This information is addressed to you as a user of the website unoriginal.work (hereinafter referred to as the “Platform”) and explains how we process the personal data provided by you when interacting with the Platform. We process your personal data in accordance with the relevant legal provisions, in particular by aligning it with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), but also in accordance with the rest of the applicable legislation, as detailed below.

MULLEN LOWE S.A., with its registered office in Bucharest, Str. Grigore Alexandrescu no. 89-97, Building B, Floor 3, Module A, Sector 1, Romania, registered with the Trade Register under no. J40/25070/1994, Unique Registration Code RO 6645758 (hereinafter referred to as the “Agency”) is the personal data controller in accordance with the legislation on the protection of personal data.

Cookies: When you browse the Website we also collect a number of cookies. Cookies are text files that contain small amounts of information consisting of letters and numbers, which will be stored on your device. Cookies contain information that connects you as a user of our website and a webserver (the website). If you access the Platform, the webserver will read the previously stored information and will recognize you on your next visit. Only essential cookies will be collected.

Retention period: For the entire duration of the Platform's existence plus the legal storage period thereafter, to fulfill legal obligations, but no more than 3 years.

Source: We may obtain the above data:

• directly from you;
• through the Platform (in relation to Cookies).

Storage period: We store your data:

• for the duration of the Platform's existence for another 3 years after its closure to resolve any requests from you;
• for the duration of the resolution of your request and subsequently for a period of 3 years;
• in the event of litigation/investigations/procedures, the data and documents will be kept for the duration of these, and for a period of 3 years from the final resolution.

We process your data to optimally organize and streamline our activity. In this regard, we may use the data, among others:

• to organize internal databases, as support for the activity carried out by the Agency;
• to support our position in various investigations, administrative and judicial procedures, litigations, etc. in which the Agency is involved.

Data: any of the categories of data in the Agency's systems mentioned above, appropriate to the type of procedure/investigation/litigation/official audit.

Source: We may obtain the above data from any of the sources mentioned for the purposes above, as well as from the authorities, institutions or judicial courts involved.

Retention period: the period imposed by specific legal provisions; where there are no rules, for the duration of the procedure/audit/investigation/litigation, and for a period of 3 years from its conclusion, respectively, taking into account the limitation period applicable to the specific situation; for the period imposed by the competent authority/institution/court, according to legal provisions; for the period requested by you to defend your rights and interests or those of a third party who has a legitimate interest in this regard.

In certain situations, the refusal to provide us with data may incur your contractual or civil liability in relation to the Agency, other people whose rights/interests would be affected. When we receive the data directly from you, we will consider that it is real, correct, complete and that it refers to you. We will make reasonable efforts to ensure that the data is real, correct and that it belongs to you, and if we suspect that you are sending us incorrect, incomplete data or that you are using another person's data without authorization, we will take measures to clarify and remedy the situation.

These measures could consist of: updating, completing or deleting data, limiting access to illegally used data – including deleting accounts associated with data that does not belong to you. We will also consider that the data collected directly from you are current as long as you have not requested their modification through the mentioned communication channels or have not personally updated the data.

Please notify any change in your data to the following address: dpo.bucharest@mullenlowe.ro with reference in the email subject: personal data update on the Platform or by courier to the Agency's headquarters.

We may transfer your data to:

• the final beneficiary: Raiffeisen Bank Romania
• our IT service providers, software;
• providers of billing, payment management and tax reporting services;
• debt collection agencies;
• providers of notarial services, translations, forced execution;
• public institutions and authorities or courts, such as:
• the National Tax Administration Authority;
• Courts and other judicial bodies (such as police bodies, prosecutors' offices attached to courts, the National Anticorruption Directorate, etc.);
• competent authorities (for example, the Consumer Protection Office, Fiscal Authorities, the National Authority for the Supervision of Personal Data Processing - ANSPDCP), or information requested by them, within the limits of their legal powers.
• In the event of a merger, acquisition or other type of reorganization. In the event that the Agency is subject to a reorganization or sale process, we will provide your information to that organization.
• Your data will not be transferred outside the European Economic Area and Switzerland.

If stored, your data will be stored on the Agency's servers, in Romania or on the territory of the European Union, in the case of Cloud storage. The Agency has implemented security and data storage protection measures at the level of the legal regulations in force.

In accordance with the GDPR, you have the following rights in relation to your personal data:

• Access: you have the right to obtain confirmation from us regarding the processing of your personal data, as well as details of the processing activities, namely a copy of your Data;
• Rectification: You can ask us to amend or complete incorrect or incomplete Data;
• Erasure: (“right to be forgotten”): You can ask us to delete the Data in certain circumstances listed in art. 17 of the GDPR;
• Withdrawal of consent: You can withdraw your consent to the processing that you have given us and you can prevent the processing in the future, if there is no other basis on which the Agency can process the Data;
• Restriction: You can request that certain Data be marked as restricted for the duration of the resolution of complaints, as well as the restriction of processing in other specific circumstances. If, following your request, we restrict the processing of your Personal Data, the Agency will store the Data and otherwise process it only with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for important reasons of public interest. We will also inform you before lifting the restriction on processing;
• Opposition: You have the right to object to the processing of your Personal Data where the legal basis for the processing is the legitimate commercial interests of the Agency. We will cease processing the Data in question unless the following situations apply: (i) there are compelling legitimate grounds for the processing which override your interests, rights and freedoms; or (ii) the Agency needs to continue processing your Personal Data for the establishment, exercise or defense of legal claims.
• Portability: You can ask us to transmit, to you or to a third party, the Data we hold about you, in electronic form (in a structured, commonly used, and machine-readable format), whenever we process your data on the basis of a contract/consent and by automated means.
• Where you can submit requests to exercise your rights:In the Platform in the contact section or to the email address: dpo.bucharest@mullenlowe.ro or by post/courier to the Agency's headquarters located in Bucharest, Str. Grigore Alexandrescu no. 89-97, Corp B, Floor 3, Module A, Sector 1, Romania, for the attention of Ms. Belodan Cristiana.
• Filing a complaint: You can file a complaint regarding the way we process Data with the data protection authority: The National Authority for the Supervision of Personal Data Processing, headquartered at: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania. www.dataprotection.ro
• Taking legal action: If you are not satisfied with the way the complaint is resolved by the ANSPDCP, you can contact the competent courts, under the terms of the law.

Thank you,