POLICY OF CONFIDENTIALITY OF “DB9” EOOD IN PROCESSING YOUR PERSONAL DATA

Introduction By presenting this policy we aim at explaining to you what kind of information about you we collect, why and how we do it, what are your rights pursuant to the Law on the Protection of Personal Data (LPPD) and the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Union and the Council of April 27, 2016 – GDPR). Our exceptional priority is to protect your personal data and to receive your free, informed and unambiguous assent for the processing of your personal data by “DB9” EOOD. If you check “I accept everything” you agree to provide your personal data voluntarily, that you have familiarized with your rights pursuant to the LPPD and REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL of April 27, 2016 – GDRP and that you give your assent for your personal data to be collected, processed, stored and provided for third persons for the purposes set forth below.

Definitions:

“Personal data” means any information related to an identified natural person or a natural person who can be identified (“subject of data” or “user”); a natural person who can be identified is a person who can be identified directly or indirectly particularly by an identifier such as a name, identity number, location data, online identifier or by one or more signs which are specific for the physical, physiological, genetic, psychic and mental, economic, cultural or social identity of that natural person;

“Administrator” means a body which on its own or jointly with other bodies determines the goals and means of processing personal data; when the goals and means of that processing are determined by the law of the European Union or the law of the Republic of Bulgaria, the administrator or the special criteria for selecting that administrator may be established by the law of the European Union or by the Bulgarian legislation. In this case the administrator is “DB9” EOOD (referred to below as DB9), a company duly registered and functioning in compliance with the laws of the Republic of Bulgaria with UIC (Unified ID code 204849348 with a business address: city of Sofia, Oborishte district, 27- Veliko Turnovo str.

“Personal data processor” means a natural person or a legal entity, a public body, agency or another structure processing personal data on behalf of the administrator;

“Processing” means any operation or a range of operations, performed with personal data or a set of personal data by automatic or other means such as collecting, recording, organizing, structuring, storing, adjusting or changing, extracting, consulting, use, disclosure by transfer, distributing or other forms of guaranteeing an access to the data, arrangement or combining, restricting, deleting or destroying;

“Supervisory body” means an independent public body of a state member of the European Union, responsible for controlling the applying of the personal data protection rules. The supervisory body in the Republic of Bulgaria is the Commission for Personal Data Protection.

Purpose of the policy

This policy of confidentiality aims at guaranteeing that the Administrator: observes the legislation in the sphere of data protection and follows good practices; protects users, employees, customers and partners of DB9; guarantees transparency as regards the ways of storing and processing the data of subjects; guarantees protection against risks related to violation of data.

How do we collect information about you?

We can collect information about you by several ways: by forms you have filled in and sent to us related to a registration or to services used in connection with the signing of a contract for a purchase. By sending such forms you conscientiously share your personal data. As regards each form we shall specify the purposes of using them, the storage deadline, the third parties with which we shall possible share them, the ways of exercising your rights pursuant to the Regulation.

We shall minimize the volume of data in the form according to the purposes declared. For instance: when you create an account on the website of DB9 you provide personal information for us including your names, phone number, address and email. when you participate in games, competitions or promotions of DB9 and/or of third parties – partners of DB9 you provide personal information according to the specifics of the game i.e. – names, phone number, email. when you buy items and goods from our online store for clothes or accessories you usually provide personal data for us – names, a phone number, an email, an address for the delivery, a bank account.

The data are provided in connection with the implementation of the contractual relations between the parties. when you subscribe for our information bulletin you provide your email for us. Data collected by supervision. Sometimes we collect information about you by supervising your behaviour on our site and in our mobile applications. To this end we use the Internet standard approaches for tracking the users’ behaviour , e.g. the use of network equipment, for tracking your IP address, analyzing the available information which is part of the communication in the protocols used by us for recording and exchanging of identifiers for you and your device e.g. HTTP GET/POST applications, the use of JavaScript functionalities and other standard and widely used in the WEB programme languages for extracting data and information about your context such as browser, operating system, resolution of the screen, language, etc.

Data received by third parties

Sometimes after your explicit assent provided via the partner’s instruments we may receive data from third parties such as data from your profile in the social networks such as Facebook.

Cookies DB9 uses cookies on its site for storing settings and identifiers needed for providing the services specified in the site. Some of these cookies are needed form a technical point of view for the normal functioning of the site. You can find more information about the DB9 policy as regards the cookies in the section POLICY OF COOKIES.

What kind of information do we collect and process when you use our services?

We usually collect the following data:

Your names; Username; Password; Mobile phone number; Email address; Delivery address; Data about correspondence with you; Bank account number – in the event of products’ return; Information about a lawful representative of a legal entity, UIC, business address of the legal entity – if it is necessary to issue an invoice for the legal entity. As regards all visitors we and the suppliers of the instruments used by us usually collect the following data about you: The IP address from which you visit our site; The identifier of your browser; The identifier of your mobile device; Your identifier which does not contain personal data; History of your behaviour – pages visited, time spent browsing, products bought, etc.; Behaviour as regards the contents of the site/mobile application – navigation, interface elements used, time of stay; Your searches; Behaviour as regards the served advertisements – what and how many advertisements have been served; place of serving; seen advertisements; realized clicks, skipped advertisements, etc; Your comments.

As regards the logged users in addition to the data mentioned above we also collect identifiers linking them to the concrete profile of the user. Basic information about the profile such as name, email address, date of birth; Details which you may choose to share according to the concrete settings of social media accounts; Your contacts and the ways of contacting them. What is our purpose in processing the information? The information which we collect and process for you can be used for the following purposes: For the normal functioning of our site These data are strictly necessary for the normal operation of the site and our mobile applications. Thereby we can establish your identity as logged user, show you better its contents, download the site faster, protect the site and you against interference. Such data include the data of your session – information whether you are logged in, cached contents, etc. Here are also the data related to your identification as regards a registration for using our services. For the implementation of the contract for a sale. Electronic trade requires that your share personal data with us. We use them so as to be able to implement the contract with you for the sale and delivery of the goods offered by us. On signing a contract your data are processed in connection with: processing the order, accepting, validating, specifying, dispatching, etc.; issuing documents related to the processing of the order; solving problems related to the cancellation of orders or any other changes as regards the orders made by you; return of products in compliance with the provisions of law; restoring the costs of products in compliance with the provisions of law; rendering of support including providing answers to your questions in connection with your order or the products we offer.

Here are also the data related to the identification of a user as regards the registration for using our services. For storing and for an access to information This purpose is auxiliary for the implementation of other purposes – by using various technical mechanisms the DB9 shall be able to achieve some of the other purposes mentioned above. It includes the storage of and access to the information stored in your device e.g. identifiers of the device, identifiers of the user, advertisement identifiers, cookies and other technologies. This purpose is auxiliary – by using the technical mechanisms described in it we shall be able to fulfil some of the other purposes described. For personalization and profiling. We collect and process information for using our services for the subsequent serving of personalized advertisement and/or content in another context e.g. other sites and mobile applications. It is typical to use the content and your behaviour in the site/mobile application for drawing conclusions about your interests through which the future selection of served advertisement and/or content is managed. For guaranteeing the better experience of users of the site, the mobile applications and services of the DB9. For the selection, supply and reporting of the served advertisements.

DB9 offers a website and mobile applications which is free for its users. DB9 is aware of its responsibilities and strives to restrict the collection and processing of data for the purposes of optimizing the serving of advertisements to the possible minimum. Still, the technological development has resulted in the development of a complicated system of relations and data exchange for those purposes. We collect information and combine it with the information available before so as to select and provide for you a relevant advertisement and so as to assess its supply and efficiency. This may include information collected in advance about your previous interests in selected advertisements, processing of data about your behaviour when you have seen the advertisement, how often specific advertisements are shown, where and when they have been shown to you, whether you have undertaken actions related to the advertisement including a click on the advertisement and a purchase. This purpose does not include personalization and profiling. For selecting, supply and reporting of the served content We collect information and combine it with previously collected information so as to select and provide for you relevant content and to measure its supply and efficiency. This may include information collected in advance about your interests in the content, processing of data about the content shown to you, how often and how long it has been shown to you, whether you have undertaken actions related to the content including a click on the content. This purpose does not include personalization and profiling. For assessment We collect information about your use of the content and combine it with previously collected information so as to assess, understand and take account of your use of our services.

Our business model has been developed on the basis of providing a free access to the content of our website for its users. With a view to the normal functioning of our website and observing normal business logic we need a basic assessment of your behaviour of a user. To this end we use only the Google Analytics instrument whereby up to the time of receiving your assent we have switched off the Google Analytics functionalities for advertising and have submitted a command for making anonymous your IP to Google Analytics. We consider that in this way on the one hand we have minimized the information collected for the purposes of assessment to the minimum thereby guaranteeing that those data shall not be used for purposes other than assessment. This purpose does not include personalization and profiling. On assignment and for third parties’ projects As regards concrete projects assigned by third parties we collect your personal data which we share with them for achieving the objectives of their projects.

You can find detailed information about the goals and purposes in the General provisions of each concrete project which will be provided for you in order to receive your assent.

For informing you about games and promotional offers of DB9 and/or of third parties – partners of DB9 To achieve this purpose we collect your personal data so as to inform you about our, third parties’, our partners’ initiatives, promotions, games, offers, etc. With a view to achieving the purposes set forth above we may use third parties’ instruments.

For processing your personal data including submitting them to the competent authorities in cases stipulated by law and for carrying out lawful obligations of DB9 (including accounting and tax goals pursuant to the accounting and tax legislation) as well as for purposes related to the implementation of the parties’ obligations under the contract

For the purposes of planning, reporting and statistics

For the purposes of planning, reporting and statistics means any operation related to the collection and processing of personal data needed for statistical research or for preparing statistical results as well as for the preparation, implementation and checking of plans and the results thereof.

For marketing purposes we collect data such as email address or any other ways of contacting you so as to send you always up to date and useful information about our initiatives. Who else has an access to that information? Sometimes we disclose your personal information to third persons – partners of DB9 including third parties outside the European Union provided that the requirements of the Regulation have been observed, namely: Third persons with whom DB9 has contractual relations for organizing games, competitions or promotions for those partners; Third persons with whom DB9 has contractual relations for publishing advertisements and promoting by other suitable means their products and services; Third persons with whom DB9 has contractual relations for assessments, for selection, supply and assessment of serving content or advertisements including servers for the supply of advertisements, venues for inventory trading (Ad Exchanges), publishing instruments (SSP) and Digital signal processing (DSP); Third persons with whom DB9 has contractual relations for using colocation services; Third persons with whom DB9 has contractual relations for using virtual servers; (VPS) Third persons – suppliers of courier services with a view to implementing the contractual relations for the delivery of the products ordered by you; Third persons providing services for improving the advertisement targeting of products and services of DB9 and/or of partners of DB9; Third persons providing services related to the development of depersonalized users’ segments according to the consumers’ behaviour; Industrially acknowledged suppliers of solutions, who have declared in public compliance with GDRP and e-privacy policies such as Google and Facebook.

The assent implies placing and using of marking unique depersonalized identifiers including by using cookies, localStorage or any other suitable universally accepted web technology.

Third persons providing service to DB9 such as accountants and accounting enterprises; auditors and auditing enterprises; jurists – attorneys, attorneys’ offices and lawyers; notaries; advertising and PR agencies; persons engaged in the system administration of data; persons engaged in the development and maintenance of our online store. How long do we store your personal data? Depending on the purposes of their processing the personal data can be stored for different periods of time. We process and store your personal data while you have an account with us, as long as you unsubscribe of our information bulletin, we process them for the period in compliance with the tax and accounting laws if a contract has been signed, etc.

You may always request that we delete the information or close your account, we shall respond to such a request and in certain cases we shall keep some information even after the account is closed when the legislation in force necessitates it.

How do we protect the safety of your personal data?

DB9 is committed to guaranteeing the safety of your personal data by applying suitable technical and organizational measures. Despite the measures we take to protect your personal data we are aware that the transfer of information via Internet or other public networks is not completely safe and there are risks for the data to be viewed or used by unauthorized third parties. We cannot take the responsibility for the vulnerability of systems which are not under our control.

What are your rights related to your personal data?

Our priority is both to inform you about your legal rights as well as to guarantee their observance. You have the following rights which should be observed in processing your personal data: The right to withdraw at any moment your assent for the processing of your personal data; To request correction or adding to your data by a written statement submitted to us in case an imprecision has been established; The right to an access to your personal data; The right to restrict the processing of your personal data; The right to an objection against the processing of your personal data; The right to the transfer of data; The right to request the deletion of your personal data which are processed illegally or by a suspended legal justification (withdrawn assent, achieved original goal for which they have been collected, etc.); The right to request that the Administrator of your personal data shall inform the third parties to which the Administrator has provided your personal data as regards corrections, deletion or restriction of the processing of personal data. You have the right to submit complaints to the Commission for personal data protection.

When can DB9 use your data to contact you?

We can use the information you have provided to contact you as regards different issues such as: To inform you about changes in the policies of DB9 and the current rules; To respond to you when you have contacted us or to answer your comments or complaints; To invite you to participate in our research as regards the services of DB9; For marketing purposes; To send you suitable offers for products and services of DB9 and/or of third parties – partners of DB9; To inform you about games, competitions or promotional offers of DB9 and/or of third parties – partners of DB9;

How can you update and manage your personal data?

You can easily update and manage your information by going to “Settings for confidentiality”. If you check “I accept everything” you agree with the information set forth above and can change or withdraw your assents by going to the “Settings for confidentiality”. In order to manage more easily your assents we have developed a Centre for confidentiality which includes an instrument for managing your confidentiality (privacy dashboard). Through it you can view and manage the assents provided and request the exercising of the rights stipulated in the GDPR. DB9 reserves its right to change and/or supplement this Policy at any time. Changes come into force immediately after their publishing on the website unless it has been envisaged otherwise in the updated version of the Policy.

You must visit regularly this page and review the Policy. It can be updated any time without specially informing the users of the site. DB9 is not responsible if a user of the site has failed to familiarize with the latest updated version of this Policy.