^{PRIVACY POLICY}

^{BY CLICKING I agree to the terms and conditions.
WHEN SIGNING UP FOR A USER/CUSTOMER ACCOUNT USING DriverUP
YOU AGREE TO COMPLY WITH THIS PRIVACY POLICY.}

^{This Privacy Policy can
be updated and changed whenever necessary/ We are trying our best to keep your
information and preferences secure. This Privacy Policy can be updated and
amended whenever necessary/ We are striving to keep your information and preferences
secure. We know how important it is to feel secure when you are online, so we
ensure your data privacy, as you are now on an encrypted (SSL) connection
whereby the information transmitted is encrypted and processed by us only with
your consent. Remember that you can express your choice about your personal
data processing at any time during our collaboration.}

^{We are fully aware that the GDPR merely provides
a modernized, compliance legal framework based on responsibility for the
protection of personal data.}

^{The processing of your data is
necessary to provide you with the products/services you require. In this
respect, we are taking several security measures to protect you online. One of
the measures we are taking to ensure transparency and proportionality toward
you is to eliminate unnecessary collection of personal data and minimize the
data we collect. That is why we just ask for the information we need and store
it to improve your experience.}

^{The latest applicable version of the Privacy
Policy will be displayed on}^{www.expressoft.eu}^{or on the
DriverUP
App, which is why we recommend that you periodically check its content for any
such updates or modifications, as this is an online contract. Any
update/modification is immediately applicable, but will not be retroactive,
unless a legal provision stipulates so.}

^{All information provided in this policy, the processes and the
analyzes performed are complete, accurate, and correct, fully reflecting the
organization’s activity in terms of personal data processing and storage.}

^{The
Company is an information technology company whose main business is connected
to software development. EXPRESSOFT TECHNOLOGY also operates activities
relating to the development and management of a mobile application for
deliverers, which allows economic operators of food units such as restaurants,
cafés, confectionery shops, etc., in different cities, located in different
areas, to take and manage orders, manage the team of drivers, keep records of
receipts and economic operators’ deliverers to be able to confirm delivery,
view and check at all times the delivery address, the products requested and
other order details and view at the end of the day statistics on receipts,
deliveries and commission received, under an assumed commercial agreement with
the Company.}

^{Information about us: EXPRESSOFT TECHNOLOGY SRL, a legal entity governed by the Romanian
law, with its registered office in Bucharest, registered with the Trade
Register under no. J40/1167/1991, tax number RO1581947, hereinafter Expressoft.
E-mail address:}^{contact@expressoft.eu}^.^{The title, copyright and intellectual property rights in DriverUP belong to Expressoft. THE SOFTWARE and the
related documentation are protected by the Romanian Copyright Act and by the
international copyright treaties. Expressoft
is an information technology service provider, does not provide food services
or other services not related to its profile.}

^{Contact form found in the Contact section of
the platform}^{www.expressoft.eu}^{or on the DriverUP App in each User’s
account.}

^{www.expressoft.EU}^{and the DriverUP
App, hereinafter the Website, is owned by Expressoft Technology SRL.}

^{We value the right to privacy and the
protection of the personal data of each of us, therefore through this privacy
policy we want to inform DriverUP visitors of the
types of personal data we collect through our App and the way we use, disclose,
and protect such information. We collect and use personal data in the ways
described here, and so as to comply with our obligations and your rights.}

^{As
required by Regulation No 679/2016 on the protection of individuals with regard
to the processing of personal data and on the free movement of such data and
repealing Directive 95/46/EC (the “Regulation”), DriverUP
is bound to process safely and only for the specified purposes, the personal
data you provide us about you via the App.}

^{Please
read this Privacy Policy carefully
and make sure you understand it. Acceptance of this privacy policy is assumed
when you first visit the DriverUP}^App^{. If you do
not agree to this Privacy Policy, you must immediately cease using the App.}

^{Please
note that signing up on the App and/or using it is only allowed for persons
over 16 years of age.}

^{1. Who
is this Privacy Policy addressed to?}

^{This Privacy Policy applies to:}

^·^{the processing of your personal data collected by us through
the App and your use of the App. The App may contain links to other websites.
Please be aware that we have no control over how your data are collected,
stored, or processed by other websites and we recommend that you check the
privacy policies of such third party websites prior to submitting any data
thereto.}

^·^{This Privacy Policy
also applies to personal data collected by DriverUP
through our pages marked on social media platforms.}

^{This
Privacy Policy is incorporated and is part of the applicable Terms and
Conditions of use of the App available}^at^{www.expressoft.eu.}

^{2. What personal data do we
process, on the basis of which legal bases, for what purpose and for how long?}

^Ø^{What data do we
process?}

^{Depending
on how you use the App, we collect certain personal and non-personal data about
you as follows:}

^·^{When you create an
account on the App, you send us: identification data: e-mail address, phone
number, surname and first name, geographic location, including location
history.}

^Ø^{When you access the App, you provide us information such as:
geolocation, identification data such as: surname and first name, phone number.
What are the purposes for processing?}

^{In
general, the purpose of processing personal data is to provide the DriverUP services for your benefit, such as viewing and
checking at any time the delivery address, the products requested, and other
details regarding the order made by the Consumer to whom you are delivering the
order.}

^{In
particular, we will use your personal data as follows:}

^·^{Provide and manage
your account on the App;}

^·^{Provide and manage
access to the App;}

^·^{Provide the services
supplied by DriverUP to your benefit; this may
include, as appropriate, the following:}

^a)^{Create and manage
the account on the App;}

^b)^{Enable the
geolocation service to receive from economic operators of food units such as
restaurants, cafés, confectionery shops where you are employed and/or with
which you collaborate, the orders to be delivered to the final consumer.}

^c)^{Provide support
services provided by DriverUP;}

^·^{Personalize and
customize the services offered by DriverUP to your
benefit; we always want to offer you the best online experience. To do so, we
may collect and use certain information related to your behavior as a
deliverer, delivery times over specific distances, etc.}

^·^{Provide answers to
your e-mails;}

^·^{Any other specific
purpose for which you have expressly given your consent, if any;}

^·^{For marketing, as
follows:}

^DriverUP^{does not carry
out any marketing activities on our legitimate interest in promoting and
developing our business.}

^·^{To defend our
legitimate interests}

^{There
may be situations where we will use or transmit personal data to protect our
rights and business. These may include:}

^a)^{measures to protect
the App and its users from cyber-attacks;}

^b)^{measures to prevent
and detect fraud attempts, including the transmission of information to the
competent public authorities;}

^c)^{measures to manage
the various risks;}

^d)^{the exercise of
rights, including before state authorities, such as courts of law.}

^·^{To comply with our
legal obligations.}

^Ø^{What is the basis for
the data processing?}

^{The
general reason for the above-mentioned personal data processing is the
conclusion and performance of the contract between Expressoft Technology and
you, but in some cases the reason may also be a legal obligation we have or our
legitimate interest in defending our business, being understood that we make
sure that all measures we take guarantee a balance between our interests and
your fundamental rights and freedoms.}

^{Where
the basis for processing is a legal obligation, we generally base our
processing on the legal provisions such as the obligation to secure goods and
values laid down by the applicable law in this area, the obligations provided
by the tax and / or accounting legislation, including with regard to the
archiving obligations.}

^{The
processing of personal data is not related to other recording systems.}

^Ø^{How long do we retain
your personal data?}

^{As a
general rule, we will not store your data longer than necessary, depending on
the purpose and basis for which we process them.}

^{Therefore,
we will store your personal data according to the following criteria and the
categories of personal data affected:}

^·^{as long as you have
an account on our App; you may request us to delete certain information or
close your account at any time and we will respond to such requests, subject to
certain information being retained after the account is closed, where the
applicable law or our legitimate interests require to do so;}

^·^{as long as we are
bound by the legal provisions;}

^·^{during the
conclusion and performance of the contract between Expressoft and you, and a
period of 3 years thereafter, or if necessary, until all rights and obligations
arising therefrom are fulfilled;}

^·^{for the duration for
which you have given consent if processing is based on consent.}

^{4. The rights you enjoy as a
result of personal data processing}

^{According to the Regulation, you benefit from
the following rights under the circumstances of the processing grounds:}

^{- the
right to be informed regarding your personal data processed by DriverUP;}

^{- the
right of access. You have the right to obtain from DriverUP
confirmation that they are processing your personal data, and if so, access to
such data and information such as the purposes of the processing, the
categories of data processed, the recipients or categories of recipients, the
storage period or where not possible the criteria to determine this period;}

^{- the
right to rectify inaccurate personal data or complete them (please contact us
in this respect);}

^{- the
right to deletion (“the right to be forgotten”) by DriverUP
of personal data in accordance with the applicable legal provisions;}

^{- the
right to restriction of processing, which may be exercised in one of the
following cases:}

^a)^{you challenge the
accuracy of the data, the restriction being valid for a period that allows the
Company to check the accuracy of the data;}

^b)^{the processing is
illegal, but you do not want to delete the personal data processed;}

^c)^DriverUP^{no longer needs the personal data processed, but you need them to
acknowledge, exercise or defend a right in court;}

^d)^{you have opposed the
processing of personal data, the restriction being valid for the length of time
during which it is verified that the legitimate interests of the DriverUP do not affect your rights.}

^{- the
right to data portability, based on the right to data portability you have the
right to receive a copy of the personal data concerning you and which you have
provided to DriverUP in a structured, commonly used
and machine readable format, and you have the right to request transmission of
these data to another operator, without obstacles from DriverUP,
when the processing is carried out with your consent, for the performance or
conclusion of a contract to which you are party or where processing is carried
out by automated means;}

^{- the
right to oppose to the processing of personal data - at any time, you have the
right to oppose, for justified and legitimate reasons related to the particular
situation, that personal data be processed, insofar as the legal conditions are
met;}

^{- the
right not to be subject of an individual decision, according to which you have
the right to request and obtain the withdrawal, cancellation or re-evaluation
of any decision based solely on automated processing (including profiling)
which produces legal effects or affects you in a similar manner, to a
significant extent;}

^{- the
right to go to court or the national supervisory authority for the processing
of personal data. You have the right to lodge a complaint with the supervisory
authority: National Supervisory Authority for Personal Data Processing, 28-30 G-ral. Gheorghe Magheru Bd., sector
1, postal code 010336, Bucharest, Romania, phone +40.318.059.211,
+40.318.059.212, fax: +40.318.059.602, e-mail:}^{anspdcp@dataprotection.ro}^{.
You are also recognized as having the right to go to court.}

^{With
regard to the rights related to automated decision-making and profiling, DriverUP does not take decisions based on an automated
decision-making process with respect to you, based on the personal data covered
by this processing.}

^{To
exercise these rights, the user can send a written, dated, and signed request
to}^{dpo@expressoft.eu}^.

^{The
exercise of the rights provided in Law 679 / 2016 (GDPR) is entirely incumbent
on the controller who is legally bound to designate a person in charge with the
processing of personal data within the organization. This person will develop a
set of technical and organizational measures to secure the processing of data
and is required to inform the controller with respect to the nature of the
processing processes, types of information and how these processes are carried
out within the organization. The controller has the responsibility and
obligation to ensure that such measures are implemented, that there is no risk
of security breaches or information leakage, and that the legislation in force
regarding the data processing and the rights of data subjects is complied with.
The person in charge can be contacted at}^{dpo@expressoft.eu}^.

^{Please
contact us for any request, question or matter related to the way we process
your personal data, or send a written, dated and
signed request to exercise your rights under Regulation No 679/2016, to
Expressoft Technoloy SRL, with head office in
Bucharest, or at e-mail address:}^{dpo@expressoft.eu}^{. You are
also recognized the right to go to court.}

^{If you request the deletion of data, please note that this is an
irreversible process and if you wish to use the DriverUP
services again we will need your new consent to collect and process these data.}

^{The maximum time for solving the requests sent to the DriverUP shall be 30 days. This may be extended once, in
accordance with the Regulation.}

^{5. Recipients
of the Personal Data Processed}

^{In general, the personal data we collect is
intended for use by the DriverUP (our own employees;
suppliers and their employees) and the final consumer to whom you deliver the
order, and only as an exception are communicated to other recipients. TO STAY
UP TO DATE ON HOW THE DriverUP CUSTOMERS WHERE YOU
ARE HIRED OR WITH WHICH YOU COLLABORATE TO RECEIVE ORDERS THAT ARE TO BE
DELIVERED TO THE FINAL CONSUMER ON DriverUP PROCESS
YOUR PERSONAL DATA, WE RECOMMEND YOU ACCESS THE PERSONAL DATA PROCESSING POLICY
SECTION ON THEIR WEBSITES.}

^{In this way, DriverUP
may contract third parties as part of the activity of supplying services to
you. Such third parties may be: accounting/financial/legal service providers or
generally provided by such professionals, IT service providers, telephone
service providers, integrated call-center solution providers, order management
solution providers, banking service providers and payment processors, couriers,
carriers, search engines, etc. In some cases, we may provide them with all or
some of your personal data. We shall not provide the data without making sure
that they are strictly necessary for the purpose for which they are
transferred, and the transfer is accompanied by security guarantees in
accordance with the legal requirements of the Regulation for the transfer to
the agents/third parties.}

^{In some cases, we may transfer your data to
other persons when we have a legal obligation to do so. Or when we are in the
course of a judicial procedure to defend our rights.}

^{We can also transmit your personal data to the public authorities
(Prosecutor’s Office, Police, courts of law and other competent state bodies),
on the basis and within the limits of the legal provisions or following duly
justified requests.}

^{Despite the protection measures taken to protect your personal
data, we state that the transmission of information via the Internet in general
or via public networks is not entirely secure and there is a risk for the data
to be viewed and used by unauthorized third parties.}

^DriverUP^{does not transfer
your personal data to third states or international organizations. If DriverUP decides to do so, then this will be made only with
DriverUP and, as applicable, the person empowered by
the same, complying with the provisions of the Regulation.}

^{6. Refusal
to Give Us Personal Data}

^{If you
choose not to provide us with the personal data collected through the App,
which are required for the purposes mentioned above, except for marketing
purposes, we shall not be able to provide the services required by you and to
put at your disposal certain sections/services on the App, such as the account
creation and administration section/service available on the App, but you will
be able to use other sections of the App without restrictions.}

^{7. Security
of Personal Data Processing}

^{The processing
of personal data shall be carried out in compliance with the appropriate
technical and organizational measures intended to protect data against
accidental or unlawful destruction, to prevent loss, alteration, disclosure,
unauthorized access, or misuse of personal data, by applying internal and
operational procedures for the collection and storage of personal data in
accordance with the Regulation.}

^{8. The processing of personal
data}^{within the organization is subject
to a number of technical and organizational measures to secure them. These
measures are intended to protect information at the level of the organization
against security incidents or unauthorized processing.}

^{At the
level of the organization, the following security measures have been taken to
reduce risks:}

^{Technical measures:}

^-^{SSL certificate}^{– is intended
to secure the exchange of information via the Internet. It encrypts information
before it circulates over the Internet. Encrypted information can only be
decrypted by the server to which it is addressed. This ensures that information
sent to an online website/platform will not be stolen, intercepted, processed.
Information about bank cards, passwords and in general any information that is
intended to remain private in terms of its nature, as defined by the law, is
secured by this certificate.}

^-^{The SSL certificate}^{of the DriverUP Online Platform is also used to secure e-mails in
such a way that the personal data of customers circulate in a secure
environment and regulated by a range of security measures ensuring the
confidentiality of information.}

^-^{Automatic back-up}^{– set to a
time interval to guarantee information and for all customers to be confident
that the information and preferences provided by them do not disappear and are
not destroyed, lost, or incorrect in the event of a server failure.}

^-^{Anti-spam and antivirus filters}^{that prevent malicious content or viruses from infiltrating which
can process the data in an unauthorized manner or transmit them to other
entities or persons who have not obtained the data subject’s consent.}

^-^{Protecting the customer profile content by introducing a more
complex password generation rule}^{. Asking
the customer, on creating the account, to provide a password meeting a higher
complexity criterion (alphanumeric + special characters);}

^-^{Securing modules and scripts that communicate inside the platform.}^{Constantly checking the functionality of the elements involved in
customer-server, server-customer interaction.}

^-^{Checking and improving modules to keep them up-to-date to prevent
vulnerabilities}^{. This measure prevents
the identification of vulnerabilities at global level in the platforms used,
0-day vulnerabilities that may intercept data exchange and implicitly personal
data in customer’s interactions with the platform or of the process manager
with the customer and the platform.}

^-^{Classifying the types of access by the process manager}^{– administration groups, the possibility to add or delete certain
rights on a user with full access – customizing access as needed.}

^-^{Protecting with password the device from which the process manager
performs the data processing}^{to prevent
unauthorized interference.}

^-^Firewall^{– software and
hardware installed in the server location of the company that provides online
platform hosting, designed to protect the server and network equipment from
cyber-attacks, unauthorized intrusion, installation of malicious software that
may endanger platform users’ personal data. The firewall blocks the access of
unauthorized persons to the information stored on Internet connected equipment.}

^-^{Access to the data processing systems where personal data is
processed is only possible after the authorized person has been successfully
identified and authenticated}^{(e.g., with
username and password or chip/PIN card), using the best security measures. In
absence of an authorization, access shall be denied.}

^-^{All access attempts, both successful and rejected, are logged (user
ID, computer, IP address used) and archived in a format according to audit
rules for 3 months}^{. To detect any
misuse, the server performs repeated, random checks;}

^-^{Access is blocked after repeated incorrect authentication attempts.}

^-^{Regularly checking the platform’s vulnerabilities}^{which might allow for the retrieval of information and personal
data. Hosting has security measures and solutions that recurrently scans the
processed files and the flow of data circulating inside the platform;}

^-^{Fighting the risks of security breaches by taking technical and
organizational precautions}^{by securing
the platform and constantly upgrading it with stable versions.}

^-^{Securing with password the equipment that has direct access to the
order table and customer delivery/invoicing data}^{to prevent unauthorized access and implicitly any unauthorized
interference by unapproved persons.}

^{Organizational measures:}

^-^{Destruction of documents which are no longer required}^{(notes, erroneous invoices, etc.) using a document destroyer at the
disposal of the process manager;}

^-^{Removing the human factor risk}^{by prohibiting the processing of information outside the secured
platform, except for the drawing up shipping notes in the courier’s platform,
which is also a secure environment;}

^-^{Adopting security measures without differentiating between types of
customers (new/existing/potential);}

^-^{Adopting an internal policy to check processes and processing}^{on placing the product for delivery or on receiving information
about an order or a potential offer;}

^-^{Avoiding customer differentiation}^{by means of mechanisms that can positively or negatively profile a
data subject. For this reason, we do not require any personal data related to
sexual orientation, sexual interests, gender, religion, membership to movements
or groups, etc. Customers are free to order and choose what they desire. With
this measure, we believe that we respect the integrity of the person and avoid
any track of analysis/profiling based on such criteria.}

^-^{Informing customers about the procedure for delivery, return and
processing of orders;}

^-^{Training the process manager on the risks of processing personal
data outside the online platform.}

^-^{Training the process manager on the need for notification in case of
a major security incident.}

^-^{Training the process manager on managing situations that may occur
when processing data within the platform}^{(errors, errors in use).}

^-^{Training the process manager on the use of the information he/she}^{processes and awareness of the nature of the personal information;}

^-^{Forbidding the processing of data outside the platform}^{by managing orders directly in the platform user interface, without
any need to process data in other unsecured and vulnerable environments.}

^{The process owner
shall be regularly trained on:}

^·^{The principles of
data protection, including technical and organizational measures,}

^·^{The requirement to
keep data secrecy and confidentiality with regard to the organization’s secrets
and business secrecy, including the transactions carried out;}

^·^{Proper, careful use
of data, data media and other documents;}

^·^{Telecommunications
secrecy;}

^·^{Other specific
confidentiality obligations, where necessary;}