INSTAGRAM PERSONAL DATA PROCESSING INFORMATION NOTICE

As of 7th June 2024

In this document you find information on the following topics:

1. WHO WE ARE

2. CONTACT INFORMATION

3. WHAT DATA WE PROCESS ABOUT YOU

4. HOW WE SHARE THE INFORMATION

5. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION

6. YOUR RIGHTS

1. WHO WE ARE: Smartemp, a Romanian company with its registered office in Bucharest, Sector 1, Str. Av. Popisteanu no. 54A, Office building 2, floor 4, Open Space 1, within the Expo Business Park, Order number in the Trade Register J40/4656/2000, unique registration code 13020557 (hereinafter referred to as “Smartemp”, “we” or another similar term). As administrators of our Instagram page (hereinafter referred to as “our page”) together with Meta Platforms Ireland Ltd., headquartered in 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, acting as provider of the Instagram social media platform, we collect and process different categories of personal data from you as a user of our Instagram page , which, in accordance with the EU General Data Protection Regulation, gives us and Instagram the quality of joint data controllers for such data. For more details on the joint processing of personal data please access https://help.instagram.com/581066165581870/

This Personal Data Processing Information Notice describes our practices regarding the collection and use of your personal data as a result of your interaction with our Instagram page. Please read this Information Notice carefully to understand how we process your personal data.

We reserve the right to change our data protection practices and update and amend this notice whenever we consider it appropriate. Therefore, we encourage you to check this notice periodically. This information notice is updated on the date shown at the top of the document. We shall process your personal data in accordance with the information notice in force, unless we have your consent to process them otherwise.

Regarding the collection and processing of your data by Instagram, which we do not control, please see the Instagram information available at: https://help.instagram.com/519522125107875.

This Information Notice does not cover the data processing in connection with accessing links (e.g to articles on our websites) posted on our Instagram page. When you access a link in an Instagram post from our company, it directs you to the desktop or mobile version of a website, where you will receive information about the processing of your data on the website.

2. INFORMAȚII DE CONTACT Vă rugăm să adresați întrebările dumneavoastră privind subiectul protecției datelor și orice cerere pentru exercitarea drepturilor dumneavoastră la următoarele informații de contact ale responsabilului nostru cu protecţia datelor personale: office@smartemp.ro Vom cerceta și vom încerca să soluţionăm orice astfel de reclamaţie sau cerere cu privire la drepturile dumneavoastră. Dacă nu sunteţi mulţumit(ă) de răspunsul primit, puteţi depune o reclamaţie şi la Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ale cărei date se regăsesc mai jos, în secţiunea 6.

3. WHAT DATA WE PROCESS ABOUT YOU AND THE LEGAL BASIS We are processing the following personal data on our website:

• If you send a message to the page, we have access to your public profile (which includes your username, but may also contain contact information, education data, jobs, personal websites, hobbies, interests) as well as the content and date/time of that message.

• if you comment on a page post, we have access to your public profile (which includes the username) as well as the content and date/time of that comment;

• if you interact with the content of our page (like, share), we can view your public profile (which includes your username, but may also contain contact information, education data, jobs, personal websites, hobbies, interests),) and your reactions

When you interact with our website, Instagram processes certain personal data based on which it provides us with aggregated statistics. The data we have access to do not include personal data directly, but are limited to:

• statistics on gender, age and location

• the number of clicks on the username of our page;

• the number of page views;

• the number of page likes;

• the number of accounts following the page;

• the number of clicks on the links included in the description of our page;

• % of accounts that do not follow our page of those who have viewed a particular post;∙ the number of unique accounts that have seen a post or story of our page;

• how many times someone tapped to jump forward to the next section of our page story (taps forward);

• how many times someone tapped to return to a previous section of our page story (taps back);

• the number of times users sent messages using the “Send Message” option in our article;

• how many times someone swiped to jump to the next item on our page;

• how many times someone quit our articles and returned to their normal activity

• the number of people who have been shown content from the page;

• the number of interactions with the page content (like, share, comment, etc)

• the number of people viewing our promotional campaigns.

Also, when we customize the audience of our posts or advertising campaigns on Instagram, we set categories of interests that may include you (e.g woman from Cluj, 25 to 45 years old, interested in human resources). The data that may be collected and processed through Instagram for this personalization are determined by Instagram without our involvement and may include age, gender, occupation, history of interactions, lifestyle data, online product and service purchases, and other data according to the Instagram policy. These data are collected and processed by Instagram, but we only have access to the categories already established by Instagram. For more details, please access the Instagram Data Policy https://help.instagram.com/519522125107875.

These data are processed in our legitimate interest to promote our brand and activity , as well as in order to prove, if necessary, our correspondence with you. The data are kept as long as our page is running. You must understand that all these data, and more, are available at any time to Instagram, as the owner of the platform (and implicitly the controller of your personal data). For more details, please access the Instagram Data Policy https://help.instagram.com/519522125107875 . Providing personal data is not mandatory, and you can individually set Instagram’s access rights to your data. However, you must understand that, within the limits of this filter available to you, Instagram works in a consistent way for all pages and all users. Therefore, if you interact with our page (you are also free not to interact with our page), we may automatically have access to certain data about you, as described above.

4. HOW WE SHARE INFORMATION We shall disclose your personal data only for the purposes and to the third parties described below. We shall take appropriate measures to ensure that your personal data are processed, secured and transferred in accordance with the legal requirements in force. For more details, please access the Meta (or Facebook) Data Sharing policy https://www.facebook.com/legal/terms/page_controller_addendum.

4.1 Disclosure of data to third parties We shall share the necessary part of your personal data only to the extent necessary and only to the following categories of third parties: (a) Instagram, which is a data controller associated with your data; (b) Third party entities that may administer the page (e.g. marketing agencies); (c) Other entities such as public authorities and institutions, accountants, auditors, lawyers and other external professional advisors, if their work requires knowledge of this data or if the law requires us to disclose it; (d) companies offering us products and services (processors), such as IT systems providers and related support service providers, telecommunications service providers, backup and disaster recovery, computer security services.

We shall also disclose your personal information to third parties: (a) If you request it or give us consent to do so; (b) To persons who can demonstrate that they have the legal authority to act on your behalf; (c) If the page is transferred, which may take place in our legitimate interest in expanding or developing our business, such as: (i) in the event of an enterprise transfer (we sell part of the activity or certain goods) related to the page you are following, the buyer will take over the page and your data; (ii) if Smartemp (or a substantial part of its assets) is acquired by a third party, in which case our Facebook pages will constitute one of the assets transferred; (d) if we are required to disclose your personal data in order to comply with a legal obligation, any legal request from governmental or executive authorities, and as may become necessary to meet certain national security or law enforcement requirements or to prevent certain illegal activities; (e) to respond to any claims, to protect our rights or those of third parties, to protect the safety of any person or to prevent any illegal activity; or (f) to protect the rights, property or safety of Smartemp, its employees, customers, suppliers or others.

Some of these recipients may use your data in countries outside the European Economic Area. Please see section 5 below for more details on this topic

Instagram may also disclose your data to third parties without our involvement or control. For more details, please access the Instagram Data Policy https://help.instagram.com/519522125107875/?helpref=hc_fnav.

4.2 Restrictions regarding the use of personal data by recipients Third parties to whom we provide your personal data as specified above are limited (by law and contract) as to how they may use your personal information for the specific purposes identified by us. We shall always ensure that any third parties with whom we choose to share your personal data are subject to privacy and security obligations in accordance with this notice and the applicable law. However, to avoid any doubts, this provision is not applicable if disclosure is not our decision, including the processing carried out by Instagram. Except as detailed above, we shall not disclose any of your personal data to any third party without notifying you.

5. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION
As a general rule, your data are not transferred by us to recipients outside the European Union. However, if this happens, we shall take appropriate measures to ensure that the recipient protects your personal information adequately, such as the conclusion of standard contractual clauses approved by the European Commission, and we shall update this information notice.

Instagram may also transfer your data outside the European Union. Please consult the Instagram policy on this matter.

6. YOUR RIGHTS As a data subject, you have specific legal rights related to the personal data we collect from you. Smartemp shall observe your rights and respond appropriately to your requests.

Although we are controllers associated with Instagram, there is no really joint data processing between us and Instagram, so we can only handle your requests in connection with our own processing. If you wish to exercise any of your rights in connection with Instagram, please contact Instagram as indicated in its policy.

(a) Right to withdraw consent: If you have given your consent to the processing of your personal data, you can withdraw it at any time.

(b) Right of access: You can request information about the personal data we have about you, including information relating to the categories of data we store or control, what they are used for, the source where we collected them, if we have obtained them indirectly and to whom they are disclosed, if at all. We shall provide you with a copy of your personal data upon request. If you request multiple copies of your personal data, we may charge you a reasonable fee based on administrative costs. You have the right to information about our safeguards for the transfer of your personal data to a country outside the EU and the European Economic Area if we transfer your personal data to such a country.

(c) Right to rectification: You can obtain from us the rectification of your personal data that we process. We make reasonable efforts to maintain the personal data in our possession that are continuously used, accurate, complete, up-to-date and relevant, based on the latest information at our disposal.

(d) Right to restriction: You can obtain from us the restriction of your personal data processing if: i) you challenge the accuracy of your personal data for a period that enables us to verify the accuracy of the personal data, ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead, iii) we no longer need your personal data but you require them to establish, exercise or defend legal claims, or iv) you object to the processing while we verify whether our legitimate grounds override yours

(e) Right to portability: You have the right to receive your personal data that you have provided to us, and if it is technically feasible, to request that we transmit your personal data (which you have provided us) to another organisation. These two rights are rights that you have if, cumulatively: We process your personal data by automated means, We rely, in the processing of your personal data, on your consent or our processing of your personal data is necessary for the conclusion or performance of a contract to which you are a party; the transmission of your personal data shall not adversely affect the rights and freedoms of others.

(f) Right to erasure: You have the right to request that we erase the personal data we process about you. We must comply with this request if we process your personal data, unless the data are necessary: to exercise the right of freedom of expression and information; to comply with a legal obligation that we have; for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes; or to establish, exercise or defend legal claims.

(g) Right to object: You may object at any time to the processing of your personal data for reasons relating to your particular situation, provided the processing is not based on your consent but on our legitimate grounds or those of a third party. In this case, we shall no longer process your personal data unless (i) we can demonstrate compelling legitimate grounds justifying the processing and overriding your interests, rights and freedoms, or (ii) or the establishment, exercise or defence of legal claims. If you object to the processing, please specify whether you also want your personal data to be erased, otherwise we will only restrict them. You can object at any time to the processing of your personal data for direct marketing purposes based on our legitimate interest, regardless of your reasons. If the marketing was based on your consent, you can withdraw your consent.

We shall try to fulfil your request within 30 days. This period may be extended for specific reasons related to specific legal rights or the complexity of your request. In any case, if this period is extended, we will inform you of the extension period and the reasons for the extension. Restriction of access: In certain situations, we may not be able to grant you access to all or part of your personal data due to legal restrictions. If we refuse your request for access, we will inform you of the reason of this refusal. Failure to identify: In some cases, we may not be able to identify your personal data due to the identification elements you provide us in the request. In such cases, if we cannot identify you as a data subject, we cannot act on your request under this section unless you provide us with additional information to allow us to identify you. We shall inform you and give you the opportunity to provide us with such further details. Exercising your rights: To exercise your rights, please contact us in writing (including electronically) at the contact details provided in section 2 above.

h) Right to lodge a complaint. If you have a complaint about the way we process your data, we would prefer that you contact us directly so that we can solve your problem. However, you can contact the National Supervisory Authority for the Processing of Personal Data through their website (www.dataprotection.ro), or you can write to: Name: Address: Phones: Fax: Email: National Supervisory Authority for the Processing of Personal Data B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania +40.318.059.211 +40.318.059.212 +40.318.059.602 anspdcp@dataprotection.ro