1. Who is responsible for your data? Where to turn to exercise your rights?

1.1. The data controller of your data is "NK Invest Group" Ltd., UIC 203860847, with its registered office in Sofia, 1680, Vitosha district, Todor Kableshkov Blvd. No. 69, entrance A, floor 1, apt. 5 ("the Company").

1.2. The Company has appointed a Data Protection Officer with the contact email nkutev@nkinvestgroup.com. You can send all requests to exercise your rights (described in points 3.1 - 3.7) to the specified email address of the Data Protection Officer.

2. General principles of the company regarding information transparency

2.1. Any information provided under this policy and any other information that may be requested in the future is provided free of charge, provided it is not repetitive, excessive, or manifestly unfounded (see point 2.3).

2.2. For each of the rights you exercise, the Company will respond within one (1) month of receiving the request or, in case of objective difficulties, complexity of the request, or a large number of requests, the Company will respond within a maximum period of three (3) months, either by fulfilling your request or by justifiably refusing to fulfill it for legitimate reasons explicitly specified in the General Data Protection Regulation 679/2016.

2.3. If the Company considers that one of your rights is being exercised in a manifestly unfounded manner, or the request is excessive or (to a greater extent) repetitive, it has the right, on the one hand, to charge you a reasonable fee for providing additional information (which is generally free), and on the other hand, to refuse to respond to the request.

2.4. If the Company has reasonable doubts about your identity when submitting a request to exercise one of your rights, it may request additional information necessary to confirm your identity before processing your request.

2.5. If the Company delays responding to your request beyond a reasonable time and in any other case where you believe that any of your rights has been violated, or the Company does not comply with its obligations regarding the preservation of your data, you have the right to file a complaint with the supervisory authority (Commission for Personal Data Protection, Website: https://www.cpdp.bg/, Tel: 02/91-53-518, email: kzld@cpdp.bg, address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd).

2.6. You have the right to withdraw your consent at any time by submitting a written statement to the Data Protection Officer's email address nkutev@nkinvestgroup.com (see point 1.2).

3. What are your rights regarding the personal data you provided to us?

3.1. Right to information

You have the right to request information about the personal data we have received from you and maintain for one or more purposes, as described below in points A to D. This text represents in its entirety a guide for basic awareness and understanding of the regulatory framework philosophy that encompasses the protection of your personal data. Updates, additional explanations, and clarifications regarding this text can be provided after submitting a request to exercise your right to information (see how in point 1.2).

3.2. Right of access

You have the right to request access to your information that we maintain and confirmation of whether it is being processed, and in particular, information about the purposes of the processing, categories of personal data, recipients or categories of recipients, the period for which the data will be stored and processed, the right to file a complaint with the Commission for Personal Data Protection, any available information about the origin of the data if the data was not obtained from you, the presence or absence of automated decision-making, including profiling and related methodology, safeguards regarding the policy we follow, and a copy of the personal data stored and processed (see how in point 1.2).

3.3. Right to rectification

3.3. Right to rectification

3.4. Right to erasure

You have the right to request full or partial erasure of your data from our Company, which we have the right to store and process, either because they are no longer necessary for the purposes for which they were collected, or because you withdraw your consent, or because your data was collected for a purpose that you consider illegal. Our Company, within a reasonable time (no more than one month and, under circumstances, if there are difficulties, no more than three months total), will respond to you by confirming the full or partial erasure of your data or the inability to erase some data if some law or the performance of a task of public interest or the right to freedom of expression and information, or the exercise or defense of legal claims requires their retention. In such a case, you have the right to file a complaint with the Commission for Personal Data Protection, as well as the right to an effective judicial remedy (see how in point 1.2).

3.5. Right to restriction

You have the right to request that our Company restricts the processing of your data in terms of quantity, time, or concerning the purpose of their processing, and in particular (a) either because you contest the accuracy of your data and until the Company verifies their accuracy, (b) or because you consider the processing to be illegal and instead of deleting the data you choose to restrict their processing, (c) or because their use by the Company is no longer necessary, but you do not wish their deletion because their retention will serve some legal claim, (d) or in case you object to the processing of the data and until it is verified that your rights as a data subject take precedence over the legitimate grounds of the Company for processing (see how in point 1.2).

3.6. Right to data portability

You have the right to receive the personal data that you have provided to us in a structured, widely used, and machine-readable format, as well as the right to transfer them further without objection, provided that the processing is based on your consent. In the context of exercising this right, you can also request a direct transfer from the Company to the third party without your own participation.

This right is exercised under the conditions of deletion, as described above (in point 3.4) and its exercise should not negatively affect the rights and freedoms of others.

3.7. Right to object

3.7.1 You have the right to object to the use of your personal data for the purposes of direct marketing and especially for profiling related to this direct marketing (see how in point 1.2).

3.7.2 This right does not exist in the case of potential employees and visitors to the Company's premises, as these data are not transferred to the marketing department and are not subject to such processing.

4. Is there a possibility that your data will be transferred elsewhere?

There is no provision for your data to be transferred to an organization outside the Company and its subsidiaries, except for (a) service providers for our electronic systems and networks – and only for the purposes of fulfilling the support contract of our Company, and (b) competent tax authorities within our mandatory compliance with tax legislation and to the extent (and provided) that this is necessary.

5. Guarantees

We assure you that the Company will take all technical and organizational measures to protect the data and will perform only the optimal, minimal, and absolutely necessary use and processing of your data as determined by law, and strictly and exclusively for the purpose for which you provided them.
Specific provisions for individual categories of personal data subjects, which apply cumulatively with the aforementioned general provisions of the Policy.

(A) COMMUNICATION RECIPIENTS

A.1. Purpose: The receiving, processing, and storing of your data provided exclusively within the communication framework is carried out solely for the purpose of informing you about our Company's products and activities. All your data is stored only for this purpose and processed solely by the marketing department of our Company.

A.2. Legal basis of processing: Your consent to process your data for the stated purposes constitutes the legal basis for this processing, in accordance with Article 6(1)(a) of the General Data Protection Regulation.

A.3. Data retention period: To fulfill the stated purpose of processing, we consider it reasonable and necessary to retain your relevant data for a period of three (3) years. After three years from the date of your consent, the relevant data will be deleted unless you provide consent again under the specified conditions.

(B) CLIENTS and POTENTIAL CLIENTS – SUPPLIERS

B.1. Essence – legal basis:

(a) During the pre-contractual phase and especially when filling out an electronic contact form on our website, or directly sending an email, or telephone communication, or filling out a paper document (in this case providing your full name/email address and/or phone number and/or address and/or profession or our products that interest you), the purpose of processing is to assess the possibility of a transaction with the Company, and the legal basis is serving the legitimate interests of the Company to pursue its commercial objectives by responding to the requested communication to explore the possibility of a transaction with you.

(b) In case a transaction with the Company is realized, the data provided during the pre-contractual phase (as well as any provided during our transaction) will be processed for the purposes of fulfilling the contract between us and for our compliance with tax legislation. In this case, the legal basis for processing is the performance of the contract between us and our compliance with legislation (Article 6(1)(b) and (c) of the GDPR).

B.2. Data retention period: We will retain the data mentioned in point B.1.(a) for five (5) years and then delete it. The data mentioned in point B.1.(b) will be kept as long as necessary under tax legislation.

(C) VISITORS TO OUR COMPANY'S PREMISES

C.1. Purpose: The receiving, processing, and storing of your data relating to your identity and time spent at our Company's premises is done for the purpose of security and protection of individuals at the Company's premises (e.g., employees, visitors) as well as the Company's general equipment (e.g., buildings, electronic equipment, etc.).

C.2. Legal basis of processing: Your consent to process your data for the stated purposes constitutes the legal basis for this processing, in accordance with Article 6(1)(a) of the GDPR.

C.3. Recipients: The material is accessed only by our competent/authorized staff responsible for premises security. This material will not be disclosed to third parties except in the following cases: (a) competent judicial, prosecutorial, and police authorities when it contains information necessary for investigating a crime involving persons or property of the administrator; (b) competent judicial, prosecutorial, and police authorities when they lawfully request data in the performance of their duties; and (c) the victim or perpetrator of a crime, in case of data that may constitute evidence of the crime.

C.4. Data retention period: We store CCTV footage for seven (7) days, after which it is automatically deleted. In case an incident is discovered during this period, we isolate part of the footage and store it for an additional one (1) month to investigate the incident and initiate legal proceedings to protect our legitimate interests, while if the incident involves third parties, we will store the footage for up to three (3) months.

(D) VISITORS TO SHOWROOMS AND EXHIBITIONS

D.1. Purpose: The purpose of processing your data is communication between us to explore collaboration opportunities and sending informational materials. This privacy policy accompanies and is an integral part of the "participation form" that interested parties fill out.

D.2. Legal basis of processing: Processing is based on your consent under Article 6(1)(a) of the GDPR.