General information note

General Information Notice on the Processing of Personal Data

 1. WHO ARE WE?

APOLLO AI TECHNOLOGIES(referred to as “the Company”), with its registered office at Iași, Strada Spital Pașcanu no. 15, registered at the Trade Registry under no. J22/2010/2017, CUI 37836880, with the contact details provided below, processes personal data in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (the Regulation) and other applicable legal provisions regarding the processing of personal data.

This privacy notice describes why and how we process personal data and provides information about your rights when the Company acts as a Data Controller.

2. HOW CAN YOU CONTACT US?

YOU CAN CONTACT US AT:

Email: office@apolloaitech.com

Address: Strada Spital Pașcanu, no. 15, Iași, postal code 700373, Iași County.

3. DATA OR CATEGORIES OF PERSONAL DATA PROCESSED BY THE COMPANY

Personal data means any information regarding a natural person that identifies or can lead to the identification of that person.

Our policy is to collect the personal data necessary for the purposes determined by the Company’s activities and to ask our clients and partners to provide us with the personal data necessary for these purposes. Due to the diversity of services and/or products we offer, described here, it is possible to process multiple categories of personal data, varying depending on the type of product/service/activity/purpose of processing.

The main data/categories of data processed by the Company may include, depending on the purposes associated with the processing:

• Identity data (name, surname, series, and number of identity documents/civil status documents, etc.), other data found in identity documents (such as date of birth, etc.)
• Contact data (email address(es), domicile/residence address, phone numbers)
• Professional data, such as representing a legal person, place of work (qualification/professional training, position held, place of work, etc.)
• Data obtained from accessing the Company’s online platforms (such as the online identifier of persons accessing one or more of the Company’s websites/pages, identifier processed for the purposes mentioned in the respective page/Site’s Cookie Policy), potential data received/collected through social network platforms
• Data related to video monitoring of spaces used by the Company
• Unique identification number such as CNP (in exceptional situations such as assigning points by specific associations/bodies in the medical field for doctors participating in specialty events)
• Video images from spaces used by the Company or related to events organized by it: photos and videos (but not biometric),
• Preferences regarding types of services and products,
• Data necessary for risk assessment related to natural persons representing/guarantors in relation to legal entity clients
• It is possible to process special data such as union membership, political opinions, to the extent that they appear in public documents or declarations or in other publicly available sources
• Voice recordings from events, and in the call center only if calls are recorded, image/video from event recordings
• Signature
• Information regarding potential offenses/misdemeanors (which can be captured from public sources)

4. SOURCE OF PERSONAL DATA AND, IF APPLICABLE, WHETHER THEY COME FROM PUBLICLY AVAILABLE SOURCES

In general, we collect personal data directly from you. We may process personal data collected from other sources such as:

• Members of our communities, suppliers, or partners
• Other publicly available sources (such as the Trade Registry, ANAF, media, social network sites, etc.)

5. WHAT TYPES OF DATA PROCESSING DOES OUR COMPANY PERFORM?

Our Company processes personal data for the purposes stated in this privacy notice, and for each purpose, one or more data processing operations may be used such as collection, recording, organization, structuring, storage, adaptation, or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure, or destruction.

6. PURPOSES FOR WHICH PERSONAL DATA ARE PROCESSED

The Company processes personal data for multiple purposes, and the methods of collection, the legal basis for processing, use, disclosure, retention periods, etc., may vary depending on each purpose.

We may use personal data for one or more of the purposes described in this privacy notice. If the Company subsequently processes personal data for a purpose other than those you have already been informed of and which is not compatible with the purposes for which the data was initially collected/made known to you, the Company will provide information about the respective secondary purpose and any relevant additional information.

We use personal data mainly for the following purposes:

• Conducting the Company’s activities, providing products and services related to the Company’s main activity, such as communication and public relations activities, creating and managing business and/or professional communities, organizing events, professional information and communication within communities, marketing and communication services for clients, sending newsletters related to our websites, and digital reports related to our communities, website administration, and related activities. We offer a wide range of services and products that you can find here.
• Managing our relationships with clients, suppliers, and professionals from various fields, improving the Company’s activities and services concerning our clients and partners, correspondence, offers, negotiations, contract management.
• Processing personal data to fulfill contractual obligations and commitments made to you.
• Risk management related to our activity, taking security measures to protect personal data, involving detection, investigation, and resolution of security threats. Personal data may be processed as part of physical security monitoring or within the IT applications we use. We may also conduct checks on individuals acting as representatives and/or guarantors of clients or partner legal entities.
• In accordance with applicable law, using the contact details of our clients and partners to provide directly or indirectly information that we consider of interest to them. We may process personal data to invite you to dedicated events and programs, for participation in business and professional communities, promotion of services and/or products, associated activities.
• When visiting our websites or our social network pages, we may process some information about the online identifier of the visitor for the purposes mentioned in the Cookie Policy (for more information access the Cookie Policy) or other personal data potentially received/collected through these platforms and/or coming from social networks or other public digital sources.
• Compliance with legal and/or regulatory requirements, such as fiscal requirements or those requested by special regulatory acts governing our activity, or as applicable, for archiving.
• Economic-financial-administrative management.
• Establishment, exercise, or defense of a right in court.
• Internal statistics.

 7. LEGAL BASES AND CONDITIONS OF LEGALITY FOR DATA PROCESSING

The legal bases for processing consider the provisions of the Regulation and the normative acts regarding the processing of personal data adopted at the Romanian level, the applicable legislation in the Company’s field of activity, the Civil Code, the Fiscal Code, and related fiscal legislation.

The processing is based on at least one of the following legality conditions:

• Processing may be necessary for concluding a legal relationship/contract and/or for its execution;
• Processing may be necessary for fulfilling a legal obligation of the Company (e.g., those related to managing fiscal documents);
• Processing may be necessary for fulfilling a task serving a public interest (e.g., those related to archiving operations);
• Processing is necessary for the legitimate interests pursued by the Company or a third party, such as:

  – Administering our activity, providing goods and services related to the Company’s main activity, such as communication and public relations activities, creating and managing business and/or professional communities, organizing events, professional information and communication within communities, marketing and communication services for clients, sending newsletters related to our websites, and digital reports related to our communities, website administration, and related activities.

  – Managing our relationships with potential clients and clients or our partners, including, but not limited to, sending communications containing information and offers regarding our services and/or products, as well as those of our partners, in accordance with the law, inviting you to dedicated events and programs, for participation in business and professional communities, promotion of services and/or products, associated activities,

  – Managing risks related to our activity,

  – Managing complaints related to our services, to be able to resolve any reported issues and improve our products and/or services, establishment, exercise, or defense of a right in court,

• Processing may be based on your consent, only if we are in one of the situations expressly provided by the Regulation in this regard.

8. HOW LONG DO WE KEEP PERSONAL DATA?

We keep personal data processed by us only as long as necessary for the purpose for which they were collected (including according to applicable law or regulations), such as:

• For the duration of the contract/legal relationship for personal data necessary for its execution, including personal data that the Company may come into contact with during the execution of the legal relationship.
• Until the expiration of the statute of limitations in cases where the Company has a legitimate interest in keeping certain personal data in connection with a potential dispute that may arise between the parties.
• For the duration provided by law in situations where there are applicable normative acts in this regard (e.g., in the case of mandatory accounting registers and supporting documents that form the basis of financial accounting records, supporting documents may also include video recordings/photos taken for and/or during events we invite you to, etc.).
• For the duration of managing the relationship with potential clients/clients/beneficiaries of our services/partners of the Company and their representatives, until exercising the right to opt-out for sending communications containing information and offers regarding our services and/or products or those of other persons as applicable, commercial communications, invitations to events and dedicated programs, for participation in business and professional communities, promotion of services and/or products, associated activities.
• Until the withdrawal of consent for personal data processing based solely on consent.
• For 30 days for images related to video surveillance in the premises used by the Company.
• For the duration of public interest archiving mentioned by law or in the applicable policies of the Company, as applicable, for the data contained in documents for which the law or the Company has provided for archiving.

In any other hypotheses or in the absence of specific legal, regulatory, or contractual requirements, our reference period for retaining personal data is a minimum of 3 years from the date of termination of relationships / last contact between the Company and the data subject.

Any data may be retained by the Company, except as provided above, until the expiry of the prescription period, concerning situations where the Company would have a legitimate interest to retain certain personal data in connection with a potential litigation that might arise between the parties, for example, in the context of possible legal liability of the Company or the data subject.

In any situation, except as provided by applicable legislation, we delete your data at the moment you request this. The applicable exceptions will be communicated to the applicant through the response forwarded by our company regarding the data deletion request.

9. YOUR RIGHTS AND HOW TO EXERCISE THEM

Our Company is responsible for facilitating the exercise of any of your rights mentioned below.

Any of these rights can be exercised by sending an email to office@apolloaitech.com or through the website, or you can send a written request to the Company’s registered office or submit it in person at the office located at Strada Spital Pașcanu, nr. 15, Iași, Jud. Iași, postal code 700373.

For the protection of your data, to prevent abuse by malicious individuals seeking access to your data, our Company may require you to undergo preliminary identification steps to ensure that you are the person exercising the rights mentioned below through a request. If we receive a request from you regarding the exercise of any of the above rights, we may ask for additional information to verify your identity before acting on the request.

If you submit a request electronically to exercise your rights, the information will be provided by our company also in electronic format where possible, unless you request another format.

We will try to respond promptly to any request from you and, in any case, within the time limits expressly mentioned by applicable legal provisions (usually 30 days from the registration of the request). In certain situations, expressly provided by applicable legislation, we may charge an access request fee that takes into account the administrative costs necessary to fulfill the request.

If, due to the application of legal provisions, our company cannot comply, in whole or in part, with a request received from you as a data subject, the applicable exceptions will be communicated to you through the response forwarded by our company concerning the request in question.

Right of Access:	You have the right to access, according to Article 15 of the Regulation, to obtain from the Company confirmation as to whether or not it processes personal data concerning you and, if so, the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; (d) where possible, the period for which the personal data are expected to be stored or, if not possible, the criteria used to determine that period; (e) the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from you, any available information regarding their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject. If personal data are transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards pursuant to Article 46 of the Regulation regarding the transfer. Upon your request, the Company provides a copy of the personal data undergoing processing.
Right to Rectification:	You have the right to obtain from the Company, without undue delay, the rectification of inaccurate personal data concerning you, according to Article 16 of the Regulation. Taking into account the purposes for which the data were processed, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Where possible or necessary, we will make corrections (if applicable) based on updated information and inform you about this aspect if applicable.
Right to Erasure:	You have the right to obtain from the Company the erasure of personal data concerning you (according to Article 17 of the Regulation), without undue delay, except in certain hypotheses provided by the Regulation, if one of the following grounds applies: (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) you withdraw your consent on which the processing is based to the extent that the processing is based solely on consent and there is no other legal ground for the processing; (c) you object to the processing carried out for the purpose of a public interest or for the purposes of the legitimate interests pursued by the Company or a third party, and there are no overriding legitimate grounds for the processing that prevail over your interests/rights and fundamental freedoms regarding the processing or you object to the processing for direct marketing purposes; (d) the personal data have been unlawfully processed; (e) the personal data must be erased to comply with a legal obligation to which the Company is subject under Union or national law; (f) other situations provided by the Regulation as applicable.
Right to Restriction of Processing:	You have the right to obtain restriction of processing (according to Article 18 of the Regulation) in the following cases: (a) you contest the accuracy of the data, for a period enabling the Company to verify the accuracy of the data; (b) the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead; (c) the Company no longer needs the personal data for processing purposes, but you require them for the establishment, exercise, or defense of legal claims; or (d) you have objected to processing in accordance with Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right to Data Portability:	You have the right to receive your personal data (according to Article 20 of the Regulation) that you have provided to the Company in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance from the Company, where: (i) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the Regulation or on a contract pursuant to Article 6(1)(b) of the Regulation; and (ii) the processing is carried out by automated means. In exercising the right to data portability, personal data may be transmitted directly from the Company to another controller specified by you, where technically feasible.
Right to Object when Processing is Carried Out for Legitimate Interests Pursued by the Company or a Third Party:	You have the right to object at any time, on grounds relating to your particular situation, to processing carried out for the purpose of a public interest or for the purposes of the legitimate interests pursued by the Company or a third party, including profiling. In such cases, the Company will no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
Right to Object to Processing for Direct Marketing Purposes:	When processing is for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing. Please note that the Company may send you invitations, offers, information, and other types of communications in light of situations such as: following your participation in an event organized by the Company as the main organizer or as a partner, because you have subscribed on the site(s) to receive newsletters from us, or your participation as a member in a business and/or professional community managed by the Company, etc. The communication is managed by the Company in principle in a distinct manner (different communication lists) so that you receive information that is of interest to you. Consequently, if you exercise your right to object (opt-out) regarding receiving a specific communication (e.g., a newsletter), you may still receive communications from the Company related to a different communication list (such as digital reports intended for members of each community).
Right to Withdraw Consent:	If the processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The hypothesis of withdrawing consent is not applicable in cases where the processing ground is not consent.

10. TO FILE A COMPLAINT:RIGHT

If you wish to complain about aspects regarding the use of your personal data, please send an email with the details of your complaint to office@apolloaitech.com.

You can also submit your request using the details below:

Postal Address: Iași, Strada Spital Pașcanu no. 15,

Or through the website www.apolloaitech.com,

We will review and respond to any complaint we receive within the legal deadlines.

You also have the right to file a complaint with the National Authority for the Supervision of Personal Data Processing (“ANSPDCP”).

11. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA:

The Company may transmit/grant access/disclose personal data primarily to the following categories of entities:

• Public authorities and entities (such as tax authorities, etc.)
• Business partners (professionals in various fields of activity, members of business and/or professional communities managed by the Company, participants in activities, events, and programs organized by the Company, etc.)

We mention that members of the business and/or professional communities managed by the Company have access within the communities they belong to some personal data of the other members of the respective communities.

• Service providers and/or processors who process personal data on behalf of the Company, in accordance with the instructions received from us and comply with this notice, data protection laws, and any other appropriate confidentiality and security measures (such as companies specialized in organizing events, tourism service providers, transport service providers, marketing service providers, access and video monitoring, IT service providers who may have access to personal data, etc.)

Transfers and disclosures are generally not made to entities outside the European Union. If the Company transfers your personal data to a third country or an international organization, we will ensure that they are adequately protected, respectively that we transfer the data to a country that ensures an adequate level of protection as assessed by the European Commission, or, if the respective country does not have laws equivalent to the EU data protection standards, we will ask the third party to enter into a legally binding contract/agreement/instrument reflecting these latter standards or provide other appropriate safeguards in this regard. This paragraph does not include any processing carried out by some members of the business and/or professional communities managed by the Company (who have access to data available through the community), processing which is not under the control of the Company.

12. CONSEQUENCES OF REFUSING TO PROVIDE PERSONAL DATA:

If personal data are collected directly from you, we inform you that you are generally not obliged to provide your personal information to the Company, except in cases where providing them constitutes a legal or contractual obligation or a necessary obligation for entering into a legal/contractual relationship. Thus, if you opt for one or more of the Company’s services, choose to join a business and/or professional community managed by the Company, enter into a legal relationship with the Company, or benefit in another context from our services/products, providing personal data is a necessity from the perspective of legal requirements and/or the legal relationship with us, as this information is necessary to fulfill the obligations assumed by the Company in relation to you or to provide services and/or products to you.

Therefore, in certain situations, depending on the data you refuse to provide, it is possible that:

• our company will be unable to enter into a contract or continue the contractual relationship with you
• our company will be unable to fully or partially fulfill its obligations assumed towards you.

If you find the information contained herein ambiguous or unclear, you can request clarifications from us at any time at office@apolloaitech.com.

By this Notice, I acknowledge the information provided by Apollo AI Technologies considering the Regulation and have been informed by Apollo AI Technologies about the rights conferred by the Regulation and Romanian law regarding the protection of individuals with regard to the processing of personal data and the free movement of such data.