Information Obligations

The Data Controller within the meaning of data protection legislation:

SONART ARTIST MANAGEMENT & RECORDS S.R.L.,

42 Mircea Vodă blvd., bl. M14, entrance 2, floor 3, ap. 46, district 3,

030669 Bucharest, Romania,

Phone +40 21 312 64 55,

e-mail: office@sonartedition.com

Rights of data subjects:

If your personal data is processed, you are the data subject within the meaning of the General Data Protection Regulation. You therefore have the following rights in respect of the data controller.

In order to exercise your rights as the data subject in respect of us as the data controller, please contact us at the following email address: office@sonartedition.com

1. Right to information

You have the right to request confirmation from the data controller as to whether your personal data is being processed or not.

If such processing is being carried out, you have the right to information about this personal data and about the following:

• the purposes for which the personal data is being processed;
• the categories of personal data that are being processed;
• the recipients or the categories of recipients to whom the personal data has been disclosed or is still being disclosed;
• if possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria for establishing the period of storage;
• the existence of a right to correction or erasure of the personal data relating to you, a right to restriction of the processing by the data controller or a right to object to such processing;
• the existence of a right of complaint to a supervisory authority;
• all available information about the origin of the data if the personal data was not collected from the data subject;
• the existence of an automated decision-making process including profiling in accordance with Law no. 190/2018 and – at least in these cases – meaningful information about the logic involved, the scope and the intended effects of processing of this sort for the data subject.

You also have the right to demand information about whether the personal data about you is being transferred to a third country or an international organization. Here, you can also demand information about the appropriate guarantees pursuant to Law no. 190/2018 in connection with such transfer.

2. Right to correction

You have the right, vis-a-vis the data controller, to immediate correction and/or completion of the data about you, insofar as the personal data is incorrect or incomplete.

3. Right to erasure

Erasure obligation:

You have the right to demand immediate erasure of your personal data, provided that one of the following grounds applies:

• the personal data about you is no longer required for the purposes for which it was collected or processed in another way;
• you have withdrawn your consent on which processing was based pursuant to Law no. 190/2018 and there is no other legal basis for processing;
• you have objected to processing pursuant to Law no. 190/2018 and there are no legitimate, precedent reasons for processing, or you have objected to processing pursuant to Law no. 190/2018;
• the personal data about you has been processed illegally;
• erasure of the personal data about you is required to fulfill a legal obligation under EU law or the law of the Member States to which the data controller is subject;
• the personal data about you has been collected in relation to the information society services offered pursuant to Law no. 190/2018.

Exceptions:

A right to erasure does not exist if processing is required:

• to exercise the right to free speech and freedom of information;
• to fulfill a legal obligation that requires processing under EU law or the law of the Member States to which the data controller is subject or to carry out a task that is in the public interest or to exercise public authority that has been transferred to the data controller;
• for reasons of public interest in the area of public health;
• for archiving purposes, historical research purposes or statistical purposes that are in the public interest,
• insofar as the right specified in section a) is likely to make achievement of the objectives of this processing impossible or will seriously hinder it, or
• to assert, exercise or defend against legal claims.

4. Right to restrict processing

You have the right to demand that the processing of the personal data about you be restricted in accordance with the following conditions:

• if you have contested the accuracy of the personal data about you for a period that allows the data controller to verify the accuracy of the personal data;
• if processing is illegal and you decline to have your personal data erased and instead demand restriction of the use of the personal data;
• if the data controller no longer requires the personal data for purposes of processing but still requires it to assert, exercise or defend against legal claims.

If processing of the personal data about you has been restricted, with the exception of storage, this data may be processed only with your consent or to assert, exercise or defend against legal claims or to protect the rights of another natural or legal person or for reasons of significant public interest in the EU or a Member State.

If processing has been restricted on the basis of the conditions described, you shall be notified by the data controller before the restriction is lifted.

5. Right to notification

If you have exercised one of your rights to correction, erasure or restriction of processing, we are obliged to notify all recipients to whom the personal data about you has been disclosed of the correction or erasure of the data or restriction of processing, unless this proves to be impossible or are associated with a disproportionate amount of work.

You also have the right to be informed of those recipients.

6. Right to data transferability

You have the right to receive the personal data about you that you have provided to the data controller in a structured and standard format that can be read by a computer. You also have the right to communicate this data to another data controller without hindrance by the data controller to whom the personal data was provided, if

a) processing is based on consent pursuant to Law no. 190/2018 or is based on a contract pursuant to Law no. 190/2018 and

b) processing is carried out with the aid of an automated process.

In exercising this right to data transferability, you also have the right to have the personal data about you transferred directly from one data controller to another data controller, insofar as this is technically feasible.

7. Right to object

You have the right for reasons resulting from your specific situation to object, at any time, to the processing of personal data about you that is/was carried out on the basis of Law no. 190/2018; this also applies to profiling based on these provisions.

The data controller shall stop processing the personal data about you unless the data controller can demonstrate compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or the processing serves to assert, exercise of defend against legal claims.

If personal data is processed for the purposes of direct advertising, you have the right to object to the processing of personal data about you for the purposes of such advertising at any time; this also applies to profiling, insofar as it is connected with such direct advertising.

If you object to processing for purposes of direct advertising, the personal data about you shall no longer be processed for those purposes.

Notwithstanding Directive 2002/58/EC, you have the option, in connection with the use of services of the information company, to exercise your right to object by means of automated processes in which technical specifications are used.

8. Right to withdraw a declaration of consent under data protection legislation

You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawing your consent does not affect the legality of the processing that was already carried out on the basis of your consent up to the point at which you withdraw it.

9. Right to complain to a supervisory authority

Irrespective of any other legal remedies under administrative law or in court, you have the right to complain to a supervisory authority, in particular in the Member State of your normal place of residence, your place of work or the location of the alleged breach, if you believe that the processing of the personal data about you breaches the General Data Protection Regulation.

The supervisory authority to whom you submit your complaint shall notify you, as the complainant, of the status and outcome of the complaint, including the option to seek legal remedy in court pursuant to Law no. 190/2018.

This data protection policy will be updated at regular intervals.