Privacy Notice

What Personal Data We Collect

When you register a user account, request services through the Platform ("Services"), ask us a question, or exercise your rights, we may receive or ask you to provide certain information about yourself.

This information may include:

• Your full name – so we know who you are;
• Email address, phone number – so we can contact you regarding your service request, respond to your inquiry or complaint, or communicate with you for other reasons related to your use of the Platform;
• Date and year of birth, gender – collected when you register an account, if necessary for the use of certain Services;
• Bank card details – required for payments through licensed payment service providers;
• Technical information about the device you use to access our Website (IP address, device type, operating system, etc.) – so we can provide optimal functionality of the Website;
• Cookies – as most websites do, we use cookies. More information is available in our Cookie Policy;
• Any other information you voluntarily provide (at our request or on your own initiative).

By providing the above personal data, you explicitly consent to their processing for the purposes stated in this Notice.

We understand that this information may seem extensive, but we use it to ensure the best possible experience when you use our Services.

When processing your personal data for the purpose of providing Services or complying with legal obligations, the processing is mandatory. Without these data, we cannot provide the relevant Services. In other cases, we will inform you whether the data are necessary and the consequences if you refuse to provide them.

AWAKYA does not collect or process special categories of personal data, such as health data, ethnicity, or political opinions. Any personal information you share with a therapist during the use of the Platform's Services is strictly confidential and accessible only to the therapist you have chosen. Such information is shared solely at your discretion during your communication and is not stored or processed by us. We do not provide it to third parties under any circumstances. We are not responsible for personal data collected or processed by therapists.

How We Collect and Use Your Personal Data

Above, we provided you with a brief explanation of why it is necessary for us to collect each of the categories of your personal data mentioned. Below you will find more detailed information about what we do with the information you provide to us.

First, we process your personal data on the following legal grounds:

• In connection with and for the performance of the contract regarding the use of the Platform, which we conclude with you (please see the Terms of Use of the Platform, published on the Website); or
• For the performance of our obligations arising from a legal act, for example obligations under the Accounting Act, the Tax and Social Security Procedure Code, or when providing information to judicial and other public authorities; or
• Our legitimate interest or the legitimate interest of a third party, except where your interests or fundamental rights and freedoms override such interest. An example of our legitimate interest is corresponding with clients and third parties in relation to their inquiries or for the purpose of offering them the use of our Services;
• Your explicit informed consent, in certain cases — for example, when you register a user profile on the Platform or subscribe to our newsletter to receive promotional emails and offers of our Services; or regarding the use of cookies. Your consent may be withdrawn at any time, after which we will cease to process the data covered by the withdrawn consent.

We use your personal data for one or more of the following purposes:

• To provide you with the Services we offer and that you have requested;
• To provide you with information related to the Services we offer, including marketing messages via telephone, SMS, and email;
• To contact you when you have asked us a question or requested an offer for our Service, or to notify you about important changes in our terms of operation or internal policies, or about data security breaches;
• To carry out our activities in accordance with applicable accounting, tax, and other laws, professional standards, and rules, including fulfilling requests from competent public authorities;
• To improve the Services we provide to you, including for our internal purposes such as audits, analyses, and studies that help us enhance our operations, or to monitor and analyse trends and the usage of our Services, and to improve the design and content of the Platform and the Website so that they optimally meet your preferences and the devices you use;
• In connection with legal claims, as described in the section "How long we store your personal data," as well as for purposes stated elsewhere in this Notice.

We will periodically update the above illustrative list in response to the development of our business and changing legal requirements. We will notify you if we intend or are required to use your personal data for purposes or in a manner significantly different from what we have informed you, and we will seek your consent where necessary.

With Whom We Share Your Personal Data

In the course of our activities, it may be necessary for us to share your personal data with some of the following persons:

• Our professional advisers;
• Public bodies which, by virtue of a legal act, have the authority to request the provision of information, including personal data, such as courts, prosecutors, various regulatory authorities like the Consumer Protection Commission, the Commission for Personal Data Protection, as well as authorities empowered to protect national security and public order;
• Our suppliers or business partners who help us provide the Services to you or assist us in carrying out our activities (including companies engaged by us to maintain the Website, hardware and software, accountants, banks).

Please also note that our Website may contain links to other websites that are not owned or operated by us. We cannot control and are not responsible for the personal data processing practices or the content of such other websites. We strongly recommend that you review the privacy policies and notices of every website that collects personal data. This Notice applies only to the personal information that AWAKYA collects about you through the Website or in another way.

In all cases, we conclude written contracts with the companies we work with, requiring them to take the necessary measures to ensure the protection of your personal information. We will transfer to these counterparties only the information they need in order to provide us with the agreed services, and we do not allow them to use your information for their own purposes. We will not provide your personal data to third parties so that they can send you unsolicited marketing messages, unless you have given the necessary consent for this. If you receive unsolicited commercial communications from companies we work with, please notify us at the following email address: [email protected].

Transfer of Personal Data Outside Bulgaria

All personal data that we process are processed in Bulgaria; however, for hosting purposes, such information may also be stored on servers located outside Bulgaria and the European Economic Area. In such cases, we will take the necessary care to ensure that appropriate safeguards are in place to protect your personal data.

How Long We Store Your Personal Data

We have an internal policy that determines how long we retain your personal data. It is based primarily on the type of information we collect and the purposes for which we collect it. As a general principle, we store your personal data for as long as necessary to achieve the processing purposes for which the data were collected, and for any other permissible and related purpose, or until the expiry of a legally defined retention period (for example, the retention and processing of accounting data and tax control purposes — 11 years).

It is our legitimate interest to retain certain personal information about you until the expiration of the statutory limitation period for the establishment of legal claims (5 years). We will not delete or anonymise your personal data if they are necessary for ongoing judicial or administrative proceedings, or for proceedings related to the review of a complaint submitted by you to us.

How We Protect Your Personal Data

We highly value your privacy and take very seriously the security measures applied to the personal data we collect and store.

We use a variety of physical, electronic, and organisational measures, appropriate to the sensitivity of the information we maintain, in order to protect the personal data you provide to us from unauthorised access, use, or disclosure. For example, we encrypt communications via SSL, encrypt information at rest, use firewalls, access control tools, segregation of duties, and other safeguards. We have adopted policies and procedures and have appointed a Data Protection Officer. We require our suppliers and partners who have access to your personal data to use appropriate measures to ensure the protection and confidentiality of your personal information.

You, however, are also responsible for safeguarding your password and username used to access our websites. Unfortunately, the transmission of information over the Internet or by telephone may not be completely secure despite the measures we take. Therefore, please be aware that the transmission of your personal information via the Internet or by telephone is carried out at your own risk.

Your Rights

In relation to your personal data, you have certain rights towards us, which are granted to you by the Regulation and the applicable legislation. In some cases, certain rights may arise and be exercised only where specific grounds for processing your personal data are present; other rights may be subject to limitations and exceptions under the law.

According to the applicable legislation, you have the following rights:

• The right of access to the personal data relating to you;
• The right to object to the processing of your personal data;
• The right to request the rectification of inaccurate personal data relating to you;
• The right to request the deletion of personal data relating to you ("the right to be forgotten");
• The right to request the restriction of processing of personal data relating to you;
• The right to receive the personal data you have provided to us which concern you and to reuse them by transferring them to another controller ("the right to data portability");
• The right to lodge a complaint with the competent supervisory authority or with the court if your rights have been violated or you have suffered from unlawful processing of your personal data.

When the processing is based on consent given by you, you have the right to withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of processing based on your consent prior to its withdrawal.

Access to Your Personal Data

You have the right to request:

• Information about whether data relating to you are being processed, information about the purposes of such processing, the categories of data, and the recipients or categories of recipients to whom the data are disclosed;
• A statement in an intelligible form containing the personal data relating to you that are being processed, as well as any available information about their source.

If you request it, we will provide you with access to the personal data that are being processed, in the form of a copy. The first copy is free of charge. If you request additional copies, we may charge you a reasonable fee to cover our administrative expenses for preparing them. If you submitted your request electronically, we will provide the information in a widely used electronic format whenever possible, unless you have requested otherwise.

We do not carry out automated decision-making for our clients as a result of automated processing of their personal data.

If we do not process any of your personal data, we will inform you accordingly. If we reject your request for a copy of the data, we will set out the reasons for this decision.

The exercise of your right of access must not adversely affect the rights or freedoms of other individuals, including trade secrets or intellectual property rights, and in particular copyright protecting software. If we determine that such adverse impact may reasonably be expected, we may, with justification, restrict part of the information we provide to you in order to prevent that impact.

If You Object to the Use and Storage of Your Personal Data

You have the right, at any time, to:

• Object to the processing of your personal data where there is a legal basis for doing so; where the objection is justified, we will cease processing your data;
• Object to the processing of your personal data for the purposes of direct marketing (i.e. where, on our initiative, we make offers to you by telephone, email, or post).

If you have objected to the processing of your personal data based on our legitimate interest or the legitimate interest of a third party (or to profiling, if we begin carrying out such profiling and we have informed you of this), we may continue the processing despite your objection if we can demonstrate compelling lawful grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

If data relating to you are used for the purposes of direct marketing, you have the right, free of charge and at any time, to object to their processing for such marketing (which may include profiling insofar as it is related to direct marketing), and we will cease such processing.

If you do not wish to receive information and offers from us regarding our products, including if you want to unsubscribe from our newsletter, please notify us in writing at the following email address: [email protected], stating your name and postal and/or email address. Alternatively, you may indicate your refusal to receive unsolicited commercial messages by clicking the Unsubscribe link located at the bottom of each email.

Correction and Updating of Your Personal Data

If we process incomplete or incorrect data, you have the right, at any time, to request that we:

• Delete, rectify, or block your personal data, the processing of which does not comply with the requirements of the law;
• Notify third parties to whom your personal data have been disclosed of any deletion, rectification, or blocking, except in cases where this is impossible or involves disproportionate effort.

We rely on the accuracy of the personal information you provide to us. If this information changes, please inform us of your up-to-date personal data at the following email address: [email protected].

Deletion of Your Personal Data

You may request the deletion of your personal data if:

• The data are no longer needed for the purposes for which we collected them; or
• You withdraw your consent for us to process your personal data (and no other legal basis exists for us to continue processing them); or
• You object to our processing of your data based on our legitimate interest, and we are unable to demonstrate overriding legitimate grounds for the processing; or
• We are processing your personal data in violation of the Regulation or applicable legislation; or
• Under Bulgarian law applicable to us or under European Union law, we are required to delete your data.

We may refuse to delete your data if they are needed in connection with a legal claim, to comply with our legal obligations, or in other cases provided for by the Regulation.

Restriction of the Processing of Your Personal Data

You may request the restriction of the processing of your personal data if:

• You contest the accuracy of the data, for the period during which we must verify their accuracy; or
• The processing of the data is unlawful, but instead of requesting their deletion, you prefer that their processing be restricted; or
• You object to our processing of your data based on our legitimate interest, while we assess and justify our right to continue the processing;
• We no longer need the data for the specific purpose, but you need them for the establishment, exercise, or defence of legal claims.

When the processing of your personal data has been restricted, we may still continue to process the data with your explicit consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural person, or for important reasons of public interest of the European Union or a Member State.

Right to Data Portability

You may request that we provide your personal data in an organised, structured, commonly used, machine-readable electronic format, only when the following two conditions are met:

• The processing of your personal data is carried out by automated means (i.e., this right does not apply to data processed on paper); and
• The processing is carried out on the basis of (a) your consent, or (b) a contract to which you are a party, or in order to take steps at your request prior to entering into a contract.

You should be aware that exercising the right to data portability does not result in the deletion of your data from our systems. You will continue to be able to use our services even after the data portability operation. Data portability also does not affect the initial retention period applicable to the transferred data. You may continue to exercise your other rights, as provided by law and listed in this Notice, while we continue processing the data.

Right to Lodge a Complaint

If you believe that we are violating the applicable legal framework, we kindly ask you to contact us so that the matter can be clarified. Of course, you also have the right to immediately lodge a complaint with a supervisory authority in the European Union, in the country where you live, work, or where the alleged violation of your rights has occurred.

The supervisory authority for personal data protection in Bulgaria is the Commission for Personal Data Protection, located at: 2 "Tsvetan Lazarov" Blvd., Sofia, postal code 1592.

You may also seek protection of your rights through the court.

Important Information About Exercising Your Rights

How to exercise your rights: To exercise your rights under the Regulation, you may write to us by email at [email protected]; through the contact form on our website; or send your request by post, or deliver it to us in person.

You may exercise your right to withdraw your consent for the processing of personal data in connection with a user profile you have registered on the Platform by writing to us at the contact details listed above with a request for deletion, and we will delete your profile in accordance with your instructions. To unsubscribe from our newsletter, you may write to the contact details listed above or use the Unsubscribe options available in every promotional email.

Requests related to exercising your rights are generally submitted in person or by a duly authorised representative. A request may also be submitted electronically, in accordance with the Electronic Document and Electronic Signature Act. When there are procedural rules under the Personal Data Protection Act or other applicable laws concerning the exercise of your rights, those rules must also be complied with.

In what form will we respond? In the same form in which you submitted your request to us — in writing on paper or in electronic form. When you have submitted a request electronically, we will provide the information in a widely used electronic format, whenever possible, unless you have requested otherwise.

Within what time will you receive a response? Within one month of receiving your request, we will inform you of the actions we have taken. Where necessary, this period may be extended by up to two additional months, taking into account the complexity and number of the requests. If such an extension is required, we will notify you within one month of receiving your request and explain the reasons for the extension.

Concerns regarding your identity: When we have reasonable doubts regarding the identity of the individual submitting the request to us, we may request additional information necessary to confirm the identity of the data subject. If we do not receive such information and are unable to identify the data subject, we may refuse to take action based on the request to exercise any of the rights listed in this Notice.

Children's Personal Information

The protection of children's privacy is of great importance to us, and we exercise particular care when communicating with children. We do not collect personal data of children under the age of 14 and, in all cases, comply with the applicable legal requirements. If you are under the specified age, you are permitted to access internet pages only with the consent of your parents or legal guardians. If you are under 14 years old, you will not be able to make online orders or use other online services on our website that require the processing of your personal data.

We strongly encourage parents to regularly monitor and supervise the online activity of their children. If you are a parent and you have concerns regarding the collection or use of personal information about your child, please contact us using the details provided in the section How to contact us.

How We Will Notify You of Changes to This Notice

We will notify you of any substantial changes to this document through the Website and, where possible, through another appropriate means, so that you are always informed about changes concerning what personal data we collect about you, how we use them, and under what circumstances we share them with other parties. You may be asked to read and accept these changes before continuing to access our websites.

If we wish to use your personal information for purposes or in a manner significantly different from what we have previously informed you, we will also send a message to the email address you have provided. This way, you will have the opportunity to decide whether you accept the changes in the use of your personal information or not.

How to Contact Us

The data controller is "AWAKYA" EOOD, UIC 208329779, with registered office and address: Svoge, postal code 2260, 11A "Chavdar" Street, phone: 0889909031.

Please address all questions, comments, or requests related to this Privacy Notice to the email address [email protected] or to the contact details indicated above.