Privacy Policy — Personal Data Processing

Last updated: June 2026 — Applicable to motiva-windowfilms.com

We, Motiva Network SRL, appreciate your decision to become our client or visitor and we acknowledge that your personal data are important to you and to us. This Policy describes which personal data we collect, how, in what circumstances and for what purposes we collect and use them, and to whom we may transmit them.

This Policy regarding the processing of personal data ("Policy") covers the following topics:

1. Who are we?
2. To whom are our services addressed?
3. What are personal data and the processing of such data?
4. What personal data do we process about you?
5. For what purposes and how do we process your personal data?
6. How long do we keep your data?
7. Automated decision-making and profiling
8. Who has access to your data?
9. Do we transfer your personal data outside the European Union?
10. What security measures do we implement?
11. What are your rights regarding the personal data we process?

This Policy applies to personal data processed through:

• The website www.motiva-windowfilms.com ("Website"), when you access our services;
• HTML emails we send to you that contain a link to this Policy, and through our various communications with you.

Please read this Policy carefully. If you intend to submit personal data of another individual to us, you may do so only after obtaining that person's consent and after informing them of the processing purposes described in this Policy. We do not accept responsibility if this procedure has not been followed.

1. Who are we?

Motiva Network SRL, with registered seat at Bld. Republicii, Nr. 304, Bl. R2, Sc. A, Et. 2, Ap. 11, Bârlad, Județul Vaslui, Romania, Trade Registry No. J2013000205377, VAT No. RO31843241, operating point at 5 Nicolae Teclu St., Sector 3, Bucharest, Romania ("Motiva Network", "Operator", or "We"), is the data controller for your personal data and the entity that provides, through the Website, information on the products sold — professional films for automotive and architectural windows, car wrap and body protection films, tools and accessories for film application, as well as technical and advisory services ("Services and Products").

For any questions regarding this Policy, how we process your personal data, or your rights, you may contact us at:

2. To whom are our services addressed?

Our services and products are not directed to persons under the age of 18 and we do not knowingly collect personal data from minors. If we discover that we have collected personal data of a minor without the consent of their legal representative, we will immediately take steps to obtain such consent or, if not possible, to delete the data from our records and from those of our authorised processors.

Our services and products are offered exclusively to legal entities registered with a valid company registration number.

3. What are personal data and the processing of such data?

"Personal data" means any information that identifies or relates to an identifiable individual. This includes less obvious identifiers such as IP addresses or MAC addresses, where these can be associated with an individual.

"Processing" means any operation or set of operations carried out on personal data, with or without automated means — including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, alignment, restriction, erasure or destruction.

4. What personal data do we process about you?

Our policy is to collect only the personal data necessary to provide you with the best experience of our services. As a general rule, we collect the following data:

• First name and last name of the contact person
• Email address
• Phone number
• Name of the company you represent
• Registered address of the company you represent
• VAT number (where invoicing is required)

Unless we instruct otherwise, we ask that you do not send us sensitive personal data (e.g. health card numbers, personal identification numbers, racial or ethnic origin, political opinions, religious beliefs, biometric data, health data, sexual orientation, criminal record information). If such data is received accidentally, we will take immediate steps to delete it.

5. For what purposes and how do we process your personal data?

We process your personal data strictly for the purposes of providing our Services and Products. In some cases we will ask you directly for your data; in others we may access them indirectly. If you do not consent to processing, we may be unable to provide the requested services.

If we decide to process your personal data for purposes other than those stated above, and this is based on your consent under Art. 6(1)(a) GDPR, we will send you a separate information notice to allow you to provide your express, free, specific and informed consent.

6. How long do we keep your data?

We store your personal data strictly for the periods necessary to fulfil each of the purposes for which the data were collected, in accordance with this Policy, our internal data retention procedures, and applicable laws (including archiving legislation).

In determining the appropriate retention period, we consider: the volume, nature and sensitivity of the data; the potential risk of harm from unauthorised processing or disclosure; the purposes for which we process the data; whether those purposes can be achieved by other, less intrusive means; applicable legal requirements; and how we can ensure data accuracy.

When we no longer have a legal obligation, legitimate interest, or your consent to process your personal data, these data will be deleted, anonymised or destroyed in accordance with our internal procedures.

7. Automated decision-making and profiling

The personal data referred to in this Policy are not subject to automated decision-making processes, including profiling, that produce legal effects or significantly affect you.

8. Who has access to your personal data?

We may grant access to your personal data (in full or in part) to:

• Our employees who have assumed confidentiality obligations, strictly to the extent necessary to perform their duties;
• Business partners and processors we have selected responsibly, strictly to fulfil their contractual obligations to us. We conclude data processing agreements with each of them and prohibit use of your data for any other purpose;
• Website hosting provider — necessary for the operation of our Website;
• Google LLC — via Google Analytics (website analytics) and Google Ads (advertising and conversion tracking). Google processes data in accordance with its own privacy policy. IP addresses are anonymised within the EU;
• Marfeel (newsroom.bi) — a third-party content engagement and analytics platform integrated on our Website. Marfeel processes anonymous interaction data in accordance with its own privacy policy;
• Technical maintenance, accounting, and legal service providers — who may have incidental access to personal data in the performance of their tasks.

Public authorities and judicial bodies: We may transmit personal data to competent authorities when required by law (e.g. fraud investigations, anti-money laundering, financial reporting obligations, criminal investigations) or to courts when defending ourselves in legal proceedings.

Business reorganisation: In the event of a reorganisation, merger or transfer of all or part of our business activity, we may transfer your personal data to the relevant third party, provided that appropriate data protection measures are in place and a data processing agreement is signed in advance.

9. Do we transfer your personal data outside the EU/EEA?

As a general rule, your personal data will not be stored or transferred to a country outside the European Union or the European Economic Area (EEA).

Where transfers to third countries do occur (for example, in connection with Google services where data may be processed in the USA), we ensure that such transfers comply with EU data protection law through one or more of the following mechanisms:

• Standard Contractual Clauses approved by the European Commission;
• Transfers to entities certified under the EU-US Data Privacy Framework (adopted July 2023, replacing the invalidated Privacy Shield);
• Other safeguards provided by applicable legal provisions.

10. What security measures do we implement?

We have implemented appropriate technical and organisational measures to ensure an adequate level of security for the collection, processing and storage of personal data, including protection against unauthorised access, misuse, destruction, loss or alteration. These measures include, without limitation: encryption techniques, restricted access to physical and IT systems, and confidentiality obligations.

We also make all reasonable efforts to ensure, including through contracts with them, that our business partners who may have access to your personal data implement appropriate technical and organisational measures.

For online transactions on our Website, we use SSL encryption to protect data in transit. Any information transmitted is automatically encrypted and protected. SSL is the most widely used secure transaction standard today.

Transmission of information to us: Transmission of information over the Internet is not entirely secure. When you send us personal data electronically (by email, through the Website, or by other means), you assume the inherent risks of transmission. We cannot be held liable for any loss, damage or reputational harm resulting from your decision to transmit information to us over the Internet, beyond our mandatory legal obligations.

In the event of a personal data security breach, we will take all notifications and measures required by applicable law.

11. What are your rights regarding the personal data we process?

In the context of processing your personal data, you have the following rights:

• (a) Right of access — you have the right to obtain confirmation as to whether your personal data are being processed and, if so, to access those data and the conditions under which they are processed.
• (b) Right to rectification or erasure (right to be forgotten) — you may request the correction of inaccurate data, the completion of incomplete data, or the deletion of your personal data where: the data are no longer needed for their original purpose; consent is withdrawn and no other legal basis exists; you have objected and we have no overriding legitimate grounds; the data were processed unlawfully; or erasure is required to comply with EU law. We may refuse erasure where we are legally obliged to retain the data or where it is necessary for the establishment, exercise or defence of legal claims.
• (c) Right to restriction of processing — you may request restriction of processing where you contest the accuracy of the data; the processing is unlawful but you oppose erasure; we no longer need the data but you require them for legal claims; or you have objected to processing pending verification of our legitimate grounds.
• (d) Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• (e) Right to object — you may object at any time to processing based on legitimate interest, for reasons relating to your particular situation. You may also object at any time to processing for direct marketing purposes, including profiling.
• (f) Right not to be subject to automated decision-making — including profiling, where this produces legal or similarly significant effects.
• (g) Right to data portability — you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller, where processing is based on consent or a contract and is carried out by automated means.
• (h) Right to lodge a complaint — you may lodge a complaint with the competent supervisory authority:
  • Romania — ANSPDCP: www.dataprotection.ro

The above rights may be exercised at any time by sending a written, dated and signed request to:

We will respond to your request within 1 month of receipt. In complex cases or where we receive multiple requests, we may extend this period by up to an additional 2 months (3 months total). We will inform you of any such extension within 1 month of receiving your request, stating the reasons for the delay. Exercising your rights is free of charge for one request per year.

Policy updates

This Policy may be subject to subsequent changes (e.g. due to legislative developments, changes in our business activities, etc.). The latest version will always be available on our Website. If you wish to consult a previous version, please contact us at office@motiva-windowfilms.com.

For minor changes (not affecting the categories of data processed, types of processing, or purposes), we will update this Policy with a new effective date. Processing will be governed by the new version from its effective date.

For major changes (affecting the categories of data, types or purposes of processing), we will notify you in advance by email (where possible) or by posting a notice on our Website.

Whenever required by law, we will obtain your express, specific, informed and written consent before processing your personal data for purposes other than those for which prior consent was obtained.

This Policy is supplemented by our Cookies Policy, available on the Website.