Information Notice on the Processing of Personal Data

Electrogrup S.A. wishes to inform you about the processing of your personal data and the rights you have under Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and the applicable national legislation.

Our identification details are: ELECTROGRUP S.A., with its registered office at 217 Calea Turzii, Cluj-Napoca, Cluj County, registered with the Trade Register under no. J1997000437127, VAT identification number RO9256208, hereinafter referred to as the “Company” and/or “Electrogrup”. The Data Protection Officer may be contacted at protectia.datelor@electrogrup.ro.

Purpose of Processing and Categories of Data Processed

Electrogrup provides turnkey solutions — design, implementation, maintenance and dispatching — for complex energy infrastructure, telecommunications and civil construction projects carried out nationally and internationally. For these purposes, Electrogrup processes your personal data in connection with the following operations:

• ➢Consultancy in the electrical engineering sector;
• ➢Construction of energy, telecommunications and civil infrastructure;
• ➢Design, implementation, maintenance and dispatching for complex energy infrastructure, telecommunications and civil construction projects carried out nationally and internationally;
• ➢Development of systems and networks of major importance to society;
• ➢Joint maintenance of energy and communications infrastructure;
• ➢Compliance with the Company’s legal obligations;
• ➢Pursuit of the Company’s legitimate interests.

In connection with these operations, Electrogrup processes the following categories of data:

• ➢For contracting electrical consultancy services: first and last name, position, telephone number and signature of the requesting company’s representative;
• ➢For the design and construction of energy, telecommunications and civil infrastructure: first and last name, position, telephone number and signature of the requesting company’s representative, as well as any additional information necessary to obtain permits in accordance with the law;
• ➢For maintenance services in complex energy and telecommunications infrastructure projects: first and last name, position and telephone number, together with any other information specified in service agreements;
• ➢When visiting our premises: first and last name, identity document series and number, facial image (captured through video surveillance);
• ➢For sending quotations: first and last name and email address;
• ➢For organising or conducting events: first and last name, registered office address and email address;
• ➢For applications for vacancies within the Company, submitted via the website, by placing a CV in the dedicated mailbox at a construction site, or by email to recruiting@e-infra.ro: first and last name, email address, home address, postal code, telephone number and attached CV;
• ➢For our employees: all personal data necessary for human resources management;
• ➢Information obtained from other sources, such as public or private authorities, fraud prevention agencies and other data providers.

Sensitive personal data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health information and data concerning sex life or sexual orientation. Electrogrup does NOT intentionally collect sensitive personal data from you for storage.

Legal Basis for Processing

The legal grounds for collecting and processing your data for each of the purposes described above are:

• ➢A services or construction contract to which you are a party;
• ➢The Company’s legitimate business interests, for example preventing fraud, maintaining the security of our services and improving them. Whenever we rely on this legal basis, we assess our business interests to ensure that they do not override your rights. In certain circumstances, you have the right to object to this processing. The Company also has a legitimate interest in exercising its legal rights and taking legal action against unlawful activities or conduct that harms the Company;
• ➢Compliance with a mandatory legal requirement, such as accounting and tax obligations, subject to strict internal policies (including retention periods), procedures and your rights relating to restrictions on the use of your data in the context of the services we provide;
• ➢For CV submissions, Article 6(1)(b) GDPR, under which processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject before entering into a contract;
• ➢Where you have given it, your consent when completing the contact form. Processing based on consent is an additional purpose beyond correspondence with you and does not constitute a condition for providing services subsequently contracted.

We collect your personal data, for example, when you:

• ➢Purchase or use any of our services;
• ➢Contact us through various channels or request information about the provision of a service;
• ➢Visit or browse our website, in accordance with our Cookie Policy;
• ➢Have authorised other companies, such as our business partners, group companies, third-party providers or contractors, to share information about you with us;
• ➢Submit a CV by one of the methods described above;
• ➢Have personal data that is publicly available; or
• ➢Are a customer or beneficiary of an activity we perform. Where appropriate, and where a lawful basis exists, we also collect information from certain organisations, including fraud prevention agencies, business directories, verification or inspection agencies, billing service providers and contracted service providers.

We use cookies (small text files stored in your browser) and other technologies, such as web beacons (small transparent image files used to track movement on our website). For more information and how to opt out, please consult the Cookie Policy on our website: www.electrogrup.ro.

Categories of Recipients to Whom Collected Personal Data May Be Disclosed

Your personal data is intended for use by the controller and may be disclosed, where appropriate, to the following recipients:

• ✓Employees and collaborators of our Company or companies within the E-INFRA group, of which our Company is a member;
• ✓Third-party companies or other recipients, such as contractual partners or debt collection companies (“Third Parties”), providing external services to the Controller as processors, duly authorised individuals and third parties responsible for direct marketing activities in accordance with GDPR and following your consent. In the latter case, recipients may include call-centre service providers, marketing communications providers and works contractors;
• ✓Public authorities and institutions (ANRE, ANAF, ANAP, ITM, criminal investigation authorities, etc.), for example to comply with tax and employment law, combat corruption, perform accounting activities, conduct procurement procedures or implement court judgments and other decisions by competent Romanian authorities, including disclosure to the police, prosecutors or ANRE;
• ✓Companies assisting with the organisation and conduct of events;
• ✓External auditors engaged by Electrogrup.

Disclosure of data to third parties takes place in accordance with the legal provisions applicable to the categories of recipients listed above.

Data Retention Period

The Company retains your personal data for no longer than necessary to achieve the purposes described above and/or for any other period required by applicable legal obligations. As a general rule, your data is retained for 10 years in accordance with applicable tax legislation. We retain personal data to comply with legal obligations connected with the Company’s activities and the GDPR and to support our defence in possible proceedings before competent courts.

CVs submitted for employment purposes are retained for a maximum of 6 (six) months from submission, after which they are destroyed or we request your consent to extend retention. If you attend an interview, the retention period may be extended to 12 months, but only with your consent at that time.

What Safeguards Are in Place for Your Personal Data?

We process your personal data until you withdraw consent to processing and no other lawful ground allows us to continue processing it. We also undertake to keep your personal data secure. Electrogrup has committed to implementing appropriate technical and organisational measures to protect the confidentiality and security of personal data against unauthorised access, theft, accidental loss, alteration or destruction. Electrogrup personnel may access data only on a need-to-know basis and are subject to strict confidentiality obligations.

What Are Your Rights?

As a data subject, you have several rights concerning the processing of your personal data:

Right to be informed — the right to receive accurate information about processing and transparency as to how your personal data is used.

Right to withdraw consent — the right to withdraw consent at any time for processing based on your consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right of access — the right to obtain confirmation from us as to whether we process personal data concerning you and, if so, to access that data and information about how it is processed.

Right to data portability — the right to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted directly to another controller where technically feasible.

Right to object — the right to object to the processing of personal data where processing is necessary for a task carried out in the public interest or based on the controller’s legitimate interests. You may object at any time to processing for direct marketing purposes or processing based on express consent.

Right to rectification — the right to have inaccurate personal data corrected without undue delay. Rectification will be communicated to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort.

Right to erasure (“right to be forgotten”) — the right to request erasure of personal data without undue delay where one of the following grounds applies: the data is no longer necessary for the purposes for which it was collected or processed; you withdraw consent and no other legal basis exists; you object and no overriding legitimate grounds exist; the data was unlawfully processed; erasure is necessary to comply with a legal obligation; or the data was collected in connection with the provision of information society services.

Right to restriction of processing — the right to request restriction where you contest the accuracy of the data (for the period needed to verify it); processing is unlawful and you oppose erasure; the Company no longer needs the data but you need it to establish, exercise or defend legal claims; or you have objected to processing while it is verified whether the controller’s legitimate grounds override yours.

Right to lodge a complaint — complaints concerning the processing of personal data may be submitted to the Romanian National Supervisory Authority for Personal Data Processing.

Address: 28–30 Gheorghe Magheru Boulevard, Sector 1, Bucharest, Romania, postal code 010336
Telephone: +40 318 059 211 / +40 318 059 212
Email: anspdcp@dataprotection.ro
Website: www.dataprotection.ro

You have the right to request access to all personal data relating to you that Electrogrup processes. The Company reserves the right to charge an administrative fee for multiple subsequent access requests that are clearly intended to cause harm or damage to the Company. To exercise these rights, or if you have any further questions about this notice or the Company’s use of your personal data, please contact our Data Protection Officer using one of the methods below.

You can contact us:

• ➢By email: protectia.datelor@electrogrup.ro; or
• ➢In person or by submitting a request by post to the Company’s registered office at the address given above.