Personal data processing policy.

Data operator OSCAR DOWNSTREAM S.R.L („OSCAR”), J23/492/2001, unique identification code RO 13991630, headquarters Ilfov county, Măgurele, Str. Atomistilor nr. 14 | postal address Eminescu Office-Et. 6, Str. Mihai Eminescu nr. 108-112, București, 2 nd district, phone: 0213182622, e-mail office@oscars.ro

For requests and notifications regarding the processing of your data by OSCAR, we kindly ask you to contact the Data Protection Officer („DPO”) OSCAR, Mr. Ștefan Zaharie Pop, email : dpo@oscars.ro

I. OBJECTIVE AND PRINCIPLES OF THE PERSONAL DATA PROCESSING POLICY

This Personal data processing policy („Policy”) is drawn up pursuant to the provisions of European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC and related legislation („ GDPR ”), the OSCAR company being fully committed to complying with them. This Data Protection Policy applies both to users of this website and to any person who comes into contact with the OSCAR company, as a collaborator/ (representative/employee/representative)/ client/supplier/employee/candidate or as an interested person in carrying out a relationship between professionals, work, etc.

In its activity, the OSCAR Company processes personal data of certain categories of natural persons, such as personal data belonging to users of this website, OSCAR representatives/collaborators/partners/customers/ suppliers. Personal data refers to information about an identified or identifiable natural person, that is, information about a person whose identity is either self-evidently clear or can at least be established by obtaining additional information. If data about such a person is processed, this person is referred to as a " data subject " within the meaning of the GDPR.

The objective of this Policy is to protect the freedoms and fundamental rights of natural persons with regard to the processing of personal data by OSCAR and to inform the data subjects whose personal data are processed of their rights according to the GDPR, establishing at the same time the principles and obligations that OSCAR through its employees and, as the case may be, the persons authorized by OSCAR, must respect and fulfil when processing personal data.

In accordance with those principles, OSCAR ensures that personal data are:

• processed only for legitimate and clearly defined purposes
• accurate, adequate, pertinent and not excessive
• processed correctly and in accordance with the legal provisions and in a secure manner
• processed in a transparent way, by informing the persons concerned and respecting their rights
• kept only for the necessary period
• processed and documented in a way that demonstrates compliance with data protection regulations
• transferred to third parties only with the obligation to take appropriate precautionary measures.

Data safety : For the protection of Your data, OSCAR has taken technical and organizational measures to protect this data in particular against loss, manipulation or unauthorized access. The measures adopted are checked regularly and are constantly adapted to the state of the art. In the event of a breach of the protection of your personal data, which is estimated to result in a major risk to your rights and freedoms, we will notify you in compliance with the legal provisions.

In the use and processing of personal data, OSCAR strictly complies with the legal provisions in force regarding data protection. Protecting your privacy while using our website and/or carrying out contractual, pre-contractual, collaborative or any other kind of relationships is extremely important to us.

That's why we continue to inform you in detail about the processing of personal data.

II. PURPOSES, CATEGORIES OF PERSONAL DATA PROCESSED AND BASIS

Pursuant to the provisions of the GDPR, the data processed by OSCAR through this website and/or in the course of its activity, may be the following and used for purposes such as:

a) for the purpose of communication with collaborators, potential partners and contractual partners, as the case may be, the following categories of personal data may be collected and processed: name, surname, position, representatives/collaborators/authorized/representatives and contact details (phone number, email address etc.), pursuant to art. 6 para. (1) letter a), b) and/or f) of the GDPR, as applicable;

b) In order to carry out contracting activities and develop various contractual relationships (with clients/suppliers), including for operations such as: sales, processing payments and drawing up financial-accounting documents, the following categories of personal data may be collected and processed: name, first name, address and payment dates, pursuant to art. 6 para. (1) letter b) and f) of the GDPR, as the case may be;

c) In order to carry out contracting activities and execution of contracts for the sale of wholesale petroleum products, the following categories of personal data may be collected and processed: name and surname, home address, function, place of work, department, no. phone number, e-mail address, CI data, driver's license data, as well as signatures, pursuant to art. 6 para. (1) letter b) of the GDPR;

d) In order to carry out contracting activities and execution of the fuel sales contract based on the OSCAR card, the following categories of personal data may be collected and processed: name and surname, user name, customer representative function, telephone number, address e-mail, card data, customer/representative CI data, signatures, pursuant to art. 6 para. (1) letters b) and f) of the GDPR, as applicable;

e) For the purpose of electronic invoicing and notification (especially regarding OSCAR cardholder customers), the following categories of personal data may be collected and processed: e-mail address and mobile phone number, pursuant to art. 6, paragraph (1), letters a), b), c) and f) of the GDPR, as the case may be;

f) In order to protect the goods, people and premises belonging to or operated by OSCAR (gas stations, main or secondary headquarters), through the use of video monitoring devices and systems, the following categories of personal data can be collected and processed: your image by automated means and the registration number of your vehicle, based on art. 6 para. (1) letters c) and/or f) of the GDPR, as the case may be;

g) In carrying out the activities of the call centre/help desk/OSCAR Care support service, for OSCAR card holders/potential customers, the following categories of personal data may be collected and processed: name and surname, telephone number, place of work, registration number, voice, call recording, pursuant to art. 6, paragraph (1), letters a), b) and f) of the GDPR, as the case may be;

h) In the course of marketing activities, advertising campaigns, the following categories of personal data may be collected and processed: name and surname, image, voice, contact data or other data imposed by fiscal provisions and/or related to advertising lotteries, based on Art. 6 para. (1) letters a), c) and f) of the GDPR, as the case may be; the provisions of this subsection are supplemented by the clarifications and information made subsequently, on a case-by-case basis, on the occasion of any advertising campaign or marketing activity carried out;

i) In carrying out patronage and sponsorship activities, the following categories of personal data may be collected and processed: name and surname, image, voice, contact data, as the case may be, and medical data or other sensitive data, provided voluntarily by to the applicant, and/or other data required by the fiscal provisions, pursuant to art. 6 para. (1) letters a), c) and f) of the GDPR, as applicable;

j) For the transfer/transmission of real rights or their dismemberment to OSCAR (sale/purchase of real estate, establishment of guarantees/rental/use/surface, etc.), the following categories of personal data may be collected and processed: name and surname, the data contained in the identity document/ title deed/ the data contained in the Land Deed extract/ fiscal attestation certificate/ energy certificate, as well as personal data of persons with whom OSCAR does not have a direct relationship, contained in the history of the right to property (OSCAR carrying out an analysis of the opportunity to carry out that transfer), such as, but not limited to data on family members of the applicant/holder, his legal representatives or other persons who appear in the history of ownership, pursuant to art. 6 para. (1) letters b) and f) of the GDPR, as applicable;

k) To resolve your requests, questions or complaints, the following categories of personal data may be collected and processed: name and surname and contact details provided by you, based on art. 6 para. (1) letters a), b) and/or f) of the GDPR, as applicable;

l) In the administration and maintenance of this website, including through the use of cookies, in order to ensure appropriate, fast and easy interactions between the user and the website, the following categories of personal data may be collected and processed: interest categories, preferred language of user, location, technology, devices, browser, IP or other identifiers of the devices with which this website is accessed, pursuant to art. 6 para. (1) letters a) and f) of the GDPR, as the case may be. This website uses Google Analytics, which is a web analysis service provided by Google, Inc. (Safe Shield certified supplier), which in turn uses cookies. For more details, see the Cookie Policy section (de introdus link);

We draw your attention to the fact that by entering your personal data in one of the sections of this website, you express your express and unequivocal consent so that OSCAR - the owner of this website, can use this data for the purpose for which you provided the data.

m) In order to carry out personnel recruitment operations, including by completing the form available in the Careers section of this website and to access the Online contracting/Contact/Offer request section, the following categories of personal data may be collected and processed: name and surname, e-mail address, phone number, and in the case of the Career section, including data from your resume, based on art. 6 para. (1) letter a) of the GDPR;

n) In order to carry out employment relationships (data processing for the execution of employment contracts, the fulfilment of legal obligations and/or the fulfilment of a legitimate interest), the following categories of personal data may be collected and processed: personal data of its employees, such as they were detailed in the information note provided to employees, based on art. 6 para. (1) letter b), c) and f) of the GDPR, as the case may be, and sometimes, in some specific situations, communicated punctually, OSCAR may process certain employee data based on their consent, based on art. 6 para. (1) letter a) of the GDPR.

o) for performing ESG Reporting, non-financial declaration and calculation of Carbon Footprint, the following data can be collected and processed: gender, address, mean of transportation to and from the workplace, or any other data necessary in performing the aforementioned reporting’s and calculations.

III. DURATION OF PROCESSING

Your personal data are stored only for the duration and to the extent necessary to achieve the purposes mentioned above or if there is a legal obligation to do so.

If you are an employee, collaborator, representative or contact person of a potential customer / customer, potential supplier / supplier or other potential partner / business partner of OSCAR, personal data is kept for the duration of the execution of the contract or in compliance with applicable legal obligations.

Data obtained through the video surveillance system at our premises is kept for a period of 20 days from the date of recording, unless the data is necessary for the investigation of an incident, in which case it is kept until the resolution of the incident.

The personal data that can be found in any supporting documents that are the basis of the records in OSCAR's accounting are kept in the OSCAR archive pursuant to the legal terms in force (according to the provisions of the Accounting Law and other incidental normative acts), calculated from the closing date of the financial year in which the supporting documents were drawn up.

In the case of resumes sent through this website, these are stored for a duration of 18 months.

For the processing of personal data based on your consent, personal data will be processed and kept until the date of withdrawal of consent, unless the law provides for another data retention period or data retention is necessary for the exercise or defence of OSCAR's rights.

Personal data will be stored: (i) until the resolution of the complaints, in the case of non-involvement of the criminal investigation bodies, or (ii) until the resolution of the criminal complaint/criminal trial, if, as a result of the complaint, a criminal complaint has been filed the injured party.

For the purpose of defending and exercising OSCAR's legal rights and interests, the personal data necessary to achieve this purpose will be kept according to the general statute of limitations or for the duration necessary to exercise and defend OSCAR's rights and interests, pursuant to the ongoing legal procedures.

After the expiration of the above terms, your personal data is deleted and/or destroyed from OSCAR records.

IV. PERSONAL DATA TRANSFER

In carrying out its activity and to achieve the purposes described above, OSCAR uses the services of various contractors, some acting as independent operators, others acting as persons authorized by OSCAR.

The previously mentioned personal data may be transmitted, available or provided to the following third parties, in specific cases, such as:

public authorities/courts and/or bodies/institutions competent to carry out controls/inspections on OSCAR's activity or assets, auditors/outsourced service providers/notaries/lawyers/affiliated persons, etc., who request OSCAR to provide information, by virtue of the latter's legal obligations to comply with a legal requirement or to protect the rights and assets of the company or other entities or persons, or for the purpose of capitalizing on a legitimate interest;

third-party potential acquirers or acquirers, as part of due diligence activities, in the event that a transfer of corporate parts/parts or the entire activity of the company is negotiated, if the said data belonging to the persons concerned are part of the documentation subject to analysis/are related with the assets representing the object of the analysis/transaction.

Examples of recipients can be: companies with an activity profile in the IT / financial-accounting (auditors, consultants, etc.) / legal (lawyers, notaries), technical maintenance, web/call centre service operators, advertising agencies and operators that provides services related to social media, surveys/market studies, authorities and courts/affiliated natural or legal entities.

In the event that OSCAR transfers personal data to service providers outside the European Economic Area (EEA), the transfer will only be carried out if the European Commission has confirmed that there is an adequate level of data protection or other appropriate data protection measures (e.g. mandatory corporate data protection rules or EU standard contractual clauses), according to publicly available information at the time of the transfer.

V. RIGHTS OF THE PERSONS CONCERNED

You can exercise the following rights regarding the processing of your personal data:

• Right to information - the right to receive information regarding your personal data processing operations carried out by OSCAR.
• Right to rectification - the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you or the completion of personal data that is incomplete.

Right to delete - You can request the deletion of your personal data if the purpose for which they were collected no longer exists, if their processing contravenes the legal provisions, if their processing excessively affects your interests or if the processing is based on your agreement, which agreement you want to revoke it. You should note that there may be other reasons that prevent the immediate deletion of Your data, for example, mandatory archiving periods, pending actions, claims, the exercise or defence of legal rights.

Right to limit processing You have the right to request a limitation of the processing of your personal data in the following cases: (i) You contest the correctness of your data, this occurring for a period that allows us to verify the correctness of your data, (ii) the processing of your data of a personal nature contravenes the legal provisions, but you object to their deletion and request a limitation of the use of this data, (iii) we no longer need your personal data for the intended purpose, but you still need these data for the purpose of executing, exercising or defending legal claims or you have contested the processing of your personal data.

Right to data portability You can ask us to make available your personal data that you have provided to us, in a structured, common and readable format by technical means, to the extent that we process this data based on your consent or for the execution of a contract between us, the processing being done through automated processes.

Right to opposition the right to object, for reasons related to your particular situation, to the processing carried out by OSCAR, having as a legal basis its legitimate interest.

Right to withdraw the consent – in cases where the processing is based on your consent, you can withdraw it at any time. The withdrawal of consent only affects you for the future, the processing carried out prior to the withdrawal, still remaining valid.

The right not to be subject to a decision based solely on automated processing , including profiling (any automated processing that uses personal data to evaluate certain personal aspects of you), which produces legal effects that concern you or similarly affect you to a significant extent.

Right to complain If you believe that we have violated provisions of Romanian or European law in the processing of your personal data, thus infringing your rights, please contact us to clarify your questions.

Of course, you have the right to address the judiciary at any time, as well as the National Authority for the Supervision of the Processing of Personal Data , with headquarters in B-dul G-ral. Gheorghe Magheru 28-30, 1 st district, postal code 010336, Bucharest, e-mail: anspdcp@dataprotection.ro or (for up-to-date contact information) accessing the website www.dataprotection.ro

These rights can be exercised directly against OSCAR, by sending a notification (dated and signed) to the e-mail address of the personal data protection officer - DPO OSCAR: dpo@oscars.ro .

We will try to respond to your request within 30 days, the term can be extended, however, in accordance with the law, in the case of a complex request, the large number of requests received or the impossibility of identifying you within a useful period.

***