Privacy Policy regarding the processing of personal data within BIOGENVET SRL

According to the changes and modifications brought by Regulation (EU) on the protection of personal data 2016/679 (“GDPR”), we have decided to inform you through this Personal Data Processing Policy (“Data Processing Policy” or “Policy”) regarding:

Who are we? What are personal data? What data do we process about you? How do we collect and process your data? How long do we keep your data? With whom do we share your data? When do we transfer your data outside the European Union or EEA? What security measures do we provide for the protection of your data? What are your rights and options regarding the data we process? We will apply the same approach every time you visit us or access our services online, on the website: www.biogenvet.ro of BIOGENVET SRL.

This Data Processing Policy may be amended or updated at any time by BIOGENVET SRL, when we consider that certain changes occur in the activities through which we process your data. We will publish any such changes on our website, www.biogenvet.ro, and inform you accordingly by email.

WHO ARE WE?

BIOGENVET SRL, a Romanian legal entity, registered in the Trade Register under no. J04/528/2010, Unique Registration Code 27068784 (“BIOGENVET SRL” or “Operator” or “We”), is the controller of your data and the entity that provides you with services/products through the website www.biogenvet.ro.

You can contact us at any time: Address: Hemeiuș, Liliacului Street, no. 4, Bacau County, Romania Email: contact@biogenvet.ro

BIOGENVET SRL has appointed a Data Protection Officer. For any questions or concerns regarding this Policy, the way BIOGENVET SRL processes your data, or your rights, you can contact us at the dedicated email address contact@biogenvet.ro or at the postal address Hemeiu, Liliacului Street, no. 4, Bacau County, Romania.

WHAT DATA DO WE PROCESS ABOUT YOU? What are personal data?

Personal data means any data or information that helps us directly identify you (such as your name, first name) or indirectly (such as based on the profile we create to send you personalized offers). Certain information is less obvious (such as your shopping preferences and habits, your computer’s IP address), but when associated with you as an individual, it helps us identify you and thus falls under the notion of “personal data.”

BIOGENVET SRL’s policy is to collect and process only the data that are necessary to provide you with the best experience when you browse/shop on the Online Course Store website. In general, we process the following types of data about you:

Name and surname; Email address; Phone number; Gender; Age; General geolocation of the device from which you browse/authenticate in your customer account; Information about the products and services purchased; Usage level and activities on the Online Course Store platform; Interests and preferences related to the products on the Presentation Site.

More specifically, in the table below, we have presented the personal data (“Data” or “Personal Data”) that we collect directly from you, resulting from your interaction with us, and that we or our partners track for the purpose of providing the ordered products or offering various personalized offers when you browse/shop on the Online Course Store website or when you use various devices (computer, tablet, or mobile phone).

HOW DO WE PROCESS YOUR DATA?

BIOGENVET SRL collects and processes your data to fulfill the services/orders you make and deliver the products you desire, improve your experiences on the Presentation Site, and provide support and assistance when you use the Presentation Site.

We have detailed in the table below how we process your data, the purposes, and the legal basis of the activities through which we process your data.

For what purpose do we collect and process your data?	What data do we collect and how do we process it?	What is the legal basis for processing the data?
Personal data that you provide to us directly
Website maintenance and security.	We use the following online identifiers for website maintenance and security: ·         IP address ·         Internet browser and operating system version of the device you are using to connect ·         HTTP/HTTPS protocol data ·         Location of the device (if geolocation is enabled) from which you are connecting to the site. More specifically, we process your data for the following purposes: ·         Ensuring the proper functioning of the website, including: ·         Correct display of website content ·         Website improvement ·         Configuration of the device you are using to connect ·         Ensuring website security and protecting you against fraud or any IT security breaches related to the Presentation Site ·         Identifying and fixing any malfunctions that hinder the use of our website.	Legitimate interest: Implementation, configuration, and maintenance of website security measures.
Audit and reporting	We process your data for the purpose of conducting annual financial audits, as well as for filing tax and accounting declarations with the tax authorities.	Legal compliance requirements. We process your data to comply with the legal obligations imposed by the applicable tax and accounting laws and regulations.
Defense of rights in justice.	When defending our rights in court to recover outstanding amounts or to protect our interests against unjustified claims/complaints, we will process the necessary data to formulate defenses, written submissions, requests, and specific documents.	Legitimate interest: Exercising any defenses/rights in front of courts, public authorities, or regulatory institutions.
Procedures and investigations by authorities and/or judicial bodies.	In exceptional cases and in accordance with the law, we may provide the competent authorities and institutions, within formal procedures/investigations or other legal proceedings, the following personal data: name, surname, address, email, and telephone number. BIOGENVET SRL will document any such actions in accordance with the prescribed legal procedures.	Legal compliance requirements. We process your data to comply with specific legal obligations imposed by applicable laws regarding the protection against fraud, money laundering, and terrorism.

PROFILE IN DIRECT MARKETING PURPOSE

When we send you personalized offers through direct marketing channels (SMS, email, push notifications), we may use certain “profiling techniques,” which involve the automated processing of your data, primarily analyzing and interpreting your personal data to evaluate or predict aspects related to your preferences and interests in the Presentation Website. In the profiling process, BIOGENVET SRL does not process sensitive data regarding sexual orientation, religious beliefs, or political affiliations. Your personal behavior and preferences for consumption are derived from your browsing history and/or orders on the Presentation Website, your financial situation resulting from your purchases, and other personal interests you have provided us with, which may be shared with other customers. Specifically, BIOGENVET SRL creates your customer profile based on:

• Your browsing behavior on the website, viewed/ordered/contracted products.
• Demographic data: age, gender, city.
• Purchase history and monetary value.

We collect your data when profiling from sources such as our website www.biogenvet.ro and advertising service providers we collaborate with. We use profiling to communicate and present personalized promotional offers for products/services in a relevant and useful way for you. We will provide you with the opportunity to modify your preferences for direct marketing at any time after registering as a BIOGENVET SRL customer by requesting this option via email. You can object to profiling for direct marketing purposes through any of the communication channels you previously consented to by withdrawing your consent when unsubscribing from a specific communication channel you previously opted for. For more details, see the “Your Rights and Options” section below.

HOW LONG DO WE RETAIN YOUR DATA?

BIOGENVET SRL processes your data for the period necessary to fulfill the purposes for which they were collected, in accordance with our personal data retention policies. In certain cases, specific legal provisions may require or allow us to retain data for a longer period.

The data retention period depends primarily on the following factors:

• The period for which we need your data to provide the requested products and fulfill our obligations to you, as well as for the purposes mentioned above in this Privacy Policy.
• If you have given your consent for data processing for a longer period, we will retain the data throughout this period unless you withdraw your consent in the meantime.
• Legal or contractual obligations require us to retain your data for a specific period (e.g., statutory limitation periods for the defense of our rights in court).

We will retain your data only as long as you have an active customer account with BIOGENVET SRL and interact with our Presentation Website. If you explicitly request the total deletion, the data associated with your customer account will be deleted or anonymized so that you can no longer be identified in our data records, except when we are legally obligated or have a legitimate interest to retain your data for a longer period.

This way, we ensure your full control over your personal data. We will collect and process your data again if you provide them to us again through the contact forms on our website, https://www.biogenvet.ro.

For the purposes for which you have provided your consent to data processing, as highlighted in the table above, we will process your data regarding the respective purpose until you withdraw your consent for processing in that specific purpose, unless we are legally obliged to retain this data for a longer period for reporting to public authorities or to defend our rights in court.

Please note that we rely on your consent when processing your data to send you:

• Personalized offers based on online behavioral advertising.
• Personalized offers based on profiling we perform for direct marketing purposes through SMS, email, and push notification channels.
• Offers based on personalized audiences (customer lists).

*Consent – means your free, specific, and informed agreement through which you unequivocally accept that your data will be processed by us for the purpose for which you give your consent. On the Presentation Website, you can express your consent by actively selecting the relevant checkbox associated with the specified processing method in this privacy policy.

WITH WHOM DO WE SHARE YOUR DATA?

Your personal data may be disclosed to and processed by our trusted partners to provide you with products.

To deliver the products ordered on the Presentation Website, we will share your data with our trusted partners. We carefully select partners and providers who perform specific activities on our behalf. We only share with them the personal data necessary to carry out the specific tasks entrusted to them.

When we outsource certain activities to our trusted partners, we make reasonable efforts to verify in advance that they ensure the protection of your data through strict data security measures, and we will conclude data processing agreements with each of them as annexes to the service contracts.

Specifically, we transmit some data to third parties (our suppliers and partners) to perform functions and services necessary for the operation of activities, such as:

• The provider that ensures data storage services on external servers located in Romania.
• Authorized third-party couriers to deliver the products purchased by you (Fan Curier, Cargus, DPD, TCE, etc.). • Payment processors authorized by us to facilitate payments (Netopia, 3D Secure, PayU, etc.).
• The agency that provides customer segmentation and profiling services for marketing purposes.

Transmission of data to authorities and public institutions or judicial bodies We may disclose some of your personal data to competent authorities or public institutions when required by law (e.g., fraud investigation, money laundering prevention, filing statements and financial reports to tax authorities, etc.), or we may disclose this data to the judicial courts when defending ourselves in legal proceedings or before other public authorities.

Access for Auditors and Consultants If we decide in the future to sell the shares or the business of BIOGENVET SRL, we may grant access to or transfer customer data to potential auditors and consultants for the necessary audit related to the acquisition of shares/business. For this purpose, we will ensure that any potential buyer follows and implements the necessary security measures to protect your data, and the parties will sign a data processing agreement prior to the transaction.

WHEN DO WE TRANSFER YOUR DATA OUTSIDE THE EUROPEAN UNION OR EEA?

As a general rule, your data is not stored in a country located outside the European Union or the European Economic Area (“EEA”).

However, some data may be transferred to our partners who assist us in operating the company’s activities and are located outside the European Union. However, we have made reasonable efforts with each of these partners to ensure that adequate data protection measures are in place.

When we send you personalized offers through targeted advertising, we use the Custom Audiences feature managed by Facebook, Inc., located outside the EU/EEA. However, it is certified according to publicly available information in accordance with the requirements of the EU-U.S. Privacy Shield (considered to provide an adequate level of protection for personal data transferred from the European Union to organizations in the United States). We recommend that you also review Facebook’s Privacy Policy on their website.

If we transfer your data to other partners/suppliers of BIOGENVET SRL located in countries that do not provide an adequate level of protection for transmitted data, we undertake to take all necessary measures to ensure that such partners/suppliers comply with the terms and conditions set out in this Policy. These measures may include, in addition, the implementation of data protection standards (e.g., ISO 27001), standard contractual clauses adopted by the European Commission, as well as direct control systems for these mechanisms.

HOW DO WE ENSURE THE SECURITY OF YOUR DATA?

BIOGENVET SRL implements the necessary technical and organizational measures to collect, process, and securely store data, including protection against unauthorized access, unauthorized use of data, or destruction, loss, or alteration of data. We are committed to keeping your personal data safe and take all reasonable protection measures to do so.

We implement systematic training processes for IT security personnel, as well as monitoring and auditing of system and IT infrastructure security in accordance with BIOGENVET SRL’s internal policies.

In addition, we make all reasonable efforts (including through contracts with them) to ensure that our trusted partners also manage appropriate technical and organizational measures for processing the data we share with them.

WHAT RIGHTS AND OPTIONS DO YOU HAVE REGARDING YOUR DATA?

We want to ensure that you have full control over your data at all times and that you can effectively exercise your rights and options under the GDPR. To ensure that you have effective control over your data, we inform you that you have the following possibilities based on the technologies available to you:

• You can manage the access, rectification, or direct deletion of certain data available in your BIOGENVET SRL customer account.
• You will be able to delete cookies or browsing history, or you can choose to modify the settings of the browser you use to restrict the tracking of your behavior on the Presentation Website by cookies (however, these restrictions may affect your browsing experience on the Presentation Website).
• Social media platforms and search engines (e.g., Google or Facebook) offer you the possibility to manage various options regarding how you choose to process your data.

In addition to these options, GDPR grants you, as a data subject, the rights described below. Before proceeding with any request regarding your rights, we will ensure that you are the data subject to whom you choose to exercise these rights, and for this purpose, we may request some information/data to verify your identity or we may request more details about your request. The correspondence we will have with you may be kept to ensure that we keep a record of requests and responses regarding your rights.

1.Right to be informed: You have the right to receive clear, transparent, easily understandable, and easily accessible information about how we process your data, including details about your rights as a data subject. This information about the data, the purpose, and the way we process your data is included in this Policy.

2.Right of access to data: You have the right to access the data we process about you without any charge for the first supply of data. If you need copies of the data already provided, we may charge a reasonable fee taking into account the administrative costs of providing the data. We have the right to refuse excessive, repetitive, or unjustified requests.

To exercise your right of access, you can send your request to us via:

Email: contact@biogenvet.ro

3.Right to rectification of data: If you identify that the data we process about you is incorrect, incomplete, or inaccurate, you can send a rectification request to the email address: contact@biogenvet.ro

4.Right to object to direct marketing (including profiling for direct marketing purposes): You can object at any time and unsubscribe from our direct marketing communications. You can easily do this by clicking the “unsubscribe” link or by replying with “unsubscribe” in any email we send to you.

In addition, you can choose to withdraw your previously expressed consent for the transmission of personalized offers based on profiling through the same channels through which we communicate these offers to you, namely: email, SMS, or push notifications.

The withdrawal of consent (by unsubscribing or written request) does not affect the legality of the processing based on consent before its withdrawal.

5.Right to object to processing based on legitimate interests: You can object at any time to any data processing when such processing is based on our legitimate interests. Please refer to the “What is the legal basis for data processing?” section in the above table to identify situations where our processing is based on our legitimate interests. You can exercise this right in writing by submitting a written request to the email address: contact@biogenvet.ro.

Right to erasure (right to be forgotten). You have the right to request the deletion of your data in any of the following situations:

Personal data is no longer necessary for the purposes for which it was processed; b) You withdraw your consent, and there is no other legal basis for future processing; c) You object to the processing of your data for direct marketing purposes (including profiling for direct marketing); d) You object to the processing of your data based on our legitimate interests, and we cannot demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms; e) Personal data is processed unlawfully; f) Personal data must be erased to comply with our legal obligations.

This right is not absolute. We may reject your request for data deletion if: (i) we are legally obligated to retain the data, or (ii) the data is necessary for the establishment, exercise, or defense of legal claims. You can exercise this right by submitting a written request to the email address: contact@biogenvet.ro.

Right to restrict processing. You have the right to obtain from us the restriction of data processing in the following situations: (a) The accuracy of the data is contested by you, for a period that allows us to verify the accuracy of the data; (b) The processing of the data is unlawful, and you oppose the deletion of the data, requesting the restriction of their use; (c) We no longer need your data, but you require them for the establishment, exercise, or defense of legal claims; (d) You object to the processing of the data based on our legitimate interests, pending verification whether our legitimate grounds override your interests.

You can exercise this right by submitting a written request to the email address: contact@biogenvet.ro.

Right to data portability. When we process your data based on consent or the performance of a contract, and in an automated manner, you have the right to request the transfer of your data: (a) to yourself or (b) to another data controller specified by you. The second option means that you can request the transfer of personal data associated with your customer account to another data controller (e.g., an operator managing another online store website for courses or products). Specifically, you can only request the portability of personal data that you have actively provided to us (excluding any derived or developed data by BIOGENVET SRL, such as a customer profile). You can exercise this right by submitting a written request to the email address: contact@biogenvet.ro. We will provide your requested data in a structured, commonly used, and machine-readable format (e.g., XML, JSON, CSV) that allows for data reuse.

Right to lodge a complaint with the supervisory authority. You have the right to file complaints with the National Supervisory Authority for Personal Data Processing (A.N.S.P.D.C.P.) regarding how we process your personal data. However, we hope that you will first discuss any issues with us before filing a complaint with A.N.S.P.D.C.P. We take the protection of your data seriously and will take all necessary measures to address any concerns regarding the control and security of your data. You can also address questions to A.N.S.P.D.C.P., the data protection supervisory authority in Romania. You can find guidance and guidelines on your rights on the authority’s website: http://www.dataprotection.ro/.

QUESTIONS AND REQUESTS REGARDING DATA PROTECTION BIOGENVET SRL is available to answer any questions, provide clarifications, or provide any necessary details regarding this Data Processing Policy. You can contact us for suggestions or comments related to this Policy or how we collect and use your data using the contact information of the DPO below.

Data Protection Officer: Address: Hemeiuș, Liliacului Street, no. 4, Bacau County, Romania. Email: contact@biogenvet.ro.

WHEN THIS POLICY IS UPDATED This Data Processing Policy is subject to changes and is supplemented by other specific policies of BIOGENVET SRL.