1. GENERAL INFORMATION

The content of the website www.megadrive.ro is the exclusive property of Conex Distribution S.A. with registered office in IASI, 32 CALEA CHISINAULUI Street, IASI County, telephone 0232273443, e-mail accesorii@conexdist.ro, registered at the Trade Register Office Iasi with number J22/2394/2003, with CUI 16019310.

In the European Union, the personal data of individuals are protected under the provisions of Regulation No 679 of 27.04.2016 (on the protection of individuals with regard to the processing of personal data and on the free movement of such data) which applies in our country from 25.05.2018 (hereinafter "GDPR" or "European Regulation").

Conex Distribution S.A. constantly monitors and ensures that the processing of personal data strictly complies with the principles and rules of the European Regulation.

This Privacy Policy is effective as of May 25, 2018 and is intended to inform you that Conex Distribution S.A. applies and complies with the provisions of the Regulation, with respect to:
- the processing of personal data carried out by the controller in order to carry out specific activities in accordance with the subject matter of the activity;
- the processing of personal data about you as a visitor to the Site or as a user of the functions on the Site;
- the processing of personal data of our employees and collaborators carried out in order to fulfil legal obligations with regard to labour, financial and tax legislation, etc.

Conex Distribution S.A. may update this Policy from time to time, in line with changes and additions to applicable legislation, as the services we provide change, and in line with technological developments, in which case it will inform data subjects via the Site of any changes before they become applicable.

1. DEFINITIONS

• Personal data: any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;
  - Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  - Controller: the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or national law, the controller or the specific criteria for its designation may be laid down in Union or national law;
  - Processor: the natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller;
  - Visitor: any person who accesses or uses the Site;
  - Data subject: any natural person whose personal data are processed by Conex Distribution S.A. as controller;
  - Restriction of processing: the marking of stored personal data with the aim of limiting their further processing;
  - Data filing system: any structured set of personal data accessible according to specific criteria, whether centralised, decentralised or broken down on a functional or geographical basis;
  - Recipient: the natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not it is a third party;
  - Third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
  - Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject signifies his or her unambiguous agreement, in a statement or by an action, to the processing of personal data relating to him or her;
  - Breach of security of personal data: a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed;
  - Genetic data: personal data relating to inherited or acquired genetic characteristics of a natural person which provide unique information on the physiology or health of that person and which result in particular from an analysis of a sample of biological material taken from that person;
  - Biometric data: personal data resulting from specific processing techniques relating to the physical, physiological or behavioural characteristics of a natural person which allow or confirm the unique identification of that person;
  - Health data: personal data relating to the physical or mental health of an individual, including the provision of healthcare services, which reveal information about the health of the individual;
  - Supervisory Authority, (hereinafter referred to as ANSPDCP - National Supervisory Authority for Personal Data Processing): national public, autonomous and independent authority, established pursuant to Article 51 of the Regulation, with the objective of protecting the fundamental rights and freedoms of natural persons on the territory of Romania with regard to the processing of personal data and the free movement of such data. It is based in Bucharest, 38-40 Magheru Boulevard.

III. INFORMATION ON THE PROCESSING OF PERSONAL DATA

1. YOUR DATA

The categories of personal data processed depend on the context of the interactions and relationships that you, as the data subject, establish with CONEX DISTRIBUTION S.A., respectively with the Site. Thus, Conex Distribution S.A will process the following categories of personal data:
1. In the case of persons visiting the Site or using functions on the Site: name, surname, e-mail, telephone;
2. In the case of carrying out specific activities, in accordance with the object of activity, and in order to provide our services in conditions of maximum quality and to meet the related legal requirements, Conex Distribution S.A. collects the following categories of personal data of individuals:
- identification data (name, surname);
- contact details (home address, telephone number, e-mail address);
- categories of data with special regime (identity card series and number, Personal Numeric Code, insured number and code recorded on the national health insurance document);
- The processing of personal data of minors under the age of 16 will only be carried out with the consent of the parent or legal representative of the minor.
- Data about how you use the site (e.g. your behaviour/preferences/usage within the domain.
- As well as any other categories of data that you provide directly in the context of creating a user account, in the context of placing an order through the site or in any other way resulting from the use of the site.
If you use your Facebook or Google account to create a user account on the site, you will process the following public profile data displayed by those applications: username, email address.

If you choose to create a user account just before completing the order of a product available on the site, you will be asked for your e-mail address under which an account will be automatically created.

If you do not complete your order, your e-mail address and other data provided will not be stored by www.megadrive.ro and the account created will be automatically deleted.

If you are a visitor to the website, www.megadrive.ro, Conex Distribution S.A will process the personal data you provide:
- Directly in the context of your use of the site, such as the data you provide in the contact/questions/complaints section, to the extent that you contact us in this way
- Indirectly, data such as: IP address, browser used, browsing duration, search history, operating system used, language and pages viewed, full URLs, sequence of clicks to, through and from our site, information or products viewed/searched, duration of visits to specific pages, information on page interaction (e.g. scrolling, clicks, mouse-overs), data on user behaviour.

Conex Distribution S.A collects and processes personal data, in accordance with the provisions of the EU Regulation 679/2016, when you register with an account on our website or when you place an order without an account on the website or by phone. This data is secure and is only transmitted to the partner car shops we collaborate with. This data transfer is secure.

We also collect and process personal data for advertising purposes, for contests or marketing campaigns carried out exclusively by www.megadrive.ro.

We do not transfer your data to other third parties without your explicit consent and we do not make this data public.

2. THE PURPOSE FOR WHICH WE USE YOUR DATA

Personal data relating to categories of data subjects will be processed by Conex Distribution S.A for the following purposes:

1. If you are a customer of the website www.megadrive.ro we will process your personal data as follows:
   - to carry out the contractual relationship between you and www.megadrive.ro, namely for: creating and managing your account on the platform, taking, validating, sending and invoicing the order placed on the site, informing you about the status of the order, organizing the return of ordered products, solving cancellations or problems of any kind related to an order, to the goods or services purchased; etc.

Basis: The processing of your data for this purpose is based on the contract between you and www.megadrive.ro defined in the Terms and Conditions. The provision of your personal data is necessary for the performance of this contract. Refusal to provide data may result in the impossibility of the contractual relationship between you and www.megadrive.ro.
- for the fulfilment of legal obligations in the context of the services provided through the site, including obligations in tax matters, as well as archiving.
Basis: The processing of your data for this purpose is necessary on the basis of legal obligations. Providing your data for this purpose is necessary. Refusal to provide your data may result in the impossibility to comply with legal obligations and therefore in the impossibility to offer you services through the website.
- for marketing activities, i.e. for the transmission, via remote communication means (e-mail, sms) of commercial communications on products and services offered by www.megadrive.ro, through the site.
Basis: The processing of your data for this purpose is based on your consent, if you choose to provide it.
You can express your consent to the processing of your data for this purpose by ticking the appropriate box at the time of account creation, or after account creation, in the My Account Information section.
To unsubscribe from receiving such commercial communications, you can use the option at the end of each e-mail / sms containing commercial communications. In addition, you can unsubscribe by accessing the "My Account Information" section.
Providing your data for this purpose is voluntary. Refusal to provide your consent to the processing of your data for this purpose will have no negative consequences for you.
- in order to perform various analyses, reports on the functioning of the site, consumer preference profiles, mainly in order to improve the experience offered on the site.
Basis: The processing of your data for this purpose is based on www.megadrive.ro's legitimate interest in continuously improving the customer experience on the site. Providing your data for this purpose is voluntary. Refusal to provide data for this purpose will not have negative consequences for you.

1. If you are a visitor to the site, www.megadrive.ro processes your personal data as follows:
   - for marketing activities, i.e. for the transmission, via remote communication means (e-mail, sms), of commercial communications regarding the products and services offered by www.megadrive.ro through the site.
   Basis: The processing of your data for this purpose is based on your consent, if you choose to provide it.
   You can express your consent to the processing of data for this purpose by filling in and ticking the appropriate box in the newsletter subscription form available on the website.
   To unsubscribe from receiving such commercial communications, you can use the option at the end of each e-mail / sms containing commercial communications.
   Providing your data for this purpose is voluntary. Refusal to provide your consent to the processing of your data for this purpose will have no negative consequences for you.
   - to resolve complaints, grievances and to monitor traffic and improve your experience on the site.
   Basis: The processing of your data for this purpose is based on the legitimate interest of www.megadrive.ro to ensure the proper functioning of the site, as well as to continuously improve the experience of visitors to the site, including by resolving various comments, questions or complaints.
   Providing your data for this purpose is voluntary. Refusal to provide data for this purpose will have no negative consequences for you.

THE LEGAL AND JUDICIAL GROUNDS FOR PROCESSING PERSONAL DATA

1. Legal grounds:
   -the proceedings and subsequently, the conclusion and execution of a (remote) contract;
   -explicit consent that is required from the data subject for certain processing purposes;
   -the legitimate interest pursued by the controller or a third party (except where the interests or fundamental rights of the data subject prevail);
   -protecting the vital interests of the data subject or another natural person;
   -fulfilment of a legal obligation of the controller or processor.
2. Legal grounds:
   - Accounting Act No 82/1991 republished, as amended);
   - Tax Code and Tax Procedure Code;
   - OMFP no. 2634/2015 on financial-accounting documents;
   - Government Emergency Ordinance No 34/2014 on consumer rights in contracts with professionals
   - Law No 157/2015;
3. Duration for which we process your data

Conex Distribution S.A, will process your personal data strictly in accordance with the time required to achieve the processing purposes for which it was collected in compliance with our internal procedures on data retention and security and in accordance with our internal policies, ensuring compliance with applicable legal obligations, including, but not limited to, the provisions on archiving obligations.

If you are a customer, we will process your data for the entire duration of the contractual relationship and subsequently in accordance with the legal obligations incumbent on us (e.g. in the case of financial-accounting supporting documents for which the retention period provided by law is 10 years from the end of the financial year during which they were drawn up).

You may request that we delete certain information or close your account at any time and we will comply with such requests, subject to the retention of certain information even after account closure, where required by applicable law or our legitimate interests.

In the event that you are a customer and you exercise your option to delete your user account by clicking the "delete account" button in the "my account information" section, www.megadrive.ro will interpret this action as your option to unsubscribe from receiving commercial communications that keep you informed about products and services offered through the site.

In this regard, if you choose to delete your user account, we will no longer send you emails and/or sms of this kind.

However, we would like to inform you that deleting your account will not automatically delete your personal data.

If you request the deletion of the account, but there is at least one active order on that account, the account deletion request can only be registered after the delivery of the products and the completion of the last active order.

If you withdraw your consent to the processing of data for marketing purposes, the processing of your personal data for this purpose will cease, without affecting the processing carried out on the basis of the consent expressed by you prior to the withdrawal.

4. Disclosure of personal data

We do not rent/sell your personal data to third parties.

In addition to the Operator, in certain situations, the data may be accessible to third parties such as service providers, transport operators, hosting providers, IT companies, appointed, if necessary, as authorised persons by the Operator.

They are contractually obliged to maintain the confidentiality of the data and to use it only for the purpose for which it was provided.
We may also disclose your personal data to central/local public authorities in the following examples:
- for site administration
- in situations where this communication would be necessary for the awarding of prizes or other facilities to data subjects obtained as a result of their participation in various promotional campaigns organized by the site;
- for maintaining, customising and improving the site and the services provided through it
- for performing data analysis, testing and research, monitoring usage and activity trends, developing security features and user authentication
- for the transmission of commercial marketing communications, under the conditions and within the limits provided by law
- when disclosure of personal data is required by law, etc.

5. Transfer of personal data

Personal data provided to www.megadrive.ro may be transferred outside Romania, but only to countries in the European Union.

PERSONAL DATA PROTECTION MEASURES

Conex Distribution S.A. attaches particular importance to the confidentiality and security of personal data collected and processed for the purposes listed above
We inform you that Conex Distribution S.A. has taken technical and organizational measures to comply with the provisions of EU Regulation No 679/2016, so that the processing procedures ensure full compliance with the processing principles set out in Article 5 of the European Regulation:
- data is collected and processed only by lawful means, fairly and transparently to you;
- processing is carried out only in accordance with the purposes set out above, respecting the requirements of the legal grounds for each type of processing;
- only appropriate and relevant data shall be collected and processed in accordance with the principle of minimisation;
- working procedures have been put in place for all personal data processing operations and technical solutions have been implemented to ensure data security, confidentiality and availability;
- training of staff on the rules and procedures for processing and securing personal data was carried out.

THE USE OF AUTOMATED DECISION-MAKING PROCESSES AND PROFILING

Conex Distribution S.A. does not use automated processes for the profiling through the processing of personal data.

Provision of personal data
The provision of personal data by you may be a contractual obligation or an obligation necessary for the conclusion/performance of a contract, it may be necessary in order to benefit from our services, to browse the www.megadrive.ro Site and to take advantage of the facilities offered on this space.

Refusal to provide personal data may make it impossible for you to benefit from the services made available to you through the Site or to respond to your requests.

In order to respect your rights and freedoms with regard to the processing of personal data, Conex Distribution S.A. asks for your consent but you should take into account that for the processing of certain personal data, this consent may not always be necessary according to the provisions of the Regulation. In such cases, Conex Distribution S.A. may use other grounds for data processing, such as the fulfilment of legal obligations, performance of contract or legitimate interest.

Your rights are:
With regard to the processing of personal data indicated in this Privacy Policy, each data subject shall enjoy the following rights, as provided for by applicable law:
- right of access: they have the right of access to the personal data processed and to information on the means of processing;
- the right to rectification: involves the correction by the controller of incorrect or incomplete personal data;
- the right to object: the data subject has the right to object to processing;
- the right of erasure: gives the data subject the right to request the erasure of stored data when they are no longer necessary for the purposes for which they were collected, when the data subject withdraws his or her consent and there is no other legal basis for the processing, when the data subject considers that the data have been unlawfully processed or for compliance with a legal obligation;
- the right to restrict processing: the data subject may obtain restriction of the processing of his or her personal data in certain cases, for example when he or she considers that the processing is unlawful or disputes the accuracy of the personal data, for a period allowing the organisation to verify the accuracy of the personal data;
- the right to data portability: the data subject has the right to receive the personal data he or she has provided to the entity, in a structured, commonly used and readable format, or to request the transmission of such data to another data controller;
- the right to lodge a complaint with the courts: when the data subject considers that his/her rights have been violated as a result of the processing of his/her personal data without complying with the provisions of the European Regulation.

If you consider that the data processing carried out by Conex Distribution S.A. in the context of its relationship with you infringes your rights under the European Regulation, you can contact the controller (with a written, dated and signed request) and the Personal Data Protection Officer at accesorii@conexdist.ro.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (B-dul General Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, telephone 0318.059.211, e-mail address anspdcp@dataprotection.ro).

In all cases, Conex Distribution S.A will respect your rights and the provisions of Regulation (EU) No 679/2016.

7. Changes in the privacy policy

We reserve the right to change this privacy policy. In case of major changes in the future you will be notified by email (if possible) or by posting a specific message on the site.