GENERAL INFORMATION REGARDING PERSONAL DATA PROTECTION

1. WHO ARE WE?

The Iulius Group has over 20 years of experience in developing and operating mixed-use projects in Romania, revolutionizing the domestic real estate market.
With this document, we wish to inform you that the protection of your personal data is a constant concern for us and to provide you with important information in this regard.

2. CATEGORIES OF DATA WE PROCESS, PURPOSES AND LEGAL BASES OF PROCESSING

(a) CONCLUSION AND/OR EXECUTION OF CONTRACTS WITH POTENTIAL AND/OR EXISTING BUSINESS PARTNERS OF THE IULIUS GROUP:

We will process your personal data for the purpose of concluding and/or executing the contract, communicating with you during negotiations and contract execution, as well as for maintaining the contractual relationship with you.
The legal bases for processing personal data are: the conclusion and/or execution of the contract with you; your consent.
In these situations, the personal data we may process are: first and last name, phone number, email address, home and/or residence and/or correspondence address, ID series and number, personal numerical code, signature; as applicable, this data may be processed in relation to your collaborators, your representatives and/or their collaborators, your contact persons and/or your collaborators, and/or your employees and/or their collaborators.

(b) ORGANIZATION AND CONDUCT OF CAMPAIGNS (WITH OR WITHOUT PRIZES):

We will process your personal data for the purpose of running advertising campaigns (with or without prizes), to maintain an active relationship in the community, with our clients, visitors, and/or users of mixed-use centers in the Iulius Group's portfolio.
The legal bases for processing personal data are: our interest in promoting the mixed-use centers we manage and the various actions we undertake in the community; communication with you during the campaign; registration of participants in the organization and/or conduct of campaigns; identification, validation, and announcement of winners (in the case of prize campaigns); fulfillment of our legal obligations in accordance with the provisions of current tax legislation (in the case of prize campaigns); your consent.
In these situations, the personal data we may process are: first and last name, gender, date of birth, phone number, email address, home and/or residence and/or correspondence address, ID series and number, personal numerical code, signature, photo and/or video images, as applicable.

We will process your personal data for the purpose of running loyalty programs, to maintain an active relationship with our clients, visitors, and/or users of mixed-use centers in the Iulius Group's portfolio.
The legal bases for processing personal data are: our interest in promoting the mixed-use centers we manage, as well as the various services of operators active within these centers; your enrollment in loyalty programs; your consent.
In these situations, the personal data we may process are: first and last name, gender, date of birth, phone number, email address, home and/or residence address, occupation, as applicable.

(d) CONDUCT OF VARIOUS EVENTS ORGANIZED BY THE IULIUS GROUP:

We will process your personal data for the purpose of conducting and promoting cultural, musical, entertainment, and other events, to maintain an active relationship in the community, with our clients, visitors, and/or users of mixed-use centers in the Iulius Group's portfolio.
The legal bases for processing personal data are: our interest in promoting the mixed-use centers we manage and the various actions we undertake in the community; your consent.
In these situations, we capture photo/video images of people in the audience at events organized by us, and these images may be published on our websites and/or on related social media pages and/or in the press. If you do not wish to be captured in these images, please exercise this right by addressing the recording personnel in advance and/or by sending us a request to destroy the image in which you were captured or to limit its future processing.

(e) TRANSMISSION OF NEWSLETTERS:

We will process your personal data for the purpose of promoting the mixed-use centers we manage, the campaigns and events we organize, and/or the actions we undertake in the community, as well as for improving your future experience.
The legal bases for processing personal data are: your consent; our interest in promoting the mixed-use centers we manage, the campaigns and events we organize, and/or the various actions we undertake in the community; our interest in evaluating and improving your experience.
In these situations, the personal data we process are email addresses.

(f) CONDUCT OF RECRUITMENT PROCESSES FOR POTENTIAL EMPLOYEES AND/OR INTERNS WITHIN THE IULIUS GROUP:

We will process your personal data for the purpose of analyzing your profile and level of training, communicating with you during the recruitment process, as well as for concluding and/or executing the individual employment contract and/or internship, as applicable.
The legal bases for processing personal data are: our interest in determining how well you fit into a company within the Iulius Group; the conclusion and/or execution of the individual employment contract with you and/or the internship, as applicable; your consent.
In these situations, the personal data we may process are: first and last name, date of birth, phone number, email address, completed studies, professional experience, other data provided in your CV, and any other relevant information we may request in this regard.

(g) SECURITY OF PERSONS AND PROPERTY:

We will process your personal data to ensure the security of persons and property within the mixed-use centers we manage.
The legal basis for processing personal data is our legitimate interest in ensuring the security of persons and property within our premises.
In these situations, the personal data we may process are: video recordings made through surveillance cameras, data collected through our receptions, namely - data entered in a valid visitor's ID, purpose of the visit, and other relevant information we may request in this regard.

(h) ACCESSING OUR WEBSITES AND/OR RELATED SOCIAL MEDIA PAGES:

We will process your personal data to improve user experience and to resolve your requests.
The legal bases for processing personal data are: our interest in improving the content of our websites and related social media pages; our interest in knowing your opinion and preferences, as well as improving user experience when accessing our websites and related social media pages; resolving your quote requests (submitted through our websites); resolving your requests to be recruited within the Iulius Group and/or within other operators active in the centers managed by the Iulius Group (submitted through our websites - www.iuliuscompany.ro); resolving your complaints and grievances (submitted through websites and/or related social media pages); your consent.
In these situations, the personal data we may process are: cookie identifiers, username and profile picture, photos published through our websites and/or related social media pages, first name, last name, email address, phone number, data included in your CV, and any other relevant information we may request in this regard.

(i) FULFILLMENT OF LEGAL OBLIGATIONS:

We will process your personal data for the purpose of fulfilling legal obligations incumbent on the Iulius Group, to respond to any requests, notifications, complaints, or questions addressed by public authorities and institutions, or in any other situations where the law obliges us.
The legal basis for processing personal data is the fulfillment of legal obligations incumbent on us.
In these situations, the personal data we process are those requested and/or provided by public authorities and institutions, as well as any other data necessary for the fulfillment of a legal obligation.

(j) DEFENSE OF OUR RIGHTS AND INTERESTS AND/OR OF ANY PERSON AFFILIATED WITH THE IULIUS GROUP:

We will process your personal data for the purpose of defending our rights and interests (as well as those of any person affiliated with the Iulius Group) before courts, bailiffs, public notaries, other public authorities or institutions, arbitral tribunals, mediators, and/or other public or private dispute resolution bodies, our lawyers, consultants, or other natural or legal persons, public or private, involved in such negotiations and/or disputes.
The legal bases for processing personal data are: fulfillment of legal obligations incumbent on us and/or defense of our legitimate rights and interests, as applicable.
In these situations, the personal data we process are those necessary for the fulfillment of a legal obligation and/or for the defense of our legitimate rights and interests.

(k) PROCESSING DATA FOR INDIVIDUALLY DETERMINED PURPOSES:

In certain situations, we will process your personal data for individually determined purposes, based on the consent you may give us by completing a document we provide to you.
In such situations, the legal bases for processing personal data are: your consent (most often); other grounds provided in the document we provide to you.
In these situations, the personal data we may process are those provided and/or mentioned in the document we provide to you.

(l) COMMUNICATION WITH YOU:

We will process your personal data in the situations above and in any other situations to respond to any requests, notifications, complaints, or questions you may address to us.
The legal bases for processing personal data are your consent; fulfillment of a legal obligation or defense of our interests and rights, as applicable.
In these situations, the personal data we may process are: first and last name, phone number, email address, and any other relevant information in this regard.

3. SOURCE OF PERSONAL DATA

The personal data we process may be collected both from you and from external sources (business partners, public authorities and/or institutions, etc.).
If you provide us with personal data concerning other individuals, please inform them in advance about the purpose, legal basis, and other necessary information regarding how you process their data, and provide them with this information regarding how the Iulius Group processes their personal data and/or explain its provisions (www.iuliuscompany.ro). Where applicable, we will inform these individuals about how we process their personal data.

4. ABSENCE OF AN OBLIGATION TO PROVIDE US WITH YOUR PERSONAL DATA

You may choose not to provide us with certain types of personal data. If you choose to do so, this may result in the inability to conclude and/or execute certain contracts with you, may affect our ability to provide you with the requested services, to answer your questions/notifications/requests, or to send you certain communications, and your ability to use certain applications and/or services or their functionalities and features. However, your choice not to provide such data will not have legal consequences for you in most cases.

5. PERSONAL DATA RETENTION PERIOD

The retention period for your personal data varies depending on the purposes for which we process it and the data category.
In certain situations, the processing period will be indicated in the document we provide to you when collecting the data and/or when you grant your consent.
In all cases, we will store personal data in accordance with applicable legal provisions, applicable limitation periods, and/or recommended data protection practices.

6. DISCLOSURE OF PERSONAL DATA

As a rule, we will not disclose your personal data; however, in certain cases, we may need to disclose some data concerning you.
For the purpose of fulfilling processing objectives, we may disclose your data to companies within the Iulius Group, to contractual partners of the Iulius Group, or to other authorized persons who process your data for the Iulius Group. We may also disclose your data to central and/or local public authorities, or to other natural and/or legal persons when there is a legal obligation to do so or our legitimate interest (for example, to obtain financing and fulfill our obligations, we may send contracts concluded with you to the Iulius Group's financing banks).
For individually determined purposes, we may disclose your data to third parties and/or persons indicated in the document you complete when granting your consent.
In the context of transactions, restructurings, or other corporate operations (i.e., based on our legitimate interests or the fulfillment of legal obligations), we may disclose your data to potential buyers, collaborators, or their consultants, or to authorities, as applicable.
In all these cases, we will make reasonable efforts to ensure that the data recipients process the data under conditions of security and confidentiality, in accordance with the purpose for which they were transmitted and respecting your rights and interests.

7. TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS

We do not transfer and do not intend to transfer your data to companies, organizations, or individuals in third countries or to international organizations.
In the event that it becomes necessary to transfer your data to any of the recipients mentioned above, we will inform you in advance about this.

8. ABSENCE OF AN AUTOMATED DECISION-MAKING PROCESS

The Iulius Group does not make decisions based solely on the automated processing of your data that produce legal effects concerning you or that significantly affect you.

9. YOUR RIGHTS

(a) RIGHT OF ACCESS means you have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed; if we are processing your data, you have the right to access that data as well as any other information regarding how it is processed. (b) RIGHT TO RECTIFICATION allows you to obtain the rectification of your data that we process, in cases where this data is inaccurate. (c) RIGHT TO DATA PORTABILITY refers to your right to receive personal data concerning you in a structured, commonly used, and machine-readable format, as well as your right to obtain the transfer of this data to another personal data controller. (d) RIGHT TO OBJECT is your right to object to the processing of your data, except where processing is necessary for the fulfillment of a legal purpose. (e) RIGHT TO RESTRICTION allows you to obtain, in certain cases, the restriction of the processing of data concerning you. (f) RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN") means you have the right to request the erasure of data concerning you in certain cases (e.g., data is no longer necessary for the purposes for which it was collected and processed; you withdraw your consent and there is no other legal basis for processing; you object to processing and there are no legitimate overriding reasons; personal data has been unlawfully processed; personal data must be erased to comply with a legal obligation, etc.). (g) RIGHT TO WITHDRAW CONSENT means you have the right to withdraw your consent at any time when the processing activity is based on your consent; however, the revocation of your consent will not affect the lawfulness of any processing based on your consent before its withdrawal. (h) RIGHT TO LODGE A COMPLAINT WITH THE COMPETENT SUPERVISORY AUTHORITY refers to your right to lodge a complaint with the supervisory authority for personal data processing (www.dataprotection.ro) regarding the processing of your data by us or on our behalf.

10. OUR CONTACT DETAILS

Do not hesitate to contact us to answer any requests related to the processing of your personal data, using the following contact details: Data Protection Officer: Name: Iulian Gânju Correspondence address: Municipality of Iași, str. Palas no. 7A, building A1, 2nd floor, Iași County and/or at the email address: gdpr@iuliusmall.com.

11. AMENDMENTS TO THIS INFORMATION

In case this information undergoes changes, they will come into force from the moment the new version is published on our websites (in the sections dedicated to personal data protection), and these changes will also apply to ongoing processing at the date of publication of the new version.