Privacy and Personal Data Protection Policy

Art. 1.(1) This Privacy and Personal Data Protection Policy (“Policy”) provides information on the processing of personal data by New Level Solutions OOD (registered in Bulgaria as „НЮ ЛЕВЪЛ СЪЛЮШЪНС“ ООД) (“Controller” or “Company”) in connection with the use of the website operated by it, the submission of enquiries, the requesting and provision of services, the making of payments and communication with clients and other interested parties.

(2) The Controller processes personal data in compliance with Regulation (EU) 2016/679 (“GDPR”), the Personal Data Protection Act and other applicable legislation.

(3) Processing is carried out in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

Art. 2.(1) The personal data controller is:

New Level Solutions OOD (registered in Bulgaria as „НЮ ЛЕВЪЛ СЪЛЮШЪНС“ ООД)

Unified Identification Code: 204173521

Registered office and address of management: 73 Bulgaria Blvd., Sofia 1404

Telephone: +359 887 818 381

Email: krastev@balkancapital.eu

(2) For questions concerning the processing of personal data, as well as to exercise their rights under the GDPR, data subjects may use the contact details provided.

Art. 3.(1) Depending on the specific service and the manner of interaction with the Company, the following categories of personal data may be processed:

1. Identification data: names, personal identification number, foreign national’s personal number, date and place of birth, nationality, and details from identity documents, where necessary for the performance of a specific service or compliance with a legal obligation.

2. Contact details: address, email, telephone number and other means of communication provided.

3. Corporate and professional data: information concerning participation in companies, capacity as a manager, shareholder, sole owner of the capital, beneficial owner, representative or other related person.

4. Data contained in documents: information included in contracts, declarations, powers of attorney, instruments of incorporation, articles of association, resolutions and other documents provided in connection with the commissioned services.

5. Order and payment data: services requested, order values, payment references, information on payments made, invoicing and accounting documents.

6. Technical data: IP address, information about the device used, browser, operating system, technical identifiers and data on the use of the website, insofar as such data are collected.

7. Correspondence data: the content of enquiries, electronic messages and other communication with the Controller.

(2) The Controller does not require the provision of personal data that are not necessary for the relevant purpose of processing.

(3) Where a specific service requires the processing of special categories of personal data under Art. 9 GDPR or data relating to criminal convictions and offences under Art. 10 GDPR, such processing is carried out only where an applicable legal basis exists and in compliance with the relevant additional requirements.

Art. 4.(1) Personal data are processed for the following purposes and on the corresponding legal bases:

(2) Where the data relate to representatives, employees, shareholders, beneficial owners or other persons who are not parties to the contract with the Controller, processing may be based on a legitimate interest or a legal obligation, depending on the specific circumstances.

(3) Where processing is based on a legitimate interest, the Controller takes into account the necessity of the processing and the rights and interests of the individuals concerned.

Art. 5.(1) Where processing is based on consent, the data subject may withdraw it at any time.

(2) Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

(3) Where the provision of personal data is necessary for entering into or performing a contract or for compliance with a legal obligation, failure to provide such data may make it impossible to provide the relevant service.

Art. 6.(1) Payment for services may be made by:

1. Bank transfer to the following bank account of the Provider:

Account holder: New Level Solutions OOD

IBAN: BG63STSA93000030396137

2. Debit or credit card through the Stripe payment platform.

(2) When payment is made through Stripe, the data necessary to process the card payment are provided and processed through Stripe’s payment infrastructure in accordance with the applicable terms and privacy policy of the relevant Stripe group company.

(3) The Controller does not store full bank card numbers, CVV/CVC codes or other sensitive data used to authenticate card payments.

(4) The Controller may receive and store information on the payment status, transaction value, date, payment identifier, payer details and other information necessary for the performance of the contract, accounting, fraud prevention and the resolution of payment disputes.

(5) Stripe may process personal data as an independent controller or as a processor, depending on the specific operation and the applicable contractual arrangements.

(6) Further information on the processing of personal data by Stripe is available at:

https://stripe.com/privacy

(7) When payment is made by bank transfer, payment data are also processed by the relevant banks and payment service providers in accordance with applicable legislation.

Art. 7.(1) Where necessary, personal data may be disclosed to the following categories of recipients:

1. State and municipal authorities, including the Registry Agency, the National Revenue Agency and other competent institutions;

2. Notaries, translators, lawyers and other professional advisers, where their involvement is necessary for the performance of the service;

3. Banks and payment service providers, including Stripe;

4. Providers of hosting, information technology, email and technical support services;

5. Accounting and other external service providers engaged in the Controller’s activities;

6. Other persons, where disclosure is necessary for the performance of a contract or is required by applicable legislation.

(2) Where third parties process personal data on behalf of the Controller, the relationships with them are governed in accordance with Art. 28 GDPR, where applicable.

(3) The Controller does not sell personal data to third parties.

Art. 8.(1) The use of Stripe or certain technology services, or the performance of services with an international element, may necessitate the transfer of personal data outside the European Economic Area.

(2) Such transfers are carried out in compliance with the requirements of Chapter V of the GDPR.

(3) Depending on the specific recipient and the country of transfer, European Commission adequacy decisions, standard contractual clauses or other permissible protection mechanisms may apply.

(4) Where necessary, the Controller takes supplementary protective measures in accordance with the applicable requirements.

(5) Information on the applicable safeguards and the means of obtaining a copy of them may be requested using the contact details provided.

Art. 9.(1) Personal data are retained only for the period necessary to achieve the purposes for which they were collected, unless applicable legislation requires a longer period.

(2) The following periods and criteria apply:

1. Data relating to contracts and services provided, for the duration of the contractual relationship and, following its termination, for the period necessary to comply with legal obligations and protect lawful rights and interests, including in accordance with the applicable limitation periods.

2. Accounting and tax documents, for the periods prescribed by applicable accounting and tax legislation.

3. Data from enquiries that have not resulted in the conclusion of a contract, for up to 12 months from the last communication, unless there are grounds for longer retention.

4. Data processed on the basis of consent, until consent is withdrawn or the purpose of processing no longer exists, unless there is another lawful basis for retention.

5. Technical data and logs, for a period determined according to the need to ensure the security and normal functioning of the website.

6. Payment data, for the periods necessary for accounting and tax reporting, handling refunds and payment disputes, and compliance with applicable legal obligations.

(3) Upon expiry of the applicable periods, personal data are erased, destroyed or anonymised, unless there is another lawful basis for their retention.

Art. 10.(1) The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful disclosure, loss, destruction or alteration.

(2) The measures are determined according to the nature of the data processed, the technologies used and the risks to the rights and freedoms of individuals.

(3) Access to personal data is granted only to persons who require it in connection with the performance of their employment or contractual duties.

(4) In the event of a personal data breach, the Controller takes the necessary action pursuant to Art. 33 and 34 GDPR, including notifying the competent supervisory authority and the individuals affected, where required.

Art. 11.Every individual has the following rights under the conditions laid down in the GDPR:

1. Right to information and access, to obtain information on whether their personal data are being processed and access to those data.

2. Right to rectification, to request the correction of inaccurate personal data or the completion of incomplete personal data.

3. Right to erasure, to request the erasure of their personal data where the statutory conditions are met.

4. Right to restriction of processing, to request restriction of processing in the cases provided for by law.

5. Right to data portability, to receive the personal data they have provided in a structured, commonly used and machine-readable format, where the statutory conditions are met.

6. Right to object, to object to processing based on a legitimate interest, including processing for direct marketing purposes.

7. Right to withdraw consent, where processing is based on consent.

8. Rights in relation to automated decision-making, pursuant to Art. 22 GDPR.

Art. 12.(1) Requests to exercise rights may be sent to krastev@balkancapital.eu or through the other means of contact provided.

(2) The Controller handles requests without undue delay and, as a rule, within one month of receipt.

(3) Where necessary, this period may be extended by a further two months, with the data subject being informed of the reasons for the extension within the initial one-month period.

(4) Where there are reasonable doubts concerning the identity of the applicant, the Controller may request additional information necessary to confirm it.

(5) Requests are handled free of charge, except in the cases provided for in the GDPR involving manifestly unfounded or excessive requests.

Art. 13.(1) Any person who suspects that their rights in relation to the processing of personal data have been infringed may contact the Controller.

(2) Irrespective of this, every person has the right to lodge a complaint with the competent supervisory authority:

Commission for Personal Data Protection (CPDP)

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Website: https://www.cpdp.bg

(3) Data subjects also have the right to a judicial remedy under the conditions laid down in applicable legislation.

Art. 14.(1) The website may use cookies and similar technologies to ensure its core functionality and security, process orders and payments, analyse website traffic and improve the user experience.

(2) Strictly necessary cookies may be used without prior consent where this is permitted under applicable legislation.

(3) Analytics, advertising and other non-essential cookies are used after the necessary consent has been obtained.

(4) Integration with Stripe may involve the use of technical tools and identifiers necessary for payment processing, payment security and fraud prevention.

(5) Users may manage their preferences through the cookie management tools provided on the website.

(6) Detailed information on the cookies actually used, their providers, purposes and retention periods is provided in a separate Cookie Policy or through the relevant consent management tool.

Art. 15.(1) When requesting services, the Client may provide personal data of other individuals, including shareholders, managers, beneficial owners, representatives and authorised agents.

(2) The Client undertakes to provide such data only where there is a lawful basis for doing so and to assist in fulfilling the applicable obligations to inform the individuals concerned.

(3) The Controller processes the data received solely for lawful purposes related to the performance of the commissioned service or to applicable legal obligations.

(4) Where personal data have not been obtained directly from the data subject, the Controller provides the information required under Art. 14 GDPR within the applicable time limits, unless a statutory exception applies.

Art. 16.(1) The Controller does not carry out automated decision-making, including profiling, which produces legal effects concerning individuals or similarly significantly affects them within the meaning of Art. 22 GDPR.

(2) Stripe’s use of automated tools for payment risk assessment and fraud prevention is governed by the relevant provider’s applicable data processing rules, with the specific roles and responsibilities depending on the payment service used.

Art. 17.(1) The Controller may update this Policy in the event of changes in legislation, the technologies used, service providers or the organisation of its activities.

(2) The current version is published on the website, indicating the date of the latest update.

(3) In the event of material changes to the processing of personal data, the Controller provides additional information to the individuals affected where required by law.

New Level Solutions OOD

Unified Identification Code: 204173521

Address: 73 Bulgaria Blvd., Sofia 1404

Telephone: +359 887 818 381

Email: krastev@balkancapital.eu