PRIVACY POLICY

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), the personal data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

The controller of Subjects' Personal Data is Simpliworks SRL with the registered office in Bucharest, 142 Gheorghe Titeica Street, Titeica Office Building, 3rd Floor, district 2, registered with the Trade Register Office under the no. J2022006777401, fiscal identification number (CUI) RO 45938180, Phone: +4 031 82 81 141, E-mail: easy@simplifi.ro ("Simplifi" or "Controller")

Simplifi takes the confidentiality of personal data seriously. The security and confidentiality of your Personal Data is very important to us. As such, we take all necessary and reasonable steps to ensure the security and confidentiality of your personal data and to process it in accordance with GDPR and applicable European and national legislation.

As per this Privacy Policy, "Personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This privacy policy explains who we are, how we collect Personal Data, how we share and use Personal Data and how you can exercise your rights regarding the protection of your Personal Data.

We recommend that you read this Privacy Policy in full to make sure you are fully informed.

This Privacy Policy applies to natural persons - customers, potential customers, Subjects of Simplifi websites, contact persons, legal or contractual representatives of contractual partners/potential contractual partners, legal entities and other natural persons designated by contractual partners, legal entities or whose data is transferred to us for processing by our contractual partners.

This Privacy Policy applies to all services that Simplifi offers. Some services may also have other personal data processing conditions that complement this policy, such as the trust services covered by eIDAS. Detailed information on the data processing carried out by Simplifi for the provision of these services can be found by following this link: PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA. www.simplifi.ro/policies.

This privacy policy is updated periodically to reflect how Simplifi processes Personal Data and to comply with any legal changes; each time we make a change, we will post it on our website www.simplifi.ro and can be accessed using this link www.simplifi.ro/policies.

Depending on the product/service we provide or how you have interacted with Simplifi, the categories of Personal Data we process may include:

• Identification data: name, surname, sole identification number (CNP), date and place of birth, citizenship, ID series and number, position and/or capacity held and the organization in which they are held, handwritten or electronic signature, information on your unique identification by remote video means, including the processing of biometric data with your consent for the purpose of issuing a qualified digital certificate (details on the processing of these data can be found in the Privacy Notices related to these services, mentioned in the preamble of this policy)
• Financial data: information about the bank account and the bank where it is held
• Contact and delivery details: e-mail address, phone number, home address, shipping address
• Data on our relationship with the data subject: data on the issuance, provision, use and revocation of digital certificates, information related to the performance of the contract with Simplifi, details on mailing, applications, complaints, claims you make or other information related to your interaction with us (e.g. for support in using our services), information on the exercise of the rights you have with regard to Personal Data
• Service usage data: login data, Subject account data, log data such as IP address, data about your actions on Simplifi or partners' platforms and website, data about the mobile device used, references – encrypted codes generated by the applications used, data collected by cookies and similar technologies – such as unique ID allowing Subject session identification, IP data. More details can be obtained from the Cookies Policy, available at www.simplifi.ro

Purposes of processing your personal data are:

• For initiating the contractual relationship, negotiating, concluding and performing contracts with you or Simplifi contractual partners, including the provision of services, the delivery of products covered by the contracts and their payment or the creation of a Subject account on Simplifi applications or websites for the purpose of contracting services, providing support services for the use of our services or products or participating in webinars organized by Simplifi in accordance with Article 6 (1) (b) of the GDPR;
• For the fulfilment of Simplifi's legal obligations in the context of the contractual relationship, according to Article 6 (1) (c) of the GDPR, such as: obligations to draw up and keep financial-accounting documents; keeping personal data throughout the duration of contractual relations and archiving documents; conducting audits; transmission of information representing personal data at the request of the competent state authorities; ensuring the security of systems and databases (including backup); other legal obligations applicable depending on the nature of the contractual relationship and/or the status of the contractual partner;
• For the pursuit of Simplifi's or a third party's legitimate interests under Article 6 (1) (f) of the GDPR, such as: for internal reporting; for managing contracts or supporting accounting documents; for communicating with contract partner representatives; for auditing and verifying internal processes; for sending commercial communications related to products or services similar to those purchased; for conducting activities aimed at increasing customer satisfaction and, for this purpose, questionnaires on customer satisfaction surveys by sms or e-mail or other communication channels or platforms, for conducting internal performance and efficiency studies, cost studies, for establishing performance indicators, studies on the allocation of resources in relevant markets; for fraud prevention; for dealing with claims or complaints; and for defending Simplifi's rights such as the recovery of claims held by it and the formulation of defences in the event of possible litigation;
• For marketing and advertising purposes, including the promotion of our services, for sending newsletters, promotional materials, marketing communications, commercial offers or any other relevant information about Simplifi products and services where you have given your consent to do so or recording telephone calls to improve our services, in accordance with art. 6 (1) (a) GDPR or based on Controller's legitimate interest, in accordance with Article 6(1)(f) of the GDPR;
• For handling Subjects' requests, petitions, and/or complaints, either (i) as necessary for the performance of the contract between the Subject and the Controller (Article 6(1)(b) GDPR), or (ii) in order to comply with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR);
• For statistical purposes, in accordance with Article 6(1)(f) and Article 89 of the GDPR (data processed in encrypted and anonymized form);
• To prevent and combat fraud and to safeguard the integrity of the trust services, based on the Controller's legitimate interest in taking necessary and appropriate measures to prevent and address potentially fraudulent conduct, in line with Article 6(1)(f), as well as to comply with legal obligations to take appropriate action against internal or external fraudulent behavior (and Article 6(1)(c) GDPR);
• For the compliance with regulatory obligations imposed by eIDAS and Romanian law in respect with identity proofing, in the context of processing the biometric information, in accordance with Article 9(2)(a) and Article 9(2)(g) GDPR.
• For any other purpose related or ancillary to the purposes listed above, or for any other purpose for which the Personal Data has been provided to us.

Simplifi can get access to the data:

• directly from the Data Subject when you purchase and use Simplifi products and services or when you contact us through various channels or when you request offers or information about Simplifi products and services or when you visit our websites;
• from our third-party remote identification services provider (ADR-certified), upon your acceptance to provide such data to such party – the data is crucial for the issuance and management of qualified electronic certificates and seals;
• from other sources: public sources (e.g. websites, public databases such as: Trade Register database, Ministry of Finance database, Official Journal, websites of court of law, etc.) or from third parties (contractual partners of Simplifi or third parties relying on trust services provided by Simplifi), public authorities (e.g. in case of court requests or judicial investigations);
• by generating data from the information provided by you (such as the serial number of the digital certificate for electronic signature or references etc.).

The processing of Personal Data mentioned above is necessary for the purposes specified above.

Personal Data are processed with the help of other personal data controllers with whom we partner (e.g. in order to identify you for the purpose of issuing and using a qualified digital certificate or of creating and using an Subject account in Simplifi platform) in compliance with Article 26 of the GDPR.

Simplifi may also process personal data through processors providing adequate safeguards in accordance with Article 28 of the GDPR, to whom we outsource certain activities.

Refusal to provide Personal Data, withdrawal of consent or requests for Personal Data erasure may make it impossible to provide the services or products covered by the Contract.

However, such requests will be evaluated and honoured to the extent possible, unless such processing is required by law, is necessary for the performance of a contract or is otherwise permitted under GDPR.

Personal Data may subject to analysis using automated tools, including artificial intelligence (AI) systems, for the purpose of providing support services and improving the quality, functionality, and security of our services or products.

Where technically feasible and appropriate, such systems will process data in an anonymized or pseudonymized form and will operate under human oversight to ensure accuracy, fairness, and compliance with applicable laws.

We do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless such processing is permitted by law and appropriate safeguards are implemented in accordance with Article 22 of the GDPR. In such cases, you will be informed in advance and will have the right to obtain human intervention, to express your point of view, and to exercise any of the right provided herein.

Your personal data may be disclosed to the following categories of recipients:

• external auditors of Simplifi, to fulfil our audit obligations,
• supervisory bodies under the legislation applicable to the service provided,
• public authorities and institutions based on our legal obligations under the applicable legislation,
• lawyers who represent us in the event of litigation or for advice,
• bailiffs, for contractual notices or enforcement of any court judgments,
• debt recovery firms,
• Simplifi contractual partners (such as courier companies, suppliers, subcontractors, accountants, consultants and technical experts, etc.) for the conclusion and execution of contracts, and the provision of services or to carry out certain activities such as assessing customer satisfaction in order to improve the services offered or to provide call center services or to ensure information security,
• banks, for mortgaging receivables and/or obtaining financing and/or guarantee instruments,
• insurance companies for obtaining guarantee instruments and/or insurance policies,
• affiliated companies of Simplifi that support us in the services we provide.

Considering the nature of the activities carried out by the Controller and the services provided to its clients, Subjects' Personal Data may be transferred outside Romania.

Any transfer of Personal Data will primarily be made to member states of the European Union (EU) or the European Economic Area (EEA) that ensure an adequate level of data protection in accordance with applicable legislation.

In cases where the transfer of Personal Data is made to countries outside the EU/EEA, such transfer will be carried out only under the conditions set out in the GDPR, namely:

• to countries that have been recognized by the European Commission as ensuring an adequate level of data protection;
• based on standard contractual clauses approved by the European Commission or other GDPR-compliant transfer mechanisms;
• in exceptional situations, with the Data Subject being duly informed and with the implementation of additional protective measures, where necessary.

The Controller will take all necessary measures to ensure that any transfer of Personal Data is carried out under secure and compliant conditions, safeguarding the rights and freedoms of Data Subjects.

Information about the third countries to which we send personal data can be provided on request and for more information, please contact us at: easy@simplifi.ro

Simplifi processes personal data, in general, throughout the entire period of negotiation and fulfilment of contractual relations with you or with the contractual partners that you represent or that have provided us with data for processing. Upon termination of these relationships, the information and personal data will be archived/stored. The archiving/storage period varies depending on the type of service you have contracted or the type of relationship you have with Simplifi.

We also process certain categories of data for the period of time required by law or by a public authority, as required by law or, in the event of a dispute, until the final resolution of the dispute.

For processing based on the legitimate interest of Simplifi or a third party, we process data according to our retention policies.

For instance:

• for compliance with financial and tax legislation, we keep data for 5 or 10 years as appropriate;
• for the handling of referrals, we keep the data for the statutory limitation period, i.e. 3 years;
• logs are kept according to the risk analysis for at least 2 years;
• details on the duration of the processing of personal data for the purpose of providing trust or certification services can be found in the related Information Notice related to these services by clicking here;
• where data processing is based on your consent, we will process the data until you withdraw your consent to the processing.

After the archiving/storage timeframes for which there is a justifiable legal reason, your personal data will, as appropriate, be destroyed/deleted in accordance with Law 16/1996 on National Archives or irreversibly anonymized.

Your rights under Articles 13-22 of GDPR are:

Simplifi will inform the recipients to whom it has disclosed personal data of any erasure, rectification or restriction of the processing of personal data, unless this proves impossible or involves disproportionate effort.

At the same time, we inform you that you have the right to address the National Supervisory Authority for Personal Data Processing - ANSPDCP to defend any rights granted by the applicable legislation in the field of personal data protection, which have been violated, as well as to appeal to the competent courts of law.

To exercise your rights under Articles 13-22 of the GDPR, you must submit a written, dated and signed request to the Personal Data Protection Department of Simplifi:

E-mail: easy@simplifi.ro

142 Gheorghe Titeica Street, Titeica Office Building, 3rd Floor, District 2, Bucharest

To ensure the efficient handling of requests, the context in which the Personal Data was provided to the Controller and the subject of the request should be described in as much detail as possible.

To ensure that the person contacting us is indeed the Data Subject, we reserve the right to verify the identity of the applicant before issuing any type of response regarding the processed Personal Data, in order to maintain the confidentiality of all Personal Data and reduce the risk of unauthorized disclosure.

We will make every effort to respond to any request made under this Privacy Policy within one month from the date of receipt of the request. This period may be extended by an additional two months if necessary, taking into account the complexity and number of requests, in which case you will be informed of any such extension and the reasons for the delay.

The Controller will not charge any fee for handling requests to exercise Data Subject rights under this Section, except where the request for access to information is manifestly unfounded, repetitive, or excessive (even in such cases, the Controller reserves its right to charge the administrative costs associated with such requests).

Simplifi implements, both as a personal data controller and as a trust service provider, appropriate technical and organizational measures to ensure the integrity and confidentiality of your personal data in accordance with Articles 25 and 32 of the GDPR and eIDAS.

To protect personal data against unauthorized access, unauthorized alteration, unauthorized disclosure or unauthorized destruction Simplifi applies measures such as:

• Implementation of strict data protection procedures, in accordance with applicable legislation and international standards;
• Continuous and explicit documentation of all Personal Data processing activities;
• Periodic assessment of risks and impact on data protection;
• Periodical external audits and penetration testing;
• Data encryption during transmission to ensure data confidentiality;
• Regular review of data protection policies, standards and procedures, including security measures;
• Restricting access to personal data to authorized employees and collaborators only, who are contractually obliged to respect confidentiality and can be held liable for breach of these obligations.

Simplifi has implemented an Information Security Management System which complies with the requirements of ETSI EN 319 401, applicable to trusted service providers. Our systems and processes are periodically audited by independent audit and certification bodies, accredited to these standards, to ensure continued compliance and the highest standards of data protection.

Simplifi reserves the right to update or amend this Privacy Policy as necessary and will duly notify Data Subjects of any such changes. We recommend you periodically review this page in order to stay informed about how Personal Data is collected and processed.