PRIVACY POLICY

Michelin is committed to protecting your personal information and being clear and transparent about what information we collect and how we will use it. This policy explains how any personal information we collect when you use our website or digital services or platforms, or that you provide to us, will be processed by us.

This policy applies to your use of Aventura.michelin.ro. Please read the following policy carefully to understand our views and practices regarding your personal information and how we will treat it in the framework of the products or services we provide.

WHO WE ARE AND HOW WE CAN BE CONTACTED

Michelin Romania S.A. (“Michelin”), as data processor, located in Sos. Bucuresti-Nord nr. 10, Global City Business Park, O1 building, 3^rd floor and 2^nd floor, O1 building, O1.3,4^th floor, room 1, Voluntari Ilfov, registered under Ilfov Register of Commerce J23/2379/2013, Unique Code of Registration 13663684, operates personal data of the users of Aventura.michelin.ro.

If you need to contact us you have a number of options, you can:

• email us at dataprivacy_EUC@michelin.com

You can send us a letter addressed to Sos. Bucuresti-Nord nr. 10, Global City Business Park, Building O1, 3rd floor, Room 1, Voluntari, Ilfov county, Romania

OTHER POLICIES AND INFORMATION WE ENCOURAGE YOU TO READ

While this Privacy Policy contains all the information you need on how we collect and use your personal information on our websites, there is information in some other places which we encourage you to read: Aventura.michelin.ro/privacypolicy

• Cookie Policy
• Terms and conditions
• Linked platforms

a. Our cookie policy

When you use our website, information can be collected through cookies to distinguish you from other users of our website and other products and services. We have a separate Cookie Policy which explains our use of cookies and the purposes for which we use them. We encourage you to read our Cookie Policy here: aventura.michelin.ro/cookies-policy.

b. Terms and conditions

Our Terms and conditions tell you the terms on which you may make use of Aventura.michelin.ro and should be read alongside this Privacy Policy. You can read our Terms and conditions here: aventura.michelin.ro/terms-and-conditions.

b. Linked platforms

Our website may contain links to and from our websites and digital platforms of our partner networks, advertisers, affiliates and social media pages. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

INFORMATION WE MAY COLLECT FROM YOU

This section sets out:

• how we collect your personal information;
• the categories of data that we collect;
• a description of how we plan to use the information we collect;
• the legal basis that we will rely on to process information collected;
• how long we will hold the information collected; and
• specific types of data

Personal Data processed by Michelin as Data Controller

VOLUNTARY INFORMATION

When you provide us information (for example, the information set out in the scenarios above), in some cases we may ask you for additional, voluntary information. This information will be identified as optional and is used to help us better understand our customers and tailor our services to them and you.

STATISTICAL INFORMATION

We also collect and use aggregated data such as statistical or demographic data (“Aggregated Data”). Aggregated Data may be derived from your personal information but does not reveal your identity in any way. For example, we may aggregate your Usage and Device Data to calculate the percentage of our website users accessing a specific feature of our website. Aggregated Data is used for our own business purposes only.

SENSITIVE PERSONAL INFORMATION

While we do not request sensitive personal information, we do have sections on our website where you can submit additional information, for example, when you submit a question in our chat-room. If you submit information on these free text sections, only submit information you are comfortable providing and always bear in mind that it may be sensitive information. If you submit reviews or feedback for our website, please remember that this information will be visible to other users of our website.

MARKETING COMMUNICATIONS

You will receive marketing communications or newsletters from us only (i) if you request it, (ii) if you are one of our customers, provided that this communication will concern similar products or services or if (iii) this communication is linked to your business activity.

In this context, we will use the information you provide us, usually just your name and email address.

In any case, you can unsubscribe or stop our direct marketing at any time either

(i) by clicking on the unsubscribe option at the bottom of each marketing communication we send to you; and

(ii) by contacting us by email or letter using any of the contact details set out in this notice.

We will generally send you marketing communications until you choose to unsubscribe from receiving them. However, if we have not heard from you for a while or notice that you have not opened our emails in a period of 3 years, we will remove your details from our database. There’s nothing stopping you from subscribing again at any time.

WHERE WE STORE YOUR PERSONAL INFORMATION

All information you provide to us is stored on secure servers of SEE or outside SEE. Any information stored outside SEE respects the below rules regarding the communication of personal fata.

SHARING YOUR PERSONAL INFORMATION

We only share your personal data with people who have a need to know such information to perform their responsibilities. We may share your personal information with the following:

• Within the Michelin Group - we may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries to the extent necessary for the same purposes of the initial processing set out in this policy.
• Service Providers - Michelin may share your personal information with selected service providers that Michelin may use to process your request or provide its services to you. These service providers act as data processors on our behalf and provide, IT and system administration services, such as hosting and email services.

These service providers are legally obligated to keep the personal information they may have received confidential and secure and to use your personal information on the basis of our instructions only.

We may also share your personal information with third parties:

(i) For legal reasons

If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions and other agreements; or to protect the rights, property, or safety of the Michelin Group, our customers, or others. In this context, we may disclose your personal information to our professional advisors who are under a duty of confidentiality.

(ii) On the basis of your consent

Third parties can collect information about you on our website, products or services via cookies or similar technologies, in order for example to provide personalised ads or to set up your preferences profile. These cookies will be accepted by you in accordance with our Cookie Policy.

Michelin is an international group with databases in the various countries in which it operates. Michelin may transfer your personal data within the group to one of its databases or to its external partners located outside of your home country.

As levels of data protection vary worldwide, we do not transmit your personal data to Michelin group companies or to third-party companies outside of the European Union unless these companies offer the same or similar level of personal data protection as Michelin.

For transfers within Michelin, the company has adopted internal rules governing the transfer of personal data from the European Union or European Economic Area. By clicking on BCRs, you can find the details of these rules.

Transfers of data outside the group are governed either by the BCR of the subcontractor or by contracts containing the clauses of the European Commission for suppliers established outside the EU to guarantee a similar level of protection as that of your home country.

HOW LONG WILL PERSONAL INFORMATION BE KEPT BY US?

As a rule, we will not hold your personal information for any purpose or purposes for longer than is necessary to fulfil the purposes of data collection, including for the purposes of satisfying any legal, accounting, or reporting requirements. For more specific retention periods, please see section Information we may collect from you above.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances you can ask us to delete your data: see your right to be erased below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

YOUR RIGHTS UNDER DATA PROTECTION LEGISLATION

Data protection legislation provides you with certain rights when it comes to the processing of your information. These are:

a. The right the be informed

You have the right to be informed about how we collect and process your personal information, including who we are, how we use your personal information and your rights in relation to your personal information. We have gathered all the information you need in this privacy notice.

b. The right of access to your information

You have the right to access the personal information we have on you. We can confirm whether or not your information is being processed and provide you with access to your personal information.

c. The right to rectify your information

If your personal information is inaccurate or incomplete, you are entitled to have that information corrected and updated. If we have disclosed your information to any third parties, where possible, we will inform them of any updates you provide to us. You can update the personal information we hold about you by contacting us using any of the contact methods details in this Privacy Policy.

d. The right to erase your information

You have the right to request the deletion or removal of your personal. There are limited circumstances in which you can request deletion of you information, these include, where the information is no longer necessary for the purpose for which we originally collected or processed it and where you have withdrawn your consent to the processing by us. If you would like further information on your right to deletion, please just ask.

e. The right to restrict processing

In some circumstances, you also have the right to restrict or suppress the processing of your personal information. If you request us to suppress your personal information, we will suspend any further processing of it.

f. The right to portability of data

If you want to move or transfer your personal information to a different service provider, you have the right to have your information transferred to another person.

g. The right to object

You have the right to ask us not to process your personal information where we are relying on a legitimate interest and there is something which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

For further information on your rights

You can find further information on your data protection rights from the Data Protection Authority on the website of Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal, ANSPDCP (http:// www.dataprotection.ro/).

Who do we contact?

If you wish to exercise your rights regarding your personal data that Michelin processes as a data controller, you can contact us in writing by sending a letter [please insert entity name and address] or by e-mail at dataprivacy_EUC@michelin.com .

How will Michelin handle my request?

Free is the general rule. Access to your personal data (or the exercise of other rights) is free. However, we may charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive. We may also refuse to grant your request in these circumstances.

What we need

We may ask you for specific information to help us confirm your identity and guarantee your right to access your personal information (or to exercise your other rights). This is a security measure to ensure that personal data is not disclosed to people who are not entitled to know it. We may also contact you to ask for more information about your request so that we can respond to you more quickly.

Response time

We try to respond to all justified requests within a month. We may occasionally need more than a month if your request is particularly complex or if you have made multiple requests. In this case, we will notify you and keep you informed of the progress of your requests.

The remedies available to you if you are not satisfied

We strive to protect and respect your privacy. However, if you are not satisfied with the way we collect or process your information, or simply want more information about your rights, you can contact us via the following means:

• You can send us an e-mail to dataprivacy_EUC@michelin.com

· You can send us a letter addressed to Sos. Bucuresti-Nord nr. 10, Global City Business Park, Cladirea O1, etaj 3, camera 1, Voluntari, judetul Ilfov, Romania

We will endeavor to resolve with you any problem you may encounter and to answer all your questions as soon as possible.

If, after contacting us, you believe that your rights are not respected or that the access control device does not comply with the data protection rules, you can submit a complaint to the Data Protection Authority - Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal ANSPDCP ( https://www.dataprotection.ro/ ) or to the competent courts.

ABOUT DATA SECURITY

Michelin has implemented measures to protect the confidentiality, security and integrity of your personal data. Access to personal data is restricted to employees and service providers who need to know this information and who have been trained to comply with the rules of confidentiality.

Michelin undertakes that your personal data will not be accidentally lost, used, accessed or accessed without authorization, altered or damaged. Michelin has procedures in place to deal with any suspicion of personal data breach and will notify its customers and any relevant supervisory authority of any violation when we are legally or contractually obliged to do so.

CHANGES TO OUR PRIVACY POLICY

We may change our policy from time to time. Any changes we make to this policy in the future will be posted on this page. If you have an online account with us, we may notify you of any changes by email or through your account the next time you log on.