I. IDENTITY AND CONTACT DETAILS OF THE JOINT CONTROLLERS

MASTERANGE ROMÂNIA S.R.L. (hereinafter referred to as the “Masterange”), a company registered in Bucharest, Nordului Road no. 24-26, 2^nd floor, District 1, registered with the Trade Registry under no. J2003003330402, having the sole fiscal identification code RO15262492, together with STEJARII UNIVERSE S.R.L. (hereinafter referred to as the “Stejarii Universe”), a company registered in Bucharest, Nordului Road no. 24-26, 2^nd floor, District 1, registered with the Trade Registry under no. J2024051344009, having the sole fiscal identification code RO51076380, acting as joint controllers (hereinafter referred to as the “Joint controllers”), operate the website https://www.stejarii.ro/ and its connected subdomains (hereinafter referred to as the “Website”), as well as the associated social media pages – Facebook, Instagram and LinkedIn – relating to the Stejarii residential complex (hereinafter referred to as the “Social media pages”).

This Privacy policy (the “Privacy policy”) details how the Joint controllers collect and process your personal data, the circumstances under which such data may be disclosed to third parties, as well as the rights you have as a data subject and how they may be exercised, in accordance with Regulation 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), as well as national legislation, including in the field of privacy protection in the electronic communications sector, when you visit the Website and Social media pages, and when you contact us using other contact methods provided, including by telephone and e-mail.

The Joint controllers have concluded personal data processing agreements through which the purpose and means of the jointly conducted processing activities have been defined, the responsibilities regarding the assurance of transparency, lawfulness and fairness of the processing activities have been allocated, as well as the limitation of the processing purposes and data minimisation, ensuring data accuracy and limiting the storage period thereof, together with the responsibilities of the Joint controllers regarding the security of personal data.

The Joint controllers have decided to designate a single point of contact so that, for any information or requests regarding the processing of personal data covered by this Privacy policy, or for exercising the rights you have as a data subject with respect to the processing of personal data, as further detailed below, you may contact our Data protection officer using the following contact details:

Data protection officer: ITH MANAGEMENT OFFICE S.R.L

Address: Nordului Road no. 24-26, District 1, Bucharest

E-mail address: dataprotection@tiriacimobiliare.ro

Telephone number: 021.431.21.49

In accordance with art. 26 para. (3) of the GDPR, you may exercise your rights in relation to any of the Joint controllers, and the Joint controller to whom you have addressed your request shall inform the other Joint controller of the request received.

II. WHO THIS PRIVACY POLICY IS ADDRESSED TO

This Privacy policy is addressed to visitors of the Website and Social media pages, as well as to individuals who contact us by telephone or e-mail, in their capacity as individual clients, potential individual clients, representatives of individual or legal entity clients, representatives of potential individual or legal entity clients, or persons interested in our services.

III. SOURCE OF PERSONAL DATA

Personal data is collected directly from you when you interact with the Website and Social media pages (for example, when you complete a form available on the Website or on the Social media pages) or when you contact us by telephone or e-mail.

To ensure that the data collected is accurate and up to date, please notify us of any changes regarding the personal information you have provided. We also recommend that you limit the data you provide strictly to what is necessary for the declared purposes.

IV. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASIS OF PROCESSING

We process the personal data listed below exclusively for the purposes and on the legal bases specified in this Privacy policy. If we intend to process this data for other purposes, we will inform you in advance, as appropriate and will take all necessary steps to comply with the provisions on the protection of personal data.

Personal data is processed as follows:

A. MANAGEMENT OF SUBMITTED REQUESTS

When you choose to complete a form available on our Website, via the Social media pages, or to contact us by e-mail or telephone, your personal data are processed as described below:

1. For the purpose of booking a tour for an apartment or requesting an offer, we process, on a case-by-case basis and depending on the channel through which you contact us, identification data (first name, last name, username – if the request is submitted via the Social media pages), contact data (e-mail address, phone number), request-related data (date and time), data regarding the type of apartment you wish to view or for which you wish to receive an offer, data regarding the language spoken, as well as any other information included in the submitted request, which, by association, may represent personal data.

Legal basis: the processing is carried out for the purpose of:

• taking steps at your request prior to entering into a lease agreement, when you are a potential individual client, in accordance with art. 6 para. (1) letter b) of the GDPR;
• pursuing the legitimate interest of taking steps to enter into a lease agreement with an individual or legal entity, when you act as a representative of a potential individual or legal entity client, in accordance with art. 6 para. (1) letter f) of the GDPR.

In the event that you become our client, we will inform you separately, through a dedicated privacy notice, regarding the framework for processing personal data in the context of entering into the lease agreement and the subsequent relationships arising from your stay in the Stejarii residential complex.

2. For the purpose of managing requests and communicating with you, we process, on a case-by-case basis and depending on the channel through which you contact us, identification data (first name, last name, username – if the request is submitted via the Social media pages), contact data (e-mail address, phone number), data regarding the subject of the request, request-related data (date and time), data regarding the language spoken, as well as any other information included in the message submitted, which, by association, may represent personal data.

Legal basis: the processing is carried out for the legitimate interest of responding to the requests submitted, in accordance with art. 6 para. (1) letter f) of the GDPR.

B. INTERACTION THROUGH THE WEBSITE

In the context of visiting the Website, your personal data is processed as follows:

1. When you choose to complete the forms available on our Website (for example, the booking a tour form or the contact form), you may freely opt to receive commercial communications by e-mail, newsletter or telephone regarding offers, services, event invitations or news that may be of interest to you, in which case we process identification data (first name, last name), contact data (phone number, e-mail address), data regarding the language spoken, as well as the option regarding the transmision of commercial communications (date and time of giving/withdrawing consent).

Legal basis: the processing is carried out on the basis of your consent, in accordance with art. 6 para. (1) letter a) of the GDPR.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal, by accessing the GDPR Panel section on the Website, using the unsubscribe links included at the end of the e-mails you receive, or by submitting a request using the contact details provided in this Privacy policy.

To withdraw your consent via the dedicated online form in the GDPR Panel section, you will need to complete a series of authentication steps, which include validating the e-mail address you originally used to subscribe.

Withdrawing your consent will not affect the handling of your request submitted through the completed form, but it will prevent us from sending you further commercial communications regarding our services.

When you visit the Website, we also process personal data through cookies and other similar technologies. For details regarding the use of cookies and the processing of personal data in connection therewith, please refer to the Cookie policy.

C. INTERACTION THROUGH SOCIAL MEDIA PAGES

In the context of using the Social media pages (Facebook, Instagram and LinkedIn), your personal data is processed as follows:

1. For the purpose of managing the Social media pages, we process identification data of followers (first name, last name, username), data regarding interactions of persons interested in our activities and services (comments, likes, tags, reposts, etc.), as well as data regarding the language spoken.

Legal basis: the processing is carried out for the legitimate interest of using such social media pages to ensure our visibility and presence online, in accordance with art. 6 para. (1) letter f) of the GDPR.

2. For the purpose of conducting analyses and statistics regarding general opinion, we process identification data (first name, last name, username) and feedback provided on these platforms or through other publicly available online channels by persons interested in our services.

Legal basis: the processing is carried out for the legitimate interest of improving the experience of clients and potential clients, so as to meet their needs, in accordance with art. 6 para. (1) letter f) of the GDPR.

D. OTHER PURPOSES

In addition, your personal data will be processed for subsequent and/or related purposes, if and as applicable:

1. For the purpose of preparing statistics and aggregate reports aimed at developing and improving our activities and services, enhancing the management of operations, optimizing processes, centralizing operations and maintaining an internal database, analyzing and minimizing financial and reputational risks related to our activities.

Legal basis for processing: the processing is carried out for the legitimate interest of ensuring proper business management, in accordance with art. 6 para. (1) letter f) of the GDPR.

In this case, the data is processed in an anonymized form and only exceptionally and when necessary in a clearly form.

2. For the purpose of ensuring the security of the systems, networks, and equipment used, as well as for their maintenance, where applicable.

Legal basis for processing: the processing is carried out for the legitimate interest of ensuring the security and proper functioning of systems, equipment, and networks, in accordance with art. 6 para. (1) letter f) of the GDPR.

3. For the purpose of complying with our legal obligations (for example, tax obligations, archiving obligations, data protection obligations, etc.), including reporting to certain public institutions and/or authorities.

Legal basis for processing: the processing is carried out for the purpose of fulfilling our legal obligations, in accordance with art. 6 para (1) letter c) of the GDPR.

4. For the purpose of asserting, exercising, or defending rights, as well as resolving disputes, where applicable.

Legal basis for processing: the processing is carried out for the legitimate interest of asserting, exercising, or defending our rights, in accordance with art. 6 para. (1) letter f) of the GDPR.

V. USE OF PLUG-IN TECHNOLOGIES / THIRD-PARTY SITES

The Website contains links to social media networks or third-party websites that you can access directly.

In this case, the social media networks or third-party websites may carry out personal data processing activities that are not under our control. Accordingly, the operators of these social media networks and third-party websites act as independent controllers and have their own policies regarding how they process personal data, including through the use of cookies.

Please consult the privacy policies of the social media networks and third-party websites for complete information regarding their processing of your personal data.

VI. DATA RECIPIENTS

Personal data may be disclosed, strictly to the extent necessary for the purposes detailed above or in cases where required by law or where we have a duly justified legitimate interest, to the following categories of recipients, who may act as independent controllers, joint controllers, or processors on behalf of the controller, as applicable:

1. Service providers:

• business administration and consulting services;
• personal data protection services;
• IT system development, technical support, and maintenance services;
• cybersecurity services;
• security auditing and IT infrastructure protection services;
• electronic communications services;
• archiving services;
• auditing services;
• provision of software solutions, platforms, or other IT systems, such as those used to manage information collected via the Website, marketing platforms, etc.;
• cloud/hosting services;
• marketing services (e.g., media agencies);
• social media platforms, as applicable, such as Facebook, LinkedIn, Instagram (in which case, please refer to their respective data processing policies available as follows:

• https://www.facebook.com/privacy/explanation,
• https://www.linkedin.com/legal/privacy-policy,
• https://help.instagram.com/519522125107875).

2. External consultants whom we engage in specific situations (for example, lawyers, consultants, experts, and other advisors).
3. Public authorities and bodies, including criminal investigation authorities and courts, bailiffs, to the extent that the disclosure of data to them is required by law and/or necessary in the event of litigation or dispute resolution, as well as in the case of inspections, where we are obliged to provide the requested information (for example, tax authorities, the National Supervisory Authority for Personal Data Processing – “ANSPDCP”).
4. Third parties expressly indicated by you;
5. Third party acquirers, to the extent that our activity would be transferred (in whole or in part) to another entity, and the data of the data subjects would be part of the assets that are the subject of such a transaction.

VII. TRANSFERS TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS

As a rule, we will not transfer your personal data outside the European Economic Area. In exceptional situations and only when necessary, the transfer of your personal data outside the European Economic Area will be carried out solely with the application of adequate safeguards in accordance with the specific legal provisions on personal data protection, and with appropriate information.

VIII. RETENTION PERIOD

The personal data indicated in Section IV will be processed only for the period necessary to achieve the purposes mentioned above, in accordance with our internal policies, for limited periods of time, such as:

1. In the case of a booking tour for an apartment or a request for an offer, if you become our client by signing a lease agreement, the data will be retained for a period equal to the contractual term, plus any periods required by law (for example, financial-accounting legislation) of at least 10 years from the end of the financial year in which the contract terminates, plus the 3-year limitation period. If you do not enter into a lease agreement and do not become our client, the data will be retained for a period of 3 years from the date of collection, for the purpose of defending our rights and interests.
2. If you submit a request to us, we will process your data for the duration of the request’s resolution, as well as for a period of 3 years from the date of the last interaction, both for the purpose of carrying out statistical analyses and reporting, and to defend ourselves in the event of disputes.
3. If you have given your consent for transmissions of commercial communications, personal data will be processed on the basis of the consent you provided for a period of 2 years, and the proof of the given consent will require its storage along with the related data for a period of 3 years from the date of withdrawal or expiration of the consent’s validity. Please note that you have the right to withdraw your consent at any time during the aforementioned 2-year period.
4. When you interact with the Social media pages, interactions, posts, and comments on these pages will be retained in accordance with the internal archiving policies of the Joint controllers or until you exercise your deletion option.
5. With regard to data collected through cookies, such data are retained for the duration specified, in each case, in the Cookie policy.
6. Personal data processed in the context of disputes, litigation, or mediations will be retained until their resolution, and thereafter in accordance with the applicable limitation periods.

Subsequently, we will remove or delete personal data from our systems and records and/or take measures to anonymize them so that you can no longer be identified, and we will also request that the recipients of the data take such measures.

The storage periods mentioned above may be modified if it becomes necessary to protect our legitimate interests or if legislative changes affect the legal retention obligations. In such cases, we will act in accordance with the law, including with respect to informing you.

IX. RIGHTS REGARDING PERSONAL DATA

Except the cases in which Romanian law or GDPR provides otherwise, you have the following rights:

1. Right to be informed, according to art. 13 and art. 14 of the GDPR, as per this document.
2. Right of access, according to art. 15 of the GDPR.
3. Right to rectification, according to art. 16 of the GDPR.
4. Right to erasure/right to be forgotten, according to art. 17 of the GDPR.
5. Right to restriction of processing, according to art. 18 of the GDPR.
6. Right to data portability, according to art. 20 of the GDPR.
7. Right to object, according to art. 21 of the GDPR.

When you send us a request to exercise this right, please also state the reasons relating to your particular situation. We will no longer process personal data, unless we can demonstrate (i) compelling legitimate grounds for processing which override your interests, rights and freedoms or (ii) the purpose is the establishment, exercise or defend a right in court.

8. Right not to be subject to a decision based solely on automated processing, including profiling, according to art. 22 of the GDPR.

The personal data referred to in this Privacy police is not subject to automated decision-making processes.

Please note that these rights are not absolute, which means that there are certain exceptions to their exercise. These rights are applicable on a case-by-case basis.

9. Right to withdraw your consent, according to 13 para. (2) letter c) and art. 14 para. (2) letter d) of the GDPR.

This right applies when personal data is processed based on your given consent, in which case you may at any time submit a request to withdraw your consent by accessing the GDPR Panel section on the Website, via the links included at the end of commercial communications you receive, or by submitting a request using the contact details provided in this Privacy policy. To withdraw your consent via the dedicated online form, you will need to complete a series of authentication steps, which include validating the e-mail address you used to subscribe. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. The withdrawal of consent regarding the processing of personal data results in the cessation of such processing.

10. Right to lodge a complaint with the supervisory authority, according to art. 13 para. (2) letter d) and art. 14 para. (2) letter e) of the GDPR.

Without prejudice to your right to contact ANSPDPC at any time, please contact us in advance in relation to the exercise of the rights mentioned above.

If you consider that we have not resolved all your requests or you are not satisfied with our responses, you can contact the ANSPDCP, to file a complaint by using the following contact details:

• headquarters: Bucharest, 28-30 Gen. Gheorghe Magheru Bvd., District 1, CP 010336,
• telephone: +40.318.05.92.11
• fax: +40.318.05.96.02
• e-mail: anspdcp@dataprotection.ro
• website: dataprotection.ro

or you can address a complaint to the competent court.

Please note the following in relation to the exercise of your rights as data subject:

• How to exercise: you can contact the Data protection officer using the contact details available above.
• The period of time for providing a response: we will try to resolve the request within one month, which may be extended with two months for specific reasons related to the complexity of the request. In all cases, if this time limit is extended, we will inform you of the length of the extension and the reasons for it.
• Identification: please provide us with the data necessary to identify you (name, surname, e-mail address), with the understanding that, to the extent that we cannot identify you on the basis of this information alone, we will ask you to provide additional information that will allow us to identify you.

If necessary, we will update this Privacy policy to reflect any changes in the way we process your personal data. In the event of any such update, we will publish the new version of the Privacy policy and indicate the update by modifying the date on which the revised Privacy policy is displayed.