This document discloses the Privacy Policy and the protection of personal data collected from users and customers of the website with the address (URL) www.mandlteam.com.

The website www.mandlteam.com is owned by Em & El Team Ltd.

This Privacy Policy is intended to inform you about how the owner of www.mandlteam.com treats your personal data as controller, and also about how you could control your preferences and settings in relation to this treatment.

Please read this Privacy and Data Protection Policy carefully before accessing the Site and its services. If you do not agree to any of the terms, you should not visit the Site or use the services it offers in any way.

This Privacy Policy forms an integral part of the Terms and Conditions of Use of www.mandlteam.com, all definitions given in the Terms and Conditions are also applicable in this Privacy Policy.

This Policy is effective from 01.12.2021.

WHAT THESE PRIVACY RULES GOVERN AND ON WHAT LEGAL BASIS THEY APPLY

The General Data Protection Regulation (GDPR) has been adopted by the European Union and aims to harmonise EU Member States' policies relating to the collection and use of personal data. The new regulation comes with a number of requirements that www.mandlteam.com implements. These include:

• To let you know what data we use.
• To let you know why we use them.
• To ask for your consent to use them when we use them to provide additional services such as targeted advertising, for example.
• To give you the opportunity to change your consent for different purposes through this site so that you have more freedom.
• The ability to delete them, and to "be forgotten".
• Identify any third parties/other companies with whom we exchange your data.

Personal data is any specific information relating to you by which you can be identified. For example, such information is your real name, address, telephone number, your passwords to access our website, IP address and the like. Data that cannot be directly or in combination with other data related to your real identity is not considered personal data.

PERSONAL DATA CONTROLLER

In order to comply with the requirements of the applicable data protection legislation, the company responsible for the protection of your personal data as data controller is:

• Name;
• Registered office and registered address. 1527, Sofia, ul. Registered office: 151515, 1527, Stara Planina 31-33;

• Correspondence data. 1527, Sofia, 1527, ul. 151515, Stara Planina 31-33;
• business email for communication with clients: l.vardi@mandlteam.com, contact phone: 0897 56 66 24;
• Supervisors:

(1) Data Protection Commission

Address. Sofia, ul. "Prof. 2,

Email: kzld@government.bg, kzld@cpdp.bg

Website: www.cpdp.bg

The Controller collects and processes all personal data in accordance with the data protection laws applicable in Bulgaria and the European Union.

BASIS FOR COLLECTION OF PERSONAL DATA

The Administrator collects and processes your personal data in connection with the use of the Site www.mandlteam.com, the conclusion of service contracts with the Provider, and the performance of the Administrator's obligations under a contract with you, based on your explicit consent as a customer / user. The consent obtained for the processing of personal data is voluntary and is provided on a case-by-case basis. The consent provided by you for the processing of personal data may be withdrawn at any time by submitting a Consent Withdrawal Form to the Controller. Such form can be found at the end of this section. The withdrawn consent shall have no further effect and shall not affect the lawfulness of the processing of the personal data provided by you prior to the submission of the Consent Withdrawal Form;

WHAT DATA WE COLLECT FROM OUR USERS

Before accessing the services on the Site, you should express your explicit consent to process your personal data in accordance with this Policy.

• The controller shall not collect or store "sensitive" categories of personal data, such as political opinions, ethnic origin, sexual orientation, data concerning the health of the subject, religious or philosophical beliefs, etc.
• Personal data collected by the controller when data subjects contact the controller directly by telephone.

The Administrator's contact telephone number is listed in the "Contact Us" section. When the data subject contacts the Controller by telephone, the Controller collects and stores only the name and contact telephone number of the person, and in certain cases may also collect and store the subject's e-mail address.

Purpose for which the data is collected: this data is stored for the purpose of communicating with the individual and providing more complete information about the services offered by the Controller.

• 3. Personal data collected from the data subject when individuals contact the Controller via a contact form on the website.

When a person sends a message to the Administrator using the contact form, the Administrator collects and stores the person's name, telephone number and e-mail address, as well as the information provided in the message.

Purpose for which the data is collected: the Controller collects and stores the specified information for the purpose of communication with the individual.

• Personal data collected automatically.

On our website we collect data about all visitors, namely:

• IP address;
• Browser identifier;
• A history of the pages you have visited to identify your preferences for certain types of content;
• History of your searches on our pages;
• Device Details. We collect device data, such as information about your computer, phone, tablet or other device you use to access the website. Depending on the device used, this separation data may include information such as your IP address or proxy server, device and application identification numbers, location, browser type, hardware model, Internet service and/or mobile carrier provided, operating system, and system configuration information.

Purpose for which the data is collected: To improve the performance and functionality of the website and produce anonymous statistics on how the website has been used.

• Personal data collected from users/customers at requesting a service and establishing a contractual relationship with the Provider:

• first and last name;
• Email;
• Address;
• Phone;

Purpose for which the data is collected: for the performance of obligations under a service contract and for tax and accounting purposes.

BISCUITS

Most web browsers are set to accept cookies by default. If you prefer, you can choose to set your browser to remove cookies and reject cookies. If you choose to remove cookies or reject cookies, this may affect certain features or services on our site. You can get more information about how the Administrator uses cookies by reviewing the Cookie Policy at www.mandlteam.com.

PURPOSES FOR PROCESSING PERSONAL DATA

The Controller collects and processes the personal data of natural persons that are provided directly by them or collected automatically only for the following purposes:

- For the proper functioning of all services on the Site;

- To contact the person;

- To provide services offered on the Site;

- For the performance of the rights and obligations of the parties under the Agreement;

- To improve the performance and functionality of the Site;

- For accounting purposes;

- For statistical purposes and analysis to improve our services;

- To protect information security;

- To make sure our customers are real and to prevent fraud;

If the purposes change, we will inform you and ask for your explicit consent to process your personal data in accordance with the new purposes.

HOW LONG WE STORE THE INFORMATION

We will not keep your data for longer than is necessary to achieve the purposes for which we process it. If the basis on which we hold your personal data ceases (for example, if we no longer have a legitimate interest in holding your personal data, if the statutory period for holding your personal data has expired or if you have withdrawn your consent to us holding your personal data), we will delete or destroy it securely. The Company will retain your personal data collected through the Site for no longer than is necessary and/or due as required by applicable law.

We apply the following retention periods for different types of personal data according to their purpose, namely:

With regard to enquiries and correspondence by e-mail, the Controller shall retain the personal data and the e-mail messages received for the period necessary to respond to the message received and to satisfy the individual's request, and for a period of one year after the Controller has responded to the message received.

Concerning personal data of persons who have made a telephone enquiry within 1 month of making the telephone enquiry, if the user has not become a customer of the Controller.

Regarding the data in connection with the contractual relationship between the Administrator and the Website User, they are kept for a period of five years after the expiry of the limitation period for the repayment of the public obligation to which they relate, unless the mandatory provisions of the law require the Provider to keep the data of its partners for a longer period (e.g. for the categories of documents that we are obliged to keep under the Accounting Act and/or the Tax and Social Security Procedural Code).

In other cases not mentioned above, the Controller will keep the personal data of the individual for no longer than necessary, taking into account the following criteria, namely:

- whether the Controller undertakes, in order to comply with a legal obligation, to continue processing the personal data of the individual;

- whether there is a contract between the Controller and the individual and the Controller is obliged to continue to process the personal data in order to fulfil the obligations under the contract;

- whether the Controller has a legal basis to continue processing the personal data of the individual.

WHERE WE STORE YOUR PERSONAL DATA

Your personal data that we collect is stored on servers located in Bulgaria.

We retain your personal data for no longer than is necessary to achieve the purposes described above, or until the services and/or the Site are discontinued. Your personal data collected through the Site will be collected, processed, stored, disclosed and destroyed in accordance with applicable Bulgarian and European Union law.

SECURITY MEASURES

The controller has taken a wide range of technical and organisational measures to protect your personal data against loss or other unlawful processing. All our employees are aware of our security policy as provided for in the Data Protection Act. The personal information of our Users is only accessible to a limited number of qualified employees. We regularly review our systems and processes for security. Although we take reasonable measures to maintain a secure site, electronic communications and databases are subject to error, tampering and breaches and we cannot guarantee that such events will not occur and we will not be liable to visitors for any such events.

Should you wish to receive detailed information on the technical and organizational measures, please do not hesitate to contact us.

PERSONAL DATA OF THIRD PARTIES

We only process and use data that you have voluntarily provided to us and we rely on that data being lawfully held and provided by you.

This means that it is the responsibility of each user not to provide the Data Controller with data of third parties in violation of their data protection rights.

Therefore, any person shall bear unlimited personal liability if he or she provides us with data of a third party without his or her knowledge or without obtaining his or her consent in accordance with the requirements of the applicable data protection legislation, regardless of the type of data or the reasons for which it is provided: names, telephone number, e-mail address, and any others.

TO WHOM WE SHARE AND DISCLOSE YOUR PERSONAL DATA

Sometimes we save some of the information on our servers or send it to third parties. This is necessary so that we can provide you with the best experience when using our services, and sometimes in general, so that we can ensure the availability and accessibility of the service you are using.

Your personal data will not be transferred to third parties unless:

• provide us with your explicit, informed and freely given consent;
• the third parties in question provide support to us under contract in order to provide our products or services;
• this is required by law or by virtue of an act of public authority (NRA, Patent Office, Trade Register, etc.);
• this is required in connection with the sale of a business, our company or its assets that are subject to confidentiality.

Our employees and partners are duly informed of the importance of their duty of confidentiality and are responsible for fulfilling this duty.

For any other purposes not specifically mentioned in this Policy, we will ask for your explicit consent, identifying our partners and the purposes for the transfer and sharing of data.

USING Google Analytics and Facebook Pixel

Our website uses the services provided by Google Analytics and Facebook Pixel to analyse and regularly improve the use of our website. The analysis of your user activity on the website is carried out using cookies, which are stored on your computer, generate information about your user behaviour and transmit it to Google and Facebook.

Under normal circumstances, a shortened version of your IP address is sent to Google's servers, but in exceptional cases the full IP address may also be sent. Google uses this information on our behalf to create a report on user activity on our website. The IP address identified by Google Analytics is not combined with other Google data.

If you activate the anonymous mode on this website, your IP address will be forwarded to the Member States of the European Union or other countries that are signatories to the European Economic Area Agreement. In exceptional cases, the full IP address may be transferred to a Google server in the USA and truncated there.

You can refuse the use of cookies by selecting the appropriate settings on your browser, but please note that if you do this you may not be able to use the full functionality of this website

User Terms:

http://www.google.com/analytics/terms/de.html,

https://www.facebook.com/legal/terms

The Data Privacy Statement:

https://www.facebook.com/about/privacy

https://policies.google.com/privacy?hl=bg

RIGHTS OF DATA SUBJECTS UNDER GDPR

Right of access to your personal data. You have the right to request and obtain confirmation from the Data Controller as to whether personal data relating to you is being processed by sending a request in free text or by using the forms located at the end of this section by email.

Right to rectification of personal data: if you find that the personal data we process about you is inaccurate, you have the right to have us rectify that personal data. You may, at any time, correct or complete inaccurate or incomplete personal data relating to you by making a request to the Controller by email, using our form or by making a free text request.

Right to erasure of personal data (right to be forgotten)

You have the right to ask the Controller to erase some or all of the personal data relating to you and the Controller has the obligation to erase them without undue delay where one of the following grounds applies:

- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

- You withdraw your consent on which the processing is based and there is no other legal basis for the processing;

- You object to the processing of personal data relating to you and there are no legitimate grounds for the processing that override;

- personal data have been unlawfully processed;

- the personal data must be erased in order to comply with a legal obligation under EU or Member State law to which the Controller is subject;

In order to exercise your right to be forgotten, you need to send by email a request for deletion of your personal data processed by the Controller by filling in a form or by a free text request.

Right to restrict processing: in certain circumstances, such as if you doubt the accuracy of your personal data or have objected to our legitimate purpose for processing your personal data, you have the right to request that we restrict the processing of your personal data until a solution is found. You have the right to request that the Data Controller restrict the processing of data relating to you by sending us a request in plain text or using an email form where:

- contest the accuracy of the personal data, for a period that allows the Controller to verify the accuracy of the personal data;

- the processing is unlawful, but you do not wish the personal data to be erased, but only for its use to be restricted;

- The controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise or defence of legal claims;

- You have objected to processing pending verification that the legitimate grounds of the Controller override your interests.

Right to data portability. If you have consented to the processing of your personal data or the processing is necessary for the performance of the contract with the Controller, or if your data is processed in an automated manner, you may:

- request the Controller to provide you with your personal data in a readable format and to transfer it to another Controller;

- to request the Controller to transfer your personal data directly to a controller designated by you, where this is technically feasible.

Right to lodge a complaint with a supervisory authority: you have the right to lodge a complaint regarding the processing of your personal data by us with the relevant supervisory authority.

The data subject shall also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her;

The right to a judicial or administrative remedy in the event that the data subject's rights have been violated.

You can exercise all rights by contacting us via email: l.vardi@mandlteam.com . We will contact you and inform you in detail about the procedure for exercising your rights.

Withdrawal of consent form for processing purposes

Your name*: .........................

Your email address you used on the Site*: .........................

Feedback data (e-mail)*: .........................

To

Picture name: ...........

Registered office and management address:

Phone:

E-email:

Site:

I hereby withdraw my consent to the processing of the personal data I have provided for the purposes of receiving newsletters, promotional communications or other marketing materials, and I am aware of the conditions for withdrawal of consent in accordance with the Mandatory Information on the Rights of Individuals on the Protection of Personal Data on the Site.

In the event of a breach of your rights under the above or applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority data protection supervisory authority.

Request "to be forgotten" - to delete personal data relating to me

Your name*: .........................

Your email that you registered with or used to place orders on the Site*: .........................

Feedback data (e-mail)*: .........................

To

Picture name: ...........

Registered office and management address:

Phone:

E-email:

Site:

I request that all personal data that you collect, process and store, provided by me or by third parties who are related to me, according to the indicated identification, be deleted from your databases.

I declare that I am aware that some or all of my personal data may continue to be processed and stored by the Controller for the purpose of fulfilling its legal obligations.

In the event of a breach of your rights under the above or applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority data protection authority.

Request for portability of personal data

Your name*: .........................

Your email that you registered with or used on the Site*: .........................

Feedback data (e-mail)*: .........................

To

Picture name: ...........

Registered office and management address:

Phone:

E-email:

Site:

I request that all personal data relating to me that is collected, processed and stored in your databases be sent in the following format XML to:

e-email: .........................

Data Receiving Administrator: .........................

Picture name: .........................

Identification number (UIC): .........................

E-email: .........................

In the event of a violation of your rights under the above or applicable data protection law, you have the right to file a a complaint to the relevant supervisory authority data protection supervisory authority.

Request for correction of data

Your name*: .........................

Your email that you registered with or used on the Site*: .........................

Feedback data (e-mail)*: .........................

To

Picture name: ...........

Registered office and management address:

Phone:

E-email:

Site:

I request that the following personal data that you collect, process and store, provided by me or by third parties related to me, be corrected as follows:

Data subject to correction:

..................................................

Please be corrected as follows:

..................................................

In the event of a breach of your rights under the above or applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority.