GDPR information

LEGAL BASIS

The Wennov Connect platform processes personal data in accordance with Regulation (EU) 2016/679 (GDPR), supplemented in Romanian law by Law no. 190/2018.

FIRST: WHO IS THE CONTROLLER OF YOUR DATA?

• ›If you are a Wennov Connect CUSTOMER (you have a platform account), Glo Wennov SRL is the controller of your account and billing data. Send your requests directly to us.

• ›If you RECEIVED A MESSAGE sent through the platform, the controller of your data is the business that contacted you, not Wennov Connect. We act only as a processor on that business instructions. You may write to office@wennov.ro – we will identify the sender, forward your request and assist them, but the decision is theirs. To stop SMS immediately, reply STOP. This distinction is required by GDPR and is explained in full in the Privacy Policy.

YOUR RIGHTS

• ›Right of access (Art. 15): You can request a copy of the data we hold about you.
• ›Right to rectification (Art. 16): You can correct inaccurate or incomplete data.
• ›Right to erasure / "Right to be forgotten" (Art. 17): You can request erasure when data is no longer needed, when you withdraw consent, or when processing is unlawful.
• ›Right to restriction of processing (Art. 18): You can request temporary suspension of processing.
• ›Right to data portability (Art. 20): Receive your data in a structured, machine-readable format. Customers can export their data from the platform themselves at any time.
• ›Right to object (Art. 21): You can object to processing based on legitimate interest or for direct marketing.
• ›Rights related to automated decision-making (Art. 22): We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you. We do however carry out profiling (RFM, engagement and churn-risk scores) on behalf of our customers – see section 10 of the Privacy Policy.

HOW TO EXERCISE YOUR RIGHTS

Send a written request to: office@wennov.ro. We respond within 30 days. Free of charge (except for manifestly unfounded or excessive requests). We may ask for additional information to verify your identity.

SUPERVISORY AUTHORITY

If you believe your rights have been violated, you can lodge a complaint with: ANSPDCP – National Supervisory Authority for Personal Data Processing (Romania) Address: B-dul G-ral. Gheorghe Magheru 28-30, Bucharest Web: www.dataprotection.ro | Email: anspdcp@dataprotection.ro Or with your local EU supervisory authority.

SUBPROCESSORS

The full list, with each subprocessor purpose and location, is in section 5 of the Privacy Policy. The main categories:

- Cloud infrastructure (EU/EEA) – hosting, databases, backups - SMPP aggregators and CPaaS providers (for example Infobip, Twilio) – SMS and Voice delivery - Meta Platforms, Telegram, Viber, Google – the corresponding messaging channels, where enabled - Amazon SES / SMTP providers – email delivery - Stripe, Netopia, FGO – payments and invoicing - Anthropic PBC (USA) – optional AI-assisted features - Sentry, MaxMind – error monitoring and login security

Transfers outside the EEA rely on Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework certification.

FOR OUR CUSTOMERS

If you use the platform to communicate with your own customers, you are the controller of that data and we are the processor. You need a Data Processing Agreement (DPA) with us – it is available at /dpa. Rules on recipient consent and permitted content are set out in the Acceptable Use Policy (/aup).