<p><span style="font-size: 12pt;"><strong>INFORMATION AND CONSENT ON THE PROCESSING OF PERSONAL DATA</strong></span></p>
<p><span style="font-size: 12pt;">&nbsp;</span></p>
<ol>
<li><span style="font-size: 12pt;">CBC processes the data you provide to us directly, as well as the data that are subsequently generated and based on them, such as trading data, etc. The collection of your data is done when the contractual relationship with CBC starts. Given the specific nature of the activities carried out by CBC, the following personal data are processed:</span></li>
<li><span style="font-size: 12pt;">General identification data: name, surname, signature, date of birth, nationality;</span></li>
<li><span style="font-size: 12pt;">Contact details: home or residence, as applicable, e-mail address, telephone number;</span></li>
<li><span style="font-size: 12pt;">Data assigned by public authorities: Personal Identification Number or other similar unique identification number, serial number of the national identity document or of passport, as well as the copy of the national identity document or of passport;</span></li>
<li><span style="font-size: 12pt;">Professional data: profession, name of employer, position held, seniority at work, completed education;</span></li>
<li><span style="font-size: 12pt;">Data necessary to prevent money laundering and the source of funds;</span></li>
<li><span style="font-size: 12pt;">Data on the family situation: civil status, dependents, housing status, publicly exposed person / direct member / partner of a publicly exposed person.</span></li>
<li><span style="font-size: 12pt;">The legal purposes and grounds based on which CBC processes the personal data belonging to the Client are as follows:</span></li>
<li><span style="font-size: 12pt;"><strong> </strong><strong>to conclude and execute the contracts signed with the Client / data subject for: </strong>the development and management of the contractual relationship in order to provide the CBC Packages and Services, to send notifications regarding the contracted Package, etc.;</span></li>
<li><span style="font-size: 12pt;"><strong> </strong><strong>to fulfill the legal obligations assumed by CBC and for reasons of major public interests </strong>in order to identify and know the clients so as to prevent frauds;</span></li>
<li><span style="font-size: 12pt;"><strong> </strong><strong>to fulfill the legitimate interests of CBC </strong>while fulfilling the line of business, centralizing the operations and maintaining an internal database, performing a statistical analysis about the CBC's portfolio of clients, improving the Packages and services offered by optimizing the flows and internal procedures; the design, development, testing, implementing and use of own IT systems and resources, settlement of disputes, investigations or any other claims / complaints / requests CBC is involved in;</span></li>
<li><span style="font-size: 12pt;"><strong> </strong><strong>based on the consent given by the Client / data subject / you for: </strong>direct marketing and commercial communications.</span></li>
<li><span style="font-size: 12pt;">These principles apply if CBC processes personal data belonging to the legal or conventional representatives, contact persons, collaborators, employees or other natural persons designated by the contractual partners of CBC. These personal data are directly provided by the contractual partner in documents transmitted to CBC at the beginning of the contractual relations or during their performance. The legal purposes and grounds based on which CBC processes personal data belonging to the data subjects are as follows:</span></li>
<li><span style="font-size: 12pt;">o fulfill the legal obligations assumed by CBC for the performance of the contractual relationship (for the management of the inspections conducted by authorities, for carrying out the audits);</span></li>
<li><span style="font-size: 12pt;">to fulfill the legitimate interest of CBC while fulfilling its line of business.</span></li>
<li><span style="font-size: 12pt;">In order to fulfill the processing purposes mentioned above, the personal data shall be processed during the contractual relationship with CBC and after they end, for a period of 10 years or for the timeframe required by the applicable legislation, including but not limited to the legal applicable minimum archiving timeframes and/or as much as necessary in order to exercise our legitimate rights.</span></li>
<li><span style="font-size: 12pt;">For the fulfillment of the processing purposes, CBC may transmit &ndash; in total or in part &ndash; the categories of personal data to the following recipients:</span></li>
<li><span style="font-size: 12pt;">public supervisory institutions and public authorities (the National Agency for Fiscal Administration, the National Office for Prevention and Control of Money Laundering, etc.);</span></li>
<li><span style="font-size: 12pt;">bailiffs, notaries public, attorneys or external consultants who assist CBC in exercising and defending its rights before courts;</span></li>
<li><span style="font-size: 12pt;">institutions in charge with investigation and support in case of cybersecurity incidents;</span></li>
<li><span style="font-size: 12pt;">service providers: IT, archiving, courier, audit, appraisers, insurance companies, as applicable.</span></li>
<li><span style="font-size: 12pt;">In order to fulfill the processing purposes mentioned above, CBC may transfer personal data inside the EU / EEA or outside the EU / EEA if the conditions set out in the GDPR are fulfilled and also pursuant to a decision made by the European Commission on the adequacy of the protection provided by the recipient country / countries. CBC may use the data as standard data protection provisions approved by the European Commission if the personal data are transferred to countries that do not provide an adequate level of protection.</span></li>
<li><span style="font-size: 12pt;">Pursuant to the legislation regarding the processing of personal data, the Client has the right to receive information about the personal data processing activities carried out by CBC, as well as about the right of access to the personal data.</span></li>
<li><span style="font-size: 12pt;">The Client has the right to rectify the data provided in the Contract by submitting a Data Rectification Form and he/she also has the obligation to notify CBC on any changes in his/her personal data. If the data we hold about you are inaccurate or incomplete, you have the right to rectify or complete them. CBC is not responsible for any loss or damage caused by any failure to notify CBC about changes in the Client&rsquo;s personal data and by it acting on the basis of information provided in the Contract or in the personal data change sheet.</span></li>
<li><span style="font-size: 12pt;">The Client has the right to obtain the deletion of his/her data if there are no longer any legitimate reasons to prevail regarding the processing, if the consent has been withdrawn or if the data are no longer necessary for the fulfillment of the purposes.</span></li>
<li><span style="font-size: 12pt;">Pursuant to the personal data legislation, the Client is also granted the following rights:</span></li>
<li><span style="font-size: 12pt;">the right to restrict the processing;</span></li>
<li><span style="font-size: 12pt;">the right to object - you may request that we no longer process your personal data for reasons related to your particular situation and if the processing of your data is based on our legitimate interest. However, this right may be excluded for certain processing operations set out in the law (e.g. the processing operations conducted by financial and tax divisions, the police, justice, social security bodies);</span></li>
<li><span style="font-size: 12pt;">the right to data portability;</span></li>
<li><span style="font-size: 12pt;">the right not to be subject to a decision based solely on automated processing;</span></li>
<li><span style="font-size: 12pt;">the right to withdraw the consent;</span></li>
<li><span style="font-size: 12pt;">the right to file a complaint with the National Supervisory Authority for Personal Data Processing;</span></li>
<li><span style="font-size: 12pt;">the right to address the competent court.</span></li>
<li><span style="font-size: 12pt;">In order to exercise one or more of the rights granted to the Client under the laws regarding the protection of personal data, you can address CBC by an e-mail sent to the address [e-mail of the Data Protection Officer] or by a written dated and signed request sent to the headquarters in Bucureşti, Strada Lt. Nicolae Pascu Nr. 4, Bl. R2, Sc. A, Et. 5, Ap. 24, Sector 3.</span></li>
<li><span style="font-size: 12pt;">The provision of my personal data is voluntary, the lack of data provision leads to the impossibility of providing the service and/or the fulfillment of the other processing purposes by CBC.</span></li>
<li><span style="font-size: 12pt;">I hereby state that I have been informed that my personal data shall be processed for the performance of the Contract or for actions to be taken upon request, prior to the conclusion of the contract, as well as for the sale of the Packages and services offered by CBC. Moreover, I hereby state that I have been informed that CBC is the Data Controller and I have been informed of the recognized rights of the data subject.</span></li>
<li><span style="font-size: 12pt;">I hereby give my consent to receive direct marketing communications, advertising and any other commercial information by electronic means of communication (including by telephone) from CBC.</span></li>
<li><span style="font-size: 12pt;">The consent has been given voluntarily, it is freely expressed and can be withdrawn at any time in writing by a notice sent to the email address [ideally to the CBC Data Protection Officer].</span></li>
<li><span style="font-size: 12pt;">I have understood this statement of consent and I do agree to the processing of my personal data through the above channels for the purposes described herein.</span></li>
</ol>