;
• to determine the effectiveness of promotion campaigns and advertising.

Whenever we process data for these purposes, we will ensure that we pay particular attention to your rights. You have the right to object to such processing and if you wish to do so, please write to us at [email protected].

How we process and protect personal data

We also process the personal data we collect by automated means, for the purposes defined above and for a certain period of time, which complies with our internal retention policy, to ensure that personal data is not kept longer than necessary.

We maintain administrative, technical and physical safeguards designed to protect the personal data you provide against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. To ensure appropriate security and confidentiality of personal data, we apply the following security measures:

• Data encryption;
• Appropriate user authentication measures;
• Secure network infrastructure;
• Network monitoring solutions.

Duration of processing of personal data we collect

We store in our systems the personal data we collect in a way that allows the identification of data subjects limited to the period of time for which it is necessary in light of the purposes for which the data were collected or for which these data are further processed.

We determine this specific period of time by considering:

• The need to keep personal data stored to provide our services;
• To protect the legitimate interests of the Operator in accordance with this Policy;
• The existence of specific legal obligations that make it necessary to process and store it for a certain period of time;

As far as Employees are concerned, personal data will be stored and kept by ATP Trucks Automobile as follows:

1. a) Personal Data necessary to achieve the purposes referred to in point II, 10), until the date of withdrawal of consent to data processing by the Employee;
2. b) Personal Data necessary for the purposes referred to in points II 9), 11), 12) above, until the legitimate interest of the employer ceases or until the Employee exercises the right to object;
3. c) Personal Data necessary for the purposes referred to in points II 3), 4), 6), 7), until the termination of the employment contract with the Employee;
4. d) Personal data necessary for the purposes mentioned in point II 1) above shall be kept in the personnel files for a period of 75 years after the compilation of the personnel file, according to the National Archives Law no. 16/1996;
5. e) Personal Data necessary for the purpose mentioned in point II 5) above shall be kept for a period of 75 years, according to the National Archives Law no. 16/1996;
6. f) Personal data contained in any supporting documents underlying the entries in the accounting records shall be kept in the Employer’s archives for 10 years, in accordance with the provisions of the Accounting Law no. 82/1991;
7. g) Personal Data contained in the Employer’s payroll (as per point II 2) above) shall be kept for 50 years, in accordance with the provisions of the Accounting Law no. 82/1991.

After the expiry of the above deadlines, personal data shall be deleted and/or destroyed from ATP Trucks Automobile’s records/databases.

Persons to whom we may transfer your personal information and data

We do not disclose the personal data we collect about you except as described in this Policy or in separate notices provided in connection with certain activities. We may distribute personal data to vendors who provide services on our behalf based on our instructions. We do not authorize these vendors to use or disclose the information except as necessary to perform services on our behalf or to comply with legal requirements. We may also share your personal data (i) our affiliates; and (ii) our partners Mercedes Benz Romania (Daimler AG), Magyar Suzuki Ltd., Opel Southeast Europe LLC, Mazda Austria GmbH, AIC TRUCKS, MHS Truck & Bus.

In addition, we may disclose personal data about you (i) whether we are obliged to do so by law; (ii) law enforcement authorities or other officials on the basis of a lawful disclosure request; and (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual fraudulent or illegal activity. We also reserve the right to transfer personal data we hold about you if we sell or transfer all or part of our business or assets (including in the event of reorganisation, dissolution or liquidation).

As regards our Employees, in the course of processing operations carried out for the purposes referred to in points II 1)-12) above, the Employee’s Personal Data will be transferred to the following third parties as follows:

(a) service providers used by ATP Trucks Automobile, including: provider of occupational medicine and medical subscriptions; provider of meal vouchers and gift vouchers; banks, for payment of salary by bank transfer; provider of courier services with which ATP Trucks Automobile collaborates, only when there are transmission documents involving the Employee and only the minimum Personal Data required for delivery services (name, surname, telephone, address);

(b) providers of training and similar services;

(c) external consultants;

(d) other companies in the ATP Exodus group in the reporting/administrative activities of ATP Trucks Automobile .

(e) authorities, including: (i) the National Tax Administration Agency, for the submission of various declarations according to the applicable legal provisions; (ii) the Territorial Labour Inspectorate and the General Inspectorate for Emergency Situations, for the fulfilment of obligations to keep records of employees, as well as for the fulfilment of legal requirements for health and safety at work and fire prevention and extinguishing/emergency situations;

(iii) Health Insurance House and Pension House, for the submission of various applications and forms; (iv) the General Inspectorate for Immigration, in order to fulfil the obligations of keeping records of employees for foreign nationals, (v) and other authorities for the fulfilment of other legal obligations.

All data transfers mentioned above are carried out in compliance with the principles related to the processing of personal data by ATP Trucks Automobile, in particular the principle of minimization of personal data – ATP Trucks Automobile transmits to third parties only the personal data that are strictly necessary to achieve the purposes mentioned.

Data transfers

We may also transfer the personal data we collect about you outside the country where the original information was collected. Those countries may not have the same data protection laws as the country where you originally provided your personal data. When we transfer your personal data to other countries, we will protect that data as described in this Policy and such transfers will be in accordance with applicable law.

Countries to which we may transfer your personal data that we collect may include:

• Within the European Union;
• Outside the European Union.

When we transfer personal data from the European Union to countries or international organisations outside the European Union, the transfer takes place on the basis of:

a) European Commission decision on adequacy;

b) in the absence of an adequacy finding, on other permissible legal grounds: (i) a legally binding and enforceable instrument between public authorities or entities; (ii) mandatory corporate rules; (iii) standard data protection clauses (previously referred to as standard clauses) adopted by the Commission, etc.

Your rights and options

Where required by applicable law, a data subject may exercise the following specific rights under Articles 15-22 of the GDPR:

a) Right to information: the right of the data subject to receive information on the processing operations of Personal Data. Compliance with this right by ATP Trucks Automobile is hereby acknowledged.

b) Right of access: the data subject shall have the right to obtain from the company confirmation as to whether or not personal data relating to him or her are being processed and, if so, access to those data and the provision of information on data processing.

c) Right to rectification: the data subject has the right to obtain from the controller the rectification of any inaccurate or incomplete personal data relating to him or her in order to ensure the accuracy of such information and to ensure adequate processing.

d) Right to erasure: the data subject has the right to obtain from the controller the erasure of personal data concerning him or her and the controller has the obligation to erase the personal data.

e) Right to restrict processing: the data subject has the right to request the Controller to restrict the processing of his/her data.

f) Right to data portability: the data subject has the right to request data portability, which means that the data subject may receive the personal data originally provided in a structured and commonly used format or that the data subject may request the transfer of the data to another Controller.

g) Right to object: A data subject who provides a Controller with personal data has the right to object at any time to the processing of the data on several grounds set out in the GDPR, without having to justify his/her decision.

h) Right not to be subject to an automated individual decision: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, if such profiling produces a legal effect on the data subject or significantly affects him or her in a similar way.

i) Right to lodge a complaint with a supervisory authority: Every data subject has the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where he or she has his or her habitual residence, place of work or the place where the breach is alleged to have taken place, if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.

Whenever processing is based on consent, according to Article 7 of the GDPR, the data subject may withdraw consent at any time.

If you need more information about the processing of your personal data, please see the “How to contact us” section below.

Updating our Policy

This Policy (including any appendices) may be updated periodically to reflect changes in our privacy practices and legal updates. For significant changes, we will notify you by posting a prominent notice on our websites, indicating at the top of each notification when the last update was made.

How to contact us

If you have any questions or comments about this Policy or if you wish to exercise your rights, please write to us by e-mail at the following address: [email protected] or you can send a written request by post to the following address: B-dul Bucuresti nr. 65, Baia Mare, jud. Maramures, Romania.