PRIVACY
POLICY

Scope

Your privacy is very important to us. This Privacy Policy is intended to explain how we collect, store, use and disclose your personal data each time you use our services, visit our website http://www.midia-international.ro with all subdomains ("Site"), or interact in any other manner with Midia International. We pay special attention to the processing of your personal data and we will take all measures to ensure that data is processed in accordance with the principles set out in applicable data protection legislation in Romania, including Regulation (EU) 2016/679 on the protection of natural persons with regard to data processing and the free movement of such data and repealing Directive 95/46/EC ("GDPR"), the national legislation implementing the GDPR, as well as any decisions issued by the National Supervisory Authority for Personal Data Processing regarding the protection of personal data.

Controller

The controller is MIDIA INTERNATIONAL S.A., part of the Prodexport Logistics Group, with its registered office in Port Midia, Năvodari, Constanța County, Romania, Tel +40 730 666 333, email: office@midia-international.ro (hereinafter referred to as Midia International).

For any other information about personal data, please contact us by e-mail at office@midia-international.ro.

General Principles

Personal data means any information regarding an identified or identifiable person; an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more specific elements of his/her physical, physiological, genetic, moral, economic, cultural or social identity.

The following principles are fundamental to the processing of your personal data:

• —Transparency and clarity: When we collect and process your personal data, you will be informed about the identity of the controller, the recipients of the data, and the reasons for the processing. Your personal data will be processed solely for purposes and under the conditions set forth in this Privacy Policy and will not be further processed in a manner incompatible with these purposes.
• —Legitimacy: We collect and process personal data only when we have a legal basis. We use personal data only for appropriate commercial purposes, when we have a legitimate interest or to comply with our legal obligations.
• —Minimisation: We collect only the appropriate, relevant and necessary data in relation to the processing purposes and we take all measures to ensure that they are processed in a way that ensures data security.

Obligation to Provide Data

In the case of data processing carried out for the performance of commercial contracts, fulfilling legal obligations or the legitimate interest of Midia International, the provision of personal data may be mandatory. In the case of processing based on the consent of the data subject, the consent and provision of personal data is entirely voluntary; for these cases, there are no negative effects for you if you choose not to give your consent or provide personal data. However, there are cases where Midia International needs certain personal data in order to fulfill its obligations, for example when this personal data is needed to process your requests. In these cases, unfortunately, it will not be possible to offer you what you ask without providing relevant personal data.

Use of Automatic Processing Means

In our activities, we do not use automated decision-making processes within the meaning of Article 22 of the GDPR. If we apply such processes in the future, we will inform the data subjects separately, in accordance with the applicable provisions.

Disclosure of Data

Our policy is not to disclose, share, sell or lease personal data to third parties in any manner other than that provided in this Privacy Policy.

It may be necessary to disclose personal data (including the granting of a right of access) to Midia International partners (e.g. service providers, legal and financial consultants) with whom we have previously concluded appropriate contracts under the conditions set out in EU and national legislation. We will only disclose data to third parties to the extent necessary to perform the processing for the purposes for which the data was originally collected and will impose appropriate confidentiality obligations.

Midia International may disclose data in order to comply with obligations under applicable legal regulations or to comply with an order from a court or other public authority, such as a warrant or summons. Midia International may also disclose your personal data if we believe in good faith that such disclosure is necessary to prevent fraud, combat money laundering or terrorist financing operations, and to protect the legitimate interests of Midia International.

Data Transfer Outside the EU/EEA

As a general rule, your data will not be transferred outside the European Union / European Economic Area (EEA). However, certain third-party service providers we use (such as EmailJS for processing contact form submissions) may process data on servers located outside the EEA. In such cases, we protect and provide adequate protection for the transfer of your personal data by ensuring that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Retention Period

Generally, personal data collected and used will be stored as long as we have a legitimate interest in retaining such data or for any longer period provided by law, a record-keeping regulation, or required by public authorities. In the case of lawsuits, we may retain your personal data until the proceedings are completed, including during the course of any appeal before the court.

Immediately after the expiration of the applicable retention period, the data shall be:

• (a)deleted or destroyed safely; or
• (b)transferred to an archive (unless prohibited by law or applicable record-keeping regulation). In any case, your personal data will not be retained in a form that allows you to be identified for longer than is necessary to fulfill the purposes for which it was collected or processed, or under the relevant legislation in force.

Security

We have taken organizational and technical measures to ensure an adequate level of security against the risks arising from processing, in particular through unauthorized destruction, loss, modification, disclosure, acquisition or access, willful or accidental handling, third-party access, erasure or modification of personal data. These measures include encrypted data transmission (HTTPS/SSL) and restricted access to personal data on a need-to-know basis.

You will be notified of a breach of data security within a reasonable period of time after the discovery of the breach, unless the relevant authority determines that the notification would impede a criminal investigation or jeopardize national security. In this case, the notification will be delayed according to the instructions of the authorized body. We will promptly respond to any requests related to data breach.

Rights of Data Subjects

As a data subject, you enjoy a series of rights, detailed below.

• —Information. You have the right to be informed about the personal data processing operations carried out by Midia International.
• —Withdrawal. If you were expressly requested to consent to a specific processing, you can withdraw your consent at any time.
• —Access. You can request access to your personal data. If you send us such a request, we will provide you with all information about the purposes of the processing, the categories of data processed, the categories of recipients, data retention period, and your rights to rectify, delete or restrict the accessed data, if applicable.
• —Portability. You can get a copy of the personal data we have recorded in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where technically feasible. You have this right only when processing is based on your consent or when processing is carried out by automated means.
• —Restriction. You may request a restriction of processing in the following cases: for a period that allows us to verify the accuracy of your personal data if you contest it; if the processing is unlawful and you prefer to restrict personal data rather than to delete them; if you need us to keep your personal data when you need this data to defend a right in court; if you objected to processing based on legitimate interests, for the period during which it is verified whether the legitimate rights of Midia International prevail over your interests.
• —Rectification/Erasure. You may request the correction, modification or erasure of any information that is incomplete, expired or incorrect. You may request the deletion of your personal data if your personal data is no longer required for the purpose of processing; if you withdrew your consent to data processing in the case of consent-based processing; if you objected to the processing of data and there are no overriding legitimate grounds for the processing; if your personal data has been processed unlawfully; if the data must be deleted to meet a legal obligation applicable to Midia International.
• —Objection. You may object to the processing of your personal data for reasons relating to your particular circumstances, within the limits and under the conditions laid down by law. Midia International will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
• —Automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• —Lodging a complaint. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — http://www.dataprotection.ro).

You may make a request or exercise these rights by contacting Midia International at office@midia-international.ro. We will ensure that all appropriate measures are taken to resolve your request without delay and, in any case, within 30 (thirty) days of receipt of your application. Information will be provided by electronic means if possible, unless you request otherwise in writing.

Modifications

Midia International may update this Privacy Policy from time to time to reflect current privacy practices. When we make changes to this Privacy Policy, we will revise the "last updated" date at the top of this page. Any material changes to the processing of personal data described in this Privacy Policy that affect you will be communicated through appropriate means.

Specific Conditions Regarding the Processing of Your Personal Data

This section describes how we obtain and use your data (the purpose of the processing), the legitimate interest in processing for these purposes, and the specific conditions of such processing.

Information Concerning Data Privacy for Site Visitors

By using http://www.midia-international.ro together with all of its subdomains, you give your acceptance and consent to the practices set forth in this Privacy Policy subsection.

Processed Data

You can browse our Site without revealing personal data. However, if you would like to contact us to address any questions, comments or suggestions, you can do so by filling out the form in the Contact section of the Site by providing:

• •First name (required)
• •Last name (required)
• •Email address (required)
• •Phone number (optional)
• •Company name (optional)
• •Subject of inquiry (required)
• •Message content (required)

The Site does not currently use cookies for tracking, analytics or advertising purposes. We do not use Google Analytics or any other third-party tracking or profiling tools. The Site uses only essential, functional cookies necessary for the proper operation of the website (such as language preference). Should this change in the future, this Privacy Policy will be updated accordingly and, where required, your consent will be obtained.

Purpose of Processing

The information provided by completing the contact form will only be used for the purpose of analyzing your request and, if accepted by Midia International, for taking all necessary measures to provide an answer or take appropriate action regarding our port services, including bulk and breakbulk cargo handling, livestock operations, storage, logistics coordination, and related port operations. Refusing to provide the requested information prevents the completion of the application registration process and makes communication between you and Midia International impossible.

Contact form submissions are transmitted through a third-party email delivery service (EmailJS), which acts as a data processor on our behalf and processes the data solely for the purpose of delivering your inquiry to our team.

Legitimate Interest in Processing Personal Data

We process your personal data based on your consent, in accordance with the provisions of Article 6 (1) lit. a) of the GDPR, as well as based on our legitimate interest in responding to inquiries relating to our business activities, in accordance with Article 6 (1) lit. f) of the GDPR.

Retention of Personal Data

We will retain your data for a period of 3 years (the general limitation period according to Romanian law), in all cases where, according to your application, the data may be necessary for the establishment, exercise or defence of a right before the court, irrespective of whether it occurs during proceedings before a court or an administrative or extrajudicial procedure. Upon expiration of this period, your data will be erased.

Information Concerning Data Privacy for Business Partners

Processed Data

In the context of concluding and performing commercial contracts, Midia International will process, as an independent controller, the personal data of representatives (legal or conventional), contact persons designated for that purpose, forwarded by the partner or otherwise collected by Midia International. The data collected and processed in this regard relate to data normally included on business cards (name, surname, position, company, telephone number, e-mail address), including, where applicable, the information required to grant a right of access to Midia International systems or equipment and, under certain circumstances, national identification numbers (personal identification number, ID series, passport or driving licence number).

If you shall conclude or have concluded, as a client, supplier or partner, a contract, agreement, memorandum or any other agreement or partnership with Midia International, please ensure that your personnel (legal or conventional representatives, contact persons designated for the actual performance of the contracts or any other person acting for and on your behalf) is well informed about the Midia International Privacy Policy, according to the agreement you have entered into with us.

Purpose of Processing

The above-mentioned data are collected and processed for the purpose of the effective conclusion and performance of contracts by Midia International. We use the data of the representatives for communications concerning the performance of the contract and the performance of the obligations and to maintain the contractual relationship with the business partner they represent. Additionally, we may use this data to establish, exercise or defend a right before the courts, irrespective of whether it occurs during proceedings before a court or an administrative or extrajudicial procedure.

Legitimate Interest in Processing Personal Data

We process the personal data of our natural person business partners for the conclusion and performance of the contracts concluded with them, according to Article 6 (1) lit. b) of the GDPR. We process the data of representatives (legal or conventional), designated contact persons and persons authorized by legal business partners for the legitimate interests of Midia International, in accordance with the provisions of Article 6 (1) lit. f) of the GDPR. We may process some of your data in the context of providing information to relevant authorities on the basis of the applicable legal provisions or in order to comply with statutory obligations. In that case, the basis of the processing is the legal obligation under Article 6 (1) lit. c) of the GDPR.

Retention of Personal Data

We will keep the data for the entire duration of the contractual relationship plus an additional period of 3 (three) years (the general limitation period under Romanian law for the purpose of establishing or defending against legal claims). In any case, the data is erased if the purposes for collection or processing have been achieved. If personal data is to be retained for compliance with a legal obligation (e.g., the obligation to prepare and maintain financial-accounting documents for a period of 10 years), such data shall be retained until the end of the relevant period.

Information Concerning Data Privacy for Access to the Operational Terminal

Processed Data

The Midia International Operational Terminal ("Terminal") is a border zone and port facility subject to the Border Police Control regime, and access and movement within it are subject to restrictive conditions under the specific legislation. If you request access to the Terminal, we will collect from you the following personal data: name, surname, signature, ID serial number and driving licence number (if applicable), the company you belong to, the company you are visiting, as well as images captured by the video surveillance cameras installed to monitor the port facility.

Purpose of Processing

Terminal access is only available at special access points. All persons entering the Terminal must hold and show to the personnel with control duties at the access point, before entering the Terminal, valid identification documents, photographs, and valid documents required by the legislation on public road traffic including, but not limited to, the registration certificate, the periodical technical inspection, the RCA (insurance) and the driver's licence (in the case of access to the Terminal with means of road transport) and, where appropriate, a document proving the need of access.

Midia International requests and verifies the above-mentioned documents as a port operator, as part of its tasks of adopting and applying security measures for port facilities against security incidents, drafting access records required by law to control access to port facilities, monitoring of port facilities (including through video surveillance systems installed at Terminal access points and premises), monitoring of restricted areas to ensure that only authorized persons have access, for the purpose of supervising the handling of goods or overseeing the handling of ship's stores, and to ensure compliance with the security measures and rules at the Terminal. We also process data to restrict access by those who previously violated security compliance obligations, rules of conduct, or refused to repair damage caused to the Terminal for a period of 12 months from the date of the incident.

Persons who refuse or are unable to prove their identity and/or confirm the purpose of their visit when required will be denied access to the Terminal, and their attempt to access will be reported to national and local authorities and security staff, these acts being considered offences (unless under criminal law they constitute criminal offences).

Legitimate Interest in Processing Personal Data

We process personal data for the aforementioned purposes in order to fulfill the legal obligations of Midia International, according to Article 6 (1) lit. c) of the GDPR and in accordance with the Port Regulation of the Romanian maritime ports under the administration of the National Company "Maritime Port Administration" S.A. Constanța and the International Code for the Security of Ships and Port Facilities of 09.12.2002 accepted by Government Emergency Ordinance 80/2003 approved by Law 484/2003. If we process data to obtain compensation for damages caused to the Terminal or to restrict access to persons, this processing is carried out based on the legitimate interest of Midia International, according to Article 6 (1) lit. f) of the GDPR.

Retention of Personal Data

Generally, personal data collected and used will be stored as long as we have a legitimate interest in retaining these data, or for any longer period provided by law, a record-keeping regulation, or public authorities. Images captured by video surveillance systems will be stored for up to 30 days unless the images are needed to investigate security events (in which case the images will be stored for the duration of the investigations and the application of the measures by the relevant authorities). Upon expiration of the storage period, the records will be destroyed or deleted, as appropriate, depending on the media on which they were stored.

Information Concerning Data Privacy for Access to the Administrative Building

Processed Data

Access to the administrative building is through specially arranged access points and is monitored. If you are a visitor at the Midia International offices, we will ask you to provide us with the following personal data at the entrance to the premises: name, surname, purpose of visit, the company you belong to, the department/service/person you are visiting. We will also process image data collected through our video surveillance system.

Purpose of Processing

The aforementioned data are processed to ensure the safety and protection of people, property and valuables, buildings and facilities, as well as fences, in order to ascertain the breach of the security obligations and measures and the rules of conduct applicable in the Midia International premises and the prevention and combating of crimes.

Legitimate Interest in Processing Personal Data

According to Article 6 (1) lit. c), respectively f), the processing of data collected by Midia International on access to the administrative building is based on the legitimate interests of the company, as well as the legal obligation of video surveillance.

Retention of Personal Data

Visitor logs will be stored for a period of 12 months.