Privacy Policy

This Privacy Policy describes how AgroTrading Inteligent Solutions S.R.L. (hereinafter referred to as "AgroTrading" or the "Controller"), with its registered office at Str. Eforiei no. 1, Bl. 2, Floor 3, Apt. 12, Valea Călugărească Village, Prahova County, Romania, VAT No. RO39242310, processes the personal data of individuals who interact with:

The AgroTrading presentation websites operated under the following national and international domains: agrotrading.ro, agrotrading.eu, agrotrading.de, agrotrading.fr, agrotrading.it, agrotrading.hu, agrotrading.pl, agrotrading.md, agrotrading.com.ua, agrotrading.gr, agrotrading.rs, agrotrading.tr, agrotrading.co.uk, agrotrading.be, agrotrading.cz, agrotrading.dk, agrotrading.fi, agrotrading.ee, agrotrading.se, agrotrading.si, agrotrading.ae, agrotrading.cl, agrotrading.com.ar, agrotrading.ie, agrotrading.lu, agrotrading.mx, agrotrading.lv, agrotrading.app, agrotrading.info, agrotrading.org, agrotrading.ai, at.agrotrading.eu, au.agrotrading.eu, bg.agrotrading.eu, br.agrotrading.eu, ca.agrotrading.eu, cn.agrotrading.eu, eg.agrotrading.eu, es.agrotrading.eu, hr.agrotrading.eu, in.agrotrading.eu, lt.agrotrading.eu, nl.agrotrading.eu, no.agrotrading.eu, pt.agrotrading.eu, sk.agrotrading.eu and agrotrading.co.za,

as well as with the AgroTrading digital platform, available at the official address https://app.agrotrading.eu.

Sole Data Controller: This Policy applies to all AgroTrading domains, regardless of extension or jurisdiction, insofar as data processing is carried out by AgroTrading Inteligent Solutions S.R.L., acting as the sole personal data controller.

Role of Websites: The AgroTrading® websites operated under the mentioned domains serve exclusively informational and presentation purposes. They do not allow direct commercial transactions and do not constitute points of sale or local representations in the respective jurisdictions.

Access to the commercial functionalities of the AgroTrading platform is available exclusively through the digital application https://app.agrotrading.eu, based on a separate validation process described in the Platform Terms and Conditions.

Regardless of the domain accessed, personal data processing is carried out by AgroTrading Inteligent Solutions S.R.L., a company registered in Romania, acting as the sole controller in accordance with Regulation (EU) 2016/679 (GDPR).

This Policy is drafted in accordance with Regulation (EU) 2016/679 (GDPR), applicable Romanian legislation, and European regulations on personal data protection.

The AgroTrading presentation websites serve exclusively informational purposes and allow the submission of contact requests or invitation requests.

Access to the functionalities of the AgroTrading digital platform is available exclusively through the official application at https://app.agrotrading.eu, based on a separate process of invitation, registration, and validation, governed by the Platform Terms and Conditions.

This Policy applies distinctly and proportionally to each interaction, depending on the nature of the service used.

Through the forms available on the presentation websites, AgroTrading collects EXCLUSIVELY data of the legal entity (company), NOT personal data of individuals:

• Company name (legal entity); • VAT/Tax ID (company tax identification code); • Corporate email (company email); • Company phone (company telephone number); • Message (optional, without personal data).

IMPORTANT: Through the presentation websites, AgroTrading does not request or collect, via forms, personal data of individuals (for example: first and last name, personal email, personal phone, national ID number, home address, etc.). However, for the secure technical operation of the websites, security and abuse prevention, AgroTrading may process technical data (for example: IP address, security logs and strictly necessary cookies), exclusively for security, stability and abuse prevention purposes, pursuant to Art. 6(1)(f) GDPR.

The requested data exclusively identifies the LEGAL ENTITY (company), not the individuals who represent it.

Note: The collection of personal data (first name, last name, personal email, personal phone, etc.) is carried out EXCLUSIVELY within the digital platform https://app.agrotrading.eu, during the registration and user account creation process, and is governed by the Platform Terms and Conditions.

The AgroTrading presentation websites contain a B2B contact form through which COMPANIES (legal entities) can submit requests, questions, or messages to AgroTrading.

The form is intended EXCLUSIVELY for companies and collects data of the LEGAL ENTITY, NOT of individuals.

Form fields: • Company (legal entity name) • Company email (corporate email address) • Company phone (company telephone number) • Message (free text field, maximum 2000 characters)

The company data collected through the form is used exclusively for: • identifying the legal entity (company) requesting information; • processing and resolving requests received from companies; • B2B corporate communication with the requesting company; • providing information about AgroTrading services; • documenting and archiving professional communication with legal entities.

IMPORTANT CLARIFICATION: • The requested data (company, company email, company phone) identifies the COMPANY (legal entity), NOT the individual. • The form does NOT request and does NOT collect personal data (first and last name, personal email, personal phone, national ID number, home address, etc.). • The "Message" field is intended for describing the company's activity and the reason for the request. Users are advised NOT to enter personal data in this field. • Any personal information voluntarily submitted in the "Message" field (contrary to recommendations) is not requested by AgroTrading and will be processed according to data minimization principles (GDPR Art. 5(1)(c)) and deleted upon completion of request processing.

ESSENTIAL CLARIFICATION for GDPR compliance:

AgroTrading makes a clear distinction between:

A) COMPANY DATA (collected on presentation websites): • Company name (legal entity) • VAT/Tax ID (tax identification code) • Corporate email (@companyname.com, @companyname.eu, etc.) • Company phone (company telephone line) • Registered office (company address from the Trade Register)

→ This data identifies the LEGAL ENTITY (company), not individuals. → This is public information, available in the Trade Register or the VIES system (Validation of VAT Information Exchange System). → This data is NOT considered personal data within the meaning of Regulation (EU) 2016/679 (GDPR), INSOFAR AS it does not allow direct or indirect identification of an individual.

In situations where, through accumulation of information, identification of an individual could result (e.g., a nominative email address such as [email protected]), processing is carried out in accordance with applicable GDPR provisions.

B) PERSONAL DATA (collected EXCLUSIVELY on the app.agrotrading.eu platform): • First and last name (individual) • Personal email (e.g., [email protected]) • Personal phone (personal mobile phone)

→ This data identifies the INDIVIDUAL and falls under the full scope of GDPR. → It is collected ONLY during the user account creation process on the digital platform. → It requires explicit consent and is protected according to all GDPR provisions.

CONCLUSION: The AgroTrading presentation websites (agrotrading.ro, agrotrading.de, agrotrading.fr, agrotrading.it, agrotrading.hu, etc.) collect EXCLUSIVELY COMPANY data (B2B legal entity), NOT personal data of individuals.

This approach ensures: • Enhanced GDPR compliance (minimal processing of personal data); • Legal clarity regarding the B2B nature of services; • Enhanced protection of individual privacy.

For details about personal data processing within the digital platform, please consult the Platform Terms and Conditions available at https://app.agrotrading.eu

Company data is processed exclusively for the following legitimate purposes:

• identifying and validating the legal entity (company) requesting information through the contact form; • processing contact requests received from companies; • processing invitation requests for company access to the AgroTrading platform; • providing information about AgroTrading services and features; • offering technical or commercial assistance to interested companies; • documenting and archiving B2B professional communication; • administrative verification of company validity during the invitation process (VAT verification in public ONRC/VIES databases, legal existence validation, verification of company active status); • B2B corporate communication exclusively with validated legal entities; • measuring the effectiveness of online promotional campaigns (EXCLUSIVELY through technical cookies, WITHOUT behavioral tracking or personalized advertising).

IMPORTANT: AgroTrading does NOT perform: • Automated profiling with legal or similar effects (Art. 22 GDPR); • Automated decision-making that significantly affects individuals; • Data processing involving special categories of data (Art. 9 GDPR).

All processing is strictly limited to company data (legal entities) and is carried out in accordance with GDPR principles of lawfulness, fairness, transparency, purpose limitation, and data minimization.

Data processing is carried out based on the following legal grounds, as applicable:

• Art. 6(1)(f) GDPR - the legitimate interest of AgroTrading in responding to received requests and administratively verifying company validity during the invitation process;

• Art. 6(1)(a) GDPR - the explicit consent of the data subject, where expressly requested (e.g., for marketing technologies such as Meta Pixel or Google Ads);

• Art. 6(1)(c) GDPR - compliance with legal obligations applicable to the Controller (e.g., fiscal document archiving, responding to authority requests);

• Art. 6(1)(b) GDPR - pre-contractual measures initiated at the request of the data subject (e.g., processing invitation requests).

A) Data submitted through the presentation websites (legal entity / B2B data):

Data submitted through contact forms (company data) is retained for a maximum of 12 months from the last interaction, for managing requests and maintaining B2B communication records, after which it is deleted or anonymized, except where the law requires a longer period.

B) Technical data (security / operation):

Technical data (e.g.: IP address, security logs, strictly necessary cookies) is retained strictly for the periods necessary for security, stability and abuse prevention purposes, in accordance with internal policies and/or security provider configurations (e.g.: Cloudflare).

Data may be accessed, within strictly controlled limits, by:

• authorized AgroTrading personnel; • IT / hosting / security service providers, acting as data processors within the meaning of Art. 28 GDPR (e.g.: Cloudflare); • public authorities, based on a legal obligation.

AgroTrading does not sell or disclose personal data to third parties for commercial purposes.

In accordance with the GDPR, data subjects have the following rights:

• Right of access to data (Art. 15 GDPR) - obtaining a copy of processed data; • Right to rectification (Art. 16 GDPR) - correction of inaccurate or incomplete data; • Right to erasure ("right to be forgotten") (Art. 17 GDPR) - deletion of data under certain conditions; • Right to restriction of processing (Art. 18 GDPR) - temporary limitation of processing; • Right to object (Art. 21 GDPR) - objection to processing based on legitimate interest; • Right to data portability (Art. 20 GDPR) - receiving data in a structured format; • Right to withdraw consent (Art. 7(3) GDPR) - for processing based on consent; • Right to lodge a complaint (Art. 77 GDPR) - with the competent supervisory authority.

Competent Supervisory Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Website: www.dataprotection.ro

To exercise your rights, you may contact us at: [email protected]

We will respond to your requests within a maximum of 30 calendar days from receipt, in accordance with Article 12(3) GDPR. In justified cases of complexity, this period may be extended by an additional 60 days, with prior notification.

AgroTrading implements appropriate technical and organizational measures to ensure data security, including protection against unauthorized access, loss, alteration, or unauthorized disclosure.

Security measures include, but are not limited to: • SSL/TLS encryption for data transmission; • Storage on secure servers located within the European Union; • Regular backups and incident recovery procedures; • Strict access controls and multi-factor authentication for authorized personnel; • Continuous system monitoring and anomaly detection; • DDoS attack protection through specialized services (Cloudflare); • Internal security incident management procedures in accordance with Articles 33-34 GDPR.

In the event of a personal data security breach that poses a risk to the rights and freedoms of individuals, AgroTrading will notify ANSPDCP within a maximum of 72 hours from becoming aware of the incident, in accordance with Article 33 GDPR.

• Primary data storage takes place on infrastructure located in the European Union; certain technical data may be processed by security and content delivery (CDN) providers, such as Cloudflare, in accordance with applicable GDPR safeguards.

The AgroTrading presentation websites use EXCLUSIVELY technical cookies necessary for website operation.

AgroTrading does NOT use tracking cookies, advertising cookies, marketing cookies, or analytics cookies that collect personal data.

Categories of cookies used:

A) Strictly Necessary Cookies (do not require consent) These cookies are essential for the proper functioning of the website and cannot be disabled: • Security cookies (Cloudflare) - protection against DDoS attacks, anti-bot protection: - _cfuvid (duration: session) - cf_clearance (duration: session) • Form protection cookies (Cloudflare Turnstile) - anti-spam protection for the contact form: - cf_turnstile (duration: session) • Preference saving cookies (AgroTrading) - saving user settings: - agrotrading_consent (duration: 12 months) - saves user confirmation regarding the use of necessary cookies

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in ensuring the security and proper functioning of the website.

These cookies do NOT track user behavior and do NOT collect personal data.

B) localStorage (non-cookie technology) In addition to HTTP cookies, the website uses localStorage technology for local browser storage of the following settings: • accessibility-settings - accessibility settings (font size, contrast, assisted navigation) This data is stored LOCALLY in the user's browser and is NOT transmitted to AgroTrading servers or to third parties.

C) WHAT WE DO NOT USE The AgroTrading presentation websites do NOT use: - Google Analytics - Google Ads - Meta Pixel (Facebook Pixel) - Microsoft Clarity - Remarketing cookies - Personalized advertising cookies - Cross-site tracking cookies

Result: • Faster website (no external tracking scripts) • Enhanced privacy (no behavioral tracking) • Simplified GDPR compliance (no complex cookie consent) • Improved user experience (no complicated cookie banner)

Note: The website displays a simple informative message about the use of strictly necessary cookies, without requesting explicit consent (in accordance with the exemption in Art. 5(3) of the ePrivacy Directive for strictly necessary cookies).

For complete details about cookies, please consult the separate Cookie Policy, available on the website.

Infrastructure note: Primary data storage takes place on infrastructure located in the European Union; certain technical data may be processed by security and content delivery (CDN) service providers, such as Cloudflare, in accordance with applicable GDPR safeguards.

Normally, AgroTrading does not transfer personal data outside the EEA through the presentation websites.

However, certain technical data (e.g.: IP address and security logs) may be processed by security and content delivery (CDN) providers, such as Cloudflare, including through global infrastructure, in accordance with applicable GDPR safeguards (e.g.: standard contractual clauses and/or other appropriate measures).

This Policy is available in multiple languages, depending on the domain used, to ensure clear and accessible information for users from different countries.

The Romanian language version is the official version with primary legal value, given that the AgroTrading platform is operated by a company registered in Romania (AgroTrading Inteligent Solutions S.R.L., VAT No. RO39242310).

Versions in other languages are informational and are provided to facilitate understanding by international users.

In case of interpretation discrepancies between the Romanian version and translated versions, the Romanian version shall prevail.

AgroTrading reserves the right to periodically update this Policy to reflect changes in processing practices, technologies used, or legal requirements.

The updated version will be published on the official websites, indicating the date of the last modification.

In the case of significant changes affecting fundamental rights of data subjects (e.g., modification of processing purposes, introduction of new data categories), AgroTrading will make reasonable efforts to inform users through a banner or notification displayed on the Website or through direct email communication, where possible.

Continued use of the Website after publication of changes constitutes tacit acceptance of the new version of the Privacy Policy.

AgroTrading makes constant efforts to ensure the accessibility of its websites for people with disabilities, in accordance with general principles of digital accessibility and best practices recognized at the European level.

AgroTrading websites include an accessibility module that allows users to adjust content display (e.g., font size, contrast, assisted navigation) to improve the user experience.

AgroTrading does not guarantee absolute compatibility with all existing assistive technologies but commits to remedying, within a reasonable time, any accessibility issues reported by users.

For accessibility concerns or suggestions, users may contact AgroTrading at: [email protected] or through the contact form available on the Website.

Important: The use of accessibility features does not involve the processing of additional personal data and does not lead to user identification. Accessibility preferences are stored exclusively locally in the user's browser using localStorage technology.

For questions, clarifications, or exercising the rights provided by GDPR, you may contact us at:

AgroTrading Inteligent Solutions S.R.L. Registered Office: Str. Eforiei no. 1, Bl. 2, Floor 3, Apt. 12, Valea Călugărească Village, Prahova County, Romania VAT No.: RO39242310 Data Protection Officer Email: [email protected]

Official Websites: • Main Website Romania: https://agrotrading.ro • Digital Platform: https://app.agrotrading.eu

Response Time: We will respond to your requests within a maximum of 30 calendar days from receipt, in accordance with Article 12(3) GDPR. In justified cases of complexity, this period may be extended by an additional 60 days, with prior notification.

For complaints regarding personal data processing, you may also contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): • Website: https://www.dataprotection.ro • Email: [email protected] • Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania

This Privacy Policy complies with the following regulations:

Regulation (EU) 2016/679 (GDPR) - Art. 6 (legal bases), Art. 7 (consent), Art. 12-14 (information), Art. 15-22 (data subject rights), Art. 26 (joint controller), Art. 28 (processors), Art. 33-34 (breach notification), Art. 46 (international transfers)

Directive 2002/58/EC (ePrivacy) - Art. 5(3) - Consent for cookies

EU Decision 2023/1795 - EU-U.S. Data Privacy Framework (DPF) - Transfers to the USA

Law No. 506/2004 - Personal data processing (Romanian legislation)

Directive 2000/43/EC - Principle of non-discrimination

Document generated: January 18, 2026 Version: 2.0 Controller: AgroTrading Inteligent Solutions S.R.L. (VAT No. RO39242310)