PRIVACY NOTICE

v.2022062001

Ans Azura S.R.L., a limited liability company, incorporated in Romania, registration no. J23/5576/2020, tax no. RO43351692, telephone +40 759 333 334, e-mail: ansazura@ansazura.com, contact address: 3A Emanoil Porumbaru Street, 2nd Floor, apartment 3, District 1, Romania (“Ans Azura” or the “Controller”).

Ans Azura processes your personal data, as controller, for the purposes detailed below, in particular for organising and conducting art auctions and sales on Ans Azura’s online platform which can be accessed at https://ansazura.com (the “Online Platform”). Personal data is processed in accordance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”) and other applicable European and national laws.

We hereby inform you regarding the processing of your personal data by Ans Azura.

This Privacy Notice is applicable to all who use the Online Platform, including visitors and persons who have created an account on the Online Platform or provided information / personal data to Ans Azura, in relation to the Online Platform (“data subjects”).

Please read this Privacy Notice carefully and note that it may be amended from time to time, whenever Ans Azura deems it necessary. Any amendment to the Privacy Notice will be published on the Online Platform and will be effective as of the date of its publication.

We recommend that you check this page regularly. As far as possible, Ans Azura will also inform you by e-mail regarding any amendments to the Privacy Notice.

Pursuant to the provisions of the GDPR:

“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1. PURPOSES AND LAWFULNESS OF PROCESSING OF PERSONAL DATA

1.1 The purposes of the processing of personal data are the following:

(a) creating and validating an account on the Online Platform and providing features of the services to the data subject (provide support, maintenance, provide feedback to data subject’s questions, operation of the Online Platform). In this case, the collection of personal data will be done through the Online Platform, following the indicated steps for the creation of the account;

(b) purchase/sale of goods by entering into and performing contracts, invoicing and delivering goods. In this case, the collection of personal data will be done by concluding the contracts, by e-mail, telephone or correspondence carried out in physical format or by the audio-video recordings of the auctions;

(c) providing promotional materials in relation to the services provided by Ans Azura, either by e-mail, SMS, telephone or providing any other relevant information in relation to the services provided by Ans Azura. In this case, the collection of personal data will be done if you have expressed your consent in this regard by subscribing to Ans Azura’s newsletter or otherwise on the Online Platform to receive information about auctions, sales or other events organised by Ans Azura; or if such a right is granted by law;

(d) further developments of the Online Platform, research, statistics;

(e) security, compliance and protection;

(f) hosting events on the Online Platform, in which case the personal data will be processed in order to enable the participation of users to the events hosted on the Online Platform and in order for Ans Azura to fulfill its obligations as per the contractual terms agreed upon with Ans Azura and the organizers of events hosted on the Platform.

1.2 In order to act as agent in the auctions and sales carried out on the Online Platform, Ans Azura is under a legal obligation to verify your identity, in particular in order to fulfil its obligations under the applicable laws on the prevention and combating of money laundering and "know-your-customer" (KYC) requirements and in order to perform contracts, issue invoices and deliver goods.

1.3 In the case of events hosted on the Online Platform but organised by third parties, Ans Azura will process the personal data of users in order to host the events; the users of the Online Platform who participate to events hosted by Ans Azura but organised by a third party, whose name will be disclosed on the event’s page, agree that their personal data provided to Ans Azura in order to participate to the hosted event may be transferred to the organiser of the event in order for the latter to perform any actions required after the event was hosted on the Online Platform, such as, without limitation to, concluding sale agreements with the users or shipping works of art to the users.

1.4 The lawfulness of the processing is as follows:

(a) your consent, pursuant to article 6 (1) point (a), GDPR – for the purpose mentioned in Art. 1.1 letter d), first paragraph;

(b) the contract concluded with you or your intention to enter into a contract, when the processing of personal data is necessary in order to perform the contract, respectively in order to take steps at your request prior to entering into a contract, pursuant to article 6 (1) point (b), GDPR – for the purpose mentioned in Art. 1.1 letter a) and b);

(c) the legal obligation pursuant to which Ans Azura is under an obligation to process personal data, pursuant to article 6 (1) point (c), GDPR, including without limitation to the obligations provided under the applicable laws on the prevention and combating of money laundering and know-your-customer (KYC) requirements or to the applicable accounting and tax requirements – for the purpose mentioned in Art. 1.2;

(d) Ans Azura’s or a third party’s legitimate interests such as, but without limitation to preventing fraud, maintaining the security of goods or direct marketing, pursuant to article 6 (1) point (f), GDPR - for the purpose mentioned in Art. 1.1 letter c) last paragraph and art. 1.1 letter d) and e). Ans Azura will determine if there is a legitimate interest in processing your personal data following a careful assessment.

1.5 Kindly consider that if you do not agree with the processing of your personal data Ans Azura will not be able to provide its services to you (e.g., if you do not provide the minimum data necessary for the creation of the account, the account will not be created and you cannot benefit from the services offered by/through the Online Platform).

2. CATEGORIES OF PERSONAL DATA PROCESSESSED BY ANS AZURA

2.1 SIMPLY ACCESSING THE ONLINE PLATFORM DOES NOT LEAD TO THE PROCESSING OF PERSONAL DATA, BUT SOME PERSONAL DATA CAN BE OBTAINED, AUTOMATICALLY, (IP ADDRESS, LOCATION, TYPE OF DEVICE USED, TIME AND DATE OF ACCESS, TIME SPENT ON THE ONLINE PLATFORM, INTERNET CONNECTION SPEED, SOLE ID NUMBER OF THE USED DEVICE). THE PERSONAL DATA COLLECTED AND PROCESSED BY THE CONTROLLER IS WILLINGLY PROVIDED BY THE DATA SUBJECT OR BY THIRD PARTIES, WHO HAVE THE PRIOR CONSENT OF THE DATA SUBJECT.

2.2 The Controller processes the following personal data:

2.2.1 With respect to the creation and use of the account*: your full name, age, e-mail address, phone number.

* for the full use of your account, respectively for registration and participation in auctions on the Online Platform and in order to complete direct sales, supplementary personal data will be processed and KYC procedures should be completed:

• your full name, previous names, mother’s maiden name, place and date of birth, citizenship, sex, personal numeric code, type, series and number of your identity document, issuing state or authority, date of issue, date of expiry, as well as all other data provided in your national identity document, the copy of your identity document (including photo);

• permanent or residence address, phone number, e-mail address;

• occupation, place of work, name of the employer or nature of your professional activity, address of the headquarters;

• information on the source of your assets and funds which will be used in your business relationship with Ans Azura;

• information on whether you are a politically exposed person (“PEP”) or the family member of a PEP or of a person known to be a close associate of a PEP or whether you have been and or whether you are listed in our identity verification service supplier’s data bases on sanctions, watch lists or adverse media;

• the purpose and nature of your business relationship with Ans Azura;

• your image.

2.2.2 With respect to purchase/sale of goods by entering and performing contracts, invoicing and delivering goods:

• your full name, place and date of birth, citizenship, personal numeric code, type, series and number of your identity document, issuing state or authority, date of issue, date of expiry, as well as all other data provided in your passport or national identity document, the copy of your passport or national identity document (including photo);

• permanent or residence address, phone number, e-mail address;

• registration of your correspondence with Ans Azura, including registrations of telephone calls and e-mails;

• shipping address, data regarding the shipping services you use to deliver the goods you sold, intended to sell or purchased through Ans Azura, information regarding the insurance of the goods, billing address;

• data regarding the goods sold or bought on the Online Platform;

• bank account details;

• any financial and tax information that may reasonably be necessary for Ans Azura to conduct its business in good conditions;

2.2.3 For providing promotional materials in relation to the services provided by Ans Azura, or providing any other relevant information in relation to the services provided by Ans Azura:

• your full name, date of birth, permanent or residence address, phone number, e-mail address;

• information regarding your preferences in relation to the promotional materials sent by Ans Azura;

2.2.4 Further developments of the Online Platform, research, statistics and security, compliance and protection:

• technical data such as the IP and the type of device from which you access the Online Platform, sole id number of the used device, internet connection speed, your location, your authentication data, encrypted password, access and use habits, the pages you accessed on the Online Platform, the time and date on which you accessed the pages, your search history, the time you spent on the Online Platform, your previous sales or purchases, your preferences on the Online Platform;

• data you provided to Ans Azura through your requests, complaints or your responses to Ans Azura surveys or market research;

• data relating to litigations, mediations or other administrative proceedings, as well as any allegations of fraud, theft or other illegal activities involving goods or persons connected to you;

• communications with the police, courts or any public authorities or institutions in relation to you or goods connected to you.

3. STORAGE PERIOD OF PERSONAL DATA

3.1 Your personal data will be kept throughout the relationship between you and Ans Azura (starting with the creation of the account on the Online Platform), as long as such data is necessary in relation to the purposes for which they were collected or otherwise processed or for the period imposed by the applicable law (e.g., accounting purposes, reporting to the competent authorities).

When your personal data is processed by Ans Azura in order to meet KYC requirements, your personal data will be kept throughout the relationship between you and Ans Azura and for a period of 5 years as of the termination of the relationship.

3.2 After the periods referred to above, Ans Azura will delete or destroy your personal data. Ans Azura will review the processed personal data at least once every 2 years, and inaccurate or amended data will be corrected or deleted, unless the applicable law provides that it is mandatory to keep such data.

3.3 Logging and access history and habits will be stored for a period of 30 days, after which it will be erased.

4. COOKIES

4.1 Cookies are small text files stored on a user's computer, mobile phone, or other device with Internet connection on which you access web pages. Cookies cannot read or understand other files or documents stored on such devices.

4.2 Cookies contain information about the manner in which web pages are viewed, such as the language in which the pages are displayed, the region of the globe in which the user is located, or the security settings.

4.3 Ans Azura uses cookies so that the Online Platform can be used as easily as possible and to adapt it to the needs of users.

4.4 The cookies on the Online Platform will be activated following your explicit and prior consent. You may activate only certain cookies and withdraw your prior consent regarding the activation of certain cookies (optional cookies). Ans Azura has the legal right to store cookies on devices, if it is strictly necessary for the operation of the Online Platform. For all other types of cookies, the user’s permission is required. Please consider that in case of non-consent/withdrawal of consent for using certain cookies your overall experience may worsen, since it may no longer be as personalised, and it may also disable the possibility to save customised settings like log in information.

4.5 The Online Platform relies on two types of cookies: persistent cookies and session cookies. A persistent cookie lasts beyond the current session and is used for many purposes, such as recognising an existing user, for easier access and log in to the Online Platform. A persistent cookie stays in the browser, so it will be read by the Online Platform when returning to it or when visiting a third-party website that uses the Online Platform’ services. Session cookies last only for the duration of the session (e.g. the current visit to a website or a browser session).

5. PROCESSING OF DATA AND DISCLOSURE OF PROCESSED PERSONAL DATA

5.1 Your personal data may be processed by the Controller's employees who require such information for the achievement of the purposes for which such data is processed.

5.2 Your personal data may be disclosed/shared within the context of the following categories of third parties on a need-to-know basis as per the purpose of the processing:

• accountants, auditors, lawyers and other external consultants, if their activity entails knowledge of such data or when the disclosure of such data is required by the applicable law;

• product and service suppliers, such as marketing, transportation, shipping, insurance, telecommunications, IT system and IT support suppliers, including email archiving, suppliers of back-up and recovery services, suppliers of computer security or data storage services, identity verification service suppliers, credit institutions. Ans Azura will take appropriate contractual measures to ensure that such third parties process your personal data in accordance with applicable legal provisions;

• public authorities and institutions.

5.3 Your personal data may also be disclosed to third parties in circumstances such as the following:

• you ask us to disclose your personal data or you give us your consent in this regard;

• disclosure is necessary in order to comply with a legal obligation, including but not limited to Ans Azura's obligations in relation to the prevention and combating of money laundering, in order to respond to a public authority’s request, in order to prevent acts contrary to the law or to defend a legitimate right or interest before a court of law;

• to help protect the rights and safety of data subjects or other;

• disclosure is necessary for Ans Azura to protect its own rights or the rights of its employees, contractual partners or third parties or to respond to a claim;

• organisers of events hosted by Ans Azura on the Online Platform, the name of which will be disclosed on the page of the event organised by such third-parties as per paragraph 1.3 of this Privacy Notice.

6. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

6.1 Certain recipients referred to under point 5 above may process your personal data in countries outside the European Economic Area.

6.2 If Ans Azura provides your personal data to recipients outside the European Economic Area, Ans Azura will take appropriate contractual measures to ensure that such recipients process your personal data in accordance with this Privacy Notice.

7. THE RIGHTS OF DATA SUBJECTS

7.1 You have the following rights in relation to your personal data:

7.1.1 The right of access

You have the right to obtain from Ans Azura confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and the following information:

• the purposes of the processing;

• the categories of personal data concerned;

• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

• the existence of the right to request from Ans Azura rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

• the right to lodge a complaint with a supervisory authority;

• where the personal data is not collected from you, any available information as to their source;

• the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

7.1.2 The right to rectification

You have the right to obtain from Ans Azura without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

7.1.3 The right to restriction of processing

You have the right to obtain from Ans Azura restriction of processing where one of the following applies:

• you contest the accuracy of the personal data, for a period enabling Ans Azura to verify the accuracy of the personal data;

• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

• Ans Azura no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims;

• you object to the processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override your legitimate grounds.

7.1.4 The right to withdraw consent

You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

7.1.5 The right to erasure (“right to be forgotten”)

You have the right to obtain from Ans Azura the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;

• you withdraw your consent on which the processing is based according to the applicable legal provisions and there is no other legal ground for the processing;

• you object to the processing on grounds relating to your particular situation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing for direct marketing purposes;

• the personal data has been unlawfully processed;

• the personal data has to be erased for compliance with a legal obligation under Union or Member State law to which Ans Azura is subject.

Nonetheless, the erasure of personal data cannot be obtained in circumstances such as:

• personal data is processed for exercising the right of freedom of expression and information;

• personal data is processed for archiving purposes in the public interest, scientific or historical research or statistical purposes;

• personal data is processed for the establishment, exercise or defence of legal claims.

7.1.6 The right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Ans Azura’s or a third party’s legitimate interests. In such cases, Ans Azura shall no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7.1.7 The right to data portability

You have the right to receive the personal data concerning you, which you have provided to Ans Azura, in a structured, commonly used and machine-readable format and you have the right to transmit that data to another controller without hindrance from Ans Azura, where:

• the processing is based on your consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2), GDPR or on a contract pursuant to point (b) of Article 6(1), GDPR; and

• the processing is carried out by automated means.

7.1.8 The right not to be subject to a decision based solely on automated processing

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

However, you cannot exercise this right if the decision:

• is necessary for entering into, or performance of, a contract between you and a data controller;

• is authorised by the law to which Ans Azura is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

• is based on your explicit consent.

7.1.9 The right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the supervisory authority for personal data processing.

Relevant information on the national authority in Romania can be accessed at: https://www.dataprotection.ro/, and on the European authority here: https://edpb.europa.eu/edpb_en.

7.2. Data subjects are aware that the aforementioned rights are not absolute rights and accept that there is a possibility that certain personal data used to achieve the purposes of processing may not be erased (for example, personal data for which there is an obligation to report to the authorities or for which there is an obligation to store).

8. SECURITY OF PERSONAL DATA

8.1 Ans Azura uses all reasonable measures to safeguard your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed, including through technical and organisational measures such as the control of physical access to Ans Azura’s headquarters, staff training and safe storage of documents, using encryption passwords to access Ans Azura’s system.

8.2 Ans Azura undertakes efforts to protect your personal data which are sent over the Internet. However, please note that sending data over the Internet is not completely secure, Ans Azura cannot guarantee its security and you are sending such data at your own risk.

9. REQUESTS AND COMPLAINTS

9.1 Please address your requests, questions or complaints regarding the protection of personal data to:

e-mail: ansazura@ansazura.com

address: Bucharest, 3A Emanoil Porumbaru Street, 2nd Floor, apartment 3, District 1, Romania.

9.2 Ans Azura will attempt to respond to your requests and complaints within 30 days as of the date of their receipt. When necessary in light of the complexity of your request or complaint, this 30-day period may be extended by two months. Ans Azura will inform you about any such extension and the reasons justifying the extension.

9.3 If you submit requests or complaints in electronic format, Ans Azura will provide you with the requested information in electronic format whenever possible, unless you expressly request us to provide such information in a different format.

9.4 If Ans Azura is unable to properly identify you, it will not be able to process your request or complaint unless you provide us with additional information enabling us to identify you.

9.5 In such cases, if we are unable to identify you as a data subject, we will not be able to process your request or complaint in accordance with this Privacy Notice, unless you provide additional information in order to enable us to identify you. Ans Azura will inform you and give you the opportunity to provide such additional information.