PRIVACY POLICY

GENERAL PROVISIONS

This privacy policy has been developed in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "Regulation (EU) 2016/679" or "GDPR").

We understand that your personal data and the protection of the information you share with us is extremely important. That is why our Privacy Policy describes how we process your data and what measures we take to protect it.

This policy applies to you if you provide us with personal data by telephone (by phone or SMS), in an online registration form, by mail or by courier, through social networks, on a corporate or promotional website, through a mobile application or otherwise. Our privacy policy is an expression of our desire to protect your personal data.

Information about the Data Controller

Article 1. (1) ECOMO IMPEX LTD. (the Company) is a data controller, registered in the Commercial Register at the Registry Agency with UIC: 204571105, with seat and registered address: Bulgaria, 1113 Sofia, ul. Nikolay Haytov 12, fl. 3, office 8

(2) This policy aims to clarify and present information and settle the conditions for the exercise of the rights of individuals in connection with the protection of their personal data, which is processed by ECOMO IMPEX LTD. in connection with the company activities.

(3) The policy aims to inform you about the activities involving the processing of your personal data, the purposes for which such data is processed, the data protection measures and guarantees, your rights and the way you can exercise them in accordance with the requirements of the GDPR and the relevant applicable legislation of the European Union and the Republic of Bulgaria.

(4) Pursuant to the Privacy Policy of ECOMO IMPEX LTD. and the objectives of the General Data Protection Regulation and the Personal Data Protection Act (PDPA), the Company processes your personal data in compliance with the following principles:

legality, good faith and transparency;

restriction of the purposes;

minimization of data;

accuracy;

restriction of storage;

integrity and confidentiality.

Information on the competent supervisory body

Art.2. In the event of a breach of your rights as stated above or under the applicable data protection legislation, you have the right to lodge a complaint with the Data Protection Commission as follows:

Name: Commission for Personal Data Protection

Headquarters and registered address: Bulgaria, 1592 Sofia, 2 "Prof. Tsvetan Lazarov” Blvd.

Mailing data: Bulgaria,1592 Sofia, 2 "Prof. Tsvetan Lazarov” Blvd.

Phone: +359 2 915 3518

Email: kzld@government.bg, kzld@cpdp.bg

Website: www.cpdp.bg.

Art.3. For the purposes of this policy:

"Personal data" means any information relating to an identified or identifiable natural person, directly or indirectly, such as name, unique civil number, location data, online identifier or one or more features, specific to the physical, physiological, genetic, mental, intellectual, economic, cultural or social identity of that individual;

"Data subject" - a natural person who can be identified as a result of the processing of his personal data;

"Processing" means any operation or set of operations carried out with personal data or a set of personal data by automatic or other means such as collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting, using, disclosing by transmitting, distributing or otherwise making the data available, arranging or combining, restricting, deleting or destroying such data;

"Personal data processor" - is a natural or legal person, public authority, agency or other entity that processes personal data on behalf of ECOMO IMPEX LTD.;

"Recipient" - means a natural or legal person, public authority, agency or other entity to which ECOMO IMPEX LTD. discloses personal data, whether being a third party or not. Public authorities which may receive personal data in the context of a specific investigation in accordance with the Union or Member-State law shall not be considered "recipients"; the processing of such data by those public authorities complies with the applicable data protection rules in accordance with the purposes of the processing;

"Consent of the data subject" means any freely expressed, specific, informed and unambiguous indication of the will of the data subject, by means of a statement or a clear confirmatory action expressing his consent to the processing of personal data relating to him;

"Data Breach" means a breach of security which results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data which is transmitted, stored or otherwise processed.

PERSONAL DATA

Art.4. In connection with our activity ECOMO IMPEX LTD. processes personal data of the following categories of persons:

1. Buyers of goods and users of services

Visitors to our website

Recipients of advertising messages.

Art.5. In order to establish and exercise your rights, ECOMO IMPEX LTD. processes the following personal data:

Data about your business - business name;

Your business details - address and e-mail address;

Other information: company, position, business sector, as well as any feedback you provide us by mail, telephone, email or messages on social networks;

Information about the device or devices you use or have used to access our site (eg., make and model of your device, operating system, browser, or IP address).

Details of the emails and other electronic messages you receive from us, including whether these messages have been opened and whether you have clicked on any of the links in them. We want to make sure that our messages are useful and important to you, so in case you don't open them and click on a link in them, we know we need to improve the information we send you.

Information from other sources, such as our partners, specialized companies that provide information about their customers with their consent, in an explicit or anonymous form (eg. marketing or clinical research companies, financial institutions, social networks, etc.), incl. information about you that is publicly available.

Cookies, as well as other tracking devices

The so-called session (temporary) cookies are used to the extent necessary to ensure the safe and efficient operation of our website and its use. The storage of session cookies on end devices or user application software designed to view information resources (Web browsers) is entirely under the control of the user. The information related to cookies is stored by the server after HTTP sessions in the service logs no longer than the period required to complete the specific purpose being processed, or as provided by law.

Art.5. (1) ECOMO IMPEX LTD. does not collect or process personal data relating to the following:

reveal racial or ethnic origin;

reveal political, religious or philosophical beliefs, or membership in trade unions;

genetic and biometric data, health data or data on sexual life or sexual orientation.

(2) The personal data are collected by ECOMO IMPEX LTD. from the persons to whom they refer.

(3) The company does not perform automated decision making with your data.

(4) The company does not process data for persons under 16 years of age, except with the explicit consent of their parents or representatives.

Art.6. Grounds for collecting, processing and storing your personal data

(1) ECOMO IMPEX LTD. collects and processes your personal data on the basis of the following:

You have agreed to the processing of your data for one or more specific purposes;

Processing is required for the performance of a contract to which you are a party or for taking steps at your request before concluding a contract between us;

The processing is necessary for the observance of a legal obligation that applies to us as a personal data controller;

(2) ECOMO IMPEX LTD. is a data controller regarding your data as users of our services. Regarding the personal data that you process using our services, ECOMO IMPEX LTD. acts as a data processor.

Art.7. Purposes for which we use the personal data you provide us:

To send you an answer to your inquiry about any of our products or services;

To send you emails with news and suggestions from the company;

To send you invitations to events we organize - independently or with our partners;

For statistical needs and analyzes;

To help us understand more about you as our customer, the products and / or services you use, the way you use them, and to provide you with better service from our employees;

To send you invitations to participate in surveys - online or on paper.

To find ways to improve our products, services, applications or websites.

To create a profile on the site and ensure full functionality in providing our services;

For individualization of a party to the contract;

For accounting purposes;

For statistical purposes;

For information security;

To ensure the implementation of the contract for provision of the respective service;

To improve and individualize the service by offering appropriate promotional offers for products and services that may interest you;

To subscribe for our articles published on the blog of our site;

To comment on products and our articles published on our blog.

RIGHTS OF INDIVIDUALS

Art.8. (1) As an individual whose data is processed by ECOMO IMPEX LTD., you have the following rights:

To receive information about your personal data being processed. You have the right to access your personal data that we process for the purposes set out above. If we process this data and receive a request from you (or from a third party authorized by you), we will provide this access free of charge. You also have the right to request a copy of your personal data that we process. Before providing access to the personal data to you or a person authorized by you, we may request proof of identity as well as details of your relationship with us or our partners, so that we can find the data that applies to you;

To request rectification of the data collected for you, if they are incorrect or have changed;

To request the deletion ("right to be forgotten") of the personal data collected for you, except in cases where ECOMO IMPEX LTD. processes your personal data in compliance with its obligations arising from the law. You have the right to request that we delete your personal data without undue delay if:

the personal data are no longer necessary for the purposes for which they were collected;

when you have withdrawn your consent;

when you have objected to the processing, if it is illegal;

where personal data must be deleted in order to comply with a legal obligation under the Union law or the law of a Member-State that applies to us as a personal data controller;

when the personal data have been collected in connection with the offering of services to the information society.

Under certain conditions, we may refuse to delete your personal data in the cases provided by law.

To request a restriction on the processing of your personal data only for the purposes for which they were collected - in accordance with the requirements of the General Data Protection Regulation, the Personal Data Protection Act and their implementing acts (only in the cases provided for in the applicable regulations and insofar as this does not contradict our regulatory obligations for the processing of your personal data);

Right to portability of your personal data (only in the cases provided for in the applicable legislation and insofar as this does not contradict our regulatory obligations for the processing of your personal data);

To receive copies of the documents containing your personal data, after submitting a request in a due form at the office of the Company;

You may object at any time to the processing of your personal data for the purposes of direct marketing carried out by ECOMO IMPEX LTD. by withdrawing your consent.

Art.10. (1) In case of violation of your rights under the General Data Protection Regulation, PDPA, you have the right at any time to file a complaint with the relevant supervisory body, namely the Commission for Personal Data Protection;

(2) You can appeal the actions and acts of ECOMO IMPEX LTD. and the processors acting on behalf of the Company, in court before the respective administrative court and before the Supreme Administrative Court.

Art.11. (1) The rights under art. 9 can be exercised by filling in a written "Request for the exercise of rights in relation to the protection of personal data" (the Request), which you can obtain from us upon request.

(2) The REQUEST can be sent personally or through your explicitly authorized proxy with a notarized power of attorney on paper in each of our offices, as well as electronically under the EDECSA. When the REQUEST is drawn up as an electronic document, it should be signed with a qualified electronic signature.

(3) If the REQUEST is submitted by an authorized person, you should attach to it the respective explicit power of attorney.

(4) In the cases where during the exercise of your rights under this chapter there is a possibility to disclose personal data for a third party, our respective employee will provide you with access only to the part of data that applies to you.

Art.12. (1) Within 30 (thirty days) from the receipt of your valid "REQUEST FOR EXERCISE OF RIGHTS IN CONNECTION WITH THE PROTECTION OF PERSONAL DATA", ECOMO IMPEX LTD., will provide you with written information in connection with our actions, such as:

In case you exercised the right of access to the personal data – we will provide you with information about: the purposes for which the Company processes your personal data; the categories of personal data it processes; the recipients or categories of recipients to whom your personal data are or will be disclosed, in particular recipients in third countries or international organizations - recipient to whom it provides data; where possible, the intended period for which your personal data will be stored and, if this is not possible, the criteria used to determine this period; the existence of the right to request from us the correction or deletion of personal data or the restriction of the processing of personal data relating to you, or to object to such processing, your right to appeal before the competent supervisory bodies; where your personal data has not been collected from you - any available information on its source, the existence of automated decision-making, including profiling, in accordance with the General Data Protection Regulation;

If you have exercised the right for deletion of your personal data - will delete your personal data without undue delay, provided that the prerequisites for exercising this right set out in the General Data Protection Regulation, the PDPA and the acts for their application are present and insofar as this does not contradict our legal obligations for the processing of your personal data;

If you have exercised the right to restrict the processing of your personal data – we will limit the processing of your personal data, in the cases provided for in the applicable regulations and insofar as this does not contradict our legal obligations to process your personal data without deleting them, and we will inform you before lifting the processing restriction.

If you have exercised the right to portability of your personal data - ECOMO IMPEX LTD. will provide your personal data in a structured, widely used and machine-readable format and will transfer your data to another controller, in the cases provided for in the applicable regulations and insofar as this does not contradict our regulatory obligations for the processing of your personal data.

(2) ECOMO IMPEX LTD. will inform you in writing of any refusal of access, deletion, right to restrict the processing of your personal data or request to exercise the right of portability, as well as the reasons for such refusal within the period under para. 1.

(3) When your personal data are deleted or their processing is restricted, ECOMO IMPEX LTD. will notify their recipients, who are responsible for their respective deletion or restriction.

(4) Our obligation to provide the information under this article may be limited in whole or in part, taking into account your fundamental rights and legitimate interests and in the cases provided for by the applicable legal regulations.

(5) ECOMO IMPEX LTD. has the right to extend the term under para 1 to 60 days, depending on the complexity and the number of the received requests in each individual case. The Company will notify you of any extension of the term, as well as the reasons for such extension of the term for response by us within 30 days from the receipt of your valid "REQUEST FOR EXERCISE OF RIGHTS RELATING TO PERSONAL DATA".

Art.13. (1) The right to request correction of your personal data can be exercised by filling in a written "REQUEST FOR CORRECTION OF PERSONAL DATA" (THE REQUEST), which we will provide upon request.

(2) The REQUEST can be sent personally or through a person explicitly authorized by you with a notarized power of attorney, on paper at our office, as well as electronically, based on the Electronic Document and Electronic Certification Services Act (EDECSA). When the REQUEST is drawn up as an electronic document, it should be signed with a qualified electronic signature.

(3) When submitting the REQUEST by an authorized person, you should attach to it the respective explicit power of attorney.

Art.14. (1) Within 30 (thirty days) from the receipt of your valid "REQUEST FOR CORRECTION OF PERSONAL DATA", ECOMO IMPEX LTD. will correct without undue delay the inaccurate personal data related to you or will supplement your incomplete personal data.

(2) ECOMO IMPEX LTD. will inform you in writing about any refusal to correct or supplement your personal data, as well as about the reasons for such refusal within the term under para 1.

(3) When your personal data is corrected or supplemented, ECOMO IMPEX LTD. will notify its recipients, who are responsible for its respective correction or supplementation.

Art.15. (1) The right to object to the processing of your personal data for the purposes of direct marketing can be exercised by filling in a written "REQUEST FOR WITHDRAWAL OF THE CONSENT FOR THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF THE DIRECT MARKETING" (The Request) which will be submitted to you upon request.

(2) The REQUEST can be sent personally or through your explicitly authorized proxy with a notarized power of attorney, on paper in each of our offices, as well as electronically, in accordance with the Electronic Document and Electronic Certification Services Act (EDECSA). When the REQUEST is drawn up as an electronic document, it should be signed with a qualified electronic signature.

(3) When submitting the Request through an authorized person, you should attach to it the respective explicit power of attorney.

Art.16. Within 30 (thirty days) from the receipt of a valid "REQUEST FOR WITHDRAWAL OF CONSENT TO THE PROCESSING OF PERSONAL DATA FOR THE PURPOSES OF DIRECT MARKETING", ECOMO IMPEX LTD. will the processing of personal provided by you for the purposes of direct marketing and will provide you with written information regarding these actions.

(2) ECOMO IMPEX LTD. will inform you in writing about any refusal to respect the Request under para 1, as well as about the reasons for such refusal within the term under para 1.

(3) After ECOMO IMPEX LTD. terminates the processing of the personal data provided by you, the Company will notify the recipients, who are responsible for the termination of their processing.

(5) ECOMO IMPEX LTD. has the right to extend the term under para 1 to 60 days, depending on the complexity and the number of the received requests in each separate case. The Company will notify you of any extension of the term, as well as of the reasons for the extension of the term for providing response within 30 days from the receipt of your valid "REQUEST FOR WITHDRAWAL OF CONSENT FOR PROCESSING OF PERSONAL DATA FOR DIRECT MARKETING PURPOSES".

Term of storage of your personal data

Art.17. (1) ECOMO IMPEX LTD. stores your personal data for a period not longer than the existence of your account on the website. After that, " ECOMO IMPEX LTD. takes the necessary steps to delete and destroy all your data without undue delay. In the general case, unless we specify otherwise, your data is stored for a period of 2 (two) calendar years from the date of its receipt.

(2) ECOMO IMPEX LTD. notifies you in case the data retention period needs to be extended in order to fulfill the objectives, fulfill the contract, in view of the legitimate interests of ECOMO IMPEX LTD. or for other reasons.

(3) ECOMO IMPEX LTD. stores your data, provided on the basis of your consent, until its explicit withdrawal, and this does not affect the publications and comments made in order to preserve the semantic integrity of the comments.

(4) ECOMO IMPEX LTD. stores the personal data, which it has to retain under the applicable legislation for the respective term, which may exceed the term of existence of your registration.

In case of personal data breach

Art. 18. (1) If ECOMO IMPEX LTD. finds a breach of your personal data, which may pose a high risk to your rights and freedoms, we will notify you without undue delay of the breach and the measures taken or about to be taken.

(2) ECOMO IMPEX LTD. is not obliged to notify you if:

it has taken appropriate technical and organizational protection measures with regard to the data affected by the security breach;

it has subsequently taken measures to ensure that the breach will not lead to a high risk to your rights;

such notification would require a disproportionate effort.

Persons to whom your personal data is provided

Art. 19. In connection with the conclusion of contracts for sale and delivery of goods and services offered by ECOMO IMPEX LTD., ECOMO IMPEX LTD. transmits the necessary information to:

Courier or postal companies that will deliver documents or other items on our behalf;

Publishing companies who need to prepare personalized materials for you;

Companies sending mass emails when you need to receive an email message from us.

Art. 20. The controller does not transfer your data to third countries.

Data protection

Art. 21. ECOMO IMPEX LTD. treats your personal data as strictly confidential. To protect them, a number of measures have been taken, including:

We restrict access to the premises in which we work, only to the people who must be there (for this purpose we use codes and access cards, passwords and other technologies related to restricting access to certain premises);

We also implement access control to our information technology systems using firewalls, identification number validation (ID), logical segmentation and / or physical separation of our systems and information;

We use methods such as encryption and pseudonymization of information;

We never ask you to send us your password;

We advise you never to enter an account number, password or other sensitive information in an email to us.

ADDITIONAL PROVISIONS

1. This policy has been approved by an order of the representative of ECOMO IMPEX LTD.

2. The General Data Protection Regulation, the Personal Data Protection Act and other legal regulations related to the activity of ECOMO IMPEX LTD. shall apply to the issues not settled herein.

3. Taking into account the current trends, this privacy policy may change. The revision date is indicated at the end of the document. Any changes to this Privacy Policy will be effective after their subsequent announcement.

Last updated: 30.08.2023