Information note on the processing of Personal Data on Orange Fab Romania events

Information about your Personal Data Controller

Orange Romania - Orange Romania SA, based in Europe House, Blvd. Lascăr Catargiu No. 47-53, Sector 1, postal code 010665, Bucharest, Romania, Registration Number in the Trade Registry J40 / 10178/1996, with Unique Entry Code 9010105, is the personal data controller. Orange Romania, as an organizer of the event organised by the Orange Fab Romania Program, is a personal data controller and processes personal data in a confidential, secure and transparent manner.

Orange Romania provides you with a dedicated address for any inquiries or questions about how personal data is processed.

For any questions regarding personal data or the exercise of legal rights, participants may use the dedicated address dpo@orange.ro. Alternatively, any personal data requests may also be addressed by mail at the following address Blvd. Lascăr Catargiu No. 47-53, sector 1, postal code 010665, Bucharest, Romania, to the attention of Orange Romania Data Protection Officer. Please state in the subject of the message the name of the program, namely "Orange Fab Romania".

All messages will be answered within the deadline set in accordance with the legal provisions (also taking into account the technical possibilities for implementing the requests received).

Categories of personal data processed within the Program

At the event organized by the Orange Fab Romania Programs, the Company may collect from the participants the following categories of personal data:

• your contact details as a Participant to the event, such as name, surname, e-mail address, telephone, company name, website address;
• the image and / or the voice of the participants, in the context of the possibility of the event being recorded photo-video;
• details of the relationship with Orange (to check the eligibility of the participant for the prizes offered), in the context of awarding prizes at the event;
• the participants' opinions on the event through physical or electronic feedback forms;

Purposes of processing personal data

The personal data of the participants at the event will be processed by Orange Romania as organizer of the event through the Orange Fab Romania Program, based on our legitimate interest, in order to: organize and unfold the event; increasing public awareness on supporting entrepreneurs in developing innovative products and distributing them locally and internationally; nominating winners and awarding prizes to winners.

At the same time, Orange Romania has a legitimate interest in promoting the organized event, including by publishing the images / videos of the participants, both online and through public social platforms, through the Orange Romania website and / or the Orange Fab Romania website and any other brochure-type advertising material. Orange Romania can perform internal analysis in order to appreciate the success of the organised event.

The length of processing of personal data

Orange Romania keeps your personal data as a participant in the event strictly during the fulfillment of the stated purposes, namely:

• 2 years from the end of the event, in the case of collecting and processing the contact details of the participants;
• 2 years after the end of the event, regarding the distribution of brochure promotional materials;
• Throughout the lifetime of the Orange Fab Program where the event you attended was organized for the publication of participants' images / videos on the public social platforms on the Orange Romania website and/or the website Orange Fab Romania (www.orangefab.ro) and Orange Fab International (www.orangefab.com)
• 3 years from the distribution of the prizes to the winning participants in the event;

In the context of the event's video recording, any participant whose image / record was published online on public social media platforms on the Orange Romania website and / or the Orange Fab Romania / Orange Fab International website may address the organizer via the means of contact made available, so that they can request that they be deleted. Taking into account the technical possibilities of implementing the received request, the image / record will be removed from the platform on which it was published.

As a participant in the Orange Fab Romania event, you have specific rights with respect to your personal data

Unless the law otherwise provides, you have the following rights:

• if the processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing on the basis of consent before withdrawing it.
• the right of access, also regarded as the right to obtain confirmation from us that we process your personal data, as well as access to them and providing information on how the personal data is being processed;
• the right to rectification which relates to the correction without undue delay of inaccurate personal data and / or the completion of incomplete data;
• the right to erasure / the right to be forgotten, meaning the right to obtain the erasure without undue delay of the personal data collected, where such data are no longer necessary for the purposes for which they were collected and there is no other legal basis for the processing, the data was collected unlawfully or the data must be erased for compliance with a legal obligation;
• the right to restriction of processing personal data that applies if (i) you contest the accuracy of your personal data, (ii) the processing is unlawful and you oppose the erasure of your personal data by requesting the restriction of processing instead, (iii) we no longer need your personal data, but you request them to find the for the purpose of establishment exercise or defence of legal claims; (iv) oppose the processing for the length of time that it is checked that our legitimate interests in the processing of personal data prevail over of your rights;
• the right to object the processing, unless we demonstrate that we have legitimate reasons to process your data, overriding your interests, rights and freedoms, or for establishing, exercising or defending a right in court;
• the right to data portability, that is to say, the right to receive the personal data you have provided to us for the purposes indicated herein in a structured, commonly used and readable, and the right to send this data to another controller;
• the right to lodgea complaint with the The National Supervisory Authority For Personal Data Processing(NSAPDP);
• the right to an effective judicial remedy against the controller if you believe that your rights have been violated as a result of the processing of your personal data by not complying with the legal provisions in the matter;
• the right to an effective judicial remedy against a legally binding decision of a supervisory authority that concerns you;
• the right not to be the subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or significantly affects you in a similar manner, unless such processing is required or permitted by law.

Personal data may be disclosed by Orange Romania to the parties involved in the Program or other authorised parties

Orange Romania may communicate the personal data of participants to third parties only inthe following situations:

• Affiliates: personal data may be communicated to affiliated companies for legitimate business purposes,
• Service Providers: Orange Romania may contract service providers, agents or entrepreneurs to assist the Company in running the Program. Orange Romania asks these third parties to comply with all applicable data protection laws and security requirements regarding the participants' personal data by entering into a written agreement,
• Consultants or external partners of Orange Romania that provide assistance to the company,
• Public Authorities: Orange Romania may communicate the personal data of the participants if required by law or if it believes in good faith that such disclosure is reasonably necessary for the proper conduct of tax obligations, legal processes, investigations or to respond to any complaints.

Protection of personal data belonging to children or other persons

Since only the individuals who are at least 18 years old at the time of the event can participate in the Program, no data will be processed and stored for people under the age of 18.

Additional information on personal data security

Orange Romania has applied appropriate security measures to guarantee the security of the personal data of the participants and has implemented itand specific duration so that personal data is kept as long as necessary to achieve the declared purpose.
In order to guarantee the security of personal data, Orange Romania has implemented a number of security measures which are in line with generally accepted industry standards. These means of protection do not cover those personal data that participants choose to communicate in online or offline public spaces.
Upon expiration of the personal data storage period, Orange Romania will erase / destroy these data from the processing and storage media in a secure manner.

Changing the policy of processing personal data

The Company has the right to modify this Information Note regarding the processing of personal data at any time during the Program. Any such change will be published on the Orange Romania Company Website and the Orange Fab Romania Program, and will be made available to the participants by the same means by which they were informed of the event organized by the Program.

Orange Romania S.A.