Personal Data Protection

This Privacy Notice is intended to provide you with information about what personal data EKO BULGARIA EAD processes about you and how it is used. If you have any questions, please contact us at: office@eko.bg or at: Litex Tower, floor 9, 3, Lachezar Stanchev Street, Izgrev Region, Sofia 1797, Republic of Bulgaria;

If you wish to confirm that EKO BULGARIA EAD processes your personal data, or to have access to the personal data EKO BULGARIA EAD may have about you, please contact us at office@eko.bg.

INTRODUCTION

EKO petrol stations are managed by EKO Bulgaria EAD. The company entered the Bulgarian market in July 2002 and to date operates 95 petrol stations throughout the country.

EKO Bulgaria is part of HELLENiQ ENERGY - the biggest Industrial and Commercial Corporation in Greece, which has a key role for the development of energy sector in the Southeast region.

The successful development of EKO gas stations is due to the main mission - customers to receive products of proven quality and the best possible service at the sites of the chain.

EKO Bulgaria EAD Data Protection Officer (DPO) –

Contact Details:

Desislava Vasileva

E-mail: office@eko.bg

contact telephone: +359 2 448 5500

Address: Sofia 1797, Izgrev District, 3, Lachezar Stanchev Str., Litex Tower Complex

CATEGORIES OF CONCERNED INDIVIDUALS (DATA SUBJECTS) AND PURPOSES OF DATA PROCESSING

For the performance of its activities EKO BULGARIA EAD processes personal data of the following main categories of Data Subjects, apart from the data subjects whose data is processed within internal employment and corporate relations:

INDIVIDUALS – visitors at EKO petrol stations; retail clients upon issuance of invoices to individuals in their personal capacity, participants in marketing initiatives.
STATUTORY AND/OR AUTHORIZED REPRESENTATIVES, OWNERS, CONTACT PERSONS АND PERSONS DELIVERING DOCUMENTS OF CORPORATE CLIENTS for wholesale and retail; as well as OF ANY ORGANIZATION that has a contractual relationship with EKO BULGARIA EAD (including lessees, lessors and holders granting us limited property rights).
EMPLOYEES OF THE ABOVE WHOLESALE AND RETAIL CLIENTS using Fleet Cards – upon the issuance of Fleet Cards and fuel and gas purchases.
INDIVIDUALS PERFORMING TRANSPORTATION OF GAS, FUELS AND/OR BITUMEN (including but not limited to drivers only)
BUSINESS CONTACTS
JOB APPLICANTS
VISITORS OF THE FACEBOOK PAGE OF EKO PETROL STATIONS
VISITORS OF THE INSTAGRAM PROFILE OF EKO PETROL STATIONS
VISITORS OF THE LINKEDIN PROFILE OF EKO PETROL STATIONS
VISITORS OF THE YOUTUBE PROFILE OF EKO PETROL STATIONS
MEMBERS OF THE VIBER CHANNEL OF EKO PETROL STATIONS
INDIVIDUALS – PARTICIPANTS IN FACEBOOK GAMES ORGANIZED BY EKO BULGARIA
INDIVIDUALS – PARTICIPATING IN INSTAGRAM GAMES AND GIVEAWAYS ORGANIZED BY EKO BULGARIA
INDIVIDUALS ATTENDING EVENTS ORGANIZED FROM EKO PETROL STATIONS
INDIVIDUALS – IN RELATION TO EKO SMILE LOYALTY PROGRAMME AND EKO SMILE WEBSITE;

HOW, WHY AND WITHIN WHAT TERMS WE PROCESS YOUR PERSONAL DATA

The below information applies both to Data Subjects who have provided their personal data to EKO BULGARIA EAD by themselves and to those whose personal data have been provided to EKO BULGARIA EAD by third parties (e.g. their employers).

EKO BULGARIA EAD, UIC 130948987, with seat and management address at: Litex Tower, Floor 9, 3, Lachezar Stanchev Street, Izgrev District, Sofia 1756, Republic of Bulgaria, represented by Andreas Triantopoulos in his capacity of Executive Director (“EKO BULGARIA”), in its capacity of personal data controller processes personal data, as follows:

INDIVIDUALS – visitors at EKO petrol stations; retail clients upon issuance of invoices to individuals in their personal capacity, participants in marketing initiatives.

EKO BULGARIA processes the following categories personal data of individuals:

(a) data collected during participation in marketing initiatives, namely: name; address for correspondence; date of birth; email address; phone number; signature; photo; data from cash receipts.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration of games and marketing campaigns;

- direct marketing through sending products, messages for products, promotional terms and conditions, campaigns, newsletters and other advertising materials related to the business activity of EKO BULGARIA, as well as for research of the cardholders opinion by sending them invitations for participation at different marketing researches;

- processing of complaints and applications for exercising the rights of the Data Subjects in connection with their Personal Data; accounting and taxation; protection in filing legal claims.

This processing is based on the fulfilment of pre-contractual and contractual obligations undertaken by EKO BULGARIA in relation to the specific legal relations.

This processing is also based on EKO BULGARIA’s legitimate interest to promote its goods and services to clients and keep the high level of quality of its goods and services.

The term of processing of data contained in marketing databases is up to 10 years after the end of the marketing campaign.

Whom we may provide your personal data to?

EKO BULGARIA may disclose your personal data only to the extent necessary to electronic service providers for maintenance of the electronic communication system, providers of services for the maintenance of marketing databases and systems, providers of external marketing services, providers of information storage services, external expert accountants, external legal advisers. Your personal data can also be processed by our partner who manages the respective petrol station where you provide them.

We may provide your personal data to competent authorities upon their due request and in compliance with all statutory requirements with this regard.

(b) data needed for the issuance of invoices to individuals - clients, namely: three names, personal identification number, address, signature, as well as the motor vehicle registration number, specified in the motor vehicle registration certificate - for natural persons, users of state compensation for fuels, provided for in the State Budget Act of the Bulgarian Republic for 2022.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- execution of pre-contractual, contractual and statutory obligations and accountancy and taxation (including issuance of invoices).

This data processing is on the grounds of EKO BULGARIA’s pre-contractual and contractual obligation to serve its clients and the company’s statutory obligations related to accountancy and taxation.

Your personal data listed in this item are processed by EKO BULGARIA for the following terms:

- data contained in accounting registers and financial statements: 11 years;

- data contained in documents subject to tax audits and needed for accounting purposes: 11 years;

- data contained in documents needed for the performance of contractual relations: up to 6 years after termination of the respective contract or until closure of dispute related procedures.

- data processed in relation to the compliance with statutory obligations – within the applicable statutory terms.

Whom we may provide your personal data to?

For the issuance of invoices, your personal data may only be disclosed, to the extent necessary, to external expert accountants, external legal advisers, service providers for maintenance of the electronic communication system, accounting system maintenance service providers.

Your personal data can also be processed by our partner who manages the respective petrol station where you provide them.

We may provide your personal data to competent authorities upon their due request and in compliance with all statutory requirements with this regard.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- monitoring for security purposes;

- processing of complaints and applications for exercising the rights of the Data Subjects in connection with their Personal Data;

- protection when filing legal claims.

This data processing is on the grounds of the pre-contractual, contractual and statutory obligations of the Company in connection with the respective legal relations, as well as the legitimate interest of EKO BULGARIA to ensure security and safety of its property.

Your personal data listed in this item are processed by EKO BULGARIA for the following terms:

- data contained in video recordings: up to 2 months;

- data contained in video recordings when an accident has occurred: 6 years or until the completion of dispute procedures, if any.

Whom we may provide your personal data to?

Your personal data may only be disclosed to the extent necessary to our partner managing the respective petrol station.

We may provide your personal data to competent authorities upon their due request and in compliance with all statutory requirements with this regard.

(d) data of visitors at EKO petrol stations in case of damages and of owners of vehicles related to the caused damages, namely: three names, PIN, signature, address, telephone number, ID card data: ID card number, date of issue and validity, data contained in copies of an identity card, driving license, driver's liability insurance and insurance policy and / or visitors' liability insurance, bank account details, vehicle’s registration number. It is also possible to process special category of personal data contained in medical documents and others, such as information about performed medical examinations, health status.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- fulfillment of insurance rights and obligations;

- accounting and taxation;

- processing of complaints.

This data processing is on the grounds of the pre-contractual, contractual and statutory obligations of the Company, as well as the legitimate interest of EKO BULGARIA to ensure security and safety of its property and to ensure the prevention of incidents.

Your personal data listed in this item are processed by EKO BULGARIA for the following terms:

- data contained in the accounting registers and financial statements: 11 years;

- data contained in documents subject to tax audits and required for accounting purposes: 11 years;

- data contained in documents necessary for the performance of contractual obligations: up to 6 years from the date of termination of the respective contract or until the completion of the procedures related to possible disputes;

- data contained in other insurance-related documents: 6 years after the accident or until the end of dispute procedures, if any;

- data collected in connection with the performance of statutory obligations - within the statutory time limits.

Whom we may provide your personal data to?

Your personal data may be disclosed, only to the extent necessary, to insurance companies, our contractors or subcontractors, external legal advisers, external expert accountants. Your personal data may also be processed by our partner who manages the respective petrol station where you provide them.

We may provide your personal data to competent authorities upon their due request and in compliance with all statutory requirements with this regard.

STATUTORY AND/OR AUTHORIZED REPRESENTATIVES, OWNERS, CONTACT PERSONS AND PERSONS DELIVERING DOCUMENTS OF CORPORATE CLIENTS for wholesale and retail, as well as of ANY ORANIZATION which has contractual relations with EKO BULGARIA EAD (including lessees, lessors and holders granting us limited property rights)

(jointly referred to the “Contractors”).

EKO BULGARIA processes the following categories personal data of its Contractors:

(a) minimum required personal data needed for the signing of the respective contract – three names, personal identification number, signature. Data contained in ID card are to be used only if the contract is signed with notary verification or is signed by authorized representative via notary verified power of attorney.

(b) Personal data for official contact during the performance of the contract - this information is limited to the kinds of information that can be found on a business card: first name, last name, job title, employer name, work address, work email and work phone number. It is possible to also process information for professional qualification.

(d) data concerning employees of our partners who manage petrol stations: data under item (a) and data on economic identity such as general economic status and personal data contained in distraint orders or other documents related to enforcement, remuneration and other personal income; special categories of health-related data contained in sick leave documents and expert decisions of labor expert medical commissions. In these cases, EKO BULGARIA acts as a processor of personal data on behalf of its partners who manage the petrol stations.

(e) data of beneficial owners, legal or authorized representatives, contract persons and persons delivering documents of Contractor (applicable upon anti-money laundering measures application): three names, signature, date and place of birth, personal identification number or other official identification number, or another unique element for certification of identity, citizenship, country of permanent residence and exact address, copy of an identity document containing photo, address for shipping if necessary; professional activity, purpose and nature of business relationships, information on the origin of funds, bank and other references; special category of data: information on whether they are prominent political figures.

We receive from our Contractors such personal data (contact information) of employees or other individuals assigned by our Contractors or their subcontractors, as contact persons for the respective contract. Our Contractors providing us the data are also personal data controllers of the data and are responsible to provide the respective Data Subjects with all needed information with this respect. Furthermore, our Contractors are obliged to ensure the accuracy of this data and to keep it up-to date all the time. This means that if any data provided to us is changed or no longer accurate, we need to be duly informed on this as soon as practically possible. Until receiving such notice, we assume that the provided contact related data are accurate and we may use it for the purposes below.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- execution of pre-contractual and contractual obligations, property management, administration of contracts (incl. accountancy and taxation), control over the performance and debt collection, legal claims defence;

- donations;

- accounting and taxation;

- compliance with statutory requirements applicable towards the respective contract and/or towards EKO Bulgaria.

The legal basis for this processing is the performance of the pre-contractual and contractual obligations of EKO BULGARIA and its statutory obligations, e.g. for ensuring anti-money laundering measures regarding the data under letter (e) above, accountancy and taxation, etc.

All of the personal data listed in this section are processed by EKO BULGARIA for the following terms:

- data contained in documentation related to payrolls, originals of unclaimed employment record books, records and certificates: 51 years;

- data contained in accounting registers and financial statements: 11 years;

- data contained in documents subject to tax audits and needed for accounting purposes: 11 years;

- data contained in documents needed for the performance of contractual relations: up to 6 years after termination of the respective contract or until closure of dispute related procedures;

- data processed in relation to the compliance with statutory obligations – within the applicable statutory terms.

Whom we may provide your personal data to?

We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our goods and services, such as our partners managing our petrol stations, accountants, auditors, lawyers, IT, software and hardware service providers and other service providers, contractors for the purposes of the statutory required checks we perform under the anti-money laundering legislation, all competent authorities, if duly requested and as far as it is needed. We also may share the above personal data with our Headquarters represented by Hellenic Petroleum Holdings S.A., Greece.

EMPLOYEES OF OUR CORPORATE CLIENTS USING FLEET CARDS

EKO BULGARIA processes the following categories personal data of Fleet Cards holders:

(a) the names of employees or other individuals stipulated by its corporate clients using personalized Fleet Cards.

Purpose, legal basis and term of processing

These personal data are processed only for the purpose of issuance and administration of Fleet Cards and fulfillment of the contractual obligations of the Company. The processing is on the legal basis of execution of EKO BULGARIA’s pre-contractual and contractual obligations to its clients and its statutory obligations, e.g. for accountancy and taxation.

These data are used by us only for the term of validity of the respective Fleet Card.

We receive these personal data from our corporate clients. That is why they are responsible to provide the Data Subjects with all needed information with this respect. Furthermore, our corporate clients are obliged to ensure the accuracy of this data and to keep it up-to date all the time. This means that if any data provided to us is changed or no longer accurate, we need to be duly informed on this as soon as practically possible. Until receiving such notice, we assume that the provided contact related data are accurate and we may use it for the purposes below.

Whom we may provide your personal data to?

EKO BULGARIA provides the above personal data to our service provider assigned to issue the plastics of the Fleet Cards, as well as to competent authorities upon their due request and in compliance of all statutory requirements with this regard.

(b) location of fuel loading, amount and price of the loaded fuel by each fleet card holder, provided upon request of the respective corporate client – this data processing EKO performs as a data processor under the assignment of its corporate clients (the data controllers for these data).

Purpose, legal basis and term of processing

These personal data are processed by us only for the purposes of our corporate clients who ordered the Fleet Cards and the services related to them.

The processing is on the legal basis of execution of EKO BULGARIA’s contractual obligations with its clients and the statutory obligations for accountancy and taxation.

We use the above data for the following terms only:

- the term of validity of the respective Fleet Card; or

- the term of validity of the agreement that we have with our corporate client; or

- within the applicable statutory terms, if any (e.g. such applicable for accountancy and taxation).

As far as our corporate clients are the data controllers of these data, they are responsible to provide the Fleet Card holders with all needed information details with respect to their personal data processing.

Whom we may provide your personal data to?

EKO BULGARIA provides the above personal data to our corporate clients in fulfilment of its contractual relations with them, to our providers of hardware and software for usage of the Fleet Cards and/or for accounting purposes, to other companies from the Hellenic Petroleum group of companies, to which EKO BULGARIA belongs (only to EU Member States), as well as to competent authorities upon their due request and in compliance of all statutory requirements with this regard.

INDIVIDUALS PERFORMING TRANSPORTATION OF GAS, FUEL AND/OR BITUMEN (including but not limited to drivers)

EKO BULGARIA processes the following categories personal data of individuals-drivers assigned to transport gas and/or fuels and/or bitumen in any possible way and by any possible person, for example by transportation company under assignment from EKO BULGARIA or by client of EKO BULGARIA:

(a) three names, telephone number, email address; personal identification number/date of birth;

(b) professional experience, professional qualification, including data contained in ADR certificates, number and period of validity of the driving license, data contained in copies of driving licenses, GPS data, data contained in criminal records.

Where do we have the personal data from

Your personal data are provided to us by your employer or contractor under civil contract.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- for the execution and performance of the contract under which EKO BULGARIA or its client have assigned transportation services, as well as for the compliance with and performance of EKO BULGARIA’s statutory obligations with this regard.

- for the purpose of control over the fulfillment of contractual obligations, for accounting and taxation, collection of debts, protection in case of legal claims.

The basis for this processing is the fulfillment of pre-contractual, contractual and statutory obligations of the Company.

We also may process your personal data based on our legitimate interest to assign the transportation services which we need to reliable partners.

The term within which EKO BULGARIA will process your personal data is limited to the term for which such processing is justified. For example, as regards personal data which may be contained in accounting documents which we have to keep by law, this term is 11 years. On the other hand, we will keep personal data contained in documents needed for the performance of contractual relations for up to 6 years after termination of the respective contract or until closure of dispute related procedures.

When applicable, the data will be processed for a term not less than the term required by law.

Whom we may provide your personal data to?

Your personal data may be disclosed, only to the extent necessary, to providers of electronic communication systems maintenance and software systems maintenance services used by the Company, other system maintenance service providers used by the Controller for the purposes of the processing of Personal Data, transportation service providers, other contractors involved in fuel and gas transportation or supplies, where required by law, external expert accountants, external legal advisers, our partners, who manage the respective petrol stations, other companies from the Hellenic Petroleum group of companies to which EKO BULGARIA belongs (only to EU Member States), as well as of the competent authorities upon due request and in compliance with all legal requirements in this regard.

BUSINESS CONTACTS

If you have provided any employee of EKO BULGARIA with your business contact information via your business card or in any other way or this information is publically available, please note that it is possible that EKO BULGARIA has included this information of you in its business contacts list.

The above means that in case of business need, for the purpose of sending you holiday greetings or for the purpose of providing you with information about our services, EKO BULGARIA may contact you but only in your official capacity in which we have your contact information.

EKO BULGARIA provides all necessary protections to its database with business contacts as for all other personal data.

If you do not wish EKO BULGARIA to contact you as described above, please inform us at any of our addresses listed in the present notice and your contact information will be deleted from our business contacts database.

Whom we may provide your personal data to?

EKO BULGARIA respects and protects the confidentiality of your personal data. In compliance with the statutory requirements, we may share personal data with our service providers (for example accounting, auditing, legal services), other contractors involved in fuel / gas or bitumen transportation or supply processes (for example our clients to which we provide deliveries by you and/or companies to which the management of petrol stations EKO BULGARIA is assigned), or with other companies from the Hellenic Petroleum group of companies to which EKO belongs (in EU member states only).

We may provide your personal data to competent authorities upon their due request and in compliance with all statutory requirements with this regard.

JOB APPLICANTS

EKO BULGARIA processes personal data of individuals contained in the CVs of job applicants received from EKO BULGARIA via post, email or otherwise.

Where do we have the personal data from

Your personal data is provided to us by you or by recruitment service providers.

Purpose, legal basis and term of processing

We use the above data only for recruitment purposes.

The basis for this processing is the legitimate interest of the Company to ensure future staffing needs.

The term in which EKO BULGARIA will process personal data contained in the professional CVs of job applicants invited to a job interview: within 6 months after the completion of the specific selection procedure for which they were initially collected, and in case the data have not been received on the occasion of a specific job advertisement (specific selection procedure), will be stored for up to 6 months from their receipt.

EKO BULGARIA will process personal data contained in the professional CVs of the uninvited job applicants: until the completion of the specific selection procedure for which they were initially collected.

Whom we may provide your personal data to?

Your personal data may only be disclosed, to the extent necessary, to service providers for the maintenance of human resources administration software systems, the recruitment process and / or for accounting purposes, to external expert accountants, to recruitment service providers.

USE OF THE EKO.BG WEBSITE

As is true of most other websites, EKO BULGARIA’s website collects certain information automatically and stores it in so called log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other information about the use of our website, including a history of the subsections you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences. EKO BULGARIA’s website also uses cookies and web beacons. They do not track users when they cross to third party websites, do not provide targeted advertising to them, and therefore does not respond to Do Not Track (DNT) signals.

You may find more information on how EKO BULGARIA may process

your personal data on our website:

https://www.eko.bg/company/eko-b-lgariya/group-policy-for-personal-data-protection/

INFORMATION ABOUT THE PERSONAL DATA PROCESSING DURING AND IN RELATION TO VISITING THE FACEBOOK PAGE OF EKO BULGARIA EAD

The Facebook page of EKO petrol stations https://www.facebook.com/EKOstations/ (hereinafter the “Facebook Page”) is created to facilitate the communication between the management of EKO Bulgaria EAD and the clients and visitors to its petrol stations, for the promotion of goods, services, games, events and other ongoings and campaigns organized by us or our partners. Our Facebook Page also aims to provide the consumers with the opportunity to share their opinions and assess the quality of the products and services offered at EKO petrol stations.

For the performance of the activities mentioned above, EKO Bulgaria EAD processes personal data of the following main categories data subjects:

VISITORS OF THE FACEBOOK PAGE OF EKO PETROL STATIONS

EKO Bulgaria processes the following categories personal data of its Facebook page visitors:

(a) data, contained in their Facebook profile, namely: first name and family name; gender; date of birth; email address, telephone number, in case and to the extent that the visitor has shared publicly these data in his/her Facebook profile.

(b) other data, published in the Facebook page of Eko petrol stations by visitors, namely: photos, videos, comments, personal messages and all other types of posts made by the visitor in our Facebook Page.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration and management of the Facebook Page of EKO Bulgaria;

- administration of any comments and complaints of our customers made through our Facebook Page.

EKO Bulgaria processes this personal data on the basis of its legitimate interest in promoting and advertising its activities, including those carried out at EKO petrol stations.

When you publish information or upload pictures/videos at the Facebook Page of EKO petrol stations or post a comment to any of our posts, the information you have published and your Facebook identification name become publically available. This information could be accessed by anyone who is visiting the Facebook Page.

EKO Bulgaria is not responsible for the way these third parties use the information you posted on our Facebook page.

When you participate in discussion on our Facebook Page (including through personal messages), we strongly recommend that you avoid sharing personal data that can be used to identify yourself directly, such as your name, age, address, and phone.

EKO Bulgaria is not responsible for the protection of the information you have posted on the Facebook page.

The processing term for these purposes is until the deletion of the specific article or post.

INDIVIDUALS PARTICIPATING IN GAMES ORGANIZED BY EKO BULGARIA IN FACEBOOK

EKO Bulgaria processes the following categories personal data of individuals who registered themselves to participate in games, organized by us (including such organized by EKO Bulgaria together with our partners) in the Facebook Page:

(a) data for physical identity: first name and family name; gender; email address; telephone number; address;

(b) data related to games’ participation: data contained in photos and/or videos; comments and other social media posts.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration of games and events, including contacting the winning participants, awarding prizes, conducting mandatory accounting and taxation;

- we may also (but not necessary) use the above personal data for direct marketing of any activities, initiatives and campaigns organized by EKO Bulgaria and its partners, including. This purpose for processing of your personal data also includes sending newsletters and various advertising messages but only for our activities, related to the goods and services offered by EKO Bulgaria.

EKO Bulgaria processes this personal data on the basis of its legitimate interest to promote and advertise its goods, services and activities including those carried out at EKO petrol stations as well as on the basis of the contractual obligation of EKO Bulgaria to award prizes to the winning participants.

The processing of your personal data for these purposes is limited by the following terms:

- for the purposes of administering the specific campaign/event your personal data will be processed for a maximum of 7 (seven) days after the expiration of the term for receiving the awards from the game (including on paper);

- data contained in documents, necessary for the execution of contracts - up to 6 (six) years after termination of the respective contract or until closure of dispute related procedures;

- data contained in accounting registers and financial statements and/or data contained in documents subject to tax audits and needed for accounting purposes – up to 11 (eleven) years.

Information on how to exercise your right to object to direct marketing, can be found in the What Are Your Rights section below.

INDIVIDUALS ATTENDING EVENTS ORGANIZED AT THE PREMISES OF EKO PETROL STATIONS

EKO Bulgaria processes the following categories personal data of individuals who have attended events, organized at EKO petrol stations or by EKO Bulgaria at other locations:

(a) data for physical identity: data contained in photos and/or videos.

Purpose, legal basis and term of processing

EKO Bulgaria may post on its Facebook page photos of events organized at EKO petrol stations or by EKO Bulgaria at other locations.

The processing of your personal data in this case is based on EKO Bulgaria’s legitimate interest to promote the organized events and communicate their conduct.

If you do not want photos/videos of you to be published on our Facebook Page, you have the right to object to the processing of these data and EKO Bulgaria will ensure that the respective posts are removed from the Facebook Page.

Information on how to exercise your rights, including how to object, can be found in the What Are Your Rights section below.

The term of this processing is until the specific article or post is deleted.

WHO WE CAN SHARE YOUR DATA WITH

EKO Bulgaria tends to organize increasingly interesting and interactive games, and for this purpose, EKO Bulgaria may assign any of the above-mentioned activities of personal data processing to marketing agencies and IT service providers (including such providing software and hardware solutions) ensuring data protection and lawful processing. We may also provide personal information to our partners, if this is necessary for the provision of game prizes (including couriers and co-organizers of games).

USE OF THE FACEBOOK PAGE OF EKO BULGARIA

Like any Facebook page, ours also follows the general rules on personal data protection that Facebook provides.

With this regard, we want to remind you that the information you share through your Facebook account is automatically owned by Facebook Inc. or the Irish subsidiary Facebook Ireland Limited. Facebook has the right to process and store this information until you delete your account.

At the same time, Facebook does not allow companies managing Facebook pages to specify storage terms for the information you send them through messages. Thus, sending information via personal message to the Facebook Page of EKO petrol stations implies higher risks for your personal data as we could not guarantee where and how long your personal data are stored.

For this reason, each data subject has the freedom to provide us with information through alternative means which are under our control, for example by email to: office@eko.bg.

INFORMATION ABOUT THE PERSONAL DATA PROCESSING DURING AND IN RELATION TO VISITING THE INSTAGRAM PROFILE OF EKO BULGARIA EAD

The Instagram profile of EKO petrol stations https://www.instagram.com/eko.bulgaria/ (hereinafter the “Instagram Profile”) is created to facilitate the communication between the management of EKO Bulgaria EAD and the clients and visitors to its petrol stations, for the promotion of goods, services, games, events and other ongoings and campaigns organized by us or our partners. Our Instagram Profile also aims to provide the consumers with the opportunity to share their opinions and assess the quality of the products and services offered at EKO petrol stations.

For the performance of the activities mentioned above, EKO Bulgaria EAD processes personal data of the following main categories data subjects:

VISITORS OF THE INSTAGRAM PROFILE OF EKO PETROL STATIONS

EKO Bulgaria processes the following categories personal data of its Instagram Profile visitors:

(a) data, contained in their Instagram profile, namely: first name and family name; gender; date of birth; email address, telephone number, in case and to the extent that the visitor has shared publicly these data in his/her Facebook profile.

(b) other data, shared with the Instagram Profile of EKO petrol stations by visitors, namely: photos, videos, comments, personal messages and all other types of posts made by the visitor in our Instagram Profile.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration and management of the Instagram Profile of EKO Bulgaria;

- administration of any comments and complaints of our customers made through our Instagram Profile.

EKO Bulgaria processes this personal data on the basis of its legitimate interest in promoting and advertising its activities, including those carried out at EKO petrol stations.

When you share information or pictures/videos with the Instagram Profile of EKO petrol stations or post a comment to any of our posts, the information you have published and your Instagram identification name become publically available. This information could be accessed by anyone who is visiting the Instagram Profile.

EKO Bulgaria is not responsible for the way these third parties use the information you shared with our Instagram Profile.

When you participate in discussion on our Instagram Profile (including through personal messages), we strongly recommend that you avoid sharing personal data that can be used to identify yourself directly, such as your name, age, address, and phone.

EKO Bulgaria is not responsible for the protection of the information you have shared with the Instagram Profile.

The processing term for these purposes is until the deletion of the specific article or post.

INDIVIDUALS PARTICIPATING IN GAMES ORGANIZED BY EKO BULGARIA IN INSTAGRAM

(a) data for physical identity: first name and family name; gender; email address; telephone number; address;

(b) data related to games’ participation: data contained in photos and/or videos; comments and other social media posts.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration of games and events, including contacting the winning participants, awarding prizes, conducting mandatory accounting and taxation;

The processing of your personal data for these purposes is limited by the following terms:

- data contained in documents, necessary for the execution of contracts - up to 6 (six) years after termination of the respective contract or until closure of dispute related procedures;

- data contained in accounting registers and financial statements and/or data contained in documents subject to tax audits and needed for accounting purposes – up to 11 (eleven) years.

Information on how to exercise your right to object to direct marketing, can be found in the What Are Your Rights section below.

WHO WE CAN SHARE YOUR DATA WITH

USE OF THE INSTAGRAM PROFILE OF EKO BULGARIA

Like any Instagram Profile, ours also follows the general rules on personal data protection that Facebook provides.

With this regard, we want to remind you that the information you share through your Instagram Profile is automatically owned by Meta Platforms Inc. or the Irish subsidiary Meta Platforms Ireland Limited. Instagram has the right to process and store this information until you delete your account.

At the same time, Instagram does not allow companies managing Instagram Profiles to specify storage terms for the information you send them through messages. Thus, sending information via personal message to the Instagram Profile of EKO petrol stations implies higher risks for your personal data as we could not guarantee where and how long your personal data are stored.

For this reason, each data subject has the freedom to provide us with information through alternative means which are under our control, for example by email to: office@eko.bg.

INFORMATION ABOUT THE PERSONAL DATA PROCESSING DURING AND IN RELATION TO VISITING THE LINKEDIN PROFILE OF EKO BULGARIA EAD

The LinkedIn profile of EKO petrol stations https://www.linkedin.com/company/eko-bulgaria/ (hereinafter the “LinkedIn Profile”) is created to facilitate the communication between the management of EKO Bulgaria EAD and the clients and visitors to its petrol stations, for the promotion of goods, services, games, events and other ongoings and campaigns organized by us or our partners. Our LinkedIn Profile also aims to provide the consumers with the opportunity to share their opinions and assess the quality of the products and services offered at EKO petrol stations.

For the performance of the activities mentioned above, EKO Bulgaria EAD processes personal data of the following main categories data subjects:

VISITORS OF THE LINKEDIN PROFILE OF EKO PETROL STATIONS

EKO Bulgaria processes the following categories personal data of its LinkedIn Profile visitors:

(b) other data, shared with the LinkedIn Profile of EKO petrol stations by visitors, namely: photos, videos, comments, personal messages and all other types of posts made by the visitor in our Instagram Profile.

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- administration and management of the LinkedIn Profile of EKO Bulgaria;

- administration of any comments and complaints of our customers made through our LinkedIn Profile.

EKO Bulgaria processes this personal data on the basis of its legitimate interest in promoting and advertising its activities, including those carried out at EKO petrol stations.

When you share information or pictures/videos with the LinkedIn Profile of EKO petrol stations or post a comment to any of our posts, the information you have published and your LinkedIn identification name become publicly available. This information could be accessed by anyone who is visiting the LinkedIn Profile.

EKO Bulgaria is not responsible for the way these third parties use the information you shared with our LinkedIn Profile.

When you participate in discussion on our LinkedIn Profile (including through personal messages), we strongly recommend that you avoid sharing personal data that can be used to identify yourself directly, such as your name, age, address, and phone.

EKO Bulgaria is not responsible for the protection of the information you have shared with the LinkedIn Profile.

The processing term for these purposes is until the deletion of the specific article or post.

INDIVIDUALS ATTENDING EVENTS ORGANIZED AT THE PREMISES OF EKO PETROL STATIONS

EKO Bulgaria processes the following categories personal data of individuals who have attended events, organized at EKO petrol stations or by EKO Bulgaria at other locations:

(a) data for physical identity: data contained in photos and/or videos.

Purpose, legal basis and term of processing

EKO Bulgaria may post on its LinkedIn Profile photos of events organized at EKO petrol stations or by EKO Bulgaria at other locations.

The processing of your personal data in this case is based on EKO Bulgaria’s legitimate interest to promote the organized events and communicate their conduct.

If you do not want photos/videos of you to be published on our LinkedIn Profile, you have the right to object to the processing of these data and EKO Bulgaria will ensure that the respective posts are removed from the LinkedIn Profile.

Information on how to exercise your rights, including how to object, can be found in the What Are Your Rights section below.

The term of this processing is until the specific article or post is deleted.

USE OF THE LINKEDIN PROFILE OF EKO BULGARIA

Like any LinkedIn Profile, ours also follows the general rules on personal data protection that LinkedIn provides.

With this regard, we want to remind you that the information you share through your LinkedIn Profile is automatically owned by LinkedIn Corp. or the Irish subsidiary LinkedIn Ireland Unlimited Company. LinkedIn has the right to process and store this information until you delete your account.

At the same time, LinkedIn does not allow companies managing LinkedIn Profiles to specify storage terms for the information you send them through messages. Thus, sending information via personal message to the LinkedIn Profile of EKO petrol stations implies higher risks for your personal data as we could not guarantee where and how long your personal data are stored.

For this reason, each data subject has the freedom to provide us with information through alternative means which are under our control, for example by email to: office@eko.bg.

INFORMATION ABOUT THE PERSONAL DATA PROCESSING IN RELATION TO THE VIBER CHANNEL OF EKO BULGARIA EAD

The Viber channel of EKO petrol stations: EKO България (hereinafter the “Viber Channel”) is created to provide an option for the clients and visitors at EKO’s petrol stations, to receive messages for the promotion of goods, services, games, events and other ongoings and campaigns organized by us or our partners, by means of the Viber Channel.

For the performance of the activities mentioned above, EKO Bulgaria EAD processes personal data of the following main categories of data subjects:

MEMBERS OF THE VIBER CHANNEL

EKO Bulgaria processes the following categories personal data of the visitors to its Viber Channel:

Name/pseudonym of the Viber user;
Image (in case the Viber user has uploaded their photograph to their Viber account).

Purpose, legal basis and term of processing

We use the above data for the following purposes only:

- sending messages with relevant EKO promotions using Viber.

EKO Bulgaria EAD processes the above specified personal data on the basis of its legitimate interest to popularise and promote its activities, including those carried out at EKO petrol stations.

The above referenced personal data (name/pseudonym and image) will be processed by Viber Media S.a.r.l, 2 Rue du Fosse, L --1536, Luxembourg, Grand Duchy of Luxembourg. For more information regarding the purpose and scale of the data processing by Viber Media S.a.r.l you can read Viber Media S.a.r.l’s Privacy Policy which is available at: https://www.viber.com/en/terms/gdpr-privacy-rights/.

The processing term for these purposes is until withdrawal of your consent, after which you will no longer receive relevant marketing messages through Viber. You may - at any time and completely free of charge - withdraw your consent using your mobile device by opening the ‘Settings’ function in the Viber Channel and choosing the option ‘Leave and Delete’. Your membership in the Viber Channel will thereby be terminated and you will cease receiving our marketing messages via Viber.

You may find more information on how to exercise your right to object against the processing of your personal data for the purposes of direct marketing in Section What are your rights herein below.

INFORMATION ABOUT THE PERSONAL DATA PROCESSING IN RELATION TO EKO SMILE LOYALTY PROGRAMME

Regarding the processing of the personal data of natural persons in connection with the EKO Smile Program and/or the website www.ekosmile.bg please refer to the PRIVACY POLICY FOR THE EKO SMILE PROGRAM , available at the following link: Privacy policy | ekosmile.bg

WHAT ARE YOUR RIGHTS

If you are an individual whose data are processed by EKO BULGARIA under any of the above circumstances, you have the following rights with this regard:

(a) You have the right to object to processing of your personal data for the purpose of direct marketing, if you are addressee to such messages.

If you make such an objection to our direct marketing messages we will no longer process your personal data for this purpose but none of our other services provided to you in connection with your EKONOMY card will be limited anyhow. However, in order to ensure that your objection is regarded, your data will be included in data base of objected data subjects.

You have the right to object to processing of your personal data for the purpose of promoting events organized by/at EKO petrol stations or by EKO Bulgaria at other locations оn our Facebook Page; If you make such an objection to a publication of photos/videos containing your personal data on the Facebook page, we will remove the respective photos/videos and will no longer process these personal data for that purpose.

(b) All Data Subjects have the following rights:

- to be informed what kind of personal data are processed by EKO BULGARIA;

- to access and to receive a copy of their processed personal data;

- of rectification or erasure of their personal data;

- to restrict the processing; and

- data portability.

You may exercise any of your rights above by submitting a written application in any of the following ways:

- via e-mail to: office@eko.bg

- via letter addressed to: EKO BULGARIA, 3 Lachezar Stanchev Str., Litex Tower Complex, fl. 9, Sofia 1756, Izgrev District, Republic of Bulgaria.

Please note that your application for exercise of any of your rights should contain at least your names and other identification information, description of your request, preferred way of communication with you, address for correspondence and date of the application.

If the application is signed by a proxy, the respective power of attorney should be attached to the application.

EKO Bulgaria may contact you for additional information, if it needs to ensure your identity or further clarify your request.

You may also object to direct marketing in any other way indicated by EKO Bulgaria in the respective direct marketing message - e.g. by clicking on link provided in an e-mail.

You also have the right to file a complaint concerning the processing of your personal data with the supervisory authority which is the Personal Data Protection Commission for the Republic of Bulgaria.

EXCESSIVE DATA PROVIDED BY/FOR YOU

If we receive any personal data in excesses of what is needed for us to comply with our purposes above, we will delete this information immediately but not later than 1 (one) month after its receipt.

PROTECTION OF YOUR DATA

To help protect the privacy of data we maintain physical, personal, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data only to those employees and personal data processors who need to know that information to provide benefits, goods or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to ensure our employees' privacy responsibilities.

CHANGES AND UPDATES TO THIS PRIVACY NOTICE

As our organization, goods and services change from time to time, this Privacy Notice is expected to change as well. We reserve the right to amend the Privacy Notice at any time, for any reason, without notice to you, other than the posting of the amended Privacy Notice on this Site. We may e-mail periodic reminders of our notices and terms and conditions and will e-mail our partners and clients of material changes thereto, but you should check our website frequently to see the current Privacy Notice that is in effect and any changes that may have been made to it.

The present documents represent privacy notice within the meaning of Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).