Operator Identification Data SC AES IDEAS SRL, as “PAVOT”

Operator Identification

Contact details

Contact details of the data protection person

• when you provide the respective data (e.g., by contacting us, by completing the registration form for the auction session);
• when you access our website, some data is collected through cookies;
• when you participate in our events through photographs and video clips that are taken, including live streaming.

PAVOT collects and processes your personal data in the following contexts:

• The use of the website www.pavot.art;

• Participation and registration for events broadcasted live;

• The conclusion of a contract with PAVOT.

Your information is not stored longer than necessary – depending on our legal obligations (e.g., to maintain accounting records), or based on any other grounds under which we use the information (e.g., consent, contractual obligations, legitimate interests).

The data is stored using technical and organizational solutions such as: storing information on secure servers, encrypting data transfers to and from our servers using SSL technology, encrypting payment transactions on the website using SSL technology, granting access to your personal data only when necessary, encrypting personal data, encrypting emails, pseudonymizing and/or anonymizing personal data.

We use cookies and similar technologies for collecting information, such as web beacons, on our website, including essential, functional, analytical, and targeting cookies.

We will transfer your personal data outside the European Economic Area only if we are required to do so by law or in order to fulfill our contractual obligations to you. When we do so, we ensure that adequate protection measures are in place, for example: the protection of personal data to partners outside the European Union is regulated through standard contractual clauses for the transfer of personal data from the Community to third countries.

We use automated decision-making processes in relation to our website, such as using Web Analytics tools, cookies, web beacons, or using targeting cookies to display ads to people who visit our site on other websites (for example, through the use of the Google AdSense networ

We collect and use information from website visitors in accordance with this section.

We use a third-party server to host our website, called _______________, whose privacy policy is available here: ____________________. Our website server automatically records the IP address you use to access our website, as well as other information about your visit, such as the pages accessed, requested information, the date and time of the request, the source of access to our website (e.g., the website or URL (link) that referred you to our site), and the version of your browser and operating system.

Our provider collects and stores server logs to ensure the security of the IT network. This includes analyzing the log files to help identify and prevent unauthorized access to our network, distribution of malicious code, forecasting DDoS attacks and other cyberattacks, by detecting unusual or suspicious activities.

Unless we are investigating a suspected or potential criminal activity, we do not and we do not allow our provider to make any attempt to identify you based on the information collected through the server logs.

The legal basis for processing data is the compliance with the legal obligations to which we are subject (Article 6(1)(c) of the General Data Protection Regulation).

The registration of access to our website using server log files is a technical measure to ensure an adequate level of security to protect the information collected from our website in accordance with Article 32(1) of the General Data Protection Regulation.

Cookies are data files that are sent from a website to a browser to record information about users for various purposes.

You can reject some or all of the cookies we use on our website by modifying your browser settings, or you can disable non-essential cookies using our cookie control tool. However, rejecting them may affect the functionality of the website or certain features of the website. For more information about cookies, including how to modify your browser settings.

We collect and use information from individuals who contact us in accordance with this section:

Email

When you send a message to the email address displayed on our website, we collect your email address and any other information you provide in that email (such as your name, phone number, and any details contained in the email signature block).

The legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: To maintain a record of correspondence and to fulfill contractual obligations.

Legal basis for processing: It is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6, paragraph (1), letter (b) of the General Data Protection Regulation).

Reason why it is necessary for the performance of a contract: If your message pertains to the provision of goods or services or taking steps at your request prior to providing our goods and services (e.g., providing information about such goods and services), we will process your information to fulfill this purpose.

Transfer and Storage of Your Information

We use a third-party email provider to store the emails you send us. Our email provider is Microsoft – Office 365. Its privacy policy is available here: https://privacy.microsoft.com/en-us/privacystatement.

The emails you send us will be stored within the European Economic Area on Microsoft Office 365 servers located in Austria.

Auction Session Registration Form

When you contact us using the auction session registration form, we collect: your first name, last name, email address, and phone number. We also collect any additional information you provide when filling out the form in the "comments" field.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: to initiate the process of entering into a contract at your request.

Legal basis for processing: it is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Phone

When you contact us by phone, we collect your phone number and any information you provide during the conversation with us. We do NOT record phone calls.

The legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: to respond to the questions and messages we receive and to keep a record of the correspondence.

Legal basis for processing: it is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).

The reason why it is necessary for the performance of a contract: if your message concerns the provision of goods or services or taking action at your request prior to providing you with our goods and services (for example, providing information about such goods and services); we will process your information to carry out this action.

Transfer and Storage of Your Information

The information about your call, such as your phone number and the date and time of your call, is processed by our telephone service provider, Vodafone, located in Romania. Its privacy policy is available here: _________________.

WhatsApp Chat Service

When you send us a message using the chat service displayed on our website to get a response to your inquiries, we collect your name, email address, and the content of your message.

The legal basis for processing: your consent (Article 6, paragraph (1), letter (a) of the General Data Protection Regulation).

Consent: You give your consent when you send us the message.

Transfer and Storage of Your Information

We use a service provided by a third party for sending messages on our website, called WhatsApp. Its privacy policy is available here: https://www.whatsapp.com/privacy/?lang=ro.

This section establishes how we obtain or collect information about you through third parties.

In general, we receive information about you from third parties. Those third parties from whom we receive data about you are generally companies within our group, affiliates, business partners, or individuals who purchase our services (and) on your behalf.

Also, it is possible that third parties with whom we have had no prior contact may provide us with information about you.

The information we obtain from third parties will generally include your name and contact details, but may also include any additional information about you that is provided to us.

The legal basis for processing: it is necessary for the performance of a contract or to take steps at your request to enter into a contract (Article 6, paragraph (1), letter (b) of the General Data Protection Regulation).

The reason why it is necessary for the performance of a contract: if a third party has provided information about you (such as your name and email address) to provide you with services, we will process your information to take steps at your request to enter into a contract with us (as applicable).

Legal basis for processing: consent (Article 6, paragraph (1), letter (a) of the General Data Protection Regulation).

Consent: In cases where you have requested that a third party disclose information about you to us and the purpose of disclosing this information is not related to the performance of a contract or service by us to you, we will process your information based on the consent you provide by requesting that the third party share the information with us.

Legal basis for processing: Our legitimate interests (Article 6, paragraph (1), letter (f) of the General Data Protection Regulation).

Legitimate interests: In cases where a third party has disclosed information about you to us and you did not consent to the transmission of that information, we will have a legitimate interest in processing that information under certain circumstances.

For example, we will have a legitimate interest in processing your information in order to fulfill our obligations under a subcontract with the third party, where the third party holds the main contract with you. Our legitimate interest is in fulfilling our obligations under our subcontract.

Similarly, third parties may disclose information about you to us if you have violated or might violate any of our legal rights. In this case, we will have a legitimate interest in processing this information to investigate and pursue any potential breach.

If we accidentally receive information about you from a third party and/or we do not have a legal basis for processing this information, we will delete your information.

In certain circumstances (for example, to verify the information we hold about you or to obtain the missing information we need to provide you with a service), we will obtain your data from certain publicly accessible sources, both from the EU and outside the EU, such as public institutions/authorities.

In certain circumstances, we will also obtain information about you from private sources, both from the EU and outside the EU, such as insurance companies. This data will be processed only with your explicit consent.

Legal basis for processing: it is necessary for the performance of a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason it is necessary for the conclusion of a contract: if you have entered into or requested us to enter into a contract with you, in certain circumstances, we will obtain information about you from public sources to help us understand your activities and provide services that meet your needs. For example, we may obtain and/or verify your email address from your website if you ask us to send information via email and we do not have or need confirmation of your email address.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interests: In certain circumstances, we may have a legitimate interest in obtaining information about you from public and private sources. For example, if you have violated or are suspected of violating any of our legal rights, we will have a legitimate interest in obtaining and processing information about you from these sources in order to investigate and pursue any suspected or potential breach.

Legal basis for processing: consent (Article 6(1)(a) of the General Data Protection Regulation).

Consent: We may obtain information from third parties if you have agreed to share this data with us by expressing your consent, for example, by checking a box stating that you wish your information to be shared with us.

We collect information from individuals participating in our events in accordance with this section.

Information collected when you attend our events.

Necessary information.

When you attend our events, we collect data in the form of photo-video content.

We use your relevant personal data for the purpose of preparing and enabling your participation in events organized by PAVOT, which include the live streaming of the auction session, from the moment it starts until its conclusion. The legal basis for processing personal data is the performance of our contract (if you have registered for the event) or our legitimate interest in ensuring your participation in the event (if your participation is ensured by another person, such as a representative or legal/authorized proxy).

In the context of the events, live broadcasts will be recorded and published on the website www.pavot.art, and audio-visual materials, photographs (including screenshots) from the event will be shared. These materials may be published on the PAVOT website, included in press releases, and in media articles.

Participants will not be photographed individually. However, photographs or screenshots featuring them may appear in the broadcast images for the purpose of promoting the events.

Participants who do not wish to be part of the streaming, recording, and publishing activities mentioned above will be informed that they can avoid being recorded. They will be asked if they agree to appear in the images/recordings, and if they do not provide their consent, they will not appear in the images/videos.

Please note that online events will take place using a third-party video conferencing service – Zoom, Microsoft Teams, which processes personal data. The live streaming will be conducted on the website www.pavot.art.

For the purposes mentioned above, you may give your consent through a clear affirmative action by checking the boxes on the auction registration form.

Legal basis for processing: necessary for the performance of the contract and consent (Article 6(1)(b) and (a) of the General Data Protection Regulation).

Reason it is necessary for the execution of a contract: to fulfill our obligations arising from the contract.

Consent: you give your consent to take photos and videos in the context of the event.

Transfer and Storage of Your Information

We use a third-party storage provider to store the photo-video content. Our storage provider is Microsoft – OneDrive. Its privacy policy is available here: https://privacy.microsoft.com/en-us/privacystatement.

The photo-video content will be stored within the European Economic Area on Microsoft servers in Austria.

We use automated decision-making mechanisms on our website. We do not believe that this has a legal effect on you or affects you in a similar way.

You have the right to object to our use of automated decision-making mechanisms and profiling described in this section. You can do this by opting out of cookies and similar technologies, as described in the relevant section of this privacy policy.

If you do not want us to process your real IP address (usually the IP address assigned by your Internet Service Provider) when visiting our website, you can use a virtual private network (VPN) or a free service such as Tor.

The automatic decision-making mechanisms are those decision-making processes carried out through technological means (via a machine) without human involvement.

We automate the display of ads containing our products and services on other websites you visit through the use of cookies.

Logic involved: the automatic display of ads to individuals who have visited our site increases advertising efficiency and is more cost-effective for us than manual display or other advertising methods.

Meaning and anticipated consequences: cookies will be used to recognize that you have visited our site in order to show you ads (unless you have blocked such cookies), and will collect information about your online behavior.

How you can opt-out: you can block these types of cookies by adjusting your browser settings.

This section outlines the circumstances under which we will disclose your data to third parties and any other additional purposes for which we use your data.

Disclosure of your information to service providers

We use a range of third parties to provide us with services necessary for running our business or helping us conduct our operations, and who process your information on our behalf, namely:

• Telecommunications service providers

• Email service providers

• IT service providers

• Website developers

• Web hosting service provider(s)

• Marketing service providers

• Email marketing service provider

• Photo-video content provider

Your information will be shared with these service providers where necessary to provide you with the service you have requested, whether this request is for accessing our website or otherwise.

We do not publicly disclose the identity of our service providers for security and competitiveness reasons. However, if you would like additional information about the identity of our service providers, please contact us directly via email at info@pavot.art, and we will provide such information if you have a legitimate reason for requesting it.

Legal basis for processing: legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: if we share your information with these third parties in a context other than when necessary to perform a contract (or at your request to do so), we will share your information with such third parties to enable us to conduct and manage our business efficiently.

Legal basis for processing: necessary for the performance of a contract or taking steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).

Reason why it is necessary for the performance of a contract: we may share information with our service providers to allow us to fulfill our obligations under the respective contract or to take steps you have requested prior to entering into a contract with you.

We disclose your information to third parties in certain circumstances, as outlined below.

Providing information to third parties, such as Google Inc., Facebook. Google collects information through the use of Google Analytics on our website. Google, Facebook, use this information, including IP addresses and cookie information, for several purposes, such as improving the quality of our services and your browsing experience. The information is collected by Google and Facebook anonymously.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interests: improving the quality of our services.

Sharing your information with third parties, either related to or associated with our business operations, where necessary for us. These third parties include consultants, affiliates, business partners, independent contractors. Additional information about each of these third parties is provided below.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: operating and managing our business efficiently.

Consultants

Occasionally, we obtain advice from consultants, such as lawyers, audit firms, public relations professionals, etc. We will share your information with these third parties only when necessary to enable them to provide us with relevant advice. Our consultants are located in Romania.

Affiliates

Affiliates are individuals or entities with whom we work to promote our company through various means. Affiliates will share information with us, and we will disclose information to them if you have expressed interest in our products or services and to fulfill our contractual obligations to you. Our affiliates are located in Romania.

Business Partners

Business partners are companies we work with that provide goods and services similar to those we offer, complementary to our own activities, or that allow us to provide goods or services we cannot offer alone. We share information with our business partners if you have requested services they provide, either independently or in connection with our own services, and to fulfill our contractual obligations to you. Our business partners operate in the fields of arts and transport. Our business partners are located within the European Union and outside the European Union.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: operating and managing our business efficiently.

Legal basis for processing: necessary for the performance of a contract (or to take steps at your request before entering into a contract) (Article 6(1)(b) of the General Data Protection Regulation).

Reason why it is necessary for the performance of a contract: we must share information with third parties to fulfill our contractual obligations to you or to take steps at your request before entering into a contract.

We do not disclose the identity of all other third parties with whom we may share information for security reasons and to maintain our competitive advantage. However, if you would like additional information about the identity of such third parties, please contact us by email at info@pavot.art, and we will provide such information if you have a legitimate reason for requesting it and only if we have shared the information with such third parties, for example.

We will disclose your information to a potential or actual buyer or seller in the context of a sale or acquisition of business, a merger, or a similar event, either real or potential.

Legal basis for processing: legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: allowing access to information with a potential buyer, seller, or similar person to facilitate such a transaction.

Indicating potential criminal acts or threats to public safety to a competent authority.

If we suspect that criminal or potential criminal behavior has occurred, we may, in certain circumstances, need to contact a competent authority, such as the police. This could be the case, for example, if we suspect fraud or a crime has been committed, or if we receive threats or malicious communications directed at us or third parties.

In general, we will only need to process your information for this purpose if you were involved in or affected by such an incident in one way or another.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: preventing criminal activity or suspected criminal activity (such as fraud).

We will use your information in relation to the enforcement or potential enforcement of our legal rights, including, for example, exchanging information with debt collection agencies if you fail to pay amounts owed when you are contractually required to do so. Our legal rights may be contractual (if we have entered into a contract with you) or non-contractual (such as the legal rights we have under copyright law or tort liability).

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: to enforce our legal rights and take steps to secure our legal rights.

We may need to use your information if we are involved in a dispute with you or a third party, for example, either to resolve the dispute or as part of mediation, arbitration, a court judgment, or a similar process.

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: resolving disputes or potential disputes.

We will use and process your information to comply with the legal obligations to which we are subject. For example, we may need to disclose your information based on a court order or subpoena if we receive one.

Legal basis for processing: compliance with a legal obligation (Article 6(1)(c) of the General Data Protection Regulation).

Legal obligation: legal obligations to disclose information imposed on us by domestic or international regulations (e.g., under an international agreement that Romania has signed).

Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).

Legitimate interest: if legal obligations are part of the laws of another country and have not been integrated into Romania's legal framework, we have a legitimate interest in complying with those obligations.

We use photos and videos taken by the photo-video service provider in the context of events organized by us, for the promotion of the services offered.

The promotion is carried out online using social media networks, the Organizer's website, and email marketing.

Legal basis for processing: consent (Article 6(1)(a) of the General Data Protection Regulation).

Consent: you give your consent to have photos and videos taken during the event and to use them for marketing purposes (point 8.4 of the Framework Agreement).

This section establishes how long we retain the collected data. We have specified retention periods where possible. In cases where this has not been possible, we have outlined the criteria we use to determine the retention period.

Retention period

Server logs: we retain server log information for a period of 6 months.

Information regarding bidding requests: we retain this information for six years from the end of the financial year in which you placed the order followed by the conclusion of the contract, in accordance with our legal obligation to retain records for tax purposes.

Correspondence: when you make a request or contact us for any reason, either by email or phone, we will retain your information for as long as necessary or until you expressly request the deletion of your data, which will be applied in conjunction with our legal obligations.

Photo-video content: we retain photo-video content created during events for 3 years.

Criteria for determining retention periods

In any other circumstances, we will retain your information only for as long as necessary, considering the following:

• the purpose and use of your information both currently and in the future (for example, if it is necessary to continue storing that information in order to fulfill our obligations under a contract with you or to contact you in the future);

• if we have a legal obligation to continue processing your information (such as any record-keeping obligations imposed by applicable law or regulations);

• if we have any grounds to continue processing your information (such as your consent);

• if we have a legitimate interest in continuing to process your data;

• the levels of risk, cost, and responsibility involved in continuing to hold the information.

We take appropriate technical and organizational measures to ensure your information and protect it from unauthorized or unlawful use and accidental loss or destruction, including:

• sharing and providing access to your data to the minimum extent necessary, subject to confidentiality restrictions, where applicable, and anonymously whenever possible;

• using secure servers to store information;

• verifying the identity of anyone requesting access to information before granting access to such information;

• using the Secure Sockets Layer (SSL) standard to encrypt any information you send to us via any forms on our website;

• transferring your data only through a closed system or encrypted data transfers.

Transmission of information over the internet is not entirely secure, and if you send us information via the internet (through email or any other method), you do so entirely at your own risk.

We cannot be held responsible for any expenses, loss of profit, reputational damage, harm, debts, or any other form of loss or damage suffered by you as a result of your decision to transmit information to us through such means.

Subject to certain restrictions, you have the following rights regarding your data, which you can exercise by sending an email to: info@pavot.art

• To request access to your information and information related to the use and processing of your data;

• To request the correction or deletion of your data;

• To request the limitation of the use of your data;

• To receive the information you have provided to us in a structured, commonly used, and machine-readable format (e.g., a CSV file) and the right to transfer that information to another data controller (including a third-party data controller);

• To object to the processing of your data for certain purposes (for more information, refer to the section below titled “Your right to object to the processing of data for certain purposes”)

• To withdraw your consent for the use of your data at any time, where we rely on your consent to use or process that information. Please note that if you withdraw your consent, this will not affect the lawfulness of the use and processing of your data based on your consent before the withdrawal.

In accordance with Article 77 of the General Data Protection Regulation, you also have the right to lodge a complaint with a supervisory authority, especially in the member state of your residence, place of work, or the place of an alleged violation of the general data protection regulation.

For this purpose, in Romania, the supervisory authority is: www.dataprotection.ro

Verification of your identity when requesting access to your information

If you request access to your information, we are required by law to take all reasonable measures to verify your identity before doing so.

These measures are designed to protect your information and reduce the risk of identity fraud, identity theft, or general unauthorized access to your data.

How we verify your identity

If we have adequate information about you in our database, we will attempt to verify your identity using this information.

If we cannot identify you based on this information or if we do not have sufficient information about you, we may request copies or certificates of certain documents to verify your identity before we can provide access to your data.

We will be able to confirm the exact information we need to verify your identity in your specific circumstances if and when you make such a request.

You have the following rights regarding your data, which you can exercise by sending an email to info@pavot.art: to object to the use or processing of your information by us to fulfill a task in the public interest or in the pursuit of our legitimate interests, including analyzing or predicting your behavior based on your information.

"Sensitive personal data" refers to information about an individual that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in a trade union, genetic information, biometric information for the purpose of uniquely identifying an individual, health-related information, or information regarding the sexual life or sexual orientation of a natural person.

As a rule, we do not collect "sensitive personal data". However, if you accidentally or intentionally provide us with any other sensitive personal information, you will be considered to have explicitly consented to the processing of sensitive personal information in accordance with Article 9(2)(a) of the General Data Protection Regulation. We will use and process your sensitive personal data for the purpose of deleting it.

We periodically update and modify our privacy policy.

If we make minor changes to our privacy policy, we will update the Privacy Policy with a new effective date mentioned at the beginning of it. The processing of your information will be governed by the practices set out in the new version of the Privacy Policy from its effective date.

If we make major changes to our privacy policy or intend to use your data for a new or different purpose than the purposes for which we originally collected it, we will notify you by email (if possible) or by posting an announcement on our website.

We will provide you with information about the change and the purpose, as well as any other relevant details, before we use your information for the new purpose.

Whenever necessary, we will obtain your prior consent before using your information for a purpose other than the one for which we initially collected it.