The present privacy policy (the “Privacy Policy”) contains information regarding the processing of user-related personal data on the online platform.

WHAT IS PERSONAL DATA AND WHY WE COLLECT IT?

Whenever users visit the Platform to view its contents and/or use its features including to close deals We collect personally identifying information (“Personal Data”) about users via digital tracking technologies (cookies) as well as personal data manually entered in the Platform when creating a user profile or the closing or execution of purchase contracts. .

The types of personal data that we collect whenever users of the Platform manually enter data in the course of making registration filling user’s profile or the closing or execution of purchase contracts include: names, IP address, e-mail address, username, password, telephone, other data related to the verification process after activation of a user profile, such as: company’s name, Bulstat code, VAT number, headquarters and address of management, e-mail, telephone number, manager names, electronic signature data.

To review our rules with regards to the automatic collection of personal data and our use of digital tracking technologies please visit our Cookie Policy which represents an integral part to this policy.

HOW PERSONAL DATA IS PROCESSED?

The personal data collected through the Platform is primarily processed using computer and electronic means, adopting security measures in order to reduce to a minimum the risks of destruction or loss, including accidental loss, of the data itself, unauthorized access or processing without consent, or processing that is not in conformity with the purposes of collection indicated in this Privacy Policy.

LEGAL GROUNDS FOR THE PROCESSING

Through the Platform, different types of personal data are collected and processed, for different purposes and on different legal grounds. More precisely:

- Personal data related to browsing and collected via cookies is processed on grounds of the performance of contracts or functioning of the Platform (for necessary and functionality cookies) or on grounds of our legitimate interest (for marketing and analysing cookies);

- Personal data provided manually by users in the course of registering on the Platform, filling user’s profile with additional information, digital signature verification or the closing or execution of purchase contracts is processed on grounds of the conclusion and performance of contracts for sale of the products marketed on the Platform;

- Personal data collected during automated processing (incl. profiling) for the purpose of offering a rating system for individual traders (based on the opinions of buyers) who perform transactions through the Platform are processed based on the consent of the users of the Platform;

RETENТION PERIODS

Personal data linked to deals concluded on the Platform will be stored for at least 10 years to comply with tax and civil law. Moreover, the data linked to the deals concluded on the Platform may be stored for a longer period of time in order to comply with any statutory or contractual warranties granted to the client.

Unless provided otherwise by the applicable laws consent-based processing of personal data such as data provided for marketing and profiling activities are kept as long as necessary for the particular processing also with reference to the specific sector of activity and considering the interest demonstrated by the users to be updated on the products and services. Users who have subscribed to marketing messages will be asked to renew their consent no later than 2 (two) years after subscription or consent renewal.

Personal data of users who have not renewed their consent and where the company cannot demonstrate any other legal grounds for the processing shall be deleted without undue delay.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

The company discloses the personal data collected over the Website only as permitted by law. Personal data shall be processed and disclosed to:

- Consultants of company such as lawyers or accounts, processing data in their capacity of persons in charge of the protection of the interests of the company as well as for conforming with legal obligations;

- Google Tag Manager

- Business partners such as banks, couriers, system administrators and marketing companies acting in their capacity of data processors and providing the company with specific technical and organizational services in relation to the Platform or the closing or execution of purchase contracts (e.g. logistics services, payment services, IT services and marketing services).

- Police and judicial authorities, in compliance with the law and upon their request, or in case there are good reasons to believe that such disclosure is reasonably necessary to (1) investigate, prevent or take initiatives in relation to suspected unlawful activities, or assist national supervisory authorities; (2) prepare a defence against third party claims or charges, protect the security of its own website and of the company; (3) exercise or protect the rights, property or security of the company, its affiliates, customers, employees and third parties.

The company processes personal data using servers located within the European Union.

Although the company does not intend to, in the cases when the company transfers personal data outside the European Economic Area it shall ensure that the relevant country has been established to have an adequate level of personal data protection or the company shall require its partner to conclude the EU’s Standard Contractual Clauses in order to protect the transferred personal data.

AUTOMATED PROCESSING AND PROFILING

The company uses automated processing of personal data (including profiling) in order to offer a rating system for individual traders (based on the opinions of buyers and sellers) who make transactions through the Platform. However, we will not base our decisions solely on automated processing and will also use human factor. The User has the right to object to the automated processing of his/her data.

RIGHTS OF USERS WITH REGARDS TO THE PROCESSING OF THEIR DATA

A user always has the right to obtain confirmation whether or not personal data concerning him/her exists, even if it is not yet recorded, and to have it communicated to him/her in an intelligible form.

A user also has the right to obtain information about the source of personal data; the purposes and methods of processing it, the logic applied in the event of processing that is performed with the aid of electronic instruments; the identification details of the controller and data processors; and indication of the persons or categories of persons whose personal data may be communicated, or who could end up being known by, for example, data processors or а supervising authority.

A user also has the right to request an update, correction or, when s/he has an interest in doing so, an inclusion of personal data, deletion, conversion to an anonymous form or the blocking of personal data, that has been processed in violation of the law, including data which it is not necessary to keep in relation to the purposes for which it was collected or subsequently processed; a statement that the above operations were disclosed, including in terms of their content, to those parties to whom the data was communicated, except in the case in which such performance proves impossible or entails the use of methods that are clearly disproportionate to the right protected. The user can also ask for the portability of his/her data.

A user has the right to object, in part or in full, for legitimate reasons, the processing of personal data concerning him/her, even if it is pertinent to the scope of the collection and the processing of personal data concerning him/her for the purposes of sending advertising or direct marketing materials, or to conduct market research or commercial communications. In such cases the user has the right to ask for restriction of the processing concerning himself/herself. The right to object may also be exercised specifically with regard to one or more methods of sending marketing communications.

The user also has the right to lodge a complaint with a data protection authority (please find more information below) as well as the right to withdraw the consent previously given. The User has the right to object to the automated processing of his/her data.

FINAL PROVISIONS

Please note that this Privacy Policy has been drawn up and is governed by the EU General Data Protection Regulation (Regulation 2016/679/EU). Insofar as the General Data Protection Regulation does not apply, this Privacy Policy shall be regulated by the laws of the Republic of Bulgaria.

Changes in the applicable laws including the GDPR might require Us to amend this policy from time to time. We shall inform you for any such changes to this policy to the email address provided by you for receiving communications from the company.

In case you need any information or assistance with regards to the processing of your data or to exercise your legal rights as data subject please contact Us at: ...

The application of this Privacy Policy and the processing of personal data carried by from the company is subject to the control of the Commission for Personal Data Protection of the Republic of Bulgaria, https://www.cpdp.bg/en/

Depending on your place of living you might also be able to refer to another Data Protection Authority (DPA) within the European Union. Please find a list of DPAs within the EU and their contact details here: https://edpb.europa.eu/about-edpb/board/members_en

Notice for marketing activities regarding an online platform for intermediary services for the purchase and sale of goods

This document is a privacy notice within the meaning of the General Data Protection Regulation (GDPR). It was prepared by the company, (hereinafter “We” or “Us”) especially for our users in connection with the sending of marketing communication from the company online Platform for intermediary services for the purchase and sale of goods.

Below you will find information:

✓ regarding the responsibility for the processing of your data;

✓ what categories of personal data we process;

✓ under what conditions we process the data;

✓ the purposes and legal grounds for the processing;

✓ data retention periods and data security measures;

✓ how to exercise your rights under the GDPR,

✓ as well as in which cases and how we share your data with third parties.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

The responsibility for the processing of your personal data is borne by the company, (hereinafter, “We” or “Us”). In case:

✓ you wish to access, rectify or delete the data collected for you;

✓ you suspect that your personal data has been accessed illegally;

✓ you would like to object to the processing or withdraw your consent to processing;

✓ or if you have any questions or comments related to this Notice,

You can contact us at the following address for correspondence: ………..or by email at: …

WHAT INFORAMTION DO WE COLLECT ABOUT YOU?

In the context of marketing messages sent by company, information that constitutes personal data is collected and processed (more information on specific objectives and grounds can be found below). The information is collected directly by the User of the Platform (upon registration for receiving messages from Us) and specifically concerns the following categories of personal data: name, other identification data; contact details (email, address, phone); as well as other information that you choose to voluntarily share with Us.

WHY DO WE COLLECT YOUR DATA?

The main purpose of collecting your data is to provide you with information that would be of interest to you (for example, about new products). We also collect information about you in order to track your preferences so that content can be provided that may be of greater interest to you. Аs well as for conducting business analyzes, tracking the behavior of the subjects and their product preferences.

ON WHAT LEGAL GROUNDS DO WE COLLECT YOUR PERSONAL DATA?

The company processes personal data only if there is a valid legal basis. The conducting of marketing communication requires the explicit consent of the User to be informed by email about new products and other marketing activities. The basis for the processing of personal data is your explicit consent. Upon registration to receive messages from us, the User has the right to consent to receiving marketing communication from Us. The User gives his consent by checking the appropriate box at the end of this notice, the consent may be withdrawn at any time and is not connected to the use of the Platform or making deals through it.

WHAT MEASURES FOR PROTECTION OF THE COLLECTED PERSONAL DATA DO WE IMPLEMENT?

The company focuses on protecting the security of its users personal data. To prevent the loss, misuse or unauthorized access to your data, we apply all reasonable measures and remedies. However, if you suspect a data security breach, please contact Us immediately.

FOR HOW LONG DO WE STORE YOUR PERSONAL DATA?

The company stores the data processed on the basis of the explicit consent of the User, until the withdrawal of the consent, but not more than 2 / two / years, unless the consent is renewed.

YOUR RIGHTS IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA

The GDPR provides a number of rights for data subjects in connection with the collection and processing of data, in particular:

✓ right to access - to request information about the processing of your data;

✓ right to object to the processing - when the data is processed on the basis of the legitimate interest of the company;

✓ to withdraw your consent - when the data is processed on the basis of the explicit consent of the User;

✓ right to portability - when the data is processed on the basis of the explicit consent of the User you have the right to request a copy of the same or for the data to be automatically transferred to another organization;

✓ right to rectification - in case the data we store for you is not accurate;

✓ right to erasure, which includes the possibility to request “to be forgotten” when the data is no longer needed for the purpose, when the consent has been withdrawn or when the processing illegal from the beginning.

✓ The right to lodge a complaint with a supervisory authority (see section "How can you contact the competent supervisory authority?").

IN WHAT WAY DO WE SHARE YOUR PERSONAL DATA?

We may provide your data to the following parties for the following purposes:

✓ companies from the company group, when necessary and permissible by law;

✓ competent tax and other state authorities during an inspection;

✓ Partners of the company (e.g. lawyers in case of a dispute);

✓ in the event of a merger or acquisition, your data may be shared with the new owner (s), of which you will be notified. In any case, your data will not be shared with third parties established outside the EEA (EU, Norway, Iceland and Liechtenstein), unless explicitly permitted by local law and adequate protection measures are in place.

HOW CAN YOU CONTACT THE COMPETENT SUPERVISORY AUTHORITY?

Notwithstanding the above, in case of complaints you have the right to contact the Commission for Personal Data Protection (CPDP):

✓ in person at the following address: Sofia, Prof. Tsvetan Lazarov boulevard, No 2;

✓ in writing, at the following address: Sofia, postal code 1592, Prof. Tsvetan Lazarov boulevard, No 2;

✓ on the CPDP email – [email protected];

✓ Through the website of the CPDP: https://www.cpdp.bg/.

In view of the legal requirements, the above information may be changed by the company. For questions and up-to-date information regarding the processing of your data, you can contact us via the indicated contact details.

 □ declare that by entering my data I consent to receive marketing communication and have read the privacy notice regarding the processing of my personal data. I give my consent for the personal data provided by me to be processed in order to be informed by email about new products and other marketing activities of the company. My consent is not bound by the use of the Platform or making deals through it and can be withdrawn at any time by email to …