Thank you for your interest in our company. We are committed to respecting your privacy, acting strictly in accordance with applicable data protection laws and regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This statement (together with the Cookie Directive and any other documents referred to in the content of this statement) aims to provide you with information about the personal data that we collect from you or that you provide to us in the relationships we have, including through this website, and how it will be processed by us.

The person responsible for the processing of personal data, described below, is Porsche Romania SRL, with headquarters at Bd. Pipera, No. 2, 77190, Voluntari, Ilfov County ("Porsche Romania" or "Company"), as the controller.

During Porsche Romania's activities, your personal data may be processed differently depending on the capacity you have in your interaction with the Company. Below you can find the relevant details regarding how your personal data is processed by the Company, considering the nature of your relationship with it, such as website user, customer or potential customer, representative of a contractual partner or collaborator, candidate for available positions within the Company, employee. Please refer to the section on the processing of personal data presented below that is applicable to you.

1. Data security

1.1 To protect your data, Porsche Romania has taken appropriate technical and organizational measures that, among other things, protect your data against loss, manipulation or unauthorized access. The measures taken are reviewed regularly and are constantly adapted to the current state of the art. In the event of a breach of the protection of your personal data, which is estimated to result in a high risk to your rights and freedoms, we will notify you immediately, without undue delay.

1.2 Please note that you are responsible for the confidentiality and security of your user data and passwords, which have been handed over or communicated to you.

2. Processing of minors' data

2.1 We expressly point out that all processing of personal data refers exclusively to persons who have reached the age of 16. The use of systems and work tools, as well as the results of data processing of users who do not have this minimum age, cannot take place without the consent of their parents/guardians. If personal data processing nevertheless takes place, we will cease processing these data as soon as possible after becoming aware of this fact.

3. Collection and processing of personal data

3.1. Data provided by you

Personal data is processed by us in accordance with the legal provisions in force regarding the protection of personal data. If you take a test drive, correspond with us through the website or social media channels, apply for open positions within the Company, have a contractual relationship with the Company or fill out a form with personal data on our website, please note that your personal data will be processed for the purposes described below in section 5.

3.2. Data collected by us

If you visit our website, personal data is automatically recorded using Cookies. For more information on the Cookies used on our website, please see section 6 and the Cookie Policy.

We may also process your personal data collected by the Company for the purpose of informing you about various measures recommended by the manufacturer to improve the quality of motor vehicles, as described below in section 5.

4. Partners

To carry out the processing described below, the Company uses the services of partners who may be: service providers, IT systems and applications, marketing and call-center service providers, personnel selection and recruitment service providers, opinion poll and market research service providers, courier service providers, legal service providers, all of whom operate in Romania or in countries within the EU (Austria, Germany, the Czech Republic, Spain, etc.). We make every effort to ensure that our partners process your personal data safely and securely, in accordance with applicable data protection legislation and that your rights are respected. The personal data we disclose to our partners is limited to the minimum necessary for the provision of those services and we ask these partners not to use the personal data for any other purpose.

The personal data indicated below may also be made available or transmitted to third parties in the following situations (in these cases, third parties who do not intend to process the data, but may have access to them in the performance of their tasks or in their interactions with the Company): (i) public authorities or institutions (for example, if communication is necessary for the management of complaints, for the fulfillment of legal and fiscal obligations resulting from the organization of promotional campaigns and contests or when the Company is obliged, by virtue of a legal provision, to provide information to authorities or institutions competent to carry out inspections and controls on the Company's activity and assets, or to courts of law, for the protection of the Company's rights and assets), (ii) notaries public (for example, for the organization of promotional draws), (iii) financial or legal auditors; (iv) to any third-party acquirers, to the extent that the Company's activity would be transferred (in whole or in part), and the data of the data subjects would be part of the assets subject to such a transaction; (v) to the Company's authorized service partners and distributors; (vi) to the companies in the international group of which Porsche Romania is a part.

5. Data processing for which consent is not required

More information regarding the processing of personal data for which consent is not required can be found below.

Drive Test

To perform a drive test, the Company processes your personal data from the following categories: contact and identification data (data contained in the ID card and driver's license), vehicle data, telephone number, e-mail address, feedback following the test, signature.

Purpose: Carrying out a drive test of one/several vehicles at the request of the data subject

Grounds: Contract or pre-contractual relationship

Storage period: 3 years

Information on quality improvement measures

To inform customers about the measures recommended by the manufacturer for vehicles, Porsche Romania processes your personal data from the following categories: contact and identification data (data contained in the CI), vehicle data.

Purpose: Informing the data subject about measures to improve the quality of motor vehicles

Grounds: The legitimate interest of Porsche Romania to inform customers about the measures recommended by the manufacturer to improve the quality and/or safety of the use of the vehicle

Storage duration: until the quality improvement measure is completed and closed by the manufacturer.

Complaints/information requests

To process complaints/requests received from you, your personal data from the following categories are processed: contact and identification data (name, surname, telephone, e-mail, form of address), vehicle data.

Purpose: Processing and resolving complaints/requests for information

Grounds: The legitimate interest of Porsche Romania to respond to and resolve customer requests and complaints.

Storage period: 4 years

Interaction with users of social media channels

When you interact with us through social media channels such as Facebook, Instagram, Twitter, YouTube on the company's official pages or when you send us questions, complaints or requests formulated through these communication channels, your personal data that you provide to us will be processed, such as: name and surname, image, username, IP address and, where applicable, e-mail address, telephone number and any other information or details that you communicate to us in correspondence.

Purpose: Transmitting answers to questions, complaints or requests via social media channels.

Grounds: Legitimate interest, which allows us to interact with people interested in the information published on the company's pages through social media channels such as Facebook, Instagram, Twitter and to provide answers to the questions, complaints or requests of users who address us.

Storage period: 4 years

Processing of data of representatives of contractual partners involved in the performance of contracts with Porsche Romania SRL and/or representatives of public authorities

If you are the contact person of partners, potential partners or public authorities with whom Porsche Romania interacts in the performance of contracts, the latter processes your personal data.

Purpose: For the initiation or development of the contractual relationship between Porsche Romania and partners or potential partners, as well as for the initiation or development of relationships between Porsche Romania and representatives of public authorities with whom it interacts in the course of its current activity.

Grounds: the legitimate interest of Porsche Romania to initiate and develop contractual relationships and/or with public authorities in carrying out its activity in the context of offering its products and services.

Storage period: During the duration of the contractual relationship, but no more than 4 years after the termination of the contractual relationship.

Recruitment

The data contained in your CV, which we invite you to send to the e-mail address available on the site, are processed according to the information note that provides complete information about the categories of data we process, the recipients of this data, the storage period, the basis for the processing, and your rights.

Financial, accounting and tax reporting

If you purchase products or services from Porsche Romania, it processes your personal data (name, surname, address, purchase or service invoice data), for the purpose of financial, accounting and tax reporting to the Romanian authorities.

The legal basis for this processing is the Company's legal obligation to report accounting, financial and tax information in relation to the transactions carried out.

The storage period of your personal data processed for this purpose is 10 years.

Compliance with the contractual obligations assumed by the Company

If you purchase products from one of Porsche Romania's Authorized Distributors, through an intermediary within the EU, or if you are the representative of that intermediary, the Company may process your personal data (name, surname, address, contact details - e-mail, telephone number), to verify the compliance of the sale with its contractual obligations.

The legal basis for this processing is the Company's legitimate interest in complying with its contractual obligations.

The storage period of your personal data processed for this purpose is 2 years.

Compliance with the rules on preventing and combating the financing of terrorism and money laundering. Compliance with the rules on international sanctions.

If you purchase products from Porsche Romania, it processes your personal data (name, surname, date of birth) to comply with the rules on preventing and combating the financing of terrorism and money laundering, as well as in order to comply with the rules on international sanctions.

The legal basis for this processing is the Company's legal obligation to comply with the above-mentioned rules.

The storage period of your personal data processed for this purpose is 5 years.

As part of the personal data processing described above, Google tools are used, about which we provide you with information below, within the meaning of Articles 12 (1) and 13 (1) letter (f) of the GDPR.

Google Fonts

The Google Fonts tool (formerly Google Web Fonts) is used on our website for the uniform display of fonts. Google Fonts is an interactive collection of over 1300 fonts that Google makes available to companies for free use. When you access a web page, your browser loads the fonts necessary for the correct display of texts into the cache. Porsche Romania does not process personal data as part of Google Fonts. It cannot be excluded that Google Ireland (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) processes additional data as part of the process, creates a personal reference and sends it to Google Inc. (location: USA).

You can find more information about Google Web Fonts at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/.

Google Maps

The selection of the Dealer or Service Partner, as well as the possibility of planning a route after booking an online service, is done using the Google Maps tool. For this processing of personal data, they are transmitted to Google Ireland (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). If you do not want your personal data to be transmitted to the IT service provider Google, you can contact the Dealer or Service Partner directly or use our contact form. When using Google Maps, the following personal data is processed: IP address, already installed Google cookies, previous interactions with the browser, the number of mouse movements and keystrokes and the time spent on websites.

It cannot be excluded that Google Ireland (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) will process additional data as part of the process, create a personal reference and send it to Google Inc. (location: USA).

You can find more information about Google Maps in Google's privacy policy: https://www.google.com/policies/privacy/.

Address validation by Google

This is the way in which certain fields containing personal data are automatically filled in. For this processing of personal data, they are transmitted to Google Ireland (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). If you do not want your personal data to be transmitted to Google's IT service provider, you can contact your Dealer or Service Partner directly or use our contact form. When you use Google Maps, the following personal data is processed: IP address, Google cookies already installed, previous interactions with the browser, the number of mouse movements and keystrokes and the time spent on websites.

6. Cookies and Social Plug-ins

6.1 We collect data automatically

using Cookies. A Cookie is a small text file that saves your internet settings. Almost every web page uses this technology. It is downloaded by your internet browser the first time you access a web page. The next time you access this web page with the same device, the Cookies and the saved information are either sent back to the web page that created them (First Party Cookie) or to another web page to which they belong (Third Party Cookie). This way, the web page recognizes that you have accessed the page with this browser before and in some cases varies the content displayed.

6.2 For more information about Cookies used on our website, please see the Cookie Policy.

7. Rights of data subjects

You can exercise the following rights regarding the processing of personal data:

7.1 Right to information. You can request confirmation of the processing of your personal data and how it is used.

7.2 Right to rectification. If we process incomplete or incorrect personal data, you can request its correction or completion at any time.

If you have created a user account, you can access your personal data at any time and complete or correct it. In addition, you can close your user account at any time.

7.3 Right to erasure. You may request the erasure of your personal data if the purpose for which they were collected no longer exists, if their processing is contrary to legal provisions, if their processing excessively affects your interests or if the processing is based on your consent, which you have revoked. You should note that there may be other reasons that prevent the immediate erasure of your data, for example, mandatory archiving periods, pending actions, claims, the exercise or defense of legal rights, etc.

7.4 Right to restriction of processing. You have the right to request a restriction of the processing of your personal data in the following cases:

• Contest the accuracy of your data, for a period that allows us to verify the accuracy of your data,
• the processing of your personal data is contrary to legal provisions, but you oppose their deletion and request a limitation of the use of these data,
• we no longer need your personal data for the intended purpose, but you still need this data for the purpose of enforcing, exercising or defending legal claims or you have contested the processing of your personal data.

7.5 Right to data portability. You may request that we provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format, to the extent that we process these data on the basis of your consent or for the performance of a contract between us and the processing is carried out by automated means.

7.6 Right to object. If we process your personal data for the performance of tasks carried out in the public interest, in the exercise of official authority or in the case of the need to defend a legitimate interest, you may object to the processing of this data, to the extent that there is an overriding legitimate interest in relation to your personal data. You may at any time revoke your consent to the transmission of advertising messages without giving a reason.

7.7 Right to complain. If you believe that we have violated provisions of Romanian or European law in the context of processing your personal data, thus infringing your rights, please contact us so that we can clarify your questions. Of course, you also have the right to contact the Romanian Data Protection Authority, respectively a European supervisory authority.

These rights can be exercised directly against Porsche Romania SRL by sending a notification to the email address [email protected]

8. Contact details

Responsible: Porsche Romania SRL

Bd. Pipera, No. 2, 77190, Voluntari, Ilfov Email: [email protected]

Phone: 021/203 28 88

Version: May 2022