PRIVACY NOTICE

Hilton Garden Inn Bucharest Airport

1. Introduction

This Privacy Notice (hereinafter – Privacy Notice) informs how APEX ALLIANCE AERO 5 S.R.L., registered address in Romania, Bucharest, District 4, 15 Episcopul Chesarie str., Tronson C, ground floor, office no. 1, room no. 7, registered with the Trade Register under No. J40/15089/2017, Sole Registration Code 38160351, the owner of the hotel Hilton Garden Inn Bucharest Airport, located at Bucharest, Aeroportului Boulervard 13, (hereinafter – the ‘Company‘ or the ‘Hotel’) collects, stores and otherwise processes personal data while respecting the privacy of individuals.

Following the spin-off process of APEX ALLIANCE AERO 5 S.R.L. (APEX 5), managing Hilton Garden Inn Bucharest Airport Hotel, located at Bulevardul Aeroportului 13, Otopeni 075150, Romania, APEX 5 legal and contractual obligations, including customer data, will be transferred to a newly established Romanian legal entity, AAHM-OTP S.R.L., with subsequent dissolution of APEX 5 (Transaction). It is estimated that the Transaction should be completed and all necessary registration procedures of AAHM-OTP S.R.L. should be finalized by September 15th, 2025. Full registration and contact details of AAHM-OTP S.R.L. will be published here immediately upon its registration.

The data controller is managing the Hotel under the Franchise Agreement with Hilton Worldwide Holdings Inc. Hotel Group, which includes brands such as: Waldorf Astoria Hotels & Resorts, Conrad Hotels & Resorts, Canopy by Hilton, Hilton Hotels & Resorts, Curio A Collection by Hilton, DoubleTree by Hilton, Tapestry Collection by Hilton, Embassy Suites by Hilton, Hilton Garden Inn, Hampton by Hilton, Tru by Hilton, Homewood Suites by Hilton and Home2 Suites by Hilton etc. (hereinafter the “Group”).

We are glad to see that you are interested in our company, our products and our services and we would like to provide you with some highlights regarding the way we handle and protect your personal data.

When using our services, you entrust us with your most personal information. We understand this is a big responsibility and we work hard to protect your information and keep you informed on how we handle your personal information.

All your personal data is processed in accordance with the General Regulation (EU) 2016/679 on the protection of personal data (hereinafter referred to as the “Regulation”), national legislation governing the protection of personal data and other legislation governing the protection of personal data.

The compliance with the right to personal data protection, as well as the right to privacy is one of the core missions of the Company.

The purpose of this Privacy Notice is to inform you of:

• The types of personal data which we may collect about you and how it may be processed;
• Our use of personal data regarding IP Addresses and our use of cookies;
• Any disclosure of personal data to third parties;
• Your ability to correct, update and delete your personal data;
• The security measures we have in place to prevent the loss, misuse, or alteration of personal data under our control;
• Retention period of personal data.

In this Privacy Notice we provide information on how we process data subjects Personal data in the course of carrying out the Company’s business, concluding and executing agreements, managing orders, and providing our services.

We commit ourselves to be transparent with you by providing clear information about what Personal data we process, the purpose of the processing, the retention period of the Personal data as well as the legal basis for the processing, your data subjects rights, and other information that we are required to provide under to applicable legislation.

If you use our Services, it means you have read this Privacy notice and understood the purposes, methods, and procedures for processing your Personal data specified herein.

2. What are personal data and how are they processed?

Personal data is any information about you that could directly or indirectly identify your identity by name, surname, personal code, location data, and IP address and other physical, physiological, genetic, mental, economic, cultural, or social aspects of your identity.

When processing your personal data, Company follows the following principles of personal data processing:

• Your personal data are processed only to the extent necessary to achieve the relevant, clearly defined and legitimate purposes, taking into account the protection of your privacy;
• Your personal data are processed accurately, fairly and lawfully and only for purposes that are consistent with the purposes for which your personal data were collected prior to collection;
• Your personal data are processed strictly in accordance with the statutory requirements for clear and transparent processing of personal data;
• Your personal data will be processed only in a form that identifies you for no longer than it is necessary for the purposes for which the personal data are processed;
• The processing of your personal data is subject to relevant technical and organizational measures to ensure the security of personal data, including protection against unlawful data processing and unintentional loss, destruction and damage.

3. The purposes, scope, retention period and legal basis of the processing of Personal data in the Company’s business operations:

3.1. Management and archiving of Hotel guest’s registration cards:

Categories of personal data	Last name, first name, address: street and no, zip code, city, state, country of residence, nationality, date of birth, passport / ID number, issuing country, company, ‘Hilton Honors’ membership number, frequent flyer number, telephone number, email address, signature, arrival date, departure date, room number, room type, room rate, customer’s preferences.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (performance of a contract or steps necessary prior entering into a contract).
Retention period	1 year from the date of the client’s (guest’s) departure.

3.2. Registration of guest’s arrival (check-in) and departure (check-out) from the Hotel:

Categories of personal data	Last name, first name, address: street and no, zip code, city, state, country of residence, nationality, date of birth, passport / ID number, issuing country, company, ‘Hilton Honors’ membership number, frequent flyer number, telephone number, email address, signature, arrival date, departure date, room number, room type, room rate, customer’s preferences.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	1 year from the last accommodation / reservation.

3.3. Administration and management of services for the Hotel guests:

Categories of personal data	Last name, first name, address: street and no, zip code, city, state, country of residence, nationality, date of birth, passport / ID number, issuing country, company, ‘Hilton Honors’ membership number, frequent flyer number, telephone number, email address, payment method, bank account or (credit) card number, signature, arrival date, departure date, confirmation, room number, room type, room rate, user ID, details of stay, other bookings (parking, hotel, restaurant, event, theatre, other hotels from our Group of hotels in case of overbooking etc.), customer’s preferences, purchases and transactions (history).
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	1 year from the last reservation.

3.4. Reservation management:

Categories of personal data	Name, surname, date of birth, bank card number and date of validity, name and surname of the bank card owner, address, country of residence, e-mail, telephone number, information about the visit, reason for visit, ‘Hilton Honors’ membership number.
Legal basis of data processing	• Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement); • Point (f) of Article 6(1) of the Regulation (for the Company’s legitimate interests in the proper management of cancelled reservations).
Retention period	5 years from the last reservation.

3.5. Management of gift cards:

Categories of personal data	Gift card’s data.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	Until the full usage of the value of a Gift Card.

3.6. Receipt of a credit card or deposit as a guarantee / security against payment for accommodation:

Categories of personal data	Bank card number and date of validity, name and surname of the bank card owner.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	Until the check-out of the guest and full payment for the services provided.

3.7. Debt management:

Categories of personal data	Name, surname, identification number, payments information, information on debt.
Legal basis of data processing	Point (f) of Article 6(1) of the Regulation (for the legitimate interests of the Company in debt management and debt recovery for defaulted payments for services provided).
Retention period	1 year from the date of the debt recovery.

3.8. Creating and updating the client’s profile in the Hotel Management System:

Categories of personal data	First name / Last name, identification number, age (date of birth), gender, telephone number, email address, details of stay, bookings (hotel, restaurant, event, theatre, etc.), loyalty membership number, preferences.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	1 year from the last reservation.

3.9. Conference hall reservation:

Categories of personal data	Conference room, date, time, pax, price, setup, food and beverages inquiries, name, surname (organizer), company name, email, telephone.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	1 year from the reservation.

3.10. Company advertising in the public domain:

Categories of personal data	Images, video recordings.
Legal basis of data processing	Point (a) of Article 6(1) of the Regulation (based on the data subject’s consent).
Retention period	5 years from the receipt of data or until withdrawal of the consent (whichever occurs first).

• Restaurant reservation management:

Categories of personal data	First name, last name, telephone number, other information related to the reservation.
Legal basis of data processing	Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement).
Retention period	6 months from the date of data submission.

3.12. Management of reviews, complaints and inquiries:

Categories of personal data	Name, email and text of the review, request and / or complaint (including personal data therein).
Legal basis of data processing	· Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement); · Point (f) of Article 6(1) of the Regulation (based on processing is necessary for the purposes of the legitimate interests).
Retention period	1 year from the date of the inquiry, request and/or complaint.

3.13. Video surveillance in order to ensure the safety of hotel guests and employees, maintain public order and protect guests and Hotel property:

Categories of personal data	Data from video cameras.
Legal basis of data processing	Point (f) of Article 6(1) of the Regulation (in the legitimate interests of Company in order to ensure the safety of hotel guests and employees, maintain public order and protect guests and hotel property).
Retention period	30 days from obtaining data.

Video surveillance is carried out in the following premises and territories:

• For the purpose of ensuring the safety of the Hotel’s guests and employees: in the Hotel lobby, in the reception area, in the Hotel’s restaurant, in the bar, in lift accesses at each of the building floors, Hotel parking;
• For the purpose of maintaining public order at the Hotel: in the Hotel lobby, on the Hotel’s premises (parking areas, at the central and service entrance of the Hotel), in the lobbies of the Hotel, in the restaurant, in the bars, in lift accesses at each of the Hotel floors;
• For the purpose of protecting the property of guests and the Hotel: in the reception area, on the Hotel ramp, in Hotel parking, in the restaurant, in the bars, in lift accesses at each of the Hotel floors.
  • Using Wi-Fi connection:

Categories of personal data	Device name, IP address assigned, Device MAC address, Details of the access point being used (name), Room name, Connection session duration, Amount of data sent, amount of data received.
Legal basis of data processing	Point (a) Article 6(1) of the Regulation (consent).
Retention period	Until the end of the Wi-Fi connection session.

3.15. Invoicing, accounting:

Categories of personal data	Name, surname, payment account number, issued / paid invoices, and their content (e.g. the amount, type of services, quantity, etc.), email address, telephone number, position (if applicable).
Legal basis of data processing	• Point (b) of Article 6(1) of the Regulation (in order to conclude or / and perform service agreement); • Point (c) of Article 6 (1) (according to national legislation).
Retention period	10 years.

3.16. Selection of candidates for the workplace:

Categories of personal data	Name, surname, date of birth, image, city and country of residence, e-mail, telephone number, work experience, knowledge of foreign languages, professional experience, education, information about desired positions and working conditions, data on diseases that could prevent the proper performance of the desired work, other data submitted by the candidate such as CV, cover letter, recommendation and/or other documents.
Legal basis of data processing	Point (a) of Article 6(1) of the Regulation (based on the data subject’s consent expressed when applying for a job position).
Retention period	Until the end of the selection for the job position or until the withdrawal of consent (whichever occurs first). In the case of separate consent to store data after the selection – 2 years after receiving consent or until the withdrawal of consent (whichever occurs first).

1. In order to improve our website, we may process cookies. You can find more information about the processing of cookies in the Cookie Policy.

4. Children’s personal information

4.1. We protect the privacy of data obtained from children under 16. If you are under the age of 16, you must obtain the consent or permission of your parents or legal guardian for any personal data you provide.

4.2. Our website and applications are not intended to be used by minors and does not collect through the website, knowingly, information about children under 18 years old.

4.3. In case a minor will access and use our website, we will automatically consider that he/she had the consent of his/her legal guardian. If we discover that a minor has used our website without the consent of his/her legal guardian, we will delete all the personal data related to him/her.

4.4. We do not knowingly collect, disclose, or sell personal information of individuals under the age of majority in their respective jurisdiction without permission from a minor’s parent or guardian. When searching for hotel reservations on our website or one of our applications, you may be asked to provide the ages of any minor guests staying in the room. We collect this information for the purpose of determining room rates where applicable.

5. The sources of data obtained and processed by the Company

5.1. We collect personal data from most of our interactions with you, as well as within other aspects of our business.

5.2. You can always choose which personal data you want to provide us with. However, if you choose not to provide certain personal data, if the basis of our request is the compliance with a legal obligation, contractual obligations or obligations required in order to conclude an agreement, we will not be able to provide you with certain services, for example: i) if you do not wish to provide us with your surname, first name, e-mail address or phone number, if you wish to make a reservation, we will not be able to make the reservation, or (ii) in the arrival-departure sheet you will fill in when you arrive at our hotel, you will have to enter some personal data required by law, and if you do not wish to fill out those mandatory fields, we will not be able to accommodate you.

5.3. To provide you with the expected level of hospitality and the best services, we may collect information about you from our business partners and other third parties, as detailed below:

5.3.1. From Hilton Worldwide Holdings Inc Group members for similar purposes or in connection with those for which they were collected;

5.3.2. From our business partners: such as card partners, social networking services that are consistent with your own settings for these services, travel agencies, online travel agencies such www.booking.com, event planners and etc.;

5.3.3. Candidates’ CV and other related data from job search portals;

5.3.4. From public authorities where we are obliged to do so by applicable law.

6. The cases and grounds for transfer and disclosure of Personal data to the third parties

6.1. In order to ensure a continuous operation and the proper provision of services, we may disclose your personal data to our employees, managers, suppliers, subcontractors, and service providers, if reasonably necessary to achieve those purposes.

6.2. We may also transfer your personal data to subsidiaries and to third parties who process your personal data and / or have access to them, on our behalf and upon our instructions, e.g. to the providers of IT systems and other persons who help us to duly provide you with the services.

6.3. To provide you with the expected level of hospitality and high-quality services, your data may be sent from a Hilton Worldwide Holdings Inc. Group hotel to another Hilton Worldwide Holdings Inc Group hotel or the company headquarters.

6.4. We provide your data to our service providers and other third parties, as detailed below:

6.5. Suppliers: in order to provide the requested services, in some cases, we will need to forward some of your personal data to suppliers; they are processors and process the data on our behalf and according to our instructions (such as software, IT, accounting, marketing, audit service, etc.);

6.6. Hilton Worldwide Holdings Inc Group members

6.7. Our data processor, the Hotel’s operator UAB Apex Alliance Hotel Management for purposes mentioned above;

6.8. Group events or meetings: if you visit our hotels as part of a group or conference, the information required for planning the meeting and event may be shared with the organizers of those meetings and events and, where appropriate, with the guests who are organizing or attending the meeting or event.

6.9. Business partners: in some cases, we associate with other companies, to provide you with products, services, or offers. For example, we can arrange for you to rent a car or intermediate optional services for products beyond our offer.

6.10. Public authorities and/or institutions: according to national legislation for: (i) complying with the legal provisions, (ii) responding to their requests, (iii) reasons of public interest (e.g.: national security).

6.11. In case of a merger, acquisition, or other change in organizational structure of the Company your data may be transferred to a new owner / partner taking into consideration the purposes for which the data was originally obtained, and the lawful basis for sharing it, as well as ensuring compliance with the data processing principles and allowing data subjects to exercise their rights.

6.12. The privacy of your data is important to us, which is why the transmission of personal data in accordance with all the above is done only on the basis of a privacy commitment on the part of the recipients, to ensure that the data is kept safely and that such information is provided in accordance with the legislation in force and applicable policies. In any case, we will always send to recipients only the information strictly necessary to achieve that purpose.

6.13. In order to secure appropriate security level, in such a manner that processing Personal data will meet the requirements of the Regulation and ensure the protection of the rights of the Data subject which data is processed, we are cooperating only with those service providers / partners who are obliged to implement necessary technical and organizational measures. 

7. Jurisdiction and territory of the processed Personal data

7.1. We process your Personal data in the territory of the European Union, except for the exceptions below.

7.2. We may transfer your data to Hilton Worldwide Holdings Inc., located outside the EU/EEA (United States of America), which acts as an independent data controller, for the following purposes: (i) Registration of guest’s arrival and departure from the Hotel; (ii) Administration and management of services for Hotel guests; (iii) Reservation management; (iv) Creating and updating the client’s profile in the Hotel Management System. The Hilton Privacy Statement available on http://hiltonhonors3.hilton.com/en/promotions/privacy-policy/english.html.

7.3. Please note, that some of the data we collect when you are browsing our website or data generated by visiting our website, or data provided when you communicate with us via social media applications (Messenger, WhatsApp, etc.) may be transferred or available to the companies acting by both in the European Economic Area (EEA) and the third countries such as United States of America and other non-EEA countries (such as Google Analytics, Facebook Ads or other similar services, functionalities and goods).

7.4. We do not control those third-party sites or any of the content contained therein, and you agree that we are in no way responsible or liable for any of those third-party sites, including, without limitation, their content, policies, failures, promotions, products, services or actions and/or any damages, losses, failures or problems caused by, related to or arising from those sites.

7.5. In order to ensure an adequate level of data security and to guarantee the lawful transfer of data for transfer of data outside the EU and the EEA, we are following the terms and conditions set out in the Regulation.

8. The security of data processed by the Company

8.1. We pay close attention to protecting your data and applies appropriate technical and organizational measures to ensure the protection of personal data processed, appropriate to the risks and categories of data protected. In particular, we protect your data by limiting access to authorized persons, respecting the applicable laws, as well as taking measures against data change, loss, damage or destruction.

8.2. In order to guarantee the security of your data we use appropriate organizational and technical measures to protect your personal information from loss, misuse, alteration or destruction. The security measures in place will, from time to time, be reviewed in line with legal and technical developments.

8.3. In order to adequately protect your personal data on our systems, we take appropriate technical and organizational measures, including but not limited to:

8.3.1. Ensuring strict access controls and limiting access to data to those who have a need to know;

8.3.2. Access to personal data is protected by passwords of an appropriate level;

8.3.3. We enter into confidentiality agreements with those who have access to your data;

8.3.4. Monitor access to personal data; etc.

8.4. The data is stored securely and provided only for those persons who have to access the data to perform their duties and obligations. In order to secure your data, we also demand our business partners to implement necessary technical and organizational measures.

9. Data subject’s rights

9.1. You as the Data subject have the rights under the Regulation and law and you can freely exercise your rights. In this Privacy Notice we are delivering your rights guaranteed to you by Regulation and the main ways how to implement your rights. 

9.2. Your data subject’s rights:

9.2.1. The right to obtain information regarding processing Personal data:

9.2.1.1. At the moment when we collect your data we provide you with information regarding processing your Personal data. You can always find the information on how we process your Personal data in this Privacy Notice or by submitting your request by email: privacy@hgiotopeni.com.

9.2.2. The right to access data processed:

9.2.2.1. You have the right to access the Personal data and obtain a confirmation from us on how we process your Personal data, including the basis for processing data, categories, data processors, and other information. We will provide a copy of your data. You have the right to obtain your Personal data in a structured, commonly used, and computer-readable format. However, you will not be able to exercise this right in cases where it may adversely affect the rights and freedoms of third persons. We have the right to refuse to provide the data we process if there are legal grounds set out in the law under which the Personal data are not provided.

9.2.3. The right to rectify your Personal data:

You have the right to rectify or modify, amend or correct your Personal data.

9.2.4. The right to request the erasure personal data (right to be forgotten):

9.2.4.1. You can exercise this right when:

9.2.4.1.1. The Personal data are no longer necessary in relation to the objectives for which they were collected or otherwise processed;

9.2.4.1.2. You withdraw consent and there is no other legal ground for the processing;

9.2.4.1.3. You object to the processing pursuant to our legitimate interest or third party interest;

9.2.4.1.4. Data is processed for direct marketing purposes;

9.2.4.1.5. The Personal data have been unlawfully processed;

9.2.4.1.6. Personal data must be erased in accordance with the requirements of the legislation applicable to us. In some cases, you will not be able to exercise the right to be forgotten due to some exceptions. These exceptions cover the cases where the processing of Personal data is necessary in order to:

9.2.4.1.7. For exercising the right of freedom of expression and information;

9.2.4.1.8. For compliance with our legal obligation;

9.2.4.1.9. For the establishment, exercise or defense of legal claims.

9.2.5. Right to restriction of your Personal data processing:

9.2.5.1. You can exercise this right:

9.2.5.1.1. When you challenge data accuracy;

9.2.5.1.2. When Personal data is processed unlawfully, however you don’t want to delete your Personal data;

9.2.5.1.3. When there is no need to process your Personal data, however you request data in order to establish, exercise or defense of legal claims.

9.2.5.1.4. When you restrict processing your Personal data based on our or third-party legitimate interest, the data will be processed until the ground of your restriction will be verified.

9.2.5.1.5. We must point out, that because of the restriction of data processing, during the period of such restriction, we may be continuing to store your data, without processing data, except:

9.2.5.1.6. For the establishment, exercise or defense of legal claims;

9.2.5.1.7. To protect the rights of natural or legal persons;

9.2.5.1.8. For important reasons of public interest.

9.2.6. Right to object to data processing.

9.2.6.1. You have the right to object to Personal data processing when Personal data is processed based on our legitimate interests. To exercise the right specified in this paragraph, please submit a written request by e-mail privacy@hgiotopeni.com.

9.2.7. Right to object to data processing, when direct marketing is the basis for processing.

When you withdraw your consent of processing your Personal data for direct marketing purpose, we won’t process data based on your consent for this purpose. 9.2.8. Right to data portability.

9.2.8.1. You can exercise this right when we process your data by automated measures (computers, etc.) and the legal basis for processing is:

9.2.8.1.1. Your consent;

9.2.8.1.2. The performance of the agreement or our actions made with your request before concluding the agreement.

9.2.8.1.3. With your request and where technically possible we will move your data to another data controller.

9.2.9. Right to withdraw the consent to process your Personal data.

9.2.9.1. In those cases, where we process your data on the basis of your consent, you have the right to withdraw your consent at any time and data processing based on your consent will be stopped. Withdrawal of consent will not affect the lawfulness of the processing prior to the withdrawal.

9. 2.10. Right to lodge a complaint to the supervisor authority.

9.2.10.1. If you think that we process your data in breach of the requirements of Personal data protection legal acts, we always ask that you contact us directly at first. If you are not satisfied with a problem solution, you will have the right to lodge a complaint with the ANSPDCP, the Romanian Data Protection Authority via the following link: https://www.dataprotection.ro/?page=Plangeri_pagina_principala.

10. Company contacts and communication methods

10.1. If you will have any questions how we process data or if you will have any requests or remarks, please contact us: privacy@hgiotopeni.com.

11. Procedure for dealing with data subjects’ requests

11.1. In order to protect Personal data from illegal disclosure, by submitting the request for implementing the data subject’s rights, he/she shall confirm his identity:

11.1.1. Where the request is submitted to an employee of the Company – by producing a valid personal identity document;

11.1.2. Where the request is submitted by post or courier, it shall be accompanied by a copy of a valid personal identity document certified according to a procedure prescribed by law;

11.1.3. Where the request is submitted electronically – the identity shall be confirmed by means of electronic communications that enable a proper identification of a person.

11.1.4. The data subject may exercise his rights either himself or through a representative.

11.1.5. Where the request is submitted to the Company by the data subject‘s representative, the request shall state the representative‘s first name, surname, place of residence and contact details as well the first name, surname and place of residence of the represented person and information on the specific right of the data subject to be exercised including the scope of the exercise; the request shall be accompanied by a representation document.

11.2. In order to verify your identity, we may also ask you to indicate relevant data (e.g. name, date of birth, e-mail address, or telephone number) or send a control notification at the last contact (SMS or e-mail), asking to take an authorization action, as well as we may request additional documents or data. If the verification procedure fails, we will be forced to state that you are not the Data subject of the requested data and we will have to reject your request.

11.3. Upon receipt of your request regarding implementation of any right of yours and having successfully performed the above-indicated verification procedure, we undertake without undue delay, but in any case no later than within one month after receipt of your request and completion of the verification procedure, to give you information about actions we took with regard to your request. With regard to complexity and number of requests, we have the right to extent the period of one month for two more months, informing you about it before the end of the first month and indicating reasons for such an extension.

11.4. If your request is submitted electronically, we will give the answer to you electronically, too, unless it is impossible (e.g. due to a particularly large scope of information) or when you request to answer you in some other way.

11.5. We have the right to refuse to satisfy your request by our reasoned written response under the conditions and grounds provided for in legal acts. We will provide you with information free of charge, however, if the requests are manifestly unfounded or disproportionate, in particular because of their repetitive content, we may require a reasonable fee to cover administrative costs or may refuse to act upon your request.

12. Final provisions

12.1. We have the right to change this Privacy Notice periodically in order to properly reflect how we process your Personal data.

• If any provision of the Privacy policy shall be found to be invalid or unenforceable, this provision does not affect the legality and validity of the remaining provisions of the Privacy policy.

Last update: 2025/06/27.

ANNEX 1 – Definitions

Consent of the data subject	any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of Personal data relating to him.
Data controller	natural or legal person, public authority, agency, or other body which alone or jointly with others determines the purposes and means of the processing of Personal data. In this Privacy Notice, the Data controller is the Company.
Data processing	any operation or set of operations performed with Personal data carried out with or without automated means, such as collection, registration, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, distribution or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data processor	a natural or legal person, public authority, agency, or other body which processes Personal data on behalf of and for the account of the Data controller.
Data recipient	means a natural or legal person, public authority, agency, or another body, to which the Personal data are disclosed, whether a third party or not.
Data subject (or you)	An identified or identifiable natural person whose Personal data are being processed. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as his or her name, identification number, location, online identifier, or one or more factors specific to the physical, physiological, genetic, religious, economic, cultural or social identity of that natural person.
Regulation	2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”).

Other terms shall have the meanings assigned to them and defined in the Regulation.