PRIVACY POLICY

Last updated: 13 January 2026

This Privacy Policy (“Policy”) is intended to inform you how the person owning and operating the “Capital in Euro” website (“Controller”, “We”), located at the domain https://www.kapitalvevro.com, processes your personal data.

SECTION ONE – GENERAL PROVISIONS

1. The term “Personal Data”, as used in this Policy, has the meaning given to it in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, referred to below as the “General Data Protection Regulation” and/or “GDPR”, namely: “any information relating to an identified or identifiable data subject”.
2. For the purposes of this Policy, “Data Subject” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

SECTION TWO – CATEGORIES OF PERSONAL DATA, LEGAL BASES AND PURPOSES OF PROCESSING

3. The Controller processes (including, but not limited to: collects and stores) Personal Data solely in connection with its business activity and in accordance with the requirements of applicable law, including the Personal Data Protection Act of the Republic of Bulgaria and the General Data Protection Regulation.
4. The Controller may collect some or all of the following categories of Personal Data of the Data Subject for the following purposes and on the following legal bases:
   • Identification data (first name, middle name, surname and email address) on the basis of steps taken by the Data Subject with a view to entering into a contract to which the Data Subject is party;
   • Identification data (first name, middle name, surname, date of birth, Unique Civil Number (EGN) or Personal Number of a Foreigner (LNCh), permanent address, identity document data, including number, date of issue, issuing authority, citizenship) of the partners, shareholders, legal representatives or authorised persons of the company indicated by the Data Subject in an inquiry submitted via the contact form on the website or by email to office@kapitalvevro.com, for the purpose of preparing the documents required to perform the contract and for representation before the Registry Agency.
   • IP address and pages visited, for the purposes of protecting information security;
   • Other data that may be necessary in certain cases or in connection with the provision of services to the Data Subject by the Controller, including data necessary for the performance of contractual obligations, such as a handwritten or qualified electronic signature.
5. The Controller does not process, and accordingly does not collect from Data Subjects via the Website, special categories of Personal Data such as: data revealing racial or ethnic origin, political opinions, genetic or biometric data, or data concerning the sex life or sexual orientation of the data subject.
6. The Controller uses “cookies”, which are files intended to improve the experience of the Data Subject as a user of the website. You can find more information in our Cookie Policy.
7. The personal data of Visitors is processed on the basis of at least one of the following grounds:
   • Consent of the Data Subject to the processing of their Personal Data;
   • The processing of the personal data is necessary for the performance of the Controller's contractual obligations to the Data Subject;
   • The processing of the personal data is necessary in order to take steps at the request of the Data Subject prior to entering into a contract;
   • The processing of the personal data is necessary for compliance with a legal obligation to which the Controller is subject;
   • The processing of the personal data is necessary for the purposes of the legitimate interests pursued by the Controller in carrying out its business activity.
8. For the purposes of this Policy, explicit consent is deemed to have been given when the Data Subject indicates their agreement with this Privacy Policy by marking the relevant field before submitting an inquiry or using the contact form on the website. A Data Subject who has taken steps towards entering into a contract with the Controller is likewise deemed to have given informed consent.
9. The Controller does not make decisions based solely on automated processing of data, including profiling.

SECTION THREE – DATA RETENTION PERIOD

10. The Controller retains the Data Subject's Personal Data for a period no longer than necessary to achieve the relevant purpose of processing, or for the statutory period, where applicable. In this regard, the retention periods for personal data by category are as follows:
    • personal data provided by the Data Subject when completing the contact form will be retained for a period of up to one year;
    • personal data of the Data Subject processed in connection with the performance of contracts will be retained for a period not exceeding 5 years from the date of termination of the relevant contract;
    • personal data of a Data Subject processed in connection with the issuance of tax documents (invoices) will be retained for a period not exceeding 10 years, counted from 1 January of the year following the year in which the contract was terminated;
11. The Company may retain Personal Data for a longer period where pseudonymisation has been carried out after the expiry of the above periods, for marketing, advertising or statistical purposes in accordance with Article 89 of the GDPR.

SECTION FOUR – ACCESS TO AND TRANSFER OF PERSONAL DATA TO THIRD PARTIES

12. The Personal Data of Data Subjects is accessible to the Controller's employees, representatives and contractors who need it to fulfil their statutory obligations and/or to perform a contracted service. In this regard, the Controller may transfer all or part of a Data Subject's Personal Data to third parties such as accountants, professional consultants, including lawyers, cloud platforms for processing/storing data (for the purposes of organisational support of the Controller's business, e.g. storing and processing documents prepared by the Controller in the performance of a contracted service, on cloud platforms for greater security), providers of information services, providers of hosting services for third-party information, e.g. hosting companies, or the Commercial Register and the Register of Non-Profit Legal Entities kept by the Registry Agency, in connection with the performance of contracts.
13. Pursuant to applicable law, or at the request of public authorities, all or part of the Data Subjects' personal data may be provided to the relevant competent authorities following a duly submitted request.
14. The Controller may disclose Personal Data to other controllers and/or processors, provided that such controllers and processors first provide sufficient guarantees of the implementation of appropriate technical and organisational measures, so that the processing meets the requirements of the GDPR and ensures the protection of the rights of Data Subjects.
15. Where the Controller has transferred Personal Data to a third party in accordance with this Policy, for example the Commercial Register and the Register of Non-Profit Legal Entities kept by the Registry Agency, the personal data rules of that party shall apply, and such processing is not covered by this Policy.

SECTION FIVE – RIGHTS OF DATA SUBJECTS

16. At any time while the Controller is processing a Data Subject's personal data, and subject to the limitations set out in applicable law, the Data Subject has the following rights:
    • Right of access – the right of the Data Subject to request information as to whether the Controller is processing their Personal Data, and to obtain access to and a copy of such Personal Data. If the Data Subject requests more than one copy of their personal data, the Controller is entitled to charge a reasonable fee for each additional copy;
    • Right to rectification – the Data Subject has the right to request that their personal data be corrected if they consider it to be inaccurate or incomplete.
    • Right to erasure (“right to be forgotten”) – in certain circumstances, for example where the Personal Data is no longer necessary for the purposes for which it was collected, or where consent to the processing of certain Personal Data for which there is no other legal basis has been withdrawn, the Data Subject may request that their Personal Data be erased without undue delay. In certain cases the Controller may refuse to erase such Personal Data where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
    • Right to restriction of processing – where certain conditions are met (e.g. the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data; the processing is unlawful but the Data Subject does not want the personal data erased and requests the restriction of its use instead; the Controller no longer needs the Personal Data for the purposes of processing, but the Data Subject requires it for the establishment, exercise or defence of legal claims), the Data Subject has the right to request that the processing of their Personal Data be restricted;
    • Right to data portability – where the Data Subject's Personal Data has been provided to the Controller and is processed by automated means, the Data Subject has the right to request that such Personal Data be provided in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where technically feasible;
    • Right to object – the Data Subject has the right, at any time, to object to the processing of Personal Data for particular purposes, in which case the Controller will stop using the personal data for that specific purpose, unless there are overriding legitimate grounds for the processing;
    • Right to withdraw consent – where the Controller processes Personal Data on the basis of consent given, the Data Subject has the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
17. The Data Subject may exercise their rights by contacting the Controller at: gdpr@kapitalvevro.com. To exercise the relevant right, it is sufficient for the Data Subject to indicate which right they are exercising, together with a brief description of the reason for exercising it.
18. Exercising the above rights is free of charge for the Data Subject, except where the request is manifestly unfounded or excessive. In such a case, the Controller may either charge a reasonable fee for handling the request, or refuse to act on it.
19. If a Data Subject considers that their Personal Data is not being processed lawfully, or that any of their rights relating to the protection of Personal Data have been infringed, they have the right to lodge a complaint with the competent data protection supervisory authority, as follows:

SECTION SIX – CHANGES TO THIS POLICY