Personal Data Protection Policy

NOTICE on the processing of personal data

SC ECOLUX SRL (hereinafter – the “Controller”) informs data subjects about the processing
of personal data in connection with the negotiation, conclusion and performance of commercial
and contractual relationships, including the sale and supply of equipment, design, delivery,
installation, assembly, commissioning, service, maintenance and warranty, as well as the
administration and defense of rights arising from these relationships, in accordance with
Law No. 195/2024 on the protection of personal data.

1. Data subjects

This Notice applies, as appropriate, to:

(a) clients, beneficiaries, suppliers, service providers or other contractual partners
who are natural persons;
(b) administrators, representatives, employees and contact persons of clients,
beneficiaries, suppliers, service providers or other partners that are legal entities;
(c) persons requesting quotes, design, delivery, installation, service, maintenance,
warranty or other services of the Controller;
(d) other natural persons whose data is processed in a necessary and legitimate manner
in connection with the commercial or contractual relationships of the Controller.

2. Categories of personal data

The Controller may process, depending on necessity:

(a) name and surname;
(b) the IDNP and, when necessary and permitted by law, the strictly necessary data from
the identity document;
(c) domicile/address, phone and e-mail;
(d) position, capacity, right of representation and signature;
(e) data on requests for quotes, offers, contracts, orders, projects, deliveries,
installations, works, commissioning, service, warranties, invoices, payments, balances,
receivables, notifications, formal notices, disputes and enforcement, to the extent that
they contain personal data.

3. Sources of data

(a) directly from the data subject;
(b) from the client, beneficiary, supplier, service provider, contractual partner,
representative or the person who transmits the necessary documents;
(c) from documents and records generated in the process of quoting, negotiating and
performing commercial or contractual relationships;
(d) from official registers or public sources, when consultation is necessary and
permitted by law.

4. Purposes and legal bases of processing

(a) quoting, negotiating, concluding and performing contracts, including delivery,
installation, assembly, commissioning, service, maintenance and warranty – performance of
the contract or pre-contractual steps requested by the data subject;
(b) invoicing, accounting and tax records, reporting and archiving – fulfilling the
Controller’s legal obligations;
(c) administering the commercial relationship, communicating with representatives and
contact persons, organizing works and services, preserving evidence, preventing fraud,
protecting assets, recovering receivables, as well as establishing, exercising or defending
a right – the legitimate interests of the Controller;
(d) other distinct operations – only on the basis of a legal ground provided by law.

5. Legitimate interests pursued

The legitimate interests pursued are the safe and efficient administration of commercial
relationships, the identification of and communication with the persons involved, the
organization of deliveries, works and services, the prevention of fraud and non-performance
of obligations, the preservation of evidence, the protection of assets, the recovery of
receivables and the defense of the Controller’s rights.

6. Recipients or categories of recipients

Data may be disclosed, to the extent necessary, to:

(a) authorized employees and collaborators of the Controller;
(b) providers of accounting, banking, payment, IT/cloud, e-mail, hosting, postal,
courier, transport, logistics, installation, service and maintenance services, to the extent
that access to data is necessary for the services provided;
(c) lawyers, auditors, consultants, debt recovery companies, notaries and judicial
enforcement officers;
(d) courts, public authorities and other entities to which disclosure is required or
permitted by law.

7. Transfers to other states or international organizations

If the processing involves such a transfer, the Controller will ensure the conditions and
safeguards provided by Law No. 195/2024 and will provide the data subject with the applicable
information on the transfer and the safeguards used.

8. Retention period

Data is kept for the duration of quoting, negotiating and performing the commercial or
contractual relationship and thereafter for as long as necessary to fulfill legal obligations
and to establish, exercise or defend rights. Data relevant to a dispute, a debt recovery
procedure or an enforcement procedure may be kept until their completion and the expiry of the
related legal terms.

9. Rights of the data subject

Under the conditions of the law, the data subject may request:

(a) access to data;
(b) rectification of inaccurate data or completion of incomplete data;
(c) erasure of data;
(d) restriction of processing;
(e) data portability, when the legal conditions are met;
(f) objection to processing based on legitimate interest.

Requests may be sent to office@ecolux.md or to the Controller’s office.

10. Processing based on consent

If a distinct processing is based on consent, it may be withdrawn at any time, without
affecting the lawfulness of processing carried out before withdrawal. Processing necessary for
the contract, legal obligations or legitimate interests does not depend on a general consent.

11. The right to lodge a complaint

The data subject may lodge a complaint with the National Center for Personal Data Protection
if they consider that the processing of their data infringes the applicable legislation.

12. The necessary nature of providing data

The provision of data necessary for identification, quoting, concluding and performing the
contract, delivery, installation, service, invoicing, payments and fulfilling legal
obligations is, as appropriate, a contractual or legal requirement or a necessary condition
for concluding or performing the relationship. Failure to provide strictly necessary data may
prevent quoting, concluding or performing the contract or exercising the related rights.

13. Automated decision-making

Within the relationships covered by this Notice, the Controller does not make decisions
based solely on automated processing, including profiling, that produce legal effects on the
data subject or similarly significantly affect them.