Artmark S.R.L., with registered office in Bucharest, 5 C.A. Rosetti Street, Building A, ground floor, room 39, Sector 1, registered with the Trade Register under no. J40/17654/2018, VAT no. 40284718, ("A10"), a company directly or indirectly controlled by ARTMARK HOLDING S.R.L. (hereinafter "ARTMARK"), with registered office in Bucharest, Sector 1, 5 C.A. Rosetti Street, Building A, registered with the Trade Register under no. J40/12823/2008, VAT no. 24235977, is a member of the ARTMARK group of companies (the "ARTMARK Group"), together with the following companies: Art Safari S.R.L., Art Games S.R.L., I.M.A. Institutul de Management al Artei, Lava Cow S.R.L., in accordance with Article 4(19) of Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the "GDPR").

For the purposes of the GDPR, the controller with regard to the personal data we hold means A10, as well as ARTMARK, referred to both individually and jointly in this notice as the "Controller".

The Controller processes, in compliance with the applicable legislation, under secure conditions and only for the specified purposes, the data you provide us for the purpose of (i) fulfilling the legal obligations incumbent on the Controller or other companies within the ARTMARK Group; (ii) concluding and performing contracts; (iii) promoting the products and services of the ARTMARK Group; (iv) monitoring the safety of persons and property in the building located in Bucharest, 5 C.A. Rosetti Street, Sector 1, as well as in the locations where the companies within the ARTMARK Group carry out their activities.

This notice informs you about how your personal data are processed by the Controller; processing means any operation or set of operations performed on personal data or on sets of personal data, with or without automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data means any information relating to an identified or identifiable natural person (the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, economic, cultural or social identity of that natural person.

1.  CATEGORIES OF DATA PROCESSED

The Controller processes the following categories of personal data: first and last name, age, home/residence address, delivery address, business address, date of birth, personal identification number, data relating to the national identity document (series and number, issue date and validity date, issuer), passport data (series, issue date and validity period, issuer), phone number, email address(es), bank account, place of work, profession, image, voice, IP address and device type from which you access the Controller's website, www.artmark.ro, pages visited, duration of use, search history, purchasing patterns/preferences.

2.  PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

• We will process personal data for the following purposes:

registration for participation in in-person, online, telephone, or written-offer auctions; data collection will be carried out through completion of auction participation contracts; performance of contracts (including receipt of payments), invoicing and delivery of goods or provision of purchased services; data collection will be carried out either through completion of auction participation contracts, adjudication forms, by email or by phone, respectively through video recordings of the auctions; compliance with legal reporting obligations; advertising, marketing and promotion of the products and services of the ARTMARK Group, by email, SMS, telephone, auction catalogues, invitations, regarding upcoming events and/or other forms of advertising; data collection will be carried out through newsletter subscription, by completing auction participation forms; sale/provision of tickets/access permits to ARTMARK Group events; data collection will be carried out through special purchase forms, respectively those created for issuing tickets/access permits; video surveillance by CCTV for the purpose of monitoring the security of persons, spaces and/or property within the building at 5 C.A. Rosetti Street, Sector 1, Bucharest.

• We will process personal data on one of the following legal bases:

your intention to contract or the contract concluded with you, for the performance of which we must obtain data strictly necessary for fulfilling the Controller's legal obligations regarding customer due diligence, issuing the invoice and delivering the purchased good(s) or providing the purchased service(s); the legitimate interests of the ARTMARK Group, for example fraud prevention, maintaining property security, presenting website content in the most accessible way, direct marketing. Whenever we rely on this legal basis to process your data, we assess our interests so that they do not override your rights, and you are entitled to object at any time to such use; compliance with an imperative legal requirement, including, for example, accounting and tax requirements, customer due diligence and anti-money laundering requirements subject to strict internal policies; the consent you give when no other basis for processing exists and which may be withdrawn by you at any time.

3.  RETENTION PERIOD FOR PERSONAL DATA

Personal data will be stored for the entire duration of the customer relationship, plus a period of 5 years from its termination, or for the period required by law. After the expiry of this period, the personal data will be deleted and/or destroyed. The processed personal data will be reviewed by the Controller at least once every 2 years, and any inaccurate or modified data will be corrected or deleted, except where the law requires such inaccurate or modified data to be retained.

4.  COOKIES

Cookies are small text files placed on your device. Whenever a person accesses a website, it may write or read from the cookie it has placed on the device various information transmitted by the reader, directly or indirectly. Cookies play an important role in the way our websites are viewed. They retain information about how web pages have been viewed, such as the language in which the pages are displayed, font size, the region of the world where the user is located, security-related settings and others. By using cookies, you will benefit from a better browsing experience on our websites, which would not be possible without them or would be significantly poorer. However, if you prefer, through the settings in the browser you use to browse the Internet, you can allow or block cookies. The Controller's cookie policy is available and can be consulted at https://www.artmark.ro/ro/politica-cookies.

5.  PROCESSING AND DISCLOSURE OF PROCESSED PERSONAL DATA

Personal data are processed by the Controller's employees who, by virtue of their position within the Controller, are responsible for collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, restricting, deleting or destroying personal data.

Access to the personal data processed by the Controller is limited to those employees who need to obtain this information in order to achieve the purposes for which the data are processed.

Personal data may also be disclosed to third parties, personal data controllers or processors of the Controller, such as service providers: third parties that manage email newsletters, SMS marketing or other types of marketing, customer support or sales activities, including transport providers, couriers, insurers, IT system providers and support, including email archiving, telecommunications providers, backup and disaster recovery services and cybersecurity services. Disclosure may also be made to accountants, auditors, lawyers and other external consultants whose activities require knowledge of the data or where disclosure is required by law. We ensure through contractual arrangements that these service providers (processors) process personal data in accordance with European data protection legislation, in order to guarantee a high level of data protection.

There may also be other recipients where there is a legal obligation to inform the competent public authorities or institutions, when required by law (e.g. fraud investigations; anti-money laundering; filing declarations or financial statements with tax authorities, etc.), or the transmission of data to courts for the purpose of defending a legal right, or before other public authorities.

Some of these recipients (including our affiliates) may use your data in countries outside the European Economic Area.

Images of natural persons present in the building at 5 C.A. Rosetti Street, Sector 1, Bucharest, as well as in locations where auctions are held, are intended for use by the Controller and may be disclosed to the following recipients: the data subject, courts of law and criminal investigation bodies, as well as the Controller's lawyers.

Personal data may be disclosed where it is in our legitimate interest, for administrative reasons, for example, or for auditing and monitoring our internal processes, or when providing products and services such as information technology within the ARTMARK Group.

6.  DATA TRANSFER WITHIN THE GROUP OF COMPANIES

In accordance with the GDPR, for business administration reasons, management of customer and employee needs, including for the purpose of processing personal data, the Controller transfers personal data within the group of companies, the ARTMARK Group.

7.  DATA TRANSFER OUTSIDE THE EUROPEAN UNION

Personal information may be processed by personnel operating outside the EEA (European Economic Area, which includes the countries of the European Union, Iceland, Liechtenstein and Norway; these are considered to have equivalent laws regarding data protection and privacy) of third-party personal data controllers for the purposes mentioned above.

In the event that personal data are provided to entities outside the EEA, appropriate measures for the security of the processing will be taken by contractual means.

8.  YOUR RIGHTS

Right to information: the data subject is entitled to know, even from the moment of collection, how that data will be used, to whom it will be disclosed or transferred, and what rights the persons concerned have in relation to the processed data.

Right of access to data: the data subject may obtain confirmation as to whether personal data are being processed and, if so, has the right to access those data.

Right to erasure (right to be forgotten): the data subject may obtain erasure of the data without undue delay (there are also exceptions, such as: some data are processed to provide the public with the right to information, some data are processed for statistical or archiving purposes, some data are processed to comply with a legal obligation, or the data are processed for the establishment or defence of a right in court).

Right to rectification: the data subject may obtain, without undue delay, rectification of inaccurate personal data (for example, the right to obtain completion of incomplete personal data).

Right to restriction of processing: the data subject has the temporary right to obtain restriction of processing where one of the following cases applies: (a) you contest the accuracy of the data, for a period allowing us to verify their accuracy; (b) the processing is unlawful and you oppose the erasure of the personal data, requesting instead restriction of their use; (c) we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of a right in court; (d) you have objected to processing pursuant to Article 21(1) of the GDPR, for the period during which it is verified whether our legitimate interests override your rights.

Right to object: the data subject has the right to object to the Controller's processing of personal data when they are processed for marketing purposes. If you no longer wish to receive marketing messages about our events, you may choose to opt out of all marketing communications or only selected methods (email, SMS, MMS, phone or mail).

Several ways to opt out of receiving marketing messages are available to you:

• Log in to your account and change your preferences;

• Send an email to [email protected] for instructions;

• Click the link at the end of an email or marketing text message received by SMS to unsubscribe;

Right to data portability: the data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from us, where: (a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR; and (b) the processing is carried out by automated means.

Right not to be subject to a decision based solely on automated processing, where that decision produces legal effects or similarly significantly affects them and is based solely on automated processing of data intended to evaluate certain personal aspects. Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing.

9.     PERSONAL DATA SECURITY

The Controller ensures a high level of protection and security against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in the course of operations performed on personal data, through appropriate technical and organizational measures.

Organizational measures include physical access control to our premises, staff training and locking physical files in storage cabinets. Technical measures include the use of encryption, passwords for access to our systems, the use of SSL security certificates for encrypting data in transit, etc.

If you provide personal data via the internet, although the Controller makes every effort to protect the data provided in this way, the transmission will not be completely secure (for example, third parties may observe the transmission activity; therefore, the security of personal data transmitted over the internet cannot be guaranteed).

10. EXERCISING YOUR RIGHTS

To exercise your legal rights, please contact us by email at [email protected] and/or in writing at the correspondence address 5 C.A. Rosetti Street, Sector 1, Bucharest. We will try to respond to your request within 30 days and may extend this period for reasons justified by the complexity of the request. In all cases, if this period is extended, you will be informed of the deadline and the reasons for the extension. If it is impossible for us to properly identify you and therefore we are unable to respond, we may request additional information that will help identify you.

11. UPDATES

The Controller may update the content of this Information Notice at any time. All updates and changes are effective immediately upon notification, which we will provide by publication on the website and/or by email, to the extent that this data is available.

12. QUESTIONS AND REQUESTS

If you have any questions or concerns regarding the processing of your data or wish to exercise your legal rights in connection with the data we hold, or if you have concerns about how we handle any privacy matter, you may send a request to [email protected] and/or in writing to the correspondence address 5 C.A. Rosetti Street, Building A, Sector 1, Bucharest. We will investigate and try to resolve any request or complaint regarding the use or disclosure of your personal information. If you are not satisfied with our response, you may file a complaint with the National Supervisory Authority for Personal Data Processing. You can find more information at: http://dataprotection.ro/?page=procedura_de_solutionare_a_plangerilor