1. GENERAL

1.1. Your personal data is processed by an entity of the Sopraco group, acting in the capacity of data controller. The contact details of our main office, where you can go with all your questions and/or comments regarding this Privacy Statement, are: Rompa BV, Provinciënbaan 19 5121 DK Rijen (Netherlands), with company number NL802459419B0. You can send your questions by e-mail to the person responsible for privacy of Rompa at info@rompaleather.com. 1.2. You must interpret the terms in this statement as referred to in the General Data Protection Regulation (Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and to repealing Directive 95/46/EC). 1.3. Where reference is made to particular laws or regulations, such reference shall also include any amendment, replacement or annulment of said laws or regulations, including any related executive order. 1.4. Rompa reserves the right to change or amend this Privacy Statement from time to time. Any such change or amendment will be communicated through the Websites.

2. TYPES OF PERSONAL DATA WE PROCESS

2.1. When you use our Websites and Social Media channels, we collect:

• technical information about the device you are using, such as your IP address, browser type, geographic location, language and operating system;
• information about your surfing behaviour, such as how long you visit the page, which links you click on, which pages you visit and how often you visit the page.

2.2. When you fill in the contact form on our Websites, or contact us by e-mail, telephone, fax or Social Media channels with a concrete question or complaint or to receive our newsletter, we collect:

• the basic identity information you provide to us, such as name, e-mail address, correspondence address, telephone number;
• the content of your communication and the technical details of the communication itself (who among us you correspond with, the date, time, etc.);
• publicly available information on your profile on Social Media channels;
• any other personal data you provide us.

2.3. When you leave your business card or communicate with us at trade shows and events where we attend, we may collect from you:

• the basic identity information you provide to us, such as name, email address, correspondence address, telephone number, the company you work for, your position (i.e. when such information is provided by you or is stated on your business card);
• your photo.

3. PURPOSES FOR WHICH ROMPA USES YOUR PERSONAL DATA

3.1. Rompa processes your personal data to make it possible to respond to your complaint and/or question or to communicate with you at a trade fair or event. 3.2. Rompa processes your personal data when necessary to defend us in legal or other proceedings. 3.3. Rompa processes your personal data to perform statistical analyses in order to improve our Websites, products and services or to develop new products and services. 3.4. Rompa processes your personal data to comply with legal obligations or to comply with any reasonable request from authorised agents or representatives of police, judicial authorities, government agencies or bodies, including competent data protection authorities. Rompa may, on its own initiative, transfer your personal data to the police or to the judicial authorities as evidence or if there is a justified suspicion of an illegal act or crime that you have committed through, or with the help of, the use of the Websites, our Social Media channels or other communication with us. 3.5. Rompa may process your personal data to protect the legitimate interests of Rompa, its partners or a third party if any and if your use of the Websites or communication through our Social Media Channels could be considered (a) a breach of any applicable terms and conditions of use or the intellectual property rights or any other right of a third party, b) a threat to the security or integrity of the website, c) a threat to the website or any of the underlying systems of Rompa or its subcontractors due to viruses, Trojan horses, spyware, malware or any other form of malicious code, or d) in any way resentful, obscene, discriminatory, racist, defamatory, hateful, offensive or otherwise inappropriate or illegal. 3.6. Rompa may process your personal data to inform any third party in the context of a possible merger with, acquisition from/by or splitting of that third party or a similar corporate transaction, even if that third party is located outside the EU. 3.7. Rompa processes your personal data for marketing purposes, i.e. to provide you with targeted communications, promotions, offers and other advertisements from Rompa and selected partners. Unless you are an existing customer who has already purchased similar goods or services from us and which we intend to target with our own marketing materials, Rompa will send you notifications, promotions, offers, newsletters and other advertisements via email or other electronic communication channels from person to person only if you have expressly consented to receive such communications, offers, newsletters and other advertisements.

4. BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA

4.1. If we collect health data from you in the context of a question or complaint addressed to us as set out in clause 3.1, you acknowledge that making the question or complaint constitutes your consent to the processing of this personal data. If we collect your personal data and you are not yet an existing customer of ours as described in clause 3.7, we will also ask for your consent. By consenting to the processing of your personal data for the purpose of sending communications, promotions, offers, newsletters and other advertisements via email or other person-to-person electronic communication channels, you agree that we may process your personal data for this purpose in the manner and under the conditions set forth in this Privacy Statement. 4.2. The processing of your personal data for the purposes mentioned in article 3.4 is necessary to enable Rompa to comply with our legal obligations. 4.3. The processing of your personal data for the purposes mentioned in clauses 3.1, 3.2, 3.3, 3.5, 3.6 and 3.7 is necessary for Rompa’s legitimate interest, namely to:

• be able to respond appropriately to your requests for information and other requests and to communicate with you;
• enable us to defend ourselves in legal proceedings;
• enable continuous improvement of Rompa’s Websites, Social Media channels, products and services;
• keep our Websites, Social Media channels, products and services safe from abuse and illegal activities;
• protect our commercial and business interests and meet needs in the face of changing market conditions;
• enable conventional direct marketing and promotion of our products, services, brands and the successful commercialisation of our products and services.

5. RECIPIENTS AND TRANSMISSION

5.1. With the exception of the situation described in clause 5.2 below, Rompa will not transfer your personal data to third parties in an identifiable manner without your express consent. However, you understand that if you use our Social Media channels, your personal data will also be processed by the providers of these social media. More information about how these providers process your personal data can be found in their respective privacy statement. 5.2. Rompa works together with third-party processors such as IT service providers and marketing service providers to provide you with the Websites, to allow us to advertise and to process your personal data on our behalf. These external processors may only process your personal data on behalf of Rompa on the express and written instruction of Rompa. Rompa guarantees that all external processors are selected with the necessary care and obliges them to respect the security and integrity of your personal data.

6. QUALITY GUARANTEES

6.1. Rompa makes every effort to process only those personal data that are necessary to achieve the purposes described above. 6.2. Your personal data will only be kept for as long as necessary to achieve the purposes described above or until you withdraw your consent to its processing. Please note that withdrawal of consent may mean that you can no longer use all or part of the Websites or that we have to stop certain services. Rompa will de-identify your personal data when it is no longer needed for the purposes described above unless:

• there is an overriding interest of Rompa or another third party in keeping your personal data identifiable;
• there is a legal or regulatory obligation or a judicial or administrative order preventing Rompa from de-identifying them.

6.3. Rompa will take appropriate technical and organisational measures to protect your personal data against unauthorised access or theft as well as against accidental loss, falsification or destruction. Rompa will only grant access to personnel or external processing companies that process personal data for us on the basis of the “need-to-know” principle. This means that both the personnel and these third-party processing companies are subject to strict confidentiality obligations. However, you understand that safety and security are best efforts obligations.

7. YOUR RIGHTS

7.1. You have the right to request access to all personal data that we process about you. You must always specify which processing activities you wish to exercise your right of access to. However, Rompa has the right to reject certain requests for access if these requests are clearly aimed at causing nuisance. Rompa also has the right to reject a request for access if its granting has disproportionate negative implications for the rights and freedoms of others, including Rompa itself. 7.2. You have the right to request that any personal data relating to you that is incorrect is corrected free of charge. If a request for correction is made, this request must be accompanied by proof of the defective nature of the data for which correction is requested. 7.3. You have the right to withdraw your previously given consent under clause 4.4 to the processing of your personal data. 7.4. You have the right to request that personal data concerning you be deleted if it is no longer required in light of the purposes described above or if you withdraw your consent. However, you should keep in mind that any removal request by Rompa will be evaluated against:

• overriding interests of Rompa or another third party;
• legal or regulatory obligations or administrative or court orders that may contradict such removal.

Instead of deletion, you can also request that Rompa restrict the processing of your personal data if and when (a) you contest the accuracy of that data, (b) the processing is unlawful or (c) the data is no longer necessary for the purposes as described above, but you need this information to defend yourself in court. 7.5. You have the right to object to the processing of personal data if you are in a special and specific situation that justifies such an objection. You must notify us of this situation, so that we can assess your request correctly. However, if the intended processing can be regarded as direct marketing, you have the right to object to this processing free of charge and at any time. 7.6. You have the right to receive from us in a structured, commonly used and machine-readable format any personal data you have provided to us in the situations described under clauses 4.1 and 4.2. 7.7. To exercise your rights as stated in this statement, you can contact the Rompa data controller. You must submit a written request to the above-mentioned e-mail address, in which you make clear to which right your request relates, as well as the motivation for your request. In addition, you must enclose a copy of your valid identity card, on which the validity date and your signature are clearly visible, in order to prevent unlawful or fraudulent requests. As soon as the Rompa privacy officer receives your request, you will receive a confirmation of receipt. Your request will then be processed within a reasonable time. If you are still dissatisfied after this, you can contact the Dutch Data Protection Authority, https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen