CLUB MEMBERSHIP CONSENT STATEMENT

1. General Information

(a) Introduction

This information form is meant to provide you with details about the processing of your personal data and the rights you have in connection with this processing, in accordance with the European Union Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and the other applicable legal provisions.

(b) Controller

In accordance with GDPR, the capacity of controller is held by Metro Digital Romania SRL, a Romanian legal entity, registered with the Trade Register under no. J23/5428/2020, Sole Registration Number RO43319098, address: Voluntary City, 4C Pipera Tunari Avenue, Construdava Business Building, 1st floor, Office no. 1, Ilfov County (hereinafter referred to as “Metro Digital”). Metro Digital is responsible for the processing of personal data, as detailed below.

(c) Data Protection Officer

You can contact at any time our Data Protection Officer using the following contact data: e-mail: dataprotection-ro@metro.digital.

2. Information about Data Processing

We process your personal data as described in the Consent Statement, in order to grant and control access in the Tech’n Trade Club, provide information about marketing campaigns and events organized by Metro Digital, to offer invitations to events organized or promoted by Metro Digital, as well as to inform you about employment opportunities at Metro Digital. In order to achieve these purposes, your personal data will be transferred to external suppliers in Romania, in order to prepare marketing materials and/or invitations to events and to transmit these, as well as inside the European Union, to entities belonging to Metro Group (in order to ensure the security of the system). Therefore, your personal data will not be transferred outside the European Union.

The legal basis for the processing of data is Article 6(1)(a) of GDPR. The consent to the processing of personal data and the provision of the data mentioned above are voluntary. You are under no obligation to provide us with your personal data, and their provision is not a legal or contractual obligation, or an obligation required in order to conclude an agreement. If you do not provide us with your personal data, this will not have any consequence as far as you are concerned. The personal data mentioned above are retained until the withdrawal of the consent.

3. Your Rights

As data subject, you can contact our Data Protection Officer at any time, using the contact data indicated in section 1 above, without the need to follow specific notification formalities, in order to exercise the rights you benefit from under the law. These rights are:

(a) the right to receive information on data processing and a copy of the processed data (the right of access, Article 15 of GDPR);

(b) the right to rectify inaccurate personal data or to complete incomplete personal data (the right to rectification, Article 16 of GDPR);

(c) the right to request the erasure of personal data and, if the data has been made public, to request that the other controllers be informed about the request to erase the data (the right to erasure, Article 17 of GDPR);

(d) the right to request the restriction of the processing of personal data (the right to restrict the processing of data, Article 18 of GDPR);

(e) the right to receive the personal data concerning the data subject in a structured, commonly used and machine-readable format, as well as the right to transmit those data to another controller (the right to data portability, Article 20 of GDPR);

(f) the right to object to the processing of personal data in order to stop this operation (the right to object, Article 21 of GDPR);

(g) the right to prevent being subject to a decision based solely on automated processing, if such decision produces legal effects concerning you or similarly significantly affects you (Article 22 of GDPR);

(h) the right to withdraw your consent at any time, in order to stop the processing of data based on your consent. The consent withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal (the right to withdraw the consent, Article 7 of GDPR);

(i) the right to lodge a complaint with the National Supervisory Authority for the Processing of Personal Data (www.dataprotection.ro), if you consider that the processing of personal data breaches the provisions of GDPR (the right to lodge a complaint with the supervisory authority, Article 77 of GDPR).