This GDPR Policy applies to the operator Gervain SRL, a limited liability company of Romanian nationality, with its registered office in Romania, registered at the Trade Registry Office under the unique European number ROONRC.J13/1464/2024, unique tax identification code RO 500157921 (named commercial "Gervain").

1. Our commitment to your personal data

1.1. Gervain SRL will process personal data in accordance with this Personal Data Protection Policy ("GDPR Policy"), according to the applicable legislation.

1.2. The GDPR policy is based on the provisions of Regulation no. 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC ("General Data Protection Regulation" or "GDPR"), in force from 25 May 2018, as well as applicable national legislation.

1.3. The GDPR defines personal data as “any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific factors, own his physical, physiological, genetic, mental, economic, cultural or social identity."

1.4. Gervain is committed to implementing the highest standards of confidentiality and transparency regarding the personal data it processes in its daily activities. Ensuring total protection and transparency in the processing of your personal data within our activities are our top priorities.

1.5. Please also consult the Cookies Policy and the General Terms and Conditions available on the website www.gervain.com , which complement this GDPR Policy.

1.6. Any information regarding the processing of your personal data can be requested in writing to the address of the registered office mentioned above or by email to: contact@gervain.com

2. Consent

2.1. Your use of our services is subject to this GDPR Policy. By using our services, you agree to the terms of this GDPR Policy. The purpose of the GDPR Policy is to inform our customers about how we collect, store and use personal data.

3. Categories of personal data collected

The personal data we process as a result of your use of the website may include:

• Details of your visits to our website (in this regard, we recommend you read the Cookies Policy);
• Other information you provide to us when you make a request on the site or send it by email or phone;
• Data required for issuing invoices and other relevant data

4. Ways of collecting your personal data

4.1. We collect your data mainly after visiting the website www.gervain.com and placing an online order.

4.1.1. We collect and process personal data relating to your name, surname, email address and telephone number to maintain correspondence or communication with you. Thus, if you make a request by email or phone, we will process your data to resolve it.

4.1.2. In this context, if your situation requires it, we may share your contact details with financial and government institutions, transport companies or the post office.

4.2. We collect your data that comes from a request to be contacted.

4.2.1. We collect personal data relating to your name, surname, email address, telephone number and interest in contracting, which come from your request to be contacted by filling in the fields on the website.

4.2.2. In this regard, our consultants will contact you to provide you with more information.

4.2.3. After completing the contact form, your data is imported into Gervain's database.

4.2.4. If you have expressly consented to your data being processed for marketing purposes by Gervain, such as receiving newsletters, information about our products and services, or events and competitions organized by us, Gervain will process your data for this purpose .

5. The purposes of processing your data

We may collect and process personal data for the following purposes:

• Providing our products and services;
• Sending invitations for events organized by us;
• Compliance with our legal obligations (such as keeping accounting records and supporting documents);
• Analyzing and improving our services and communications to you;
• Ensuring the security and management of websites and other systems, preventing and detecting security threats, fraud or other criminal or malicious activities;
• Transmitting them to third parties, if you have expressly given your consent;
• Marketing campaigns, customer surveys, market analysis, sweepstakes, contests or other promotional activities or events, where you have expressly consented;
• Ensuring the physical security of the premises, according to the applicable special legislation;
• Interaction with public authorities, in accordance with applicable civil and criminal laws;
• Any purpose related and/or ancillary to any of the above or any other purpose for which your data has been provided to us.

6. Direct marketing

6.1. We promote our services to you and others. We use customer information to send invitations and communications promoting our products and services.

6.2. In all cases, you will have the opportunity to unsubscribe from receiving marketing information by accessing the unsubscribe link in each such communication or by sending a written request to the registered office address mentioned above or by email to: contact@gervain .com

6.3. Please note that in the event of an unsubscribe request, there may be a period of up to 48/72 hours in which you may continue to receive marketing information, due to considerations related to the operation of changes in the system. Unsubscribing from marketing emails does not prevent the further transmission of transactional emails by which we may inform you about the status of the transaction we may conclude.

7. Sharing and Transferring Your Personal Data

7.1. We may provide access to the personal data you provide to our authorized persons based on contracts entered into in this regard, but we will retain control over your data and use appropriate safeguards, in accordance with applicable law, to ensure the integrity and the security of your data.

7.2. We may also disclose your personal data when you instruct or give us permission to do so, or when we are required to do so by applicable law, court order or official request, or to investigate actual or suspected fraudulent or criminal activity.

7.3. We will not transfer personal data outside the EEA, unless the transfer is subject to one or more specified safeguards or exceptions.

7.4. In the absence of an adequacy decision, the transfer of personal data to a third country or international organization will only take place under the following conditions:

• The transfer is necessary for important reasons of public interest;
• The transfer is necessary for the establishment, exercise or defense of legal claims.

8. Storing and ensuring the security of personal data

8.1. Ensuring the confidentiality of the personal data you transmit to us is an important concern for us. We have implemented technical and organizational measures to maintain the confidentiality and security of your personal data in accordance with our internal procedures regarding the storage, disclosure and access of personal data. Personal data may be kept on our technological systems, those of our contractors or in hard copy for a period of 5 years or any other period according to the applicable legal rules.

8.2. The website www.gervain.com is protected by the standard SSL encryption system. This technology encrypts all your personal data that you transfer to Gervain.

9. Your Rights

9.1. We would like to inform you that, under the new regulations on the protection of personal data provided by the General Data Protection Regulation EU 679/2016, if we process your personal data, you have the following rights, as well as any other applicable legal rights :

• The right of access, provided by art. 15 of the GDPR, based on which you can ask us, free of charge, to confirm whether or not we are processing personal data concerning you. You can also ask us for a copy of the data we process about you. Applications must include relevant information to identify you in our database. We will resolve your request within the legal term;
• The right to information – involves informing the data subjects in a concise, transparent and easily accessible manner about the processed data;
• The right to rectification, provided by art. 16 of the GDPR, which you can exercise by making a request through which you can ask us to modify the information we already have about you. You can make such a request when you notice that your data is incomplete or inaccurate;
• The right to restrict processing, provided by art. 18 of the GDPR, which you can exercise when you dispute the accuracy of the data, consider the processing to be unlawful or object to the deletion of the data. Following the exercise of this right, we will still be able to store your data, performing other processing operations being possible only with your consent, except in cases expressly provided by law;
• The right to data portability, provided by art. 20 of the GDPR, which you can exercise only in cases where the processing is based on your consent or the contract and only if your data is processed by automated means. If you meet the conditions, you can send us a data porting request to the operator you want;
• The right to object to data processing for marketing purposes, provided by art. 21 of the GDPR. You can exercise this right at any time, and we guarantee that your data will no longer be processed for this purpose. However, it is possible that a reasonable period of time (up to 72 hours) is required to register and process your request during which you may still receive marketing communications from us;
• The right to erasure, provided by art. 17 of the GDPR, based on which we have the obligation to delete the personal data we process about you. This right is not an absolute one, having applicability only in certain situations expressly provided by law. When making a deletion request, please be aware that deleting them can be a complex process.
• The right to contact the National Supervisory Authority for the Processing of Personal Data, the public authority in Romania, with headquarters in B-dul General Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, web page http:/ /www.dataprotection.ro , which aims to protect the fundamental rights and freedoms of natural persons, especially the right to private life, in relation to the processing of personal data and free circulation of this data ("ANSPDCP"), if you report a violation of the GDPR.

9.2. To exercise these rights, please send us a written request to the address of the registered office mentioned above or by email to: contact@gervain.com, with the subject "Personal information request".

You can also withdraw your consent for direct marketing purposes by using the "unsubscribe" option included in each marketing communication.

10. GDPR Policy Update

We reserve the right to periodically update and amend this GDPR Policy to reflect any changes to how we process your personal data or any changes in legal requirements.

In the event of any such changes, we will display the amended version of the GDPR Policy on our website www.gervain.com and/or make it available in other ways.

11. Contact

For additional information regarding the content of the GDPR Policy, please contact us in writing at the registered office address mentioned above or by email at: contact@gervain.com