In force as of 25 May 2018

I. Introduction

R&M Management Ltd ("R&M") respects the privacy of its clients and guarantees the protection of their personal data as much as possible. The present Privacy and Personal Data Protection Policy (hereinafter referred to as "Privacy Policy") has been prepared and is based on the current Bulgarian and European legislation in the field of personal data protection.

This Privacy Policy governs the processing of personal data of individuals or representatives of legal entities that are our clients or potential clients as well as users of our website: www.r-m-management.com (the "Website"), in connection with the services provided by R&M, including provided through and available on the Website.

This Privacy Policy along with the Cookies Usage Policy and any other documents mentioned on the Website set out the rules that R&M will observe when processing personal data that we collect from you or for you, or which you provide us with. This Privacy Policy does not affect, limit or invalidate your rights under the Personal Data Protection Act ("PDPA") or other relevant legislation.

If you have any questions or comments regarding this Privacy Policy, please contact us at: gdpr@r-m-management.com.

Please read carefully this Privacy Policy before using the Website or provide your personal data, whether electronically on the Website or on paper, as with the provision of your personal data you agree to its terms and conditions. If you do not wish to process your personal data in the manner described in this Privacy Policy, please do not provide it to us. The provision of personal data on your behalf is voluntary, in order to use certain services provided by us and the use of the Website and/or the access thereto. Please note that in some cases we will not be able to provide you with the service you have requested if you do not provide us with the necessary information. Please also keep in mind that in certain cases your consent to the processing of personal data may not be necessary, if R&M has another legal basis, for example compliance with statutory obligations.

II. Who processes and is responsible for your personal data?

R&M Management Ltd (R&M/ we) is a business company registered in the Commercial Register of the Registry Agency under UIC 175265145, which collects, processes and stores your personal data under the terms of this Privacy Policy. R&M is a personal data controller within the meaning of the Personal Data Protection Act (PDPA). You can contact us at any of the following contact details:

Registered office: 1000 Sofia, 6 “Nikola Vaptsarov” Blvd.

Telephones: +359 2 962 4906

E-mail: gdpr@r-m-management.com

III. Categories personal data processed by R&M

1. R&M may process publicly available personal data and / or personal data provided by you. The main types of personal data processed are:

(i) Personal identification information (including name, personal identification number, identity card number, place of residence, nationality, language of communication, etc.);

(ii) Information about the field of activity (including education, educational establishment, workplace, position occupied, etc.);

(iii) Contact details (including postal and e-mail addresses, telephone and fax numbers, etc.);

(iv) Financial information (bank account, etc.);

(v) Information about a representative (legal representative or proxy of such) of our client legal entity;

(vi) Data from the communication between us and you, your habits, preferences, your satisfaction with our services (activity when using our services, complaints, requests, etc.);

(vii) Information about Website visits and use of the Website, including operations and usage history of the Website;

(viii) Data obtained in the performance of obligations deriving from regulatory acts (ie data arising from inquiries, regulations, investigative bodies, notary, tax offices, court, enforcement agent);

(ix) Data obtained from performance of contractual obligations (including name, PIN, address, telephone and / or e-mail address, etc.).

2. R&M may process data prepared and generated by R&M during the provision of services:

(i) data on the terminal electronic communication device used, the type of device, operating system used, IP address, location;

(ii) data on the products and services preferred by you;

(iii) video recording upon visiting R&M office.

3. In order to ensure the proper performance of the services and the obligations arising from client contracts, R&M is entitled to process any information that is available in public registers (including a public database and data disclosed on the Internet) as well as information obtained from third parties regarding the implementation of legal provisions regarding clients.

4. R&M has the right and obligation to verify the accuracy of the personal data stored in the database by requiring you to verify the data and, if necessary, to correct or verify the correctness of your data.

5. Various types of personal data may be processed individually or in combination.

IV. Purposes and legal bases for the processing of personal data

1. Processing of personal data that is necessary for the conclusion or performance of contracts with us or in connection with the preparation for concluding contracts with us.

R&M processes your data for the following purposes:

(i) Identifying clients upon: signing a new or amending an existing contract with us; clarifications on the services used; performance of a contract signed;

(ii) Making proposals for signing contracts, forwarding pre-contractual information and draft of a contract;

(iii) Data obtained from you in the performance of obligations arising from contracts entered into with you or a company represented by you, exercising of rights and ensuring the performance of contracts by our clients;

(iv) Servicing and responding to client complaints/ inquiries/ appeals/ objections;

(v) Payment of obligations, rescheduling of amounts due.

2. In performing its legal obligations, R&M processes your data for the following purposes:

(i) Issuing of invoices;

(ii) For carrying out tax and social security supervision by the relevant competent authorities;

(iii) Obligations provided by the Accountancy Act and the Tax-Insurance Procedure Code and other related statutory instruments in relation to the conduct of proper and lawful accounting.

3. R&M processes the relevant data provided with the explicit written consent of the client for their processing for the following purposes: For direct marketing of products and services;

4. The processing is required for the purposes of the legitimate interests of R&M.

(i) In order to protect and ensure the interests of visitors and employees, R&M uses video surveillance equipment to make a video recording when visiting the R&M office.

(ii) Assessing and establishing customer satisfaction as well as the effectiveness of the advertising we offer to you and others and to meet your expectations by presenting adequate advertising;

(iii) Analysis of purchase history data, customer preference and behavior;

V. Categories of third parties who have access to and process your personal data

(i) Transportation/ courier companies, postal operators in order to perform our contractual obligations, dispatch of correspondence and communications, in connection with the contract between us;

(ii) Persons to whom R&M has assigned to maintain equipment and software used to process your personal data;

(iii) Debt collection providers, notaries, attorneys, enforcement agents or any other third party, if the client has breached the obligation arising from a contract with us;

(iv) Banks serving payments made by you;

(v) Persons to whom R&M has provided the performance of part of the activities or obligations related to a particular service which we have undertaken to provide to you;

(vi) Persons performing consultancy services in different fields - lawyers, accountants, etc.;

(vii) Bodies, institutions and individuals to which we are required to provide personal data under current legislation;

(viii) Security companies holding a license to perform private security activities processing the video recordings of R&M sites/offices and/or maintaining other registers in the process of ensuring the access regime in the same sites;

VI. For what period of time your personal data shall be retained?

The period of storage of your personal data depends on the processing purposes for which it was collected:

1. Personal data processed for the purpose of signing/ amending and performing contracts between R&M and you or a company represented by you - for the duration of the contract and until the final settlement of all financial relations between the parties. R&M may retain some of your personal data for a longer period of time until the expiration of the applicable limitation period in order protection against any customer claims in connection with the execution/ termination of contracts with us as well as for a longer period of time in case of a legal dispute that has already arisen until its final decision has been reached with a court/ arbitration ruling enforced;

2. Personal data processed for the purpose of issuing accounting / financial documents for the implementation of the tax and social security supervision, but not limited to invoices, debit, credit notes, delivery protocols, service/ goods contracts shall be kept at least 11 years after the expiry of the limitation period for repayment of the public claim unless the applicable law provides for a longer period.

3. Video recordings from security cameras - no more than 30 days after the recording was created.

4. Personal data processed for the purpose of direct marketing - to the explicit withdrawal of the consent given for direct marketing or the receipt of an objection to the processing of personal data for direct marketing.

VII. Your right regarding personal data processessing

1.General rights

In relation to the processing of personal data, you have the following rights that you may exercise at any time while we store or process your personal data by sending a request to the address of the R&M listed above or electronically at e-mail: gdpr@r-m-management.com.

You have the right to request from R&M:

• a copy of your personal data and access to them at any time;
• to rectify without undue delay your inaccurate personal data as well as data that has already not up to date;
• your personal data in a form convenient to transfer them to another personal data controller, or to ask us to do so without being impeded by ourselves (the right of portability);
• to delete your personal data without undue delay in the presence of any of the legal grounds for doing so;
• to limit the processing of your personal data, in which case your data will only be stored but not processed. Our refusal to limit the processing will be explicit only in writing, and we are obliged to provide you grounds by specifying the legitimate reason;

You also have the right to:

• withdraw your consent to the processing of your personal data at any time with a separate request addressed to R&M for consent-based processing;
• oppose the processing of your personal data;
• oppose the automated processing, including profiling;
• not be the subject of a decision based solely on automated processing including profiling;

2. You have a right to file a complaint to the supervisory authority

You have the right to file a complaint directly to the supervisory body and the competent authority is the Personal Data Protection Commission, address: 1592 Sofia, 2 Prof. Tsvetan Lazarov (www.cpdp.bg).

In case you wish to file a complaint about the processing of your personal data performed by R&M, you can do so at the specified contact details of the Data Controller (at the above mentioned contact details).

3. Automated decision making

The data controller does not use your personal data for automated decision making. In the event that we intend to use your personal data for automated decision making, you have the right to be informed and therefore to receive information about the logic of any automated processing of personal data relating to you.

4. Objection against direct marketing use

You have the right to object to the future processing of your personal data for the purposes of direct marketing and advertising as well as to disclosure to third parties and their use on their behalf for the purposes of direct marketing and advertising by withdrawing your consent anytime. To do so, you may send an e-mail with the request to discontinue the use of your personal data for direct marketing purposes at: gdpr@r-m-management.com

5. Can you refuse to provide personal data to R&M and what shall be the consequences of this act?

In order to conclude a contract with you and/or to provide you with the requested products or services in accordance with our statutory and consequent contractual obligations, R&M needs certain data to identify the contracting party, its proxy, contact details, details related to payment of obligations.

You refusal to provide such data prevents us from signing a contract with you.

VIII. How we shall protect your personal data

R&M applies organizational, physical, IT and other necessary measures to ensure the security and protection of your personal data and the monitoring of the personal data processing.

Among other things, such security measures include the following activities:

- R&M has established the requirements for the processing, registration and storage of personal data by the adopted internal procedures, the observance of which is constantly observed;

- the access of R&M employees to personal data and the permission to process the personal data in R&M database is limited, depending on their duties;

- R&M has established confidentiality obligations for its employees;

- the access to R&M office equipment and computers of any employee is limited;

- we apply all the necessary organizational and technical measures provided by the Personal Data Protection Act, as well as the best practices of international standards;

- For maximum security when processing, transferring, and storing your data, we may use additional protection mechanisms such as encryption, pseudonymisation, etc.;

The security measures we apply are subject to constant improvement and adaptation to state-of-the-art technologies.

IX. Links to other websites

Sometimes the Website may contain links/ hyperlinks to other websites. We do not operate linked websites and we do not approve the content, services and products on these sites. We encourage you to use the linked websites carefully and with due attention to their content and terms of use. R&M is not responsible for the privacy policy or the content of such websites and we advise you to review their privacy policies. However, as soon as R&M receives information about illegal activities or illegal information on such websites, R&M will take immediate action to remove the electronic links (hyperlinks) to them.

X. Biscuit Usage Policy

In order to get familiar with the Cookie Policy, please visit the page Cookie Policy

Personal data of children

We do not consciously collect personal data from children under the age of 16. If we learn that we have collected personal data of a child under the age of 16, we will take steps to delete such information as soon as possible or to obtain the consent of the person exercising parental responsibility for the child.

Amendments of the Privacy Policy

We may periodically update our Privacy Policy. In the event of a change in the current Privacy Policy, a notice will be published on our website as well as the updated Privacy Policy. All amendments and additions to the Privacy Policy will be applied only after publishing its up-to-date content available on our Website.