PRIVACY POLICY REGARDING THE PROCESSING OF PERSONAL DATA

"OUTSOLE" (hereinafter referred to as " we ", " our ", " ours " or " OUTSOLE " in this policy) refers to OUTSOLE SRL , is the operator of all personal data collected and used in relation to OUTSOLE customers in the sense of the Romanian provisions regarding the protection of personal data. OUTSOLE SRL is a company registered and organized in accordance with the laws of Romania, registered at the Commercial Registry Office at the Timiș Court under no. J35/2314/2020, unique identification code 42946188 and registered office in Timisoara, Coriolan Brediceanu street 9 apartment 1 car garage.

INTRODUCTION

This privacy policy on the processing of personal data explains what we do with your personal data, whether we provide you with products, marketing materials or use your personal data as part of research we carry out for marketing or scientific purposes .

At the same time, we inform you that, as of May 25, 2018, Regulation 2016/679/EU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter " the Regulation ") will be applied by all the states of the European Union. By means of the Regulation, it is desired to create a unitary and uniform legislative framework on the territory of the European Union.

OUTSOLE aligns with the provisions of the Regulation and we think it is a good time to point out some important aspects.

This document describes how we collect, use and process your personal data and how in doing so we comply with our legal obligations to you. Your privacy is important to us and we are committed to protecting your personal data and protecting you the rights.

If you are dissatisfied with any aspect of our customer privacy policy, you may have legal rights that we have described below, where applicable.

We may change this notice from time to time. Please visit this page if you want to stay updated the next time we post changes here.

What is your personal data that we process?

Your personal data is collected through our website, email, call center and post/courier. Depending on the relevant circumstances and applicable local laws and requirements, we may collect some or all of the information listed below to help us do this:

• Name and surname;
• Contact telephone number/numbers;
• Sex;
• Date of birth;
• Contact details: email address, contact address;
• Correspondence between OUTSOLE and You;
• Any other additional information you choose to provide to us.

Additionally, when you visit our site, we automatically collect technical information, including the IP (Internet Protocol) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, plug-in types and versions browser, system and platform, passwords and hints, similar security information used for authentication and account access.

IMPORTANT

Please note that when you use our website, cookies are stored by the browser on your device. Please note that if you disable cookies, our website may not function properly in your browser. We want to ensure that our website gives visitors what they are looking for and that they receive the most relevant marketing messages. To achieve this goal, we may store and use your data for market research, for improvements to the quality of our website and our services, for service developments, to improve website performance, for to measure the success of our advertising campaigns or to adapt our services to your needs.

How do we use your personal data ?

We collect and use your personal data for the following purposes:

• in order to facilitate the provision of services and products and services (including from third parties) on our website to inform customers/buyers about the status of their user account, including validating, shipping and invoicing orders, solving problems of any nature regarding a order, respectively to the purchased goods and/or services. For this purpose we collect the following data: name and surname, telephone number, e-mail address, gender and date of birth, delivery address, payment data;
• to send you newsletters. For this purpose we collect the following data: name, surname, telephone number and e-mail address;
• to provide you with offers based on your preferences. For this purpose, we collect the following data: name, surname, telephone number and e-mail address;
• to communicate with you in the process of conducting customer satisfaction surveys for analytical purposes, for quality improvements, for service developments, to improve website performance, to measure the success of advertising campaigns or to adapt the services to your requirements. For this purpose we collect the following data: name, surname, telephone number and e-mail address.

We may also use your personal data for these reasons if we consider it necessary to ensure our legitimate interests. For more information, please see below.

Do we share your personal data with third parties?

Mainly, we will communicate your personal data to third parties, only in order to ensure the optimal performance of our contractual relations, but also in order to fulfill specific legal obligations, as follows:

• Financial consultants, audit firms, as well as any public authority, in the event that such a legal obligation to disclose personal data falls on us (for example, in the situation where we receive such a notification and/or address from the public authorities central or local or in connection with an ongoing litigation before the courts in Romania);
• Service providers acting on our behalf (including but not limited to external consultants, lawyers, auditors and/or accountants and IT consultants and experts);
• In the event that a company in the OUTSOLE group is acquired or merges with another company or group of companies in the future, we may provide your personal data to the representatives of the new owners (after notifying you of such a move and the implications on your personal data)

How do we ensure the security of your personal data?

We are concerned about protecting your personal data. This is the reason why we have implemented or are in the process of implementing appropriate measures that are intended to prevent unauthorized access as well as incorrect use of your personal data.

We are committed to taking all reasonable and appropriate measures to ensure the security of your personal data against their theft and unauthorized access, and we make all necessary efforts in this regard. We achieve all this by implementing specific technical and organizational measures, including encryption, anonymization and data recovery/back up measures.

IMPORTANT

If you suspect the unauthorized use or theft of your personal data, please notify us as soon as you suspect such unauthorized activity. In this regard, please contact info@onesizeup.ro in the first instance in order to be able to investigate the situation and to be able to later provide you with updated information regarding the stage of resolving the incident, as well as regarding the steps to be taken.

For what period of time do we process your personal data?

We will not keep your personal data in our records for a period of time that will exceed the purposes for which these personal data were collected, except in cases where the legal provisions require us to keep your personal data for a period of time determined more lengthy for our purpose (for example, in the situation where we receive such a notification and/or address from the central or local public authorities or in connection with an ongoing litigation before the Romanian courts). The recordings of telephone conversations with customers will be kept for a period of 6 (six) months.

What are your rights regarding the personal data we process?

One of the main objectives of the Regulation is to protect and clarify the rights of natural persons regarding the protection of personal data. Thus, although we process your personal data, the regulation recognizes a number of rights regarding your personal data.

Also, the Regulation gives more rights to the persons whose personal data is processed. Thus, in addition to the currently existing rights, we also find the right to data portability or data deletion.

Here are the rights you have in brief.

The right of access means that you have the right to obtain confirmation from us as to whether or not we are processing your personal data and, if so, access to that data and information on how the data is processed.

The right to data portability refers to the right to receive personal data in a structured, commonly used and machine-readable format and the right to have this data transmitted directly to another controller if this is technically feasible. technical view.

The right to object refers to the right to object to the processing of personal data when the processing is necessary for the performance of a task that serves a public interest or when it has a legitimate interest of Sport Vision in mind. When the processing of personal data is aimed at direct marketing, you have the right to object to the processing at any time.

The right to withdraw consent refers to cases where we have obtained consent to process your personal data for certain activities (for example, for direct marketing purposes), you can withdraw this consent at any time and we will stop carrying out that particular activity unless we consider that there is an alternative legal basis to justify continuing to process your personal data for this purpose, in which case we will inform you of this condition.

The right to rectification refers to the correction, without undue delay, of inaccurate personal data. The rectification will be communicated to each recipient to whom the data were transmitted, unless this proves impossible or involves disproportionate efforts.

The right to data erasure ("the right to be forgotten") means that you have the right to request that we delete your personal data without undue delay if one of the following reasons applies:

• they are no longer necessary to fulfill the purposes for which they were collected or processed;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds;
• personal data were processed illegally;
• personal data must be deleted to comply with a legal obligation;
• personal data were collected in connection with the provision of information society services.

The right to restrict processing can be exercised in one of the following cases:

• when you dispute the accuracy of the data, for a period that allows us to verify the correctness of the data;
• the processing is illegal and you object to the deletion of personal data, requesting the restriction instead;
• in the situation where Sport Vision no longer needs the personal data for the purpose of processing, but you request them from us to ascertain, exercise or defend a right in court;
• in the event that you have objected to processing for the time frame in which it is checked whether our legitimate rights prevail, in which case we will explain our reasons to you in detail.

IMPORTANT

All these rights can be exercised through a written request, signed and dated, sent to our headquarters or by email, the necessary contact data can be found in Appendix no. 1.

Upon request, you will receive from us a copy of the processed personal data; you can request and receive an answer from us in any way you want (including email).

Please note that your right to request a copy as set out above must not prejudice the rights and freedoms of others.

The right to lodge a complaint with the supervisory authority - If you believe that your personal data rights have been violated, you can also contact and lodge a complaint with your local data protection authority:

The National Supervisory Authority for the Processing of Personal Data

G-ral Blvd. Gheorghe Magheru no. 28-30
Sector 1, postal code 010336
Bucharest Romania
anspdcp@dataprotection.ro
Phone: +40.318.059.211
+40.318.059.212

Who is responsible for the protection of your personal data?

OUTSOLE SRL is responsible for the protection of your personal data. Its headquarters are in TIMISOARA, STR.CORIOLAN BREDICEANU 9 AP.1 CAR GARAGE.

For any comments or suggestions regarding this notice please contact us using the contact information in Appendix no. 1. We are very concerned about the security of your personal data and we will respond to you within a maximum period of 5 (five) working days.

Transfer of your personal data? How and to whom?

In order to ensure the smooth running of our contractual relations, your personal data may be transferred:

• Between the OUTSOLE SRL group companies;
• To third parties (for example, OUTSOLE SRL group consultants);
• To a cloud storage service provider.

We want to ensure that your personal data is stored and transferred in a way that ensures adequate security.

For these reasons, we will transfer your personal data outside the European Economic Area (Member States of the European Union, Norway, Iceland and Liechtenstein) only in the situation where the transfer is carried out in compliance with the legal provisions on the protection of personal data and ensuring a level of adequate protection, as follows:

• By transferring your personal data to a state that offers an adequate level of protection, recognized as such by a decision of the European Union Commission;
• If you have given your freely expressed and informed consent to the transfer of personal data outside the European Economic Area;
• By concluding a contract regarding the transfer of personal data to a third party, a contract that incorporates the standard clauses adopted by the European Union Commission regarding the transfer of personal data to operators and agents located in states that ensure an adequate level of protection.

Legal grounds for processing your personal data

The Regulation provides for a number of ways in which we can process your personal data legally, as described below.

The legal basis for the processing is the execution of the contract

Article 6, paragraph (1) of the Regulation provides that " the processing is legal only if and to the extent that at least one of the following conditions applies: [...] b) the processing is necessary for the execution of a contract to which the data subject is party or to take steps at the request of the data subject before the conclusion of a contract ".

Therefore, we rely on this legal basis to process your personal data to enable us to perform both our contractual obligations and our obligations to third parties, but also to ensure that you properly fulfill your obligations. towards us.

The legal basis for the processing is a legal obligation

In addition to our contractual obligations, we are bound by other legal obligations that we must comply with. Article 6, paragraph (1), letter (c) of the Regulation provides that we can process your personal data if this processing " is necessary to comply with a legal obligation to which we are subject. "

An example of a legal obligation we must comply with is our obligation to cooperate with tax authorities.

The legal basis for the processing is a legitimate interest

Article 6 paragraph (1) letter (f) of the Regulation explains that we can process your data if it " is necessary for the purposes of the legitimate interests pursued by [us] or by a third party, unless these interests are superseded by the interests or fundamental rights or freedoms of [You] that require the protection of personal data. "

We consider the following as non-exhaustive examples of activities to process your personal data according to our legitimate interests:

• for our internal administrative purposes;
• to prevent unauthorized use of our information and equipment;
• in order to carry out investigations regarding alleged violations; and
• for the establishment, exercise or support of legal claims.

The legal basis for the processing is freely expressed consent

In certain circumstances, we will obtain your opt-in consent (voluntary registration) before undertaking certain requirements regarding the processing of your personal data.

Article 4 paragraph (11) of the Regulation provides that the opt-in agreement is " any free, specific, informed and unambiguous indication of the data subject's wishes by which he or she, through a statement or through a clear affirmative action, the processing personal data concerning them ".

In plain language, this means that:

• you must express your consent freely, without us putting you under any pressure;
• you need to know what you're consenting to - so we make sure we give you enough information;
• you should only be asked to consent to one processing activity at a time - we therefore avoid asking for a single consent for multiple processing activities so that you do not know exactly what you are agreeing to; and
• you must take specific steps to give us your consent - you will most likely be asked to complete a tick box to ensure that this requirement is met in a clear and unambiguous manner.

With the introduction of these specific processing activities of your personal data, we will provide you with more information so that you can decide whether you want to opt-in.

You have the right to withdraw your consent for these activities. You can do this at any time and details of how you can do this can be found in the " Right to withdraw consent " section above.

Please note that we need the personal data listed in Section 1 to provide you with our services.

If you do not provide us with the requested personal data, we will not be able to provide you, in whole or in part, with the services you have requested. If you withdraw your consent, we may not be able to provide you, in whole or in part, with the services you have requested.

We do not believe that any of the above activities harm you in any way.

However, you have the right to object to the processing of your personal data in certain circumstances.

If you would like to know more about these circumstances and how to object to our processing activities, see the " Right to object " section.

APPENDIX NO. 1

For questions related to the protection of personal data, to exercise your rights or to register a complaint, contact OUTSOLE SRL via an e-mail message, at the address specified below.

You can also contact us by sending a message by mail to the following address:

Details for contacting OUTSOLE.RO

Email: info@outsole.ro

Postal address: Timisoara, Coriolan Brediceanu street 9 ap1 car garage, 300011.

Attention: OUTSOLE SRL - personal data protection