TERMS AND CONDITIONS

Introduction and agreement. This website (the “Site”) is operated by Carpe Diem Co Ltd. The Privacy Statement (the “Statement”) that follows describes Carpe Diem Co Ltd.’s collection, use and disclosure of information practices in connection with the Site.

Site Content. All information and content provided on this site (collectively “content”) is protected under copyright law and other intellectual property laws. Content is owned by Carpe Diem Co Ltd. While using or downloading a separate copy of any part of the content for private or non-commercial use for the purpose of information or use, you may not reproduce, sell, post, distribute, modify, display, use, re-run or otherwise use any part of the content in any other way or for any other purpose without the prior consent of Carpe Diem Co Ltd in writing.

Software. Please note that all software programming, including but not limited to, all HTML and other codes on this site (collectively, “Software”) are owned by Carpe Diem Co Ltd and are protected by copyright law and intellectual property laws, as well as international treaties. Any unauthorised access to the reproduction, retransmission, publication, display, or other use of the software is prohibited by law and the violation is prosecuted under civil and / or criminal law.

Collection and Processing of Personal Data when visiting our Website. When visiting and using our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server, which are technically necessary for us to display our website to you and to guarantee stability and security.

We pass on the data collected to external service providers, contractors (e.g. hosting, content management system) in accordance with the purposes required (for displaying the website and setting up its content).

Cookies. In addition to the aforementioned data, cookies or other technologies like pixels (hereinafter referred to as “Cookies”) are used on your computer when visiting and using our website. Cookies are small text files that are stored by your browser on your device to save certain information or image files, such as pixels. The next time you visit our website on the same device, the information saved in the cookies will subsequently be transmitted either to our website (“First Party Cookie”) or to another website to which the cookie belongs (“Third Party Cookie”).

Through the information saved and returned, the respective website recognises that you have already accessed and visited it with the browser you use on that device. We use this information to be able to design and display the website in an optimum way in line with your preferences. In that respect, only the cookie itself is identified on your device. Beyond this extent, your personal data will only be saved upon your express consent or if it is strictly necessary to be able to use the service offered to and accessed by you accordingly.

This website uses the following types of cookies: * Strictly necessary cookies * Functionality and Performance Cookies * Consent based Cookies (e.g. Marketing)

Opt-out for cookies used for online advertising. You can also manage many companies’ cookies used for online advertising via the consumer choice tools created under self-regulation programs in many countries, such as the US-based https://www.aboutads.info/choices/ or the EU-based http://www.youronlinechoices.com/uk/your-ad-choices.

PRIVACY POLICY

Information about the company processing your data: Name: CARPE DIEM CO LTD VAT: 200392770 Headquarters and management address: Sofia, Dianabad, bl.53, ap.35 Mailing address: Sofia, 77 Kalimantsi Str., ap.8 Telephone: 088 77 852 14 E-mail: info@carpediem.bg Website: www.carpediem.bg

Information on the competent supervisory authority for the protection of personal data Name: COMMISSION FOR PERSONAL DATA PROTECTION Headquarters and management address: Sofia 1680, Krasno Selo district, 50, Gotse Delchev Blvd., fl. 1, office 1 Mailing address: Sofia 1680, Krasno Selo district, 50, Gotse Delchev Blvd., fl. 1, office 1 Telephone: 02 915 3 518 Website: www.cpdp.bg

Carpe Diem Co Ltd (hereinafter referred to as Administrator or Carpe Diem Co) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you of all aspects of the processing of your personal data by the Company and the rights you have in relation to such processing.

Reason for collecting, processing and storing your personal data.”Carpe Diem Co” collects and processes your personal data in connection with the conclusion and execution of contracts with the Company on the grounds of Art. 6, para. 1, Regulation (EC) 2016/679 (GDPR), and in particular on the following grounds:

– To take steps on your request to sign a contract if you are a candidate for work with us; – To execute a contract or take steps to conclude a contract with a trading partner. – Compliance with a statutory duty applicable to the Administrator; – For the purposes of the legitimate interests of the Administrator or a third party.

Goals and principles of collecting, processing and storing your personal data. Upon conclusion of a contract with a trading partner or a commercial company-client we collect and process personal data about the names of the legal representative of the legal person – a party to the contract, for the purpose of individualisation of the party to the contract and its execution. The contact details of the legal representative or contact person shall be official information and as such shall not be considered as personal data. We collect and process the personal data you provide to us by applying for work at Carpe Diem Co, including for the following purposes:

– individualisation of the applicant; – making contact with you and conducting communication; – selection of candidates.

We keep your personal data you have provided to us for the entire duration of the job announcement, and in the event that we would like to continue storing your data after this period for the purpose of further communication with you, we will send you by email, to give your explicit consent that your data will continue to be stored.

We comply with the following principles when processing your personal information: – lawfulness, good faith and transparency; – limitation of the purpose of processing; – relevance to processing goals and minimisation of data collection; – accuracy and timeliness of the data; – restriction of storage in order to achieve the objectives; – integrity and confidentiality of processing, and ensuring an adequate level of security of personal data.

When processing and storing personal data, the Administrator may process and store personal data to protect the following legitimate interests: fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

What kind of personal data collects, processes and stores our company. ”Carpe Diem Co” performs the following operations with the personal data you provide as job applicants for the following purposes:

Conclusion and performance of an employment or civil contract with a physical person: To process a selection of job applicants, we process the personal data you have sent us to your resume.

Conclusion of the Impact Assessment: Given the small volume of data subjects that are processed and given the limited amount of personal data collected, an impact assessment is not necessary for the current operation. The administrator does not collect or process any personal data related to the following:

– reveal racial or ethnic origin; – reveal political, religious or philosophical beliefs, or membership of trade unions; – genetic and biometric data, health data, or data on sexual life or sexual orientation.

The personal data are collected by the Administrator from the persons to whom they refer. The administrator does not make automated decision making with data.

“Carpe Diem Co” carries out the following transactions with the personal data you provide as legal representatives or proxies of legal persons – trading partners and clients for the following purposes:

Concluding and executing a commercial deal with a contractor or a client contract: For the conclusion and execution of a commercial transaction with a trading company, we process only the full names of the legal representative or the person authorised by the company.

Conclusion of the Impact Assessment: Given the small volume of data subjects that are processed and given the limited amount of personal data collected, an impact assessment is not necessary for the current operation. The personal data are collected by the Administrator from the persons to whom they refer also from the Commercial Register to the Registry Agency. The administrator does not perform automated decision making with data.

“Carpe Diem Co” performs the following operations with the personal data provided by you as persons who have made a request through the Company’s website form – https://www.carpediem.bg/en/contact:

Processing queries sent through the form of the websitehttps://www.carpediem.bg/en/contact – the purpose of this operation is to contact the requestor by email for the purpose of responding to the requestor, identifying the subject of the data as an applicant and sending reply to a quote or offer.

Conclusion of the impact assessment: Given the limited scope of the collected personal data, no impact assessment of the operation is necessary. The personal data are collected by the Administrator from the persons to whom they refer. The administrator does not perform automated decision making with data.

Term of storage of your personal data. “Carpe Diem Co” keeps your personal data as a candidate for work for a period no longer than the availability of a current job offer, published on our website or elsewhere. After the expiration of the notice or the completion of the selection, Carpe Diem Co takes the necessary care to erase and destroy all your data without undue delay or to anonymise them (i.e. to bring them in a form that does not reveal your personality), unless you expressly agree that your data will continue to be stored and processed for the future.

“Carpe Diem Co” shall store the personal data of the legal representatives of the legal persons – parties to the contract with the company for an indefinite period, in order to protect the legitimate interest of Carpe Diem Co and fulfil its legal obligations to state bodies and institutions. The Administrator shall notify you in case the period for storing the data needs to be extended in order to comply with a statutory obligation or in view of the legitimate interests of the Administrator or otherwise.

Transmitting your personal data for processing. The administrator may, at its own discretion, transmit all or part of your personal data to processor personal data for the fulfilment of the processing purposes you have agreed to, subject to the requirements of Regulation (EC) 2016/679 (GDPR) . The Administrator notifies you in case of intent to transfer some or all of your personal data to third countries or international organisations.

Your rights in collecting, processing and storing your personal data

Withdrawal of consent to process your personal data. If you do not wish all or any of your personal data to continue to be processed by Carpe Diem Co for any or all processing purposes, you may at any time withdraw your consent to processing by sending a request to free text.

The Administrator may ask you to certify your identity and identity with the person to whom the data relate by requesting you to present an identity document on site. Withdrawal of consent does not affect the merits of processing the personal data you provide until the withdrawal of the consent. “Carpe Diem Co” may continue to process part or all of your data if there is a legal obligation for this or for the purpose of protecting its legitimate interests.

Right of access. You have the right to request and obtain from the Administrator a confirmation that personal data relating to you is being processed. You have the right to access the data relating to you as well as information relating to the collection, processing and storage of your personal data. The Administrator shall provide you, upon request, with a copy of the processed personal data relating to you in electronic or other appropriate form. The provision of access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repeatability or excessive demand.

Right of correction or completion. You have the right to ask the Administrator to correct inaccurate personal data associated with you or to fill in the incomplete personal data associated with you.

Right to delete (“to be forgotten”). You have the right to ask the Administrator to delete any or all personal data related to you and the Administrator has the obligation to delete them without undue delay when any of the following reasons exists:

– personal data are no longer necessary for the purposes for which they were collected or otherwise processed; – you withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing; – you object to the processing of your related personal data, including for the purposes of direct marketing, and there are no legitimate grounds for the processing that will take precedence; – personal data has been tampered with; – personal data must be deleted in order to comply with a legal obligation under EU law or the law of a Member State that applies to the Administrator; – personal data have been collected in connection with the provision of information society services.

The administrator is not obliged to delete the personal data if he / she keeps them and processes them:

– for the exercise of the right to freedom of expression and the right to information; – to comply with a legal obligation that requires treatment provided for under EU law or the law of the Member State that applies to the Administrator or for the performance of a task of public interest or the exercise of official authority conferred on him;

– for reasons of public interest in the field of public health; – for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes; – for the establishment, exercise or protection of legal claims.

In the event that you exercise your right to be forgotten, the Company will delete all your data, except your three names as a candidate for employment, for reporting purposes. The data of the legal representatives of partner companies and clients under contract with the company shall continue to be preserved and processed, despite a request for forgotten, on the grounds of observance of a legal obligation of the company, observance of the legitimate interest and establishment, the protection of legal claims. In order to exercise your right to be forgotten, it is necessary to send a request in free text and to identify yourself with an identity document on the spot.

Right of limitation. You have the right to require the Administrator to restrict the processing of your related data when:

contest the accuracy of personal data for a period that allows the Administrator to verify the accuracy of personal data; processing is illegal, but you do not want personal data to be erased but only to be limited; the administrator no longer requires personal data for the purpose of processing, but you require them to establish, exercise or protect your legal claims; you have objected to the processing pending verification that the legal grounds of the Administrator have an advantage over your interests.

Right of portability. If you have consented to the processing of your personal data or the processing is necessary for the performance of the agreement with the Administrator, or if your data is processed in an automated manner, you may, after you have been identified by the Administrator:

– ask the Administrator to provide you with your personal data in a readable format and transfer it to another Administrator; – ask the Administrator to directly transfer your personal data to an administrator you provide when it is technically feasible.

You may exercise your right of portability by sending a request in free text.

Right to receive information. You may ask the Administrator to inform you of all recipients to whom the personal data for which correction, deletion, or limitation of the processing has been requested has been disclosed. The administrator may refuse to provide this information if this would not be possible or would require disproportionate effort.

Right of objection. You may object at any time to the processing of personal data by the Administrator that relates to you, including if it is being processed for profiling or direct marketing purposes.

Your rights to violate the security of your personal information. If the Administrator detects a breach of security of your personal data that may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the breach and of the measures taken or to be taken. The administrator is not obliged to notify you if:

– has taken appropriate technical and organisational protection measures with respect to the data affected by the security breach; – has subsequently taken measures to ensure that the violation will not lead to a high risk for your rights; – notification would require disproportionate efforts.

Individuals to whom your personal information is provided. For the purposes of processing your personal data and executing the concluded contract, Carpe Diem Co may provide your data to third parties – personal data processors that comply with all the legality and security requirements for the processing and storage of your personal data:

Processing personal data Purpose of the processing of personal data Transport and courier companies Send documents by courier Accounting company Accounting purposes Hosting provider For the purposes of website usage

Other provisions. In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:

Name: COMMISSION FOR PERSONAL DATA PROTECTION Headquarters and management address: Sofia 1680, Krasno Selo district, 50, Gotse Delchev Blvd., fl. 1, office 1 Mailing address: Sofia 1680, Krasno Selo district, 50, Gotse Delchev Blvd., fl. 1, office 1 Telephone: 02 915 3 518 Website: www.cpdp.bg

When assigning Carpe Diem Co Ltd to process personal data to a third party for the purpose of using the service, Carpe Diem Co Ltd acts as a personal data processor.

In the cases Carpe Diem Co Ltd only acts on your instructions as the user of the service and only insofar as it may have control over the personal data you are processing. Carpe Diem Co Ltd. has no control over the content and data that you as the user of the service you choose to upload to the service (including whether or not this data includes personal data). In this case, Carpe Diem Co Ltd does not have a role in the decision-making process whether the user uses the personal data processing service for which purposes and whether they are protected. Accordingly, the responsibility of Carpe Diem Co Ltd in this case is limited to 1) compliance with the instructions of the service user under the contract and 2) provision of information about the service and the functionalities through its interface.

“Carpe Diem Co” Ltd ensures that it will refer to this Mandatory Information with a link to its website, by indicating it or by other appropriate means, ensuring that you have the opportunity to get acquainted with its content.

Date of publication: 20.05.2018