We consider safeguarding the right to the protection of personal data to be a fundamental commitment of our company. We will therefore dedicate all necessary resources and efforts to processing your data in full compliance with Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR"), as well as with any other legislation applicable in Romania.

As transparency is one of the essential principles of this legal framework, we have prepared this document to inform you about how we collect, use, transfer and protect your personal data when you interact with us in connection with our products and services, including through our website or applications available on mobile devices.

We reserve the right to update and amend this Privacy Policy periodically to reflect changes in the way we process your personal data or changes to legal requirements. Whenever such changes are made, we will publish the amended version of the Privacy Policy on our website. We therefore encourage you to review this Privacy Policy periodically.

Who we are and how you can contact us

EXVENTURA.COM is the trading name of EXVENTURA SRL, a Romanian legal entity registered with the Trade Register under No. J2024027887004 and having Unique Tax Registration Code 50643533 (hereinafter referred to as "exventura.com" or "we"). For the purposes of data protection legislation, we act as the data controller when processing your personal data.

We are always open to hearing your views and providing any additional information you may require regarding the processing of your data. We therefore encourage you to contact us at contact@exventura.com.

Categories of personal data we process

We generally collect your personal data directly from you, which means that you have control over the type of information you provide to us. For example, we receive information from you in the following circumstances:

• When you place an order, you provide us with information such as the desired product, your first and last name, contact email address, billing details, payment method, telephone number and order details.

We may also collect and subsequently process certain information concerning your behaviour while visiting our website in order to personalise your online experience and provide offers tailored to your profile.

We may store and collect information on our website through cookies and similar technologies, in accordance with our Cookie Policy.

We do not collect or otherwise process sensitive data included by the General Data Protection Regulation within the special categories of personal data. We also do not intend to collect or process data relating to children under the age of 16.

Purposes and legal grounds for processing

We will use your personal data for the following purposes:

• To provide exventura.com services for your benefit.
• To refund the cost of services in accordance with applicable law and our Terms and Conditions.
• To provide support services, including responding to your questions concerning your orders or the goods and services offered by exventura.com or its partners.

In most cases, processing your data for these purposes is necessary for entering into and performing a contract between you and exventura.com. Certain processing activities associated with these purposes are also required by applicable legislation, including tax and accounting legislation.

Customer reviews

We may publish testimonials voluntarily provided by Users after participating in Experiences booked through the Exventura platform only where they have expressly agreed to their testimonials being made public.

Where consent has been provided, we may display the User's name, the testimonial text and any photograph attached by the User. We will never publish contact details such as an email address, telephone number or other personal data that is not necessary for the purpose of the testimonial.

The User may request the amendment, concealment or deletion of a published testimonial at any time by submitting a request to the platform's contact address.

Marketing and visitor experience

We want to keep you informed about the best offers for the products and services that interest you. For this purpose, we may send you various types of messages, including email, SMS, telephone calls, mobile push notifications and web push notifications, containing general or themed information, information about products similar or complementary to those you have purchased, information about offers or promotions, and other commercial communications such as market research and opinion surveys. We may also display personalised recommendations on the website and in the mobile application.

To provide information that may be relevant to you, we may use certain data concerning your purchasing behaviour, such as products you have viewed, added to your wishlist or purchased, to create a profile. We always ensure that this processing is carried out with due regard for your rights and freedoms and that decisions based on it do not produce legal effects concerning you or otherwise significantly affect you in a similar manner.

In most cases, our marketing communications are based on your prior consent. You may change your mind and withdraw your consent at any time by contacting exventura.com using the contact details provided above.

In certain circumstances, we may base our marketing activities on our legitimate interest in promoting and developing our business. Whenever we use information about you on the basis of our legitimate interests, we take all necessary measures to ensure that your fundamental rights and freedoms are not adversely affected. You may nevertheless ask us at any time, using the methods described above, to stop processing your personal data for marketing purposes, and we will comply with your request.

Protecting our legitimate interests

There may be circumstances in which we use or disclose information to protect our rights and business activities. These may include:

• Measures to protect the website and users of the exventura.com platform against cyberattacks.
• Measures to prevent and detect attempted fraud, including the disclosure of information to the competent public authorities.
• Measures to manage various other risks.

The general legal basis for these types of processing is our legitimate interest in protecting our business, with the understanding that we ensure all measures we take maintain a balance between our interests and your fundamental rights and freedoms.

In certain cases, we also base processing on legal provisions, such as the obligation to ensure the protection of property and assets under the applicable legislation.

How long we retain your personal data

As a general rule, we will retain your personal data for an indefinite period. You may ask us to delete certain information at any time, and we will comply with such requests, subject to our need to retain certain information after the other data has been deleted where required by applicable law or our legitimate interests.

How long files are stored

Unlike order data such as your email address, telephone number and name, all documents and files associated with your orders are stored on our servers for no longer than 35 days and are deleted after this period. In certain cases, some documents may remain accessible after this period for technical reasons, such as caching. You may ask us at any time to delete all information relating to your orders, in accordance with this Privacy Policy.

Who we disclose your personal data to

Where applicable, we may disclose or provide access to certain personal data concerning you to the following categories of recipients:

• Companies belonging to the same group of companies as exventura.com.
• Payment and banking service providers.
• Marketing service providers.
• IT service providers.
• Other companies with which we may develop joint programmes to market our goods and services.

Where we are subject to a legal obligation or where necessary to protect a legitimate interest, we may also disclose certain personal data to public authorities.

We ensure that access to your data by third-party private legal entities takes place in accordance with the legal provisions governing data protection and information confidentiality and on the basis of contracts entered into with those entities.

Countries to which we transfer your personal data

We currently store and process your personal data in Romania.

However, we may transfer certain personal data concerning you to entities located within or outside the European Union, including countries that the European Commission has not recognised as providing an adequate level of personal data protection.

We will always take steps to ensure that any international transfer of personal data is carefully managed in order to protect your rights and interests. Transfers to service providers and other third parties will always be protected by contractual commitments and, where appropriate, other safeguards, such as the standard contractual clauses issued by the European Commission or certification schemes, such as the Privacy Shield for personal data transferred from within the EU to the United States of America.

You may contact us at any time using the contact details provided above to obtain further information about the countries to which we transfer your data and the safeguards we have implemented in relation to such transfers.

How we protect the security of your personal data

We are committed to safeguarding personal data by implementing appropriate technical and organisational measures in accordance with industry standards.

Your personal data is transmitted using state-of-the-art encryption algorithms and stored on secure servers, while data redundancy is also maintained.

We use the services of the Netopia Mobilpay payment processor to process payments. All payment information is encrypted using HTTPS technology with TLS 1.2 encryption.

Despite the measures taken to protect your personal data, please note that transmitting information over the Internet generally, or through other public networks, is not completely secure. There is a risk that data may be viewed and used by unauthorised third parties. We cannot be held responsible for vulnerabilities in systems that are beyond our control.

Your rights

The General Data Protection Regulation grants you a number of rights in relation to your personal data. You may request access to your data, the correction of errors in our records and/or object to the processing of your personal data. You may also exercise your right to lodge a complaint with the competent supervisory authority or bring legal proceedings. Where applicable, you may also have the right to request the deletion of your personal data, the restriction of its processing and data portability.

To exercise your rights, you may contact us using the contact details provided above. Please note the following if you wish to exercise these rights:

Identity. We take the confidentiality of all records containing personal data seriously. For this reason, please submit requests relating to such records using the email address associated with your orders on exventura.com. Otherwise, we reserve the right to verify your identity by requesting additional information intended to confirm it.

Fees. We will not charge a fee for the exercise of any right relating to your personal data unless your request for access to information is unfounded, repetitive or excessive. In such circumstances, we may charge a reasonable fee. We will inform you of any applicable fee before processing your request.

Response time. We aim to respond to all valid requests within no more than one month, unless the request is particularly complex or you have submitted several requests, in which case we may respond within no more than two months. We will inform you if we require more than one month. We may ask you to specify exactly what information you wish to receive or what concerns you have. This will help us act more quickly and shorten our response time.

Third-party rights. We are not required to comply with a request where doing so would adversely affect the rights and freedoms of other data subjects.

You may ask us:

• To confirm whether we process your personal data.
• To provide you with a copy of that data.
• To provide other information about your personal data, including what data we hold, how we use it, to whom we disclose it, whether we transfer it abroad and how we protect it, how long we retain it, what rights you have, how you may lodge a complaint and where we obtained your data, insofar as this information has not already been provided to you through this notice.

Rectification. You may ask us to correct or complete inaccurate or incomplete personal data. We may seek to verify the accuracy of the data before rectifying it.

Erasure of data. You may ask us to erase your personal data, but only where:

• It is no longer necessary for the purposes for which it was collected.
• You have withdrawn your consent, where the processing was based on consent.
• You exercise a legal right to object.
• It has been processed unlawfully.
• We are legally required to erase it.

We are not required to comply with your request to erase your personal data where its processing is necessary:

• To comply with a legal obligation.
• For the establishment, exercise or defence of legal claims.

Restriction of processing. You may ask us to restrict the processing of your personal data, but only where:

• Its accuracy is contested, in which case the restriction will allow us to verify its accuracy.
• The processing is unlawful, but you do not want the data to be erased.
• It is no longer required for the purposes for which it was collected, but you need it for the establishment, exercise or defence of legal claims.
• You have exercised your right to object and verification of whether our rights override yours is pending.

We may continue to use your personal data following a request for restriction where:

• We have your consent.
• It is required for the establishment, exercise or defence of legal claims.
• It is required to protect the rights of exventura.com or another natural or legal person.

Data portability. You may ask us to provide your personal data in a structured, commonly used and machine-readable format, or request that it be transferred directly to another data controller, but in either case only where:

• The processing is based on your consent or on entering into or performing a contract with you.
• The processing is carried out by automated means.

Objection. You may object at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of our legitimate interests where you believe that your fundamental rights and freedoms override those interests.

You may also object at any time to the processing of your data for direct marketing purposes, including profiling, without having to provide a reason. In this case, we will stop such processing as soon as possible.

Automated decision-making. You may ask not to be subject to a decision based solely on automated processing, but only where that decision:

• Produces legal effects concerning you.
• Otherwise affects you in a similarly significant manner.

This right does not apply where the decision resulting from automated decision-making:

• Is necessary for entering into or performing a contract with you.
• Is authorised by law and appropriate safeguards are in place to protect your rights and freedoms.
• Is based on your explicit consent.

Complaints. You have the right to lodge a complaint with the supervisory authority concerning the processing of your personal data. In Romania, the contact details of the data protection supervisory authority are as follows:

Without affecting your right to contact the supervisory authority at any time, we kindly ask you to contact us first. We promise to make every effort to resolve your concerns amicably.

National Supervisory Authority for Personal Data Processing

• 28-30 General Gheorghe Magheru Boulevard, District 1, postal code 010336, Bucharest, Romania
• Telephone: +40 318 059 211 or +40 318 059 212
• Email: anspdcp@dataprotection.ro