Control item	Information
Controller	DIBALCRIS APPRAISAL SERVICES S.R.L.
Brand / website	ZEROVEC – www.zerovec.ro
Version	1.0 – draft
Document date	20.10.2026

Contents

1. Data controller

The controller of personal data is DIBALCRIS APPRAISAL SERVICES S.R.L., with registered office in Sat Haieu, Sînmartin commune, Str. Trandafirilor no. 61, Bihor County, Romania, Tax ID (CUI) 41244983, Trade Register number J2019001588053, EUID ROONRC.J2019001588053, represented by Mr. Bala Florin-Cristian, administrator. In this policy, the controller may be referred to as “Dibalcris”, and the trade name of the online store is “Zerovec”.

The exact domain to which this policy relates is www.zerovec.ro.

2. Data protection contact details

For questions about this policy, the processing of data or the exercise of rights, data subjects may contact Dibalcris at office@dibalcris.ro or at +40 770 397 104, as well as through the contact details below, if they are designated for data protection matters.

Item	Details
General e-mail	office@dibalcris.ro
Phone	+40 770 397 104
Postal address	Sat Haieu, Sînmartin commune, Str. Trandafirilor no. 61, Bihor County, Romania

3. Scope

This policy applies to data processing carried out through the Zerovec online store, through the associated forms, accounts, orders, communications and services, as well as through offline interactions related to the sale, delivery, return, warranty or management of Dibalcris products.

The products sold include drones, accessories and drone components. Products are sold to end customers in Romania, including individual consumers, companies and, where applicable, public institutions through SEAP. This policy applies both to visitors without an account and to customers with an account, buyers, contact persons of legal entities, delivery recipients and persons who contact Dibalcris.

This policy does not replace the specific information that may be provided in forms, contracts, cookie notices, marketing messages or documents concerning withdrawal, return, recall and risk products. Where more specific information exists, it supplements this policy.

4. Principles

Dibalcris processes data in compliance with the principles set out in the GDPR and the applicable legal requirements. In particular:

• lawfulness, fairness and transparency towards the data subject;
• purpose limitation: data is collected for specified, explicit and legitimate purposes;
• data minimisation, by collecting only the necessary data;
• accuracy and updating, to the extent reasonable and necessary;
• storage limitation, by keeping data only for as long as necessary or as required by law;
• integrity and confidentiality, through appropriate technical and organisational measures;
• demonstrated accountability, by documenting decisions and the measures applied.

5. Categories of persons

Depending on the interaction with Dibalcris, data may be processed about the following categories of persons:

• website visitors and users of online services;
• persons who create or use an account;
• individual customers and representatives, employees or contact persons of corporate customers;
• recipients of products and contact persons for delivery;
• persons who submit complaints, requests, return, warranty or recall requests, or information concerning risk products;
• newsletter subscribers and persons who express marketing preferences;
• persons who take part in promotional programmes, affiliate programmes or campaigns;
• representatives of suppliers, manufacturers, importers, couriers, partners and authorities;
• other persons whose data is lawfully disclosed in connection with an order, an incident or a legal obligation.

6. Categories of data processed

The specific categories depend on the product, channel, operation and the user’s choices. Based on the information available, the following may be processed:

• identification data: first name, last name, company name, capacity and identification data of the representative;
• contact data: e-mail, phone number, delivery address and, where applicable, billing address;
• data about companies and institutions: the contact person’s data;
• financial and billing data: data needed to issue the invoice, bank account for payments or refunds;
• identity document data: series, number, date of the document and personal numeric code (CNP), only if necessary and where a verified legal basis exists;
• technical and usage data: IP address, online identifiers, device type, browser, logs, pages visited, preferences and interactions with the website;
• data concerning cookies, advertising, affiliation, analytics and remarketing, according to the preferences expressed and the settings actually applied;
• data from complaints and communications: the content of the request, photographs, documents, proof of delivery, serial number/batch and data necessary for resolution;
• marketing data: consents, preferences, withdrawals, opens and interactions with communications, to the extent permitted by law.

Dibalcris does not intend to request flight data, images or other personal data that are not necessary for the purpose pursued. If such data is voluntarily submitted as part of a report, it will be analysed only to the extent necessary to resolve the case and will be appropriately protected.

7. Purposes and legal bases

Dibalcris determines the legal basis according to the purpose, context and the data actually processed. The legal bases below are indicative for the draft and must be confirmed against the actual configuration and the actual data flows.

7.1. Account creation and administration

Data is used to create, authenticate, administer and delete the account, recover the password, send account-related notifications and protect access. The legal basis may be the performance of a contract or steps taken at the request of the person before entering into a contract, as well as the legitimate interest in securing the account.

7.2. Orders and performance of the sale

Dibalcris processes the data necessary to receive and confirm the order, verify availability, prepare the products, communicate the status, issue documents and fulfil contractual obligations. The main legal basis is the performance of a contract or the taking of pre-contractual steps.

7.3. Invoicing, accounting and tax obligations

Data is used to issue, transmit and archive invoices, keep accounting records, make reports and fulfil tax or financial-accounting obligations. The legal basis is a legal obligation. Identity card data, including the CNP, series and number, must not be collected until the necessity, the legal basis and the proportionality have been verified.

7.4. Payments and fraud prevention

For online card payment, payment order or instalments at Dibalcris, data is processed to initiate, authorise, reconcile and record the payment. The processor indicated in the available information is Netopia Payments, and the full card details are handled by the processor, not by Dibalcris. The legal basis is the performance of a contract, a legal obligation and, where applicable, the legitimate interest in preventing fraud and ensuring transaction security.

7.5. Delivery and pick-up

Data is disclosed to the courier or another delivery provider for shipping the product, tracking the transport, confirming handover and managing delivery incidents. Delivery by courier, by own means and/or pick-up from Dibalcris’s premises are possible. The main legal basis is the performance of a contract.

7.6. Returns, withdrawal and legal warranty

Data is processed to receive and verify return or withdrawal requests, match the order with the product and serial number, issue refunds, communicate with the customer and keep evidence. The legal basis may be the performance of a contract, the fulfilment of legal obligations and, for the defence or exercise of rights, the legitimate interest or the establishment, exercise or defence of legal claims.

7.7. Recall, withdrawal from the market and risk products

Dibalcris may process data to identify affected products, serial numbers, batches, customers and users, send warnings, organise recovery, block distribution and document the measures. The legal basis is a legal obligation, the legitimate interest concerning safety and compliance and, where applicable, the protection of vital interests or the performance of a task carried out in the public interest under the law.

7.8. Contact and complaints

Data submitted through the contact form, e-mail, phone or other channels is used to reply, resolve the request and document the communication. The legal basis is the taking of steps at the request of the person, the performance of a contract, a legal obligation or a legitimate interest, as applicable.

7.9. Security, logs and abuse prevention

Dibalcris may process technical data and logs for website security, preventing unauthorised access, detecting fraud, investigating incidents and ensuring service continuity. The legal basis is the legitimate interest, a legal obligation or, where applicable, the performance of a contract.

7.10. Direct marketing

Newsletters, SMS messages, push notifications, offers and personalised advertising are sent only in accordance with the law and, where necessary, on the basis of consent. The person may object or withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out previously.

7.11. Analytics and website improvement

Dibalcris may use aggregated data or data from cookies and similar technologies to measure traffic, diagnose errors, improve functionality and assess performance. For non-essential cookies, the legal basis is the consent expressed through the preference mechanism, where required.

7.12. Affiliation and remarketing

The services Profitshare, 2Performant, Compari.ro, Google Ads/AdWords Remarketing, Retargeting.biz, Facebook/Meta and TikTok may use cookies or identifiers to attribute conversions, measure campaigns and display personalised ads. These technologies must be activated only after consent has been obtained, where the law requires it.

7.13. Records, audit and defence of rights

Data may be kept to demonstrate compliance, manage disputes, exercise or defend rights in court, carry out audits, respond to authorities and apply internal policies. The legal basis may be a legal obligation or a legitimate interest, with respect for purpose limitation and the retention period.

7.14. Automated communications

The platform may automatically send messages concerning customer registration, order completion, password recovery, order modification or cancellation, the contact form, product information, back-in-stock notices, delivery and order confirmation, the return form, the warranty form, account activation, failed payment and other configured events.

7.15. Compliance with UAS/drone product requirements

Data about the product, serial number, batch, manufacturer, importer, customer and relevant communications may be used to document compliance, inform the buyer, make reports and cooperate with the competent authorities, including AACR, to the extent required by law or necessary for safety.

8. Cookies and similar technologies

Cookies are files or identifiers used by the website for operation, remembering preferences, analytics, affiliation and marketing.

8.1. Cookies necessary for the operation of the website

These cookies are necessary for technical operation, security, session, authentication, the cart, form submission or remembering essential options. If they are strictly necessary, they do not rely on consent, but the person must be informed.

8.2. Profitshare

Profitshare (Conversion Marketing SRL) is an affiliate marketing platform that may use cookies to track traffic and the conversions generated through affiliation.

8.3. 2Performant

2Performant (2Performant Network SA) is an affiliate marketing platform that may use cookies to track traffic and the conversions generated through affiliation.

8.4. Compari.ro

Compari.ro (Online Comparison Shopping Kft.) is a price comparison service that may use cookies to track the conversions generated by the traffic sent to the website.

8.5. Google Ads / AdWords Remarketing

Google Ads / AdWords Remarketing is a behavioural remarketing service that analyses visitors and enables the display of personalised ads.

8.6. Retargeting.biz

Retargeting.biz SRL is a service that analyses visitor activity and may display personalised content according to their preferences.

8.7. Facebook / Meta

Facebook / Meta is a behavioural remarketing service that analyses visitors and enables the display of personalised ads.

8.8. TikTok

TikTok is a behavioural remarketing service that analyses visitors and enables the display of personalised ads.

8.9. Managing cookie preferences

The person must be able to accept, refuse or change their preferences for the non-essential cookie categories, without the refusal preventing access to the strictly necessary functions.

9. Providers and recipients

Dibalcris may use providers or disclose data to recipients only to the extent necessary for the purpose, on a legal basis and, where applicable, under a data processing agreement or other appropriate safeguards.

Provider / recipient	Possible role	Data / purpose
Gomag	Website platform provider	Accounts, orders, products, forms, logs and technical administration
Netopia Payments	Payment processor	Payment authorisation and confirmation; card data handled by the processor.
Couriers / delivery providers	Delivery and confirmation of handover	Name, phone, address, order number and logistics data
IT and security providers	Hosting, maintenance, e-mail, backup, security	Technical data, logs and operational data
Mailchimp	Newsletter and marketing communications	E-mail, first and last name, preferences and interactions
Manufacturers / importers / partners	Compliance, warranty, withdrawal or recall	Data about the product, serial number/batch, customer and incident, where applicable
AACR and other authorities	Supervision, safety and legal obligations	Data requested or necessary for reporting

Providers and partners receive only the data necessary for their role, and internal access must be limited to the persons who need the data to perform their duties.

10. Transfers outside the EEA / USA

There are transfers to the USA through Mailchimp and processing in the USA through remarketing services such as Google, Facebook/Meta and TikTok.

Before any transfer outside the European Economic Area, Dibalcris will identify the country, the provider, the role, the category of data, the purpose, the transfer mechanism and the applicable safeguards, such as an adequacy decision, standard contractual clauses, binding corporate rules or another mechanism permitted by the GDPR. If necessary, the level of protection in the destination country and any supplementary measures must be assessed and documented.

11. Retention periods

Dibalcris keeps data for the period necessary for the purpose, for the period required by law or for as long as necessary to defend rights.

Category / purpose	Storage period	Basis / remarks
Customer account	For the duration of the account and 30 days after the account is deleted.	Actual deletion from backups and auxiliary systems must be verified
Customer without an account	30 days from delivery of the order.	It must be verified whether other legal obligations require a longer period
Orders, invoices and financial-accounting records	For the period necessary to fulfil legal obligations.	Tax and accounting obligations and defence of rights
Identity document data / CNP	For the period necessary to fulfil legal obligations.	Minimisation, restricted access and documented justification

12. Obligation to provide data and consequences of not providing it

Some data is necessary to enter into and perform the contract, for delivery, invoicing, payment, communication or the fulfilment of a legal obligation. If the person does not provide the mandatory data, Dibalcris may be unable to create the account, accept the order, issue the invoice, make the delivery, process the payment, resolve the return or reply to the request.

Data for marketing, non-essential cookies and advertising profiling is, as a rule, optional. Refusing or withdrawing consent for these purposes must not affect access to purchasing or to the strictly necessary functions of the website.

13. Automated decisions and profiling

Dibalcris does not take decisions based solely on automated processing that produce legal effects or similarly significant effects on persons.

If a relevant automated decision exists, the person will be informed about the logic involved, the significance and the envisaged consequences and, where applicable, about the right to request human intervention, to express their point of view and to contest the decision.

14. Rights of data subjects

Under the GDPR and applicable law, the data subject may have the following rights:

• the right of access to the data and to information about the processing;
• the right to rectification of inaccurate data or completion of incomplete data;
• the right to erasure of data, when the legal conditions are met;
• the right to restriction of processing, in the cases provided by law;
• the right to data portability, when processing is based on consent or contract and is carried out by automated means;
• the right to object, in particular to processing based on legitimate interest and to direct marketing;
• the right to withdraw consent at any time, without affecting prior processing;
• the right not to be subject to a decision based solely on automated processing, under Art. 22 GDPR;
• the right to lodge a complaint with the competent supervisory authority.

The exercise of a right may be limited if there is a legal basis for keeping the data, to protect the rights of other persons, for security, fraud prevention, the defence of claims or the fulfilment of a legal obligation. Any limitation will be explained, to the extent permitted by law.

15. Exercising rights

The request may be sent to office@dibalcris.ro, to +40 770 397 104 or to the controller’s postal address. To protect the data, Dibalcris may request additional information to verify identity, without asking for more data than necessary.

Dibalcris replies, as a rule, without undue delay and within the period provided by the GDPR. If the request is complex or there is a large number of requests, the period may be extended under the law, with the person being informed.

If the person considers that their rights have been infringed, they may contact the competent Romanian data protection authority: the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), with registered office at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, anspdcp@dataprotection.ro; dpo@dataprotection.ro.

16. Security

Dibalcris applies technical and organisational measures appropriate to the risks, such as access control, passwords and authentication, limitation of privileges, protection of communications, backups, incident monitoring, training of authorised persons and supplier management.

In the event of a security incident, Dibalcris will assess the nature and severity of the incident, limit its effects, preserve the evidence and make the necessary notifications to authorities or persons, in accordance with the law.

17. Disclosure to authorities

Data may be disclosed to public authorities, courts or law enforcement bodies when Dibalcris has a legal obligation, receives a lawful request, needs to protect the safety of persons or needs to defend its rights. Dibalcris will analyse the basis and scope of the request and will disclose only the necessary data, unless the law requires otherwise.

18. Marketing and preferences

Dibalcris may send newsletters, SMS messages, push notifications, offers and personalised ads only in accordance with the law. Consent must be freely given, specific, informed and unambiguous, and options must be as easy to withdraw as they were to give.

Operational messages about orders, payments, delivery, account, returns, warranty, recall or safety do not constitute marketing when they are necessary to perform the contract, fulfil an obligation or protect persons. These communications may continue even if the person opts out of promotional messages, to the extent necessary for the operational purpose.

19. Operational communications

After entering data and/or placing an order, the customer may receive automatic notifications by e-mail and other configured channels. These may include account confirmation, password recovery, order confirmation or modification, payment, delivery, cancellation, the contact form, returns, warranty, recall or information about a risk product.

20. External links

The website may contain links to pages of providers, payment platforms, manufacturers, partners, authorities or social networks. Dibalcris does not control external content, cookies or policies and recommends reading each provider’s policy before submitting data.

21. Updating the policy

Dibalcris may update this policy when the website, providers, products, legal requirements, technologies, purposes or processing measures change. The current version will be published at www.zerovec.ro, with the date of the update and, where applicable, with notice to the affected persons.