POLICY REGARDING THE PROCESSING OF PERSONAL DATA

Your privacy is one of our fundamental commitments, and therefore, we take utmost care to process your personal data in accordance with the principles set

forth in the applicable legislation.

FROSBERG DIGITAL S.R.L., having its headquarters at B-DUL IULIU MANIU, NR.160, BL.I, SC.C, ET.3, AP.83, București, Sector 6, tax code 43692940, registered with

the Trade Registry under no. J40/2115/2021 ("FROSBERG DIGITAL S.R.L.", "us") processes, as data controller, your personal data („Personal Data”). The purpose

of this privacy policy („Policy”) to explain how your Personal Data is processed by FROSBERG DIGITAL S.R.L..

1. CATEGORIES OF PERSONAL DATA, PROCESSING PURPOSES AND LEGAL GROUNDS

A. Contacting the online clients

a. Contacting the online clients

Personal Data: first name, last name, phone number, e-mail address.

Processing purpose	Legal ground
Contacting the online clients in order to solve the issue or to respond to the request	Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. 1, let. b of GDPR)

B. Ordering and delivering the products

a. Delivering the products

Personal Data: first name, last name, products, domicile, phone number, any other information provided by the client.

Processing purpose	Legal ground
Efectuarea plății produselor cumpărate	Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. 1, let. b of GDPR)

b. Adding the product to the cart

Personal Data: first name, last name, product.

Processing purpose	Legal ground
Adding the product to the cart	Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. 1, let. b of GDPR)

c.       Adăugarea în coșul de cumpărături

Date cu caracter personal prelucrate: nume, prenume, produsul adăugat.

Processing purpose	Legal ground
Paying for purchased products	Compliance with a legal obligation to which the company subject(art. 6, para. 1, let. c of GDPR) Details: fulfilling the tax obligations

d. Placing the order

Personal Data: first name, last name, domicile, products, amount.

Processing purpose	Legal ground
Issuing the invoice	Compliance with a legal obligation to which the company is subject (art. 6, para. 1, let. c of GDPR) Details: fulfilling the tax obligations

e. Invoicing

Personal Data: first name, last name, products, delivering address, phone number, e-mail address, any other information provided by the client.

Processing purpose	Legal ground
Emiterea facturii aferente produselor cumpărate	Compliance with a legal obligation to which the company is subject (art. 6, para. 1, let. c of GDPR). Details: fulfilling the tax obligations

C. User account

a. Completing the user profile

Personal Data: image.

Processing purpose	Legal ground
Completing the user profile in the account	Data subject’s consent (art. 6, para. 1, let. a of GDPR)

b. Orders history

Personal Data: first name, last name, order date, products, amount.

Processing purpose	Legal ground
Showing the orders	Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. 1, let. b of GDPR)

c. Creating the user account

Personal Data: first name, last name, e-mail address.

Processing purpose	Legal ground
Registering and creating the user account	Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. 1, let. b of GDPR)

D. Marketing (Newsletter, promotions, offers)

a. Marketing messages

Personal Data: first name, last name, phone number, e-mail address.

Processing purpose	Legal ground
Sending marketing messages in order to promote the company's services and/or products	Data subject’s consent (art. 6, para. 1, let. a of GDPR)

E. Feedback

a. Feedback

Personal Data: first name, last name, e-mail address, any other information provided by the client.

Processing purpose	Legal ground
Requesting and analyzing customer opinions in order to improve our services	Data subject’s consent (art. 6, para. 1, let. a of GDPR)

F. Dispute resolution

a. Legal disputes

Personal Data: first name, last name, domicile.

Processing purpose	Legal ground
Defending the legal rights andthe legitimate interests andfiling any claims before thejudicial bodies or any otherpublic authority	Legitimate interest of the company (art. 6, para. 1, let. f of GDPR) Details: the legitimate interest of the company in defending the legal rights or legitimate interests or in filing the claims arising out of or in close connection with the conclusion or performance of the contract or in order to exercise the right of defense in the event of any dispute against thecompany

2. PROVIDING YOUR PERSONAL DATA

You may refuse to provide certain Personal Data but in such a case you may not be able to benefit from certain services specific to the relationship

described in this Policy.

3. ABOUT LEGAL GROUNDS

The legal ground for processing the personal data differs depending on the specific situation and the Personal Data processed.

When we process your Personal Data based on your consent, we will seek your free, informed, specific and unequivocal consent for the respective processing.

By expressing your consent, you will agree that we may collect, use, disclose, process and transfer Personal Data in accordance with this Policy.

4. THE SOURCE OF PERSONAL DATA

The source of Personal Data is: online client.

5. AUTOMATED INDIVIDUAL DECISION-MAKING

Your Personal Data shall not be processed in order to be subject to decision based solely on automated processing, including profiling, which produces legal

effects concerning you or similarly significantly affects you, pursuant art. 22 para. (1) of GDPR.

6. PROCESSING DURATIONS

The duration of processing of Personal Data varies depending on the specific processing operation:

Operations	Duration
Contacting the online clients	as long as it takes to solve the request
Delivering the products	1 year
Adding the product to the cart	until the order is completed or until the products are deleted from the cart
Payment	until the payment is made
Invoicing	10 years
Placing the order	10 ani
Completing the user profile	as long as the user account exists
Orders history	as long as the user account exists
Marketing messages	until the data subject withdraws the consent
Feedback	until the feedback is analysed
Legal disputes	as long as it takes to solve the legal dispute

7. TRANSFER OF PERSONAL DATA

We may transfer Personal Data, to the necessary extent, to the following categories of recipients: [IT services suppliers, couriers, payment providers,

accountant, marketing services suppliers, public authorities].

These recipients can be located in the European Union and/or in the European Economic Area. Where recipients are located outside the European Union and

the European Economic Area, including in countries not recognized as ensuring an adequate level of protection, the transfer of Personal Data shall be carried

out only if there are appropriate guarantees, in accordance with applicable law. In this respect, we rely on several guarantees, such as the standard

contractual clauses issued by the European Commission. You may receive from us a list of recipients from third countries, as well as a copy of the agreed

provisions that ensure an adequate level of protection of Personal Data. For any request to this effect, please contact us at the contact details mentioned

below.

8. SECURITY OF PERSONAL DATA

The security of your Personal Data is important for us. Your Personal Data will therefore be processed by applying reasonable technical and organizational

measures to protect Personal Data, such as limiting access to Personal Data, encryption or anonymization of Personal Data, storage on secure environments.

However, despite our efforts, we cannot always guarantee the effectiveness of the security measures implemented, and therefore we cannot guarantee the

security of Personal Data at any time.

9. RIGHTS IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA

Access right: You have the right to obtain from us confirmation that your Personal Data is processed by us, as well as information on the specific processing,

such as: the purposes of processing, categories of processed Personal Data, recipients of Personal Data, the period for which Personal Data is stored, the

source of Personal Data, if we transfer the Personal Data abroad and how we protect it, your rights, the right to lodge a complaint before the supervisory

authority.

Right to rectification: You have the possibility to request rectification of your Personal Data, provided that the applicable legal requirements are met. In the

event of errors, after notification, we will immediately correct your Personal Data.

Right to erasure: In certain cases, you have the possibility to request the deletion of Personal Data, namely when: (i) the Personal Data are no longer

necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent on which the processing is based

according and where there is no other legal ground for the processing; (iii) the Personal Data have been unlawfully processed; (iv) you exercise the right to

object to the processing. We are not obliged to comply with your request when the processing is necessary (among others) for compliance with a legal

obligation or for the establishment, exercise or defence of legal claims. There are also other circumstances in which we are not obliged to comply with this

request for the deletion of Personal Data.

Restriction of processing: You may request us to restrict the processing of your Personal Data in the following circumstances: (i) you contest the accuracy of

the Personal Data, for a period enabling us to verify the accuracy of the Personal Data; (ii) the processing is unlawful and then you oppose to the erasure of

the Personal Data and request the restriction of their use instead; (iii) we no longer need the Personal Data for the purposes of the processing, but you

require them for the establishment, exercise or defence of legal claims; (iv) you have objected to processing, pending the verification whether our legitimate

grounds override yours. However, we can continue to process your Personal Data (i) when you consent; (ii) for the establishment, exercise or defence of legal

claims or (iii) for the protection of the rights of another natural or legal person.

Right to data portability: Insofar the Personal Data is processed based on your consent or on the execution of the agreement and the processing is carried

out by automated means, you have the right to have your data Personal Data provided to you in a structured format, which is currently used and can be read

automatically and you have the right to request us to transfer this Personal Data to another controller. This right shall not adversely affect the rights and

freedoms of others.

Right to opposition: In certain situations, such as when we process your Personal Data on the basis of a legitimate interest, you have the right to object to the

processing of your Personal Data by us. In the event of unjustified objection, FROSBERG DIGITAL S.R.L. is entitled to continue processing Personal Data. You

also have the right to object to the processing of your Personal Data for marketing purposes.

Withdrawal of consent: Insofar you consented to the processing of your Personal Data, you can at all times withdraw your consent, without affecting the

lawfulness of processing based on consent before its withdrawal.

Right not to be subject to any automatic individual decisions: You have the right not to be subject to a decision based solely on automated processing,

including profiling, which produces legal effects concerning you or similarly significantly affects you. Such right cannot be exercised when the decision: (i) is

necessary for entering into, or performance of, a contract between you and us; (ii) is authorized by law which lays down suitable measures to safeguard your

rights and freedoms and legitimate interests; or (iii) is based on your explicit consent.

Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with The National Supervisory Authority for Personal Data

Processing (“DPA”) in relation to any breach of your rights regarding the processing of your Personal Data. The contact details of the DPA are: 28-30

Gheorghe Magheru Boulevard, District 1, Postal Code 010336, Bucharest, Romania; e-mail: anspdcp@dataprotection.ro.

To learn more about the manner in which you may exercise the aforementioned rights, please contact us at: office@frosbergdigital.ro.

10. CONTACT

If you have any questions or concerns about this Policy or its implementation, you may contact us at: office@frosbergdigital.ro