PRIVACY POLICY (ON THE PROCESSING OF PERSONAL DATA) OF THE FAGURA PLATFORM (“the Policy”)

Version in force as of 19 June 2026

1. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

FAGURA FINANCE S.R.L. – a limited liability company, organised and operating in accordance with the laws of Romania, with its registered office at Strada Sevastopol no. 24, Ground Floor, Room 1 Bis and Room 5, Sector 1, Bucharest, Romania, registered with the Trade Register under no. J40/8030/2021, European unique identifier EUID ROONRC.J40/8030/2021, sole registration code 44221810, in its capacity as crowdfunding service provider authorised in accordance with Regulation (EU) 2020/1503 (hereinafter – “Fagura”, “We”, “the Fagura Services Operator”) wishes to ensure the security of the personal data of persons who access the crowdfunding platform and who benefit from our services.

Fagura, in its capacity as crowdfunding service provider, makes available to Users the Fagura Platform, a digital crowdfunding platform available at www.fagura.ro (“the Platform”), through which Users registered as Project owners are connected with Users registered as Investors, by facilitating the granting of loans to Project owners, who have the possibility of publishing Projects/Requests for the purpose of obtaining financing, as clients of Fagura, from Investors who may finance the published Projects/Requests by granting Loans — services which involve personal data processing operations.

Where applicable, in certain situations other entities within the group of companies to which the Company belongs may also act as controller (alone or jointly, within the meaning of art. 26 GDPR), namely Fagura Finance S.R.L. (Romania), OCN “Fagura Marketplace” S.R.L. and Fagura Capital S.R.L. (Republic of Moldova) (together, “the Fagura Group”). Any reference in this Policy to “Fagura”, “the Operator”, “the Company”, “we” or “us” shall be deemed to be made, as applicable, also to the entity within the Fagura Group acting as controller for the relevant processing, which benefits equally from the rights and assumes the obligations set out herein. We will ensure that the controller responsible for a given processing operation remains identifiable and, where the law so requires, you will be informed accordingly.

For the purpose of accessing the Platform and using the Fagura Services, you consent to the provisions of this Policy (together with our Terms and Conditions and any other documents referred to therein), and implicitly to the processing of the personal data concerning you.

Because we constantly seek to improve our services and to comply with applicable laws and regulations, we may amend this Policy from time to time, so please check it periodically. Where we make changes that we consider significant or that affect your rights, we will inform you by notice.

This version of the Policy was updated on 19 June 2026 and applies from the moment of its publication on the Platform’s web page.

2. GENERAL INFORMATION ON THE PROCESSING OF DATA RELATING TO THE PLATFORM

In our capacity as personal data controller, we have drawn up this personal data processing policy (“the Policy“), in accordance with the legislation of the European Union and of Romania on the protection of natural persons with regard to the processing of personal data, in particular Regulation (EU) 2016/679 (“GDPR”) and the applicable Romanian national legislation (including Law no. 190/2018), as well as, with regard to the crowdfunding activity, Regulation (EU) 2020/1503 and Law no. 244/2022. By this document we wish to inform you of the following:

The categories of data subjects;
The personal data processed / The purposes of the data processing / The legal basis;
How long we retain your data;
With whom we share personal data;
Where we store the processed data;
Data security measures;
The rights you have over your personal data;

In this Policy, the following terms shall have the meanings defined below:

Term	Definition
“GDPR”	means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
“Regulation 1503/2020”	means Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business;
“Law 244/2022”	means Law no. 244/2022 on the establishment of certain measures for the implementation of Regulation (EU) 2020/1503;
“Controller”	means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or national law, the controller or the specific criteria for its nomination may be provided for by Union or national law;
“Personal data”	means any information relating to an identified or identifiable natural person;
“Data subject”	means an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as: a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person; in this Policy, Data subjects may be, but are not limited to, Project owners, Investors, the User’s employees, etc.
“Processing”	means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Consent”	means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“User”	means any Investor or Project owner, or legal person, who creates an account on the Platform and, where applicable, benefits from the Services of the Fagura Platform;
“Registration Form”	means the online form completed by the Borrower or Investor in order to obtain the status of User of the platform;
“Project owner”	means any legal person or natural person carrying out a professional activity under a form of organisation provided by law, who intends to obtain financing through the Fagura crowdfunding platform;
“Investor”	means any natural or legal person who has successfully completed the process of creating a User account – Investor type on the Platform and thereby grants loans for crowdfunding purposes through the Platform;
“Commercial communication”	means information or communication from Fagura addressed to potential Investors or potential Project owners/Users regarding the services offered by Fagura;
“ANSPDCP”	means the National Supervisory Authority for Personal Data Processing of Romania.

This section is supplemented by the definitions section of the Terms and Conditions of use of the Fagura Platform.

For certain specific tools and services, this Policy is supplemented by dedicated policies: the Privacy Policy on the AI Tools and the Privacy Policy for the Fagura chatbots on Telegram — available at www.fagura.ro/legal/privacy-telegram. For everything not specifically regulated in those policies, the provisions of this base Policy apply.

3. CATEGORIES OF DATA SUBJECTS

The persons targeted by the processing operations are the natural person Users of the Platform and of the Fagura Services, the (legal and conventional) representatives — natural persons — of legal person Users and of Project owners, natural persons acting as guarantors, as well as third-party beneficiaries of certain services (e.g. persons to whom Users send the invitation to register on the Platform), as well as any person accessing the Platform in accordance with the provisions below and with the Terms and Conditions of use of the Platform.

The Platform is not addressed to and is not intended for persons under 18 years of age. Fagura does not intend to process personal data of persons under 18 years of age; consequently, Users who are 18 years old cannot benefit from a user account.

4. PERSONAL DATA PROCESSED / PURPOSES OF THE DATA PROCESSING / LEGAL BASIS

Personal data are any data/information that help us identify data subjects; the processing of personal data concerns any person visiting the Platform, registered natural person Users or other natural persons indicated by Users (the legal/conventional representatives of legal person Users, natural persons acting as guarantors, persons to whom Users send the invitation to register on the Platform) who may be identified on the basis of the data provided on the Fagura Platform. There are data that allow us to identify you directly (for example, your surname and first name), while the processing of other information leads to your indirect identification (for example, the IP address of the Device the User employs to access the User Account — both are categories of personal data).

Accessing the Platform

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

At the moment when you, as a User, access the Platform, various information is automatically transferred between your terminal and our server; depending on how the Platform is accessed, this may include:

the IP address of your internet-connected device;
time zone settings and the country and city from which you access the Platform, the name and URL of the file accessed, the web page from which access took place, the browser, the type and version of the device you use;
the operating system of the device, the device manufacturer;
the name of the mobile communications service operator;
Wi-Fi/Bluetooth settings;
HTTP/HTTPS protocol data;
the location of the device (if geolocation is enabled) from which you connect to the Platform.

Purpose and legal basis of the processing: ensuring an optimal connection, ensuring easy use of the Platform, assessing the safety and stability of the system. The legal basis for the processing of the personal data indicated above is our legitimate interest, in accordance with article 5 para. (5) GDPR and article 6(1)(f) GDPR. Our legitimate interest arises from the data processing purposes stated above.

Recipients / categories of recipients:

…the data and information operated through the Platform is hosted by DigitalOcean (a company registered and operating in the United States of America, with its registered office at 01 6th Ave., New York), which stores the data in data centres located in Frankfurt, Germany.

Storage period:

The data are stored for a period of 6 months, after which they are automatically erased/irreversibly anonymised (which makes your identification impossible). Geolocation data (see the device-related data) are erased once you cease using our internet page.

Creating a user account on the Platform

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

Whether you wish to access the Platform as an Investor or as a Project owner, in order to be able to offer you our services it is necessary for us to process the following personal data following the creation of a user account and by completing the required online form with the data that directly identify the Data subject: surname, first name, telephone number, e-mail address, password, logs regarding the User’s consent (consent-granting actions), data provided by the User/extracted through interconnections (to the extent that such data are personal data under the law), necessary for the provision of the Services in the basic configuration of the Platform in accordance with the Terms and Conditions of Use of the Fagura Platform.

Upon your validation of the User account, you will be assigned a unique code: User account ID, which we will further process in accordance with this Policy.

Purpose and legal basis of the processing: creating the User account in order to use the Platform and benefit from the Services (including carrying out the preliminary formalities for validating the creation of the user account), both as an Investor, where you wish to grant Loans to Project owners, and as a Project owner, where you wish to attract financing for your own Project/consumer Loan. Creating an account on the Platform is a necessary preliminary formality in order to benefit from the Services of the Platform. We need the mandatory data for these formalities preliminary to the performance of the obligations arising from the contractual relationship between us and the beneficiaries of the Services. The legal basis for the processing of the personal data indicated above is to take steps at the request of the data subject prior to entering into a contract, in accordance with art. 6(1)(b) GDPR.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities and our partner providing the hosting services for the data and information operated through the Platform, DigitalOcean (a company registered and operating in the United States of America, with its registered office at 01 6th Ave., New York), which stores the data in data centres located in Frankfurt, Germany.

Storage period:

We will store the data and information processed for this purpose for the duration of the contractual relationship between Fagura and the User, plus a further period of 3 (three) years from the date of termination of the last contract or from the User’s last login to the account, whichever occurs later.

Verification of the user’s identity

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

Whether you wish to access the Platform as an Investor or as a Project owner, in order to be able to offer you our Services it is necessary for us to process the following personal data for the purpose of verifying the user’s identity by completing the required online form with the data that directly identify the Data subject: user ID, surname and first name, citizenship, sex, date of birth, home address, e-mail address, telephone number, data from the identity document (e.g. the series and number of the identity document, the date of issue and expiry of the identity document, the personal identification number), data on the Data subject’s relations with the legal person (employer, position in the company, date of employment, employer’s telephone); country, identity document, photograph provided in real time, marital status, education, data from a utility bill, logs regarding the user’s actions on the Platform, connection information between our server, the device with which the user carries out the registration formalities, and the mobile device connected to the Onfido interface.

In order for Fagura to verify whether Platform Users are the holders of the identity document and that the document shows no signs of fraud — checks required at the time of onboarding onto the Platform and creation of the account — Fagura works with Onfido Limited (a company part of the Entrust group, incorporated and registered in the United Kingdom under number 07479524, whose registered office is at 9 Devonshire Square, 4th Floor, London, United Kingdom, EC2M 4YF – “Onfido”), which provides these Services. Onfido thus processes on behalf of Fagura the identity data of Fagura’s clients, namely: (i) investors or borrowers who are natural persons, (ii) the administrators/associates (natural persons) of legal person investors, (iii) the administrators/associates (natural persons) of project owners.

The data and information processed by Onfido may include:

the image of an identity document (e.g. an identity card, a passport or a driving licence);
photographs (sometimes taken in rapid succession), or
a video recording of the user, and
the biometric facial identifiers extracted from that recording/those images.

If you provide us with information about other persons (for example, if you represent a Project owner/Investor and provide information about administrators, partners, members, shareholders or beneficial owners, or about your friends, other than your own data), then it is your responsibility to bring this Policy to their attention and to ensure that you have their agreement and are authorised to provide us with that data.

Purpose and legal basis of the processing: Verifying a User’s identity is a necessary preliminary formality in order to benefit from the Services of the Platform. The legal basis for the processing of the personal data indicated above is to take steps at the request of the data subject prior to entering into a contract, in accordance with article 5 para. (5) lit. a) GDPR and article 6(1)(b) GDPR.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities and the following third-party partners: Onfido Limited (for the services verifying the match between the Platform User and the holder of the identity document, as well as that the identity document shows no signs of fraud) and DigitalOcean (for the hosting services for the data and information operated through the CSP);

Storage period:

We will store the data and information processed for this purpose for a period of 5 (five) years in accordance with Regulation (EU) 2020/1503 and Law no. 244/2022, except where the user is party to a loan agreement concluded through the Fagura Platform for a term longer than 24 months, in which case we will store the data and information processed for the entire duration of the loan agreement plus a further period of 3 (three) years (in the case of court proceedings extending beyond that term, the data will be processed until the proceedings are concluded, exclusively for the purpose of those proceedings).

Administration of the User account

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

Where you wish to connect/log in or to carry out actions from the User account, it is necessary for us to process the following personal data for the purpose of connecting to the Platform, using the Services and the functionalities of the Platform, archiving in electronic format the information/documents relating to the Services, providing support and assistance to Users, evaluating the Services, developing, maintaining and improving the Platform, ensuring the security of the Platform, providing responses to petitions, complaints and requests, issuing payment documents, archiving the logs relating to the User’s actions and the records of transactions:

the IP address of the device from which the User accesses the Platform and other device-related information (when the Platform is used);
the date and time of access to the Platform;
the (technical) request for access to the Platform;
HTTP response code;
the amount of data transferred;
the Platform version;
the operating system;
error identification and handling;
data from the User account;
data on transactions;
data for issuing payment documents;
bank account data.

Purpose and legal basis of the processing: Administration of the User account is a necessary formality in order to benefit from the Services of the Platform. We need this data in order to perform the contractual and legal obligations provided for by Regulation (EU) 2020/1503 and Law no. 244/2022 and the GDPR. The legal basis for the processing of the personal data indicated above is compliance with legal obligations, in accordance with art. 5, para. (5) lit. (a) and (b) GDPR, as well as article 6(1)(b) and (c) GDPR.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities and the following third-party partners: DigitalOcean (for the hosting services for the data and information operated through the CSP) and the payment processor Paysera;

Storage period:

Creating the Investor profile

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

Where you wish to access the Platform as an Investor, it is necessary for us to process the following personal data in order to create an Investor profile by completing the required questionnaires with the data that directly identify the Data subject:

Information on the Data subject’s knowledge and experience in the field of investments: the history and level of knowledge in the field of investments, as well as income and level of education, for the purpose of assessing the investor profile and the appropriateness of the crowdfunding services;
simulation of the investor’s ability to bear losses: information on income, assets and existing or future commitments;
Information necessary for carrying out the Scoring: marital status, whether you have ownership rights over the property in which you reside, whether you hold a mortgage loan;
Information on politically exposed persons (PEP): if you represent an Investor and provide information about administrators, partners, members, shareholders or beneficial owners other than yourself, then it is your responsibility to bring this Policy to their attention and to ensure that you have their consent and are authorised to provide us with that data.

Purpose and legal basis of the processing: Creating the investor profile is a necessary preliminary formality in order to benefit from the Services of the Platform. We need the mandatory data for these formalities preliminary to the performance of the legal obligations provided for by Regulation (EU) 2020/1503 and Law no. 244/2022. The legal basis for the processing of the personal data indicated above is compliance with legal obligations, in accordance with article 5 para. 5 lit. (b) GDPR.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities.

Storage period:

Details regarding profiling and automated decision-making:

On the basis of the information provided and using settings calibrated in accordance with legal requirements (e.g. previous investments, risk appetite, etc.), Fagura carries out the profiling, prior to the investment contracting procedures.

Profiling means the evaluation, according to certain parameters (e.g. previous investments, etc.), in order to allocate a user to a pre-defined category on the basis of that evaluation. A decision based solely on automated processing consists in taking decisions based on technical, automated means, using the data and information provided by the data subject or the information resulting from profiling.

We use automated decision-making to evaluate the results of participation in the assessment questionnaire and to establish whether the data subject understands the level of risk associated with investments in Projects/Loans on the Platform, and to simulate whether you can bear the risk of losses. If the analysis leads to the conclusion that certain investments are not suitable for your profile or may represent a risk to your financial situation, we will display certain warnings on the Platform and assess which category of investors you belong to.

The Platform reviews the automated analysis methods in line with the policies/procedures of the supervisory authorities and adapted internal policies.

The Platform carries out the profiling in order to fulfil the legal obligation to assess the level of risk and the experience and knowledge in the field of investments, under Regulation (EU) 2020/1503 and Law no. 244/2022. We carry out these steps on the basis of art. 22(2)(a) GDPR, which allows us to carry out the assessment in the performance of a contract — namely the contractual relationship between the Investor and the Platform — and also on the basis of art. 5 para. (5) lit. b) GDPR, in order to fulfil the legal obligations incumbent on us under anti-money-laundering legislation. At the same time, the Platform allows the User to contest the decision taken as a result of the process and to express their point of view, ensuring the intervention of a person on behalf of the Controller; in addition, the User may decide on their own to continue their activity on the Platform under a different classification (e.g. you may opt to be classified as a non-sophisticated investor, even though the questionnaire completed and the automated methods resulted in a sophisticated investor profile).

Creating the Borrower profile (Project owner)

Data processed / Purposes of the data processing / Legal basis / Recipients / Storage period:

Where you wish to access the Platform as a Borrower (Project owner), it is necessary for us to process a series of personal data (including from the documentation provided by the Project owner), which may concern the person of the Project owner and/or the project/loan, including those indicated in the key investment information sheet.

Purpose and legal basis of the processing: Creating the Borrower profile is a necessary preliminary formality in order to benefit from the Services of the Platform in this role. We need the mandatory data for these formalities preliminary to the performance of the legal obligations provided for by Regulation (EU) 2020/1503 and Law no. 244/2022. The legal basis for the processing of the personal data indicated above is compliance with legal obligations, in accordance with article 5 para. (5) lit. b) GDPR and art. 6(1)(c) GDPR.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities.

Storage period:

Provision of the Services relating to the crowdfunding Platform

In order to be able to provide you with the Services offered by the Platform, following your contracting of these Services it may be necessary for us to process the following personal data:

Contact data (telephone number, postal address, e-mail address);
Platform authentication data (user ID and password);
Technical data (data on visitors’ sessions on the Platform website, logs regarding the user’s actions on the Platform);
Transaction data (transactions carried out by the User through the Platform, the User’s preferences, the auto-invest settings for Loans);
Data regarding Loan agreements and other contracts/documentation concluded through the Platform.

For the payment processing services for the intermediation operations carried out on the Platform, and to which Fagura has outsourced the payment services, and which is authorised as a payment service provider in accordance with Directive (EU) 2015/2366 (PSD2) and the applicable legislation on payment services, Fagura works with Paysera LT, UAB (a company organised and operating in accordance with the law of Lithuania, with its registered office at Pilaitės av. 16, 04352 Vilnius, Lithuania, legal entity code 300060819 – “Paysera”).

In its relationship with Fagura, in order to fulfil and perform the contractual obligations incumbent on it and to provide the payment processing Services, Paysera will process the following personal data in the name and on behalf of Fagura:

surname and first name, pseudonym, sex, date and place of birth, citizenship, signature, data from civil status documents, telephone/fax, address (domicile/residence), e-mail address, profession, place of work, professional training (graduation diplomas, education), income, source of income, economic and financial situation, data regarding assets held, banking data, public office held, political exposure, photograph or video recording of the facial image, personal identification number, series and number of the identity document, data regarding the commission of offences, IP address.

Purpose and legal basis of the processing:

The purpose of this processing is to ensure the performance of Fagura’s obligations as intermediary in relation to the contracting by Data subjects of the Fagura Services. The processing of personal data is necessary for the performance of the contract to which the data subject is party (in accordance with the Terms and Conditions of the Fagura platform), in accordance with article 5 para. (5) lit. a) GDPR and art. 6(1)(b) GDPR.

Recipients / categories of recipients:

Paysera LT, UAB, a company organised and operating in accordance with the law of Lithuania, with its registered office at Pilaitės av. 16, 04352 Vilnius, Lithuania, legal entity code 300060819 – “Paysera”;

DigitalOcean (a company registered and operating in the United States of America, with its registered office at 01 6th Ave., New York), with data centres in Frankfurt, Germany.

Storage period:

Compliance with the Controller’s legal obligations

Data processed / Purposes of the data processing / Legal basis:

We process your personal data in order to comply with the provisions of Regulation (EU) 2020/1503 and Law no. 244/2022, and also to comply with the legislation on the prevention of money laundering and terrorist financing and on fraud prevention.

Purpose and legal basis of the processing:

Fagura processes personal data for this purpose in order to fulfil the Company’s legal obligations (art. 5 para. (5) lit. b) GDPR and art. 6(1)(c) GDPR).

Recipients / categories of recipients:

Storage period:

We will store the data and information processed for this purpose for a period of 5 (three) years [sic — as in the original] in accordance with Regulation (EU) 2020/1503 and Law no. 244/2022, except where the user is party to a loan agreement concluded through the Fagura Platform for a term longer than 24 months, in which case we will store the data and information processed for the entire duration of the loan agreement plus a further period of 3 (three) years (in the case of court proceedings extending beyond that term, the data will be processed until the proceedings are concluded, exclusively for the purpose of those proceedings).

Managing the contractual relationship with the User and improving Fagura’s services

Data processed / Purposes of the data processing / Legal basis:

We process the following personal data in order to respond to all requests you may have and also in order to improve and develop our services:

Contact data (telephone number, postal address, e-mail address).

In addition, for the purpose of resolving a complaint and otherwise, we may send you messages regarding changes made or we may contact you where there are problems relating to your account/investment, such as insufficient identity information or payment errors.

Purpose and legal basis of the processing:

Fagura processes personal data for this purpose for the performance of a contract with you (art. 5 para. (5) GDPR and art. 6(1)(b) GDPR), but the processing is also necessary for our legitimate interests or those of a third party (art. 5 para. (5) lit. e) GDPR and art. 6(1)(f) GDPR).

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities.

Storage period:

We will store the data and information processed for this purpose only for the period necessary for processing this data and until the basis on which Fagura relies for the processing of the data ceases to exist.

Sending marketing communications according to the preferences selected

Data processed / Purposes of the data processing / Legal basis:

Our commercial communications will be sent periodically by e-mail and/or SMS, according to your preferences, if you decide to subscribe to them. When you give us your consent to this effect, you will receive information about the newest Fagura projects that may be of interest to you.

Purpose and legal basis of the processing:

This is carried out solely on the basis of your consent, as data subject (art. 5 para. (1) GDPR and art. 6(1)(a) GDPR). This mechanism leads to the receipt of offers tailored to a client/a client segment and may result in an uneven distribution of offers across our client base. After you give consent to the processing of your data, you may revoke that consent at any time, without any further obligations, with effect for the future, without affecting the data processing already carried out on the basis of the consent.

We remind you that you may withdraw your consent at any time, by unsubscribing from commercial communications, should you no longer wish to receive information about new Fagura projects/commercial communications from Fagura.

Withdrawal may be done through the unsubscribe link included in each communication or by contacting us directly at info@fagura.ro.

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities.

For sending marketing communications (SMS, newsletters by e-mail), we use the SendGrid service, provided by Twilio Inc., based in the United States. For this purpose, certain personal data (such as the e-mail address) may be transferred outside the European Economic Area. This transfer is carried out on the basis of standard contractual clauses approved by the European Commission, which provide appropriate safeguards regarding data protection.

Storage period:

Legal reporting to authorities, procedures and investigations carried out by the competent authorities

Data processed / Purposes of the data processing / Legal basis:

The data from the User Account, which we may be required by law to provide to the relevant authorities, in accordance with legal reporting obligations, as well as in the case of investigations carried out by the contracting authorities, in accordance with the law;
Responding to the formal/official questions/investigations of the authorities;
Compliance with our legal obligations to conform / during / for the investigations carried out under the conditions of the law;
Financial audit, reporting and other tax obligations, and for generating reports aimed at improving our business model).

Purpose and legal basis of the processing:

Legal basis: the applicable legal basis under the GDPR, as well as the provisions of article 6(b) GDPR (the legal obligations of the data controller) and article 6(f) GDPR (the legitimate interest of the data controller or of the third-party partner).

Recipients / categories of recipients:

Storage period:

We will store the data and information processed for this purpose until the clarification/conclusion of inquiries/investigations, plus 3 (three) years, and for tax documentation — 10 (ten) years starting with the following financial year.

Protection of the data controller’s rights/interests / defence procedures / debt recovery procedures / legal actions

Data processed / Purposes of the data processing / Legal basis:

The data from the User Account, in accordance with this Policy.

Purpose and legal basis of the processing:

The establishment, exercise and/or defence of our legitimate rights. Such data may be contained in documentation that we may need to submit in court/before the relevant authorities in order to protect our legitimate interests and rights.

Legal basis: article 5 para. (5) lit. a) GDPR or article 6(1)(c) GDPR (performance of the contractual obligations arising from the mandate agreement) and article 5 para. (5) lit. e) GDPR or art. 6(1)(f) GDPR (legitimate interest).

Recipients / categories of recipients:

When we act as data controller, as a rule we do not transfer the data collected for the purpose indicated above to third parties, other than the relevant authorities/entities and third-party partners such as lawyers, assignees, consultancy providers and cloud service providers.

Storage period:

We will store the data and information processed for this purpose until the conclusion of the court proceedings/actions and/or the enforcement of the final court judgment.

Business transfer / corporate operations

Data processed / Purposes of the data processing / Legal basis:

The data from the User Account, in accordance with this Policy.

Purpose. Description of the processing. Legal basis.

the administration, expansion or development of the activity of the Platform/the Operator;
In the case of a (potential) business transfer (we sell part of the business or certain assets) connected with the Operator/the Platform, or where investments are made in relation to the Operator, it may be necessary to disclose your data to the possible purchaser of those commercial activities or assets/to the investor, in order to ensure the completion of the operation; (ii) where the Operator (or a substantial part of its assets/shares) is acquired by a third party, or is the subject of reorganisation operations (merger, division, etc.);

Legal basis: art. 5 para. (5) lit. b) GDPR or art. 6(1)(c) GDPR (compliance with legal obligations) and art. 5 para. (5) lit. e) or art. 6(1)(f) GDPR (legitimate interest).

Recipients / categories of recipients:

We may need to share your data with the potential purchaser, including with consultants/specialists — auditors, on the basis of the agreements that may be necessary in this respect (e.g. a data processing agreement for the purpose of the transaction), but always on the basis of confidentiality obligations firmly assumed by those recipients, which will also include the commitment to apply the security measures necessary for the protection of your data. The data will also be transmitted to our consultants/specialists, on the basis of confidentiality and data security obligations.

Storage period:

We will store the data and information processed for this purpose until the conclusion of the contractual relations with the User, where the operations involve a transfer to a third party.

5. PERSONAL DATA OF THIRD PARTIES

When you enter or provide us with personal data concerning persons other than yourself (for example, the data of a client, partner, representative, family member or of any other person), you declare and warrant that you have a legal basis for disclosing that data to us — either the consent of the data subject or another basis provided by law — and that providing it to Fagura does not infringe the rights of that person or any confidentiality obligation incumbent on you. It is your obligation to inform the data subjects, where the law so requires, and to obtain any necessary consent. Liability for providing third-party data without a legal basis rests with you.

6. HOW LONG WE RETAIN YOUR DATA

We will retain your personal data only for the period of time necessary in order to fulfil the purposes for which we collected it, including for the purpose of fulfilling any legal or tax requirements; however, the period for processing contracts and records relating to services and transactions may not be less than 5 years, in accordance with Regulation (EU) 2020/1503 and Law no. 244/2022.

In order to determine the appropriate retention period for Personal data, we take into account the quantity, nature and sensitivity of the Personal data, the potential risk of harm caused by unauthorised use or disclosure of the Personal data, the purposes for which we process the data and whether we can achieve those purposes by other means.

7. WITH WHOM WE SHARE PERSONAL DATA

In certain circumstances, in order to be able to provide you with the Fagura services, we will share your Personal data with the licensed and authorised service providers with whom we work. When we share your data, we require them to ensure data protection through strict data security measures and to use the data only in accordance with our precise and clear instructions, specifying exactly the personal data processed, the purposes of the processing, and the manner of processing, storage and retention; they are not authorised to use the data in any situation for their own purposes or for other purposes and in a manner other than those specifically entrusted by us.

We may share data, in our capacity as controller, with the following categories of recipients: (i) processors who process the data on our behalf and in accordance with our instructions, on the basis of data processing agreements; (ii) providers of infrastructure, hosting, IT, security, communications and maintenance; (iii) providers of identity verification and fraud prevention services; (iv) payment processors; (v) professional consultants (legal, tax, audit) under confidentiality obligations; (vi) public authorities, where the law obliges us or for the establishment, exercise or defence of a right; (vii) potential purchasers/investors and their consultants, in the context of corporate operations. We reserve the right to change or supplement the providers and processors, while maintaining an at least equivalent level of protection and appropriate safeguards. The list below is indicative and may be updated periodically:

Partners providing the support/related functions necessary for operating the platform through which the Services of the Platform are provided, and to which Fagura has outsourced certain support functions, are:

Onfido Limited (a company incorporated and registered in the United Kingdom under number 07479524, whose registered office is at 9 Devonshire Square, 4th Floor, London, United Kingdom, EC2M 4YF) – which provides KYC (Know Your Customer) services on the CSP and electronic signature services;
DigitalOcean (a company registered and operating in the United States of America, with its registered office at 01 6th Ave., New York – “DigitalOcean”), with data centres in Frankfurt, Germany – which provides the hosting services for the data and information operated through the CSP;
Paysera LT (a company organised and operating in accordance with the law of Lithuania, with its registered office at Pilaitės av. 16, 04352 Vilnius, Lithuania, legal entity code 300060819) – “Paysera”, which provides the payment services.
Twilio Inc. (SendGrid) (a company registered in the state of Delaware, with its place of business at 101 Spear Street, 5th floor, San Francisco, California, 94105, United States of America), which is our e-mail marketing service provider.

You may consult the personal data processing policies of Fagura’s partners by accessing the links inserted below:

Onfido: https://www.entrust.com/sites/default/files/documentation/licensingandagreements/product-privacy-notice-identity-verification-services.pdf
Microsoft Azure: https://www.microsoft.com/en-gb/privacy/privacystatement
Paysera: https://www.paysera.com/v2/en/legal/privacy-policy
Twilio (SendGrid): https://www.twilio.com/en-us/legal/privacy

8. WHERE WE STORE THE PROCESSED DATA

All data and information processed by Fagura are stored in the data centre of Digital Ocean, the DC Hosting Services provider with which we work, namely in Frankfurt, Germany.

All data and information processed by DigitalOcean for the provision of the DC Hosting Services are stored in data centres located in Europe, namely in Frankfurt, Germany. Given that DigitalOcean’s head office is outside the European Union, there is the possibility that they may transfer personal data to countries other than the country in which the data was initially collected. For this reason, for the personal data they receive from the EEA and Switzerland, DigitalOcean has certified its compliance with the EU-U.S. Privacy Shield and the Switzerland-U.S. Privacy Shield, as established by the U.S. Department of Commerce with regard to the collection, use and retention of personal data from such countries.

DigitalOcean also currently uses standard contractual clauses in connection with data transfers from the EEA to the USA, to the extent that the EU-U.S. Privacy Shield is considered invalid and other means are not yet in force.

9. DATA SECURITY MEASURES

Fagura ensures the technical and organisational measures necessary for the collection, processing and safe retention of data, including against unauthorised access, unauthorised use of the data or the destruction, loss or alteration of the data. We undertake to keep the Personal data of Data subjects secure and take all reasonable protective measures to do so.

Fagura ensures technical and organisational measures, including against unauthorised access and unauthorised use of data, through measures such as:

specific IT security means, limited staff access by categories of competence/job duties and access rights;
appropriate administrative and organisational measures to ensure that confidentiality is maintained by the persons who have access to the data;
guarding and securing the premises in which / the servers on which the data are kept and the physical documents in which your data are stored, through specific physical security measures, security of electronic and physical documentation, etc.

Fagura has also developed and implemented several policies and procedures designed to ensure the secure processing of Data subjects’ personal data, such as: Access Control Policy, Backup and Data Restoration Policy, Change Management Policy, Clear Desk Policy, Cryptographic Control Policy, Desktop Computer Use Policy, Information Classification Policy, Information Security Incidents Policy, Internet Use Policy, Mobile Computing Equipment Policy, Password Policy, Physical Access Policy, System Monitoring Use Policy, Remote Access Policy, Risk Assessment Procedure, Segregation of Duties Policy and, last but not least, Third-Party Access Policy.

In addition, we make all reasonable efforts to ensure (including through the contracts concluded with our providers) that our trusted partners also maintain appropriate technical and organisational measures for the processing of employee data that we share with them.

10. THE RIGHTS YOU HAVE OVER YOUR PERSONAL DATA

In accordance with the provisions of the GDPR, you have the following rights over your Personal data:

Right of access: In order to obtain a copy of the personal data we hold about you, you may submit a request to this effect to the following e-mail address: info@fagura.ro;
Right of rectification/modification (updating) of the data: you have the right to have the data we process about you updated, if it is inaccurate or incomplete. You may address a request to the following e-mail address: info@fagura.ro;
Right to object: with regard to the data we process on the basis of our legitimate interest, you have the right to object (for reasons relating to exceptional situations) to the future processing of your data. Your objection will be analysed also by reference to our specific legitimate basis applicable to the processing. You may submit a request to object by e-mail to the following e-mail address: info@fagura.ro;
Right to erasure: You may contact us at any time to request the erasure of the personal data concerning you, at the following e-mail address: info@fagura.ro. This process may be applied in any of the following situations:
- The personal data are no longer necessary for the purposes for which they were collected and processed; or
- You have withdrawn your consent to the continued processing of the data and we can no longer process that data on another legal basis; or
- The personal data are processed contrary to the law.

Your personal data cannot be erased if we are obliged to retain/process it in accordance with the law, or on the basis of our legitimate interest that does not prejudice the fundamental rights and interests of the data subject.

Right to restriction of the use of personal data: You may request that certain personal data be marked as restricted for the duration of the processing of complaints regarding the accuracy and currency of the data and the lawfulness of its processing, and where, although Fagura no longer needs the data, it must retain it for the establishment, exercise or defence of a legal claim. To restrict the processing of the data, you may send a request to the following e-mail address: info@fagura.ro;
Right to withdraw consent – For the processing purpose whose legal basis is your consent, you may submit a request to withdraw your consent by e-mail to the following address: info@fagura.ro.

If you consider that your rights and interests protected by the GDPR have been infringed, you may address various questions and requests for clarification to the ANSPDCP, the supervisory authority for personal data processing in Romania, www.dataprotection.ro