Privacy Policy in accordance with Art. 13 and 14 of the General Data Protection Regulation („GDPR“) for the usage of the OMV B2PAY app

OMV International Services Gmbh, Trabrennstraße 6-8, 1020 Wien ("OIS”) as controller in the meaning of GPDR; and OMV Petrom Marketing SRL, 22 Coralilor Street, Infinity Building, et. 1, oval B, district 1, Bucharest ("OPM”) as joint controller with OIS in the meaning of GPDR for the customers located and registering on the territory of Romania. (hereinafter jointly referred to as "OMV")

This privacy policy provides information on the purpose and the manner of processing personal data in connection with the usage of the OMV B2Pay App.

We collect the data directly from you through the services offered to you within the application. You have no legal or contractual obligation to provide us with any personal data. However, depending upon the activity, some of the information we may ask you to provide is identified as mandatory (because we need it in order to provide the requested service). If you do not provide the mandatory data with respect to a particular service, you will not be able to use that service.

Further, this service is only available to users for which a virtual Routex card was requested by OMV clients. In this respect, we collect your e-mail address from our clients that are requesting virtual Routex cards for your use. We share such e-mail address with PACE Telematics GmbH ("PACE”), as independent controller in order to create the PACE account which is needed for the use of the digital payment at the pump possibility offered by this OMV B2Pay App. The use of the OMV B2Pay App will only be possible after the creation of the PACE ID account.

We do not use automated decision-making, including profiling, which produces legal effects concerning you or similarly affects you significantly.

Your personal data are protected in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - General Data Protection Regulation(“GDPR”).

1. Purpose and legal basis of the data processing

The personal data that you share with us is processed by OMV for the purpose of providing the services of OMV B2Pay App . The OMV B2Pay App enables digital payment at the pump by using Connected Fueling Service of PACE for the users who own a virtual Routex card issued by OMV.

OMV processes your personal data in accordance with the data protection regulations within the meaning of Article 6 (1) GDPR based on various legal basis:

• Based on the execution of the contract represented by the terms and conditions you adhere to when using the application (Art. 6 (1) lit b GDPR)
• Fulfillment of a legal obligation when it comes to the payment process and fiscal and tax purposes for handling such payment
• Consent when enabling use of location

2. Which personal data is collected?

By using the OMV B2Pay App in accordance with Terms & Conditions the following personal data is processed:

• E-mail address
• Phone number
• PACE ID account
• Fuel transaction data
• Location data when the location function is activated and which is mandatory in order to use the payment possibility through OMV B2PAY App

3. How long is your data processed?

OMV stores your data for the duration of the contract in order to offer the Routex services and 3 years after the termination of the contract.

The OMV B2PAY App does not store data. The data visualised in the OMV B2PAY App is stored on the PACE Connected Fueling platform and the controller of such data is PACE.

After this period, your personal data are only processed to the extent as it is required or permitted by legal regulations (such as tax, accounting or other legal requirements or to pursue our legal claims related to a charging process).

4. Personal data recipients and data processing locations

The personal data collected may be disclosed to Processors and Sub-Processors who provide services on behalf of the controller (e.g. IT maintenance and support services, including payment services) as well as to public authorities and other independent data controllers. Among those, your data will be shared with PACE. The controller ensures that any third parties to whom personal data is voluntarily disclosed are subject to confidentiality and security obligations in accordance with this notice and applicable law (for the avoidance of doubt, this may not apply where the disclosure is not a voluntary decision of the controller).

The processing of the data shall take place exclusively in member states of the European Union or in states party to the Agreement on the European Economic Area or in such third countries for which an adequacy decision of the European Commission pursuant to Art 45 GDPR or appropriate guarantees pursuant to Art. 44 and followings GDPR have been obtained.

5. Data subjects rights

In order to ensure a fair and transparent processing, the controller informs you about the rights you benefit from, as data subject, according to the applicable legal provisions:

• The right of access to processed personal data;
• The right to request the rectification or deletion of personal data;
• The right to request the restriction of processing;
• The right to withdraw your consent for processing;
• The right to object to the processing of personal data;
• The right not to be subject to a decision based exclusively on automated processing;
• The right to data portability;
• The right to file a complaint with the competent data protection authority.

Further information on data protection including the rights to which you are entitled on the basis of the GDPR can be also found under Data protection is important to us | OMV.com and for the Romanian clients under https://www.omv.ro/ro-ro/omv-in-romania/nota-de-informare.

If you have any questions, the Group data protection officer of OMV can be contacted at privacy@petrom.com and in case of data protection questions relevant for the Romanian clients or exercising any of the rights under GDPR, the data protection officer can be contacted at privacy@petrom.com.