I. PURPOSE, CATEGORIES OF PERSONAL DATA PROCESSED 1.1. The purpose of processing information containing personal data is to ensure the economic and financial management of the Company in accordance with the legislation in force and the provision of services to the Clients, to ensure the integrity of the Company's assets and/or to compensate for the damages caused, to verify the applicant's compliance with the legal rigors established for driving a car; conducting statistical/marketing research, concluding and executing the contract for the provision of car rental services, transmitting information on the services offered by the Company and in compliance with the legal provisions in force of the Republic of Moldova. 1.2. Any use of personal data entered in the "Clients" record system for purposes other than those mentioned above is prohibited. 1.3. Within the records system, the following categories of personal data are processed: 1) Name and surname; 2) Date of birth; 3) IDNP image; 4) mobile phone number; II. DESCRIPTION OF THE RECORDING SYSTEM 2.1. The personal data contained in the records system within the Company are processed/stored: 1. in electronic format: through the mobile application "TerraRentCar Prim" The subject of personal data/ The Client registers according to the rules established in the Contract and available in the electronic version on the same application by entering his personal data stored on the secure server in the Republic of Moldova. After verification by the Manager of the Company of the entered data, the registration is authorized. The Client's personal cabinet is not visible to third parties. 2.2. The processing of personal data in the record system is carried out during the period of the contract between the Parties. Once the Contract is terminated/relationships are terminated/the personal account is removed by the Personal Data Subject/Customer – these are removed from the respective mobile application. Page 1 from 3 Translated from Romanian to English - www.onlinedoctranslator.com 2.3. The company, as a personal data operator, guarantees compliance with the rights regarding the protection of personal data belonging to customers, as well as, as the case may be, to other data subjects. 2.4. In accordance with the principles of personal data protection, the data subjects benefit from the following rights: to information, access to data, intervention, opposition to the personal data concerning them, as well as the right to address in justice. 2.5. All persons involved in the activity of administration and/or processing of information in the record system shall comply with the procedure for access to personal data. 2.6. Physical access authorization Access to the commercial premises of the Company where DCP carriers are located is restricted, being allowed only to persons who have the necessary authorization. The DCP holders' access lists are approved periodically but not less often than once in 6 months by the Company Administrator. The responsible person maintains the administration and monitoring of compliance with the regime of physical access to DCP holders, and counters or ensures the countering of any attempts to violate it. Before granting physical access to DCP information systems, competence is verified. The person in charge will maintain registers or other access monitoring media for at least one year, at the end of which they will be liquidated, and the data and documents contained in the register subject to liquidation will be sent to the archive. The person in charge identifies and maintains certain restricted access spaces where DCP wearers are located. The external walls of the rooms must be strong, the entrances to the offices equipped with locks. Computers, servers, other access terminals are located in such a way that strangers do not have free access to them. The doors and windows are locked if there are no employees in the room. Address books and/or phone books that contain clues about the location of DCP processing means are not accessible to foreigners. The location of DCP processing means complies with the requirements of ensuring security against unauthorized access, theft, fires, floods and other possible risks. The use of photo, video, audio or other means of recording in the security perimeter is allowed only in case of the presence of a special permission of the Company Administrator. Information carriers and DCP processing means taken out of the rooms located in the security perimeter are not left unattended in public places. Declaration of consent for Customers, included in the contract: Through this provision, I express my express consent to the processing by SRL TERRARENTCAR PRIM of personal data, provided by me, including IDNP and photocopy of the identity card and driver's license, for the purpose of providing the services according to the concluded contract. I express my consent for the accumulated information to be used by SRL TERRARENTCAR PRIM and/or the company's employees for professional purposes and to be communicated to the following recipients: the company - owner of the server where DCP is stored and the state bodies authorized in accordance with the legal provisions. Page 2 from 3 SRL "TERRARENTCAR PRIM" Headquarters: 4/4 Mircea Cel Bătrîn str., of. 204 IDNO: 1021600028529 Administrator: Burca Petru Tel.: 079013014 E-mail:terrarentcarprim@gmail.com Page 3 from 3