Todos & Company Privacy Policy

1. About this Privacy Policy

We, the Todos & Company group of companies, comprise the following companies:

S.C. Conseil En Entreprise S.R.L. with its registered office in Bucharest, str. Episcopul Radu, no. 43, building C1, floor 3, apt. 7-8, telephone: 0773373400, registered with the Trade Registry Office attached to the Bucharest Tribunal under no. J40/11882/2015, CUI 35064007

S.C. Todos IT Solutions S.R.L. with its registered office in Bucharest, Str. Sulfului, no. 5, Room 3, office no. 1, telephone: 0773373400, registered with the Trade Registry Office attached to the Bucharest Tribunal under no. J40/12870/14.07.2017, CUI 37985229

and we are responsible for the protection of personal data. This Privacy Policy applies to all the companies that are part of this group of companies.

Below, the name “Todos & Company” will be used to refer to all the companies in the group.

The purpose of this Privacy Policy is to explain, in a simple and transparent way, what type of personal data we collect about you and how we process it. This policy applies to the following persons:

• All former, current and potential clients of Todos & Company. We are legally required to keep the data we collect about you, including for a certain period of time after the relationship has ended.

Personal data means any information that tells us something about you or that we can link to you. It includes your name, address, date of birth, account number, IP address or information about payments you have made from your bank account.

Processing means all the operations we may carry out on data, such as collecting, recording, storing, adjusting, organising, using, disclosing, transferring and erasing it. You give us personal information when you become a client, register for our online services, complete an online form, sign a contract, use our products and services or contact us through one of our channels.

We also use data that is lawfully available from public sources or the media, or that is legitimately provided by other companies or third parties.

2. The types of data we collect about you.

The personal data we collect includes:

• Identification data, such as your surname and first name, date and place of birth, personal numeric code, e-mail address and the IP address of your computer or mobile device, postal details and other information used to send a document, billing data, and also where postal or courier services are provided through one of our partner carriers.
• Financial information, such as bank account numbers for transfers following transactions.
• Computer and connection information, such as page view statistics, traffic to and from sites, referring URL, IP address and browsing history.

Personal information collected from other sources

• Social media. We allow you to share information on social networking sites (e.g. Facebook). These sites may give us automatic access to certain personal information they hold about you (e.g. your e-mail address). By linking an account managed by a social networking site to your account with us and authorising us to access this information, you agree that we may collect, use and retain the information provided in accordance with this privacy agreement.
• If you give us personal information about another individual, you must do so only with that person's consent. You must inform them how we collect, use, disclose and retain personal information in accordance with this privacy agreement.

Sensitive data

We do not record sensitive data about your health, ethnic origin, or religious or political beliefs, unless this is absolutely necessary.

Minors' data

The content of the website and of the information promoted by Todos & Company is not intended for minors, but it is not harmful to them. We do not collect information or data from minors under 16.

3. What we do with your personal data

We use your personal data only for legitimate business purposes. These include:

Administration. When we conclude a services contract between the Provider and the Beneficiary, we are legally required to collect personal data that verifies your identity (for example, a copy of your identity card or passport) and to assess whether we can accept you as a client. We also need to know your address and telephone number so that we can contact you.

Providing products and services. We use information about you to assess whether you are eligible for certain funding lines.

Personalised marketing. We may send you letters, e-mails or text messages to offer you a product or service based on your personal circumstances.

Providing the most suitable products and services. When you visit our website, call our offices or visit one of our offices, we collect information about you. We analyse this information to identify your potential needs and assess the suitability of products or services. For example, we may suggest investment opportunities suited to your profile.

We may use your data to send you personalised offers by post, e-mail or on our website. You have the right to object, at any time, to commercial or direct marketing activities, provided this does not conflict with contractual clauses that provide otherwise.

Fraud prevention and detection, and data security: We have a duty to protect your personal data and to prevent, detect and limit data security breaches. This includes information we are required to collect about you, for example, in order to comply with regulations on combating fraud involving EU funds, terrorist financing and tax fraud.

For all types of data that we process for any purpose, we try to reduce, or even eliminate, personal information as far as possible.

4. Who we share your data with, and why

We may disclose your personal information to third parties.

This disclosure of data may be necessary for us to give you access to our services, to comply with national legal obligations, to optimise our marketing and advertising activities, or to prevent, detect, mitigate and investigate fraudulent or illegal activities related to our services. We try to minimise the amount of personal information we disclose to what is directly relevant and necessary to fulfil the specified purpose. We do not sell, rent or otherwise disclose your personal information to third parties for marketing and advertising purposes without your consent.

Todos & Company partners and service providers as follows:

We transfer data within the offices or companies of the Todos & Company group for operational, regulatory or reporting purposes, for example to carry out checks on new clients or to provide certain services.

Where we use other service providers, we share only the personal data that is strictly necessary for carrying out a specific task.

Service providers support us with activities such as:

Courier services, debt recovery, certification services, transport services, internet services, e-mail messaging services, mobile telephony services, bank payment services, marketing services, IT maintenance, website administration, occupational health and safety services, and voucher issuing services.

In all these cases, partners or service providers choose to comply with the European data protection regulation.

Sales representatives

We share information with independent agents who act on our behalf. These agents are registered in accordance with local legislation and operate under a cooperation contract containing clauses requiring compliance with the Data Protection Regulation.

Whenever we share your personal data internally, or with third parties, collaborators or service providers, we take the necessary safeguards to protect it.

5. Your rights and how we respect them

We respect your rights as a customer in determining how your personal information is used. These rights include:

The right of access You have the right to request a report of the personal data we process about you.

The right to rectification

If your personal data is incorrect, you have the right to ask us to rectify it. Where we have disclosed data to third parties and it is subsequently corrected, we will also inform those third parties accordingly.

The right to object to the processing of your data

You may object to the use of your personal data by our company. You can exercise this right online or by telephone. We will take your objection into account even if the processing of your information has an unjustified impact on you that requires the processing of that data to cease.

You may also object to receiving personalised commercial messages from us. When you become a Todos & Company customer, we ask whether you wish to receive personalised offers. If you change your mind later, you can opt out of receiving messages by using the "unsubscribe" link in the footer of every commercial e-mail. You cannot object to the processing of your personal data by Todos & Company if we are legally obliged to process it; if it is necessary for us to enter into a contract with you; or if, under a contract, we have undertaken to send you personalised information and you have undertaken to receive it, even if you have opted out of receiving personalised commercial messages.

The right to restriction of processing

You have the right to ask us to restrict the use of your personal data where:

• you consider the information to be inaccurate

• we are processing the data unlawfully

• Todos & Company no longer needs the data, but you want us to keep it for use in legal proceedings

• you have objected to the use of your personal data by Todos & Company in the company's legitimate interests

The right to data portability

You have the right to ask us to transfer your personal data directly to you or to another company. This applies to personal data that we process by automated means and with your consent or on the basis of a contract concluded with you. Where this is technically feasible, we will transfer your personal data.

The right to erasure

You may ask us to erase your personal data if:

• the data is no longer necessary for the purpose for which it was collected or processed

• you withdraw the consent on which the processing is based

• you object to the processing of your data by Todos & Company in the company's legitimate interests or for the purpose of sending personalised commercial messages

• Todos & Company is processing your personal data unlawfully, or a European Union or EU Member State regulation requires Todos & Company to erase your personal data

The right to complain

If you are not satisfied with the way we have responded to your requests, you have the right to make a complaint. If you remain dissatisfied with our response to the complaint you have submitted, you may escalate it to the Data Protection Officer at Todos & Company. Also, where the matter could not be resolved between the parties, you may contact the data protection authority.

Exercising your rights

If you wish to exercise your rights or make a complaint, please contact us. You will find the contact details of the Todos & Company office at the end of this Privacy Policy. How you exercise your rights depends on the Todos & Company product you use. It can be done through our website, by visiting our head office or by telephone. We aim to respond to your request as soon as possible. In some cases, the response time may be up to 72 hours. If we need more time to resolve your request, we will let you know how much additional time is needed and give you the reasons for the delay. In certain cases, we may refuse your request. Where permitted by law, we will inform you in good time why we have refused your request.

6. Your duty to provide data

There is certain information we need to know about you so that we can begin and perform our duties as Service Provider and honour the associated contractual obligations. We are also legally obliged to collect certain information. Without this data, we may not be able to send an invoice or carry out certain activities.

7. How we protect your personal data

We apply an internal framework of policies and standards at all levels of our companies to keep your data safe. These policies and standards are updated periodically to reflect regulations and market developments. Specifically, and in accordance with the law, we take appropriate technical and organisational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of your personal data and of the way it is processed. In addition, Todos & Company employees are bound by a duty of confidentiality and may not disclose your personal data unlawfully or unnecessarily.

8. How long we keep your personal data

We are not entitled to keep your personal data for longer than it is needed for the purpose for which we originally requested it. After that period, we look for feasible solutions, either to obtain fresh consent from you or to archive the data.

9. Contact us

If you would like to find out more about Todos & Company's data policies and how we use your personal data, you can send us an e-mail, call us or visit our head office. A list of contact details can be found at the end of this Privacy Policy.

10. Scope of this Privacy Policy

This document is the Privacy Policy of each company in the Todos & Company Group. The Policy applies to all Todos & Company entities and offices to the extent that they process personal data. We may amend this Privacy Policy to remain compliant with changes in legislation and/or to reflect the way Todos & Company processes personal data. This version was amended on 24 May 2018.

You can exercise these rights, either individually or together, very easily, by telephone on +40.786.147.877 or by e-mail at: protectiadatelor@todos-company.ro. In addition, we have appointed a Data Protection Officer, who can be contacted daily from Monday to Friday between 9:00 and 16:30 if you have any queries about any aspect of personal data protection, by sending a request to the contact details given above.