In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/ CE (General Data Protection Regulation), FGC OÜ has the obligation to process in safe conditions and only for the purposes specified below, the personal data you provide us about you or another person. FGC OÜ, through internal departments, processes your personal data, collected directly from you, from associated operators or authorized persons, by automated/manual means.

The purposes of data processing by FGC OÜ are determined, explicit and legitimate, as follows:

Development of the work relationship;

Execution of a contract/agreement;

Guarding/security of goods;

Fulfilling a legal obligation.

You are obliged to provide personal data, these being necessary for Fondul de Garantare si Creditare OÜ to comply with the legal conditions related to the aforementioned purposes. Your refusal determines the impossibility of FGC OÜ to enter into contractual relations with you. The registered information is intended for use by FGC OÜ, as an operator, registered in the Registry of Personal Data Processing, and is communicated only to the following recipients: financial-banking institutions, central/local public authorities, the judicial authority, criminal investigation bodies and other institutions authorized by law to request information, etc. According to Regulation (EU) 2016/679, you benefit from the right of access, rectification, data deletion, restriction of processing, data portability, the right to opposition and the right not to be subject to an individual automated process. At the same time, you have the possibility to contact the National Authority for the Supervision of the Processing of Personal Data based in Bucharest, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, tel. +4 0770 522 627, www.dataprotection.ro. To exercise these rights, you can send a written request using postal services to FGC IFN SA, Strada Wilhelm Filderman no. 18, Bucharest 030167, sector 3, Romania or by using the electronic mail services at gdpr@fgcifn.ee

The main categories/types of personal data processed at FGC OÜ level are:

- Name and surname;

- Home address/residence;

- Personal identification code;

- Identity document series and number;

- Copies of the identity document in which the owner's photo appears along with the name and surname;

- Profession, place of work, seniority at the place of work;

- Earned income;

- Owned properties/goods;

- Phone number;

- Email address;

- Bank accounts;

- Participations/shares held in commercial entities;

- The quality held within some commercial companies;

- Car registration numbers;

- Data related to financial conduct (eg: existence of mentions in the Credit Bureau);

- Creditors/debtors of the person concerned and the amounts owed/to be collected by/from them;

- Information resulting from the verification of the quality of the politically exposed person;

- Data regarding criminal convictions or offences;

- Images taken by the cameras in the premises.

The processing and storage of personal data is carried out during the validity period of the contracts concluded with FGC IFN SA, and afterwards, according to the legal provisions (eg: Law no. 656/2002 for the prevention and sanctioning of money laundering, as well as for the establishment of measures prevention and combating the financing of acts of terrorism, BNR Regulation No. 9/2008 regarding the knowledge of the clientele for the purpose of preventing money laundering and the financing of terrorism, fiscal legislation, labor legislation, etc.).

The rights of data subjects regarding the processing of personal data:

The right to information (provided for in art. 13 and art. 14 GDPR - the data subject from whom personal data is obtained directly/indirectly has the right to receive a set of information regarding the identification data of the operator, the purpose and the legal basis in which the data are processed, the recipients of the data and the storage period, etc.);

The right of access to data (provided in art. 15 GDPR - the data subject has the right to receive a confirmation from the operator regarding the performance or not of some processing operations of his personal data, as well as a copy of the personal data processed);

The right to rectification and erasure of data (provided in art. 16 and art. 17 GDPR - the data subject has the right to obtain the rectification or completion of his personal data, with the help of the operator, as well as the possibility to request the erasure of his personal data from the records/databases of the operator);

The right to the restriction of data processing (provided in art. 18 GDPR - the data subject has the right to request the restriction of the processing of his personal data by an operator, in the event that certain conditions are met: the data are not accurate, the processing is illegal, the operator no longer needs this data, etc.);

The right to data portability (provided in art. 20 GDPR – The data subject has the right to receive the personal data concerning him and which he has provided to the operator in a structured, commonly used and machine-readable format and has the right to transmit this data to another operator, without obstacles from the operator to whom the personal data was initially provided);

The right to object (provided for in art. 21 GDPR – the data subject has the right to object to the processing of his personal data);

The right not to be the subject of an automatic processing decision (provided in art. 22 GDPR - the data subject has the right not to be the subject of a decision based exclusively on automatic processing, including the creation of profiles, which produces legal effects concerning the person target or similarly affects it to a significant extent);

The right to be informed about security incidents concerning personal data (art. 34 GDPR): FGC IFN SA will promptly inform the occurrence of security incidents concerning personal data that present a high risk for the rights and freedoms of the persons concerned. The communication will be made without undue delay and will contain, in clear and simple language, the nature of the personal data security breach, accompanied by the name and contact details of the data protection officer, the probable consequences of the breach, the measures taken/proposed. Informing the data subject will not be necessary in the event that FGC IFN SA has implemented adequate protection measures, the high risk is no longer likely to materialize or informing the data subject would require a disproportionate effort (in which case it will be replaced by an information public/similar measure).

The right to withdraw at any time the consent granted for the processing of personal data (provided in art. 7 (3) GDPR – The data subject has the right to withdraw his consent at any time. The withdrawal of consent does not affect the legality of the processing carried out on the basis of the consent before its withdrawal . Before giving consent, the data subject is informed about this. Withdrawing consent is as simple as giving it);

The right to submit a complaint to a supervisory authority - provided in art. 15 (1) lit. f) GDPR; In Romania, the competent authority is the National Supervisory Authority for the Processing of Personal Data (ANSPDCP), with headquarters in Bucharest, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, tel. 031.805.92.11, 031.805.92.12, www.dataprotection.ro. To exercise these rights, you can send a written request using postal services to FGC IFN SA, Strada Wilhelm Filderman no. 18, Bucharest 030167, sector 3, Romania or by using the electronic mail services at gdpr@fgc.ee.