Personal Data Processing Policy

Personal Data Processing Policy at B-FINE SRL

Processing Personal Data and the Data Controller

Data protection is of utmost importance to B-FINE SRL. We want to ensure that you are adequately informed about how and for what purposes B-FINE SRL processes your personal data. As the data controller, we publish this Personal Data Processing Policy to explain how we process and protect personal data in compliance with the obligations regarding the guarantee and protection of the rights and freedoms of natural persons, especially the right to privacy and family life.

General Aspects

“Personal data” refers to information about an identified or identifiable natural person (“data subject”), such as name, address, Personal Identification Number, IP or phone number, location data, an online identifier, or one or more specific elements that are specific to their physical, physiological, genetic, mental, economic, cultural, or social identity. Whenever we request your personal data, we will explain the purpose for which they are required, where and how long we store your data, and who has access to it. Of course, we inform you that you can access the information we hold about you at any time, and we will delete it if you request it. B-FINE SRL adopts appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, unauthorized access, or any other form of unlawful processing. In this regard, at the level of B-FINE SRL, a person responsible for complying with the provisions of Regulation (EU) 679/2016 is designated. This person is the company’s administrator.

Principles of Data Processing by B-FINE SRL

Personal data is processed by B-FINE SRL in good faith and in accordance with applicable legal provisions. Personal data is collected by B-FINE SRL for specific, explicit, and legitimate purposes, and subsequent processing will not be incompatible with these purposes. Personal data is adequate, relevant, and not excessive in relation to the purposes for which it is collected and subsequently processed. B-FINE SRL stores personal data only for the period necessary to achieve the purposes for which they were collected, unless there are legal provisions stipulating other periods. B-FINE SRL has taken appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, unauthorized access, or any other form of unlawful processing, as well as regarding the deletion or rectification of inaccurate or incomplete data in terms of the purpose for which they are collected and for which they will be subsequently processed.

Categories of Data Subjects Processed by B-FINE SRL

During its activities, B-FINE SRL processes the data of the following categories of data subjects:

• Contractual partners such as suppliers and customers (“Business Partners”);
• Visitors and users of our websites that can be accessed at rebornfloating.ro and all its microsites (“Website Users”);
• Users of our mobile applications (“App Users”);
• Individuals interested in employment with B-FINE SRL (“Candidates”);
• Participants in B-FINE SRL professional training programs (“Trainees”);
• B-FINE SRL employees (“Employees”);
• Visitors to B-FINE SRL salons and other facilities (“Visitors”);
• Potential customers.

Categories of Data and the Purposes of Processing at B-FINE SRL

The personal data referred to in this Personal Data Processing Policy includes identification elements such as name, surname, names of legal representatives, date and place of birth, phone/fax, home/residence address, email address, personal identification code, series, and number of the identity document, workplace, profession, professional training – diplomas – studies, banking information, or similar, which serve to identify you or the individuals you represent or are represented by.

B-FINE SRL collects, uses, processes, and provides personal data provided by you for purposes such as advertising, marketing, and advertising, statistics, organizing courses, seminars, commercial events, for educational purposes for the organization of professional training programs, for issuing any financial and accounting documents, concluding contracts, or other acts necessary in B-FINE SRL’s activity.

Personal data is intended for use by B-FINE SRL and is collected through online platforms or directly provided by the data subject. Some of this data may be communicated to B-FINE SRL’s contractual partners or state authorities, as applicable.

The collection and processing of personal data of minors by B-FINE SRL will only be carried out with the explicit consent of parents or other legal representatives.

We collect and process your personal data when you interact with us (for example, the information you provide us by filling out forms on our websites or by corresponding with us by phone, email, or in any other way). This includes information you provide when you register to use one of our websites, subscribe to our services, complete a registration form, or otherwise, when you enroll in promotions, order a product, or request a quote.

The information you provide may include your name, address, email address, and phone number, as well as other information, as applicable.

Each time you visit our websites, we automatically collect the following data:

• Technical data, for example, may include the Internet Protocol (IP) address used to connect your computer to the Internet, login information; this data may be collected and processed on our behalf through third-party cookie files.
• Information about your visit, for example, this may include complete Uniform Resource Locators (URLs), the clickstream to, though, and from our websites (including date and time), the products or services you viewed or searched for, page interaction information, or any email address used to contact our customer service department.

We will not collect, or process sensitive personal data related to you (e.g., information about racial or ethnic origin, political opinions, religious beliefs or other beliefs, health, sex life, or sexual orientation) unless (i) we are required to do so by law; and/or (ii) you have provided us with your explicit consent separately. If you voluntarily provide us with sensitive personal data by interacting with our websites or corresponding with us by phone, email, or in any other way, of your own volition and not at our request, we will delete such sensitive personal data from our systems if we do not consider their processing necessary for a legitimate purpose of B-FINE SRL, except if you have made such data publicly available (e.g., in a message forum that is publicly visible), in which case we will delete this data from our websites only if the law so requires or if we do not wish to retain it.

In some cases, we obtain your personal data (such as name, address, email address, and phone number, personal description, and photograph, age, date of birth, and gender) from third parties, such as business partners, technical service providers, payment and delivery subcontractors, advertising agencies, market research service providers, personal recruitment agencies, etc. When you visit and register on one of our online platforms, we may obtain your personal data from a third-party social communication provider if you voluntarily choose to register through that third-party social communication platform.

If we obtain your personal data from a third party, we will provide you with all relevant information about the processing as soon as possible, but in any case, no later than one month after processing your personal data, including information about the categories of personal data subject to processing, the purpose of processing, and its legal basis.

How We Use Personal Data and the Legal Basis for Processing

General Aspects

We may process your personal data for the following reasons:

• When we need to perform a contract that we have entered into with you.
• If we need to comply with a legal obligation (e.g., applicable laws in employment relationships, accounting, taxation).
• When it is necessary for our legitimate interests and your interests (e.g., fraud detection and prevention, IT and network security), unless your fundamental rights override these interests.
• If necessary to protect your vital interests (or the vital interests of others).
• When necessary for the public interest or official purposes.

We may process your personal data for various technical, administrative, and operational reasons, such as:

• Preparing specific documents related to the business partnership.
• Ensuring the security of individuals and properties.
• Ensuring the most efficient presentation of content for you and your computer.
• Improving our websites, including its functionality.
• Administering our websites, for internal operations, including troubleshooting, data analysis, testing, research, statistics, and surveys.
• Advertising and marketing, including specific marketing purposes, to provide content, including personalized content, that may be of greater interest to you.
• As part of our efforts to keep our websites secure.

In some cases, we will only process your personal data with your consent. In these cases, we will request your consent separately, transparently, when you provide your personal data. You will later have the option to withdraw your consent at any time. However, the withdrawal of consent will not affect the lawfulness of any processing that occurred before its withdrawal.

In cases where we request personal data to comply with legal or contractual obligations, providing this personal data is mandatory. This means that if such personal data is not provided, we will not be able to manage contractual relationships or fulfill obligations required by law. In all other cases, providing personal data is optional, and you are not obliged to provide it.

Additionally, we may process your personal data, such as identification data, contact information, and residential address, for the potential exercise of our rights in the future. This processing is based on our legitimate interest, as it is necessary for us to exercise our rights in the event of possible disputes.

Most frequently, we will use your personal data in the following situations:

• Business Partners:

For providing services, delivering goods, and processing payments/receiving payments under contracts, we may process your personal data, such as identification data, business contact information, banking information, and tax identification number for individuals registered for VAT purposes. This processing is based on (i) the performance of a contract to which you, as a Business Partner, are a party, (ii) legal obligations imposed on us, and (iii) our legitimate interest.

In some cases, we process personal data such as the names and contact details of employees or representatives of Business Partners for communication related to the execution of a specific contract with Business Partners. This processing is based on (i) the performance of a contract to which Business Partners are a party, (ii) legal obligations imposed on us, and (iii) our legitimate interest.

As a Business Partner, we may provide you with communications about our new products and services. If you no longer wish to receive such communications, you can opt out by sending us an email at hello@rebornfloating.ro.

• Website Users and Customers:

For providing services, delivering goods, and processing payments under contracts and orders, we may process your personal data, such as identification data, contact data, and banking data. This processing is based on (i) the performance of a contract to which Website Users/Customers are a party or (ii) a legal obligation imposed on us.

We may process personal data to provide you with information about goods or services we believe may interest you.

If you are an existing customer, we may contact you by email, post, SMS, or push notifications through Mobile Applications with information about goods and services similar to those that have been the subject of a previous sale or negotiation with you, unless you have opted out previously.

If you are a new/potential customer, we will only contact you electronically if we have your prior consent. If you do not want us to use your data in this way, please tick the relevant box on the data collection form (or registration form) or inform us using the contact details provided below. If you have installed a Mobile Application and no longer wish to receive push notifications, you can change the settings on your mobile device or within the Mobile Application.

• Applicants and Trainees:

In connection with your participation in a recruitment or professional training process, we may collect and process personal data (such as identification data, social status, education and professional experience, CV, etc.) for pre-selection/selection, preparation of documents required by labor and tax laws, as well as communication with you and other interested parties in connection with the recruitment/professional training process. This processing is based on (i) the legitimate interest of B-FINE SRL, (ii) the performance of a contract to which you are a party, or (iii) your consent.

• Application Users:

In connection with your use of our mobile applications, we may collect and process your personal data, such as identification data, contact data, information about debit or credit cards, and geographic location data, when you:

• Register to use our Mobile Applications (including free trials) and provide information about yourself;
• Provide a comment, rating, or other post using our Mobile Applications;
• Interact with us using our Mobile Applications;
• Interact with us through other means, such as by phone, fax, SMS, email, social media communication, or posts related to a Mobile Application.

This processing is based on (i) the performance of a contract to which Application Users are a party through registration in such Mobile Applications, (ii) our legitimate interests in verifying user account data for services provided in the territory where you have your habitual residence and in detecting and preventing fraud, (iii) a legal obligation imposed on us, and/or (iv) your consent for informative messages regarding products and services offered by B-FINE SRL, newsletters, promotional campaigns, and other marketing communications sent by or on behalf of B-FINE SRL.

• B-FINE SRL Employees:

To comply with legal provisions regarding employment contracts and the performance of tasks by B-FINE SRL employees, we will process the personal data of Employees, such as identification data, family data, financial data, banking data, occupational health data, contact data, signature, personal image, copies of personal documents, etc. The legal grounds for these processing activities are: (i) the conclusion and performance of an employment contract, (ii) our legitimate interest, and (iii) the consent of the individual in certain cases.

• Visitors to B-FINE SRL Salons and Other Facilities (“Visitors”):

To comply with legal provisions regarding the security of persons and property, B-FINE SRL will process the personal data of Visitors, such as identification data, personal images, etc. The legal grounds for these processing activities are: (i) our legitimate interest and (ii) the consent of the individual in certain cases.

Duration of Data Retention

We intend to keep your personal data only for as long as necessary, for a period that does not exceed the period necessary to fulfill the purposes for which the data was collected and/or as required by applicable legislation regarding minimum retention periods and/or as long as necessary to exercise our legitimate rights (and the legitimate rights of other individuals).

For example, if you are a Business Partner, we will keep your personal data for the duration of our contractual relationship with you. If we have an ongoing business relationship with you as a Business Partner (e.g., if we can use the same personal data in separate contractual relationships with you), we will continue to retain this personal data until the termination of our business relationship and for the minimum retention period imposed by law.

In the case of employees, personal data related to labor law documentation is archived and stored until the termination of the employment relationship or the expiration of the retention periods for specific documents as required by tax and labor laws.

For Application Users, we will retain your personal data for the duration of your use of the Mobile Application or the period indicated by relevant legislation.

If you would like more information about how long we retain your personal data, please contact us at hello@rebornfloating.ro.

Please note that we may process any of your personal data that has become anonymous without prior notice to you.

In cases where we process your personal data based on your consent, these personal data will be processed only for the period provided in your consent, unless you withdraw or limit your consent before the expiration of this period. In such cases, we will cease processing the respective personal data for the purposes for which they were collected, subject to any legal obligation to process such personal data and/or our need to process such personal data to exercise our legitimate rights (including the legitimate rights of other individuals).

Recipients of Processed Data: How and to Whom We Disclose Your Personal Data

We do not sell your personal data to third parties.

In principle, we process personal data only for purposes necessary for the operation of B-FINE SRL.

Within B-FINE SRL, only a limited number of staff members, such as those in Sales, Legal, Production, Technical, Accounting, and IT departments, may have access to your personal data based on the principle of need to know. These staff members are subject to confidentiality obligations regarding personal data.

Adequate technical and organizational measures are taken to protect personal data. B-FINE SRL staff members have the right to manage personal data only in accordance with B-FINE SRL’s instructions and in connection with their service responsibilities.

Personal data may be disclosed to government authorities and/or law enforcement agencies if required by applicable laws or if necessary for the exercise of our rights or for the protection of our legitimate interests (including the legitimate interests of third parties) in accordance with applicable laws.

Your personal data may also be disclosed to third parties, including:

(i) service providers providing administrative, professional, and technical support to B-FINE SRL for IT support, security, accounting, and human resources;

(ii) business partners, suppliers, and subcontractors for the execution of all contracts we conclude with you;

(iii) analytics and search engine service providers who help us improve and optimize our websites;

(iv) courier service providers.

B-FINE SRL may also disclose personal data to external consultants (e.g., lawyers, accountants, auditors) when necessary.

In some cases, we may disclose personal data to our Affiliate Companies based on the need to know principle. B-FINE SRL implements adequate safeguards in its relationships with its affiliates to secure these transfers of personal data and their processing.

B-FINE SRL may share personal data with its Affiliate Companies and other third parties in the context of certain types of transactions, including transactions involving a change in control of the Company, a substantial sale of its assets, or commercial restructurings.

B-FINE SRL intends to conduct a prior assessment in selecting third-party service providers and requires these service providers to maintain adequate technical and organizational security measures to protect personal data and process personal data only in accordance with B-FINE SRL’s instructions. Service providers have the right to use subcontractors in the provision of services to B-FINE SRL, provided that the subcontractor complies with the same data protection obligations as the service providers.

Transfer of Data to Third Parties or Third Countries

We will not share your personal data with third parties for marketing purposes without your explicit consent.

We do not sell your personal data to third parties.

In principle, we use your personal data only within our own company, including affiliated companies.

The personal data we collect is stored in Romania, but in certain legally justified situations, it may be transferred to the European Union (“EU”) and the European Economic Area (“EEA”). However, information collected by third parties through cookie files, for example, will generally serve the traffic from a data center closest to the source of the traffic. This means that such information, including advertising traffic, may be managed by servers located in the EEA and may be transferred outside the EEA.

We do not intend to transfer your personal data outside the EEA unless adequate safeguards are in place, including:

• An adequacy decision issued by the European Commission regarding the destination country or countries;
• A “Privacy Shield” certification;
• Appropriate corporate binding rules;
• An approved code of conduct, along with binding and enforceable commitments by the data controller or processor in the destination country outside the EU and EEA;
• An approved certification mechanism, along with binding and enforceable commitments by the data controller or processor in a country outside the EU and EEA to apply the appropriate safeguards; or
• Standard EU contractual clauses approved by the European Commission.

You can request further details about transfers and the adequate protection measures implemented by B-FINE SRL before any data transfers take place.

Your Rights as Data Subjects

According to Regulation (EU) 679/2016, you have the following rights regarding the processing of your personal data:

• Right to Information – you can request information about the processing activities of your personal data.
• Right of Access to Data – you also have the right to obtain confirmation, upon request, as to whether data concerning you is being processed by B-FINE SRL.
• Right to Rectification – you can request the rectification of inaccurate personal data or have them completed.
• Right to Erasure of Data (“right to be forgotten”) – you can obtain the erasure of data if the processing was not lawful or in other cases provided by law.
• Right to Restrict Processing – you can request the restriction of processing if you dispute the accuracy of the data or in other cases provided by law.
• Right to Object – you can object, for legitimate and well-founded reasons, to the processing of personal data in certain cases provided by law.
• Right to Data Portability – you can receive, under certain conditions, the personal data you have provided in a format that can be automatically read, or you can request that such data be transmitted to another controller.
• Right to Lodge a Complaint – you can file a complaint regarding the processing of personal data with the National Supervisory Authority for Personal Data Processing.
• Right to Withdraw Consent – in cases where processing is based on your consent, you can withdraw it at any time. The withdrawal of consent will only affect future processing, and processing carried out prior to withdrawal will remain valid.
• Right Not to Be Subject to Automated Individual Decision-Making – Another right you have is the right to request and obtain the withdrawal/cancellation/reassessment of any decision that produces legal effects concerning you, adopted solely based on automated data processing intended to evaluate certain aspects of your personality, such as professional competence, credibility, behavior, or other similar aspects.
• Right to Seek Judicial Remedy – at the same time, you have the right to seek judicial remedies for the protection of any rights guaranteed by law that have been violated.
• To exercise these rights, you can submit a written, dated, and signed request using the contact information provided in this Personal Data Processing Policy.

Ways to Exercise Your Rights

If you wish to exercise these rights, please contact us through the contact persons mentioned below. We hope to address all your questions regarding how we process your personal data. However, you also have the right to file a complaint with data protection authorities. You can file the complaint in the Member State where you reside, work, or where the alleged violation of data protection law occurred.

Use of Cookies

Our websites use cookie files.

When you use our Internet pages, if you allow it, cookies are saved on your computer. Cookies are small text files that are stored on your hard drive, classified by the browser used, and through which the entity that places them receives certain information.

This helps us provide you with a good experience when browsing our websites and also allows us to improve our websites. This processing is based on your consent expressed on our websites or through your browser settings.

Cookies cannot run programs or transmit viruses to your computer. These files serve to make your overall Internet browsing more user-friendly and efficient.

We or third parties administering our web pages use the following types of cookies, whose volume and functioning are explained below:

• Temporary cookies are automatically deleted when you close your browser. This includes session cookies in particular. These save an identifier, a so-called session ID, by which various browser calls can be classified in a common session. This way, your computer can be identified when you return to our Internet page. Session cookies are deleted when you log out or close your browser.
• Persistent cookies are automatically deleted after a certain period, which can vary depending on the cookie. You can delete cookies at any time from your security settings.
• You can configure your browser settings according to your preferences, for example, you can refuse to accept third-party cookies or all cookies. In this context, we emphasize that you may not be able to use all the functions of this Internet page.

Social Media Services

Our websites may include social media communication features, such as Facebook, Twitter, Instagram, LinkedIn, or YouTube buttons. These features may collect information about you, such as your IP address and the websites you visit, and may set a cookie file to enable them to function correctly. The processing of this information through interactions with these features is governed by the privacy notice/policy of the company that provides them (see the section on your rights above).

We emphasize that as the operator of this page, we do not receive information about the content of the data transmitted and their use by social media services. More information about what data about the use of social media services is collected by Facebook, Twitter, Pinterest, or YouTube and how this data is used can be found in their respective data protection provisions at the following addresses:

Links to Other Websites

Our website may provide links to websites that the Company does not control. After clicking on a link to a third-party site, you will be directed to the third-party’s website. If you visit any of these connected websites, you should review their privacy policies. We are not responsible for the policies and practices of other companies. Our company does not control and assumes no responsibility for the content, privacy policies, information notices, or practices of third-party websites or services.

Additional Information

Protection of Minors

Children and young people under the age of 18 do not have the right to transmit personal data to us without the consent of their parents or guardians. We do not specifically request personal data from children or young people, do not collect them consciously, and do not transmit it to third parties.

Contact Information

You have the right to withdraw your consent for data processing at any time and to submit any requests to exercise your rights through the following channels:

• Email: hello@rebornfloating.ro
• Phone: +4-0786-950.850

Please do not disclose sensitive personal data (e.g., information regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, health, or membership in a trade union) or social security numbers or criminal record information when contacting us.

Changes to This Data Protection Statement

We reserve the right to modify this Personal Data Processing Policy at any time, with effect for the future. You can access the current version at any time from our website. Please visit our website periodically and stay informed about the current version.