POLICY FOR THE PROCESSING OF PERSONAL DATA

VERTORA Ltd. is a company registered in the Commercial Register of the Agency on entries with UIC 205500292, with registered office and registered address: Burgas, ul. Hristo Botev 93, fl.2, Tel: 0876433656, e-mail: info@verthora.com We process your personal data on the following grounds:

● Contracts between us and you in order to fulfill our obligations under him; ● Your explicit consent - the purpose is stated on a case-by-case basis; ● With a statutory obligation In the following paragraphs you will find information about how to process your personal data, depending on the reason on which we process it. TO CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTING RELATIONSWe process your personal information to fulfill our contractual and personal information pre-contractual obligations and enjoy the rights under the contracts concluded with you. Purpose of processing: ● Identify your identity; ● managing and executing your request and executing a contract contract; ● Prepare and send an invoice / invoice for the services you use with us; ● Save correspondence in connection with ordering, processing requests, reporting problems, and more. ● creating a profile;

Based on the agreement between you and us, we process information about the type and content of the contractual relationship, as well as any other information relating to the contractual relationship, including: ● personal contact information - contact address, email, telephone number; ● identification information - three names, a unique civilian number or alien's personal number, permanent address; ● Details of orders placed through the profile; ● E-mail, letters, information about your removal requests problems, complaints, requests, complaints; ● Credit or debit card information, bank account number or other banking and billing information in connection with the made payments; The processing of these personal data is, for us, mandatory we can contract with you and execute it. We provide your personal information to third parties and our primary purpose is to We offer quality, fast and comprehensive service. We provide personal information to the following categories of recipients (Administrators personal information): ● postal operators and courier companies; ● Consultants in various fields. The data collected on this basis are deleted 5 years after the termination of the contractual relationship, whether due to the expiry of the contract, destruction or other cause. The term is set by the 5-year statute of limitations term for possible claims from the contract. FOR PERFORMANCE OF REGULATORY OBLIGATIONS The law may provide for an obligation for us to process the personal Your data. In these cases, we are required to perform the processing, such as for example: ● Obligations under the Anti-Money Laundering Act; ● fulfillment of obligations related to distance selling, the sale off-premises provided for in the Law on the protection of consumers; ● providing information to the Consumer Commission or third parties provided for in the Consumer Protection Act;

● providing information to the Commission for Personal Data Protection in relation to the obligations laid down in the regulatory framework for protection personal data; ●● obligations under the Accounting and Tax Act- the Social Security Code and other related legal acts, in relation to the keeping of legal accounting; ● providing information to the court and third parties within the framework of court proceedings, in accordance with the requirements applicable to the production of regulations; ● age verification when shopping online. The data collected in accordance with a foreseen obligation in the law are deleted after with the collection and storage obligation being fulfilled or dropped. For example: ● under the Accounting and Storage Act data (11 years), ● Information obligations to the competent court Public authorities, etc. The grounds set out in the existing Legislation (5 years). When the contested law gives us an obligation, we can provide Your personal Data Russkom competent government authority, natural or legal person, Person. AFTER YOUR CONSENT We process your personal data russkom this reason only after clear, Unambiguous and voluntary consent on your part. We will not Adverse consequences for you if you expect to opt out Processing Russkom personal data. Consent is a separate basis for processing Russkom your personal data and the purpose Russkom The processing is specified therein and is not covered by the objectives set out in this Policy. If you give us the appropriate consent and the withdrawal or Termination Russkom All contractual relations with you are preparing suitable for Product/service offerings. On this basis, we only process the data for which you have given us your explicit Consent. Specific data shall be determined for each individual case. Typically, data includes: ● Email; ● Phone; ● Address;

● names; On this basis we can provide your data to marketing agencies and Third parties. The consents granted may be revoked at any time. Withdrawal Agreement has no impact on the fulfilment of contractual obligations. If you withdraw your consent to the processing of personal data for any or all of the Ways described above, we will not use your personal data and Information on the objectives defined above. Data collected on this basis, we delete at your request or 1 The first year after their initial collection. PROCESSING OF ANONYMISED DATA We process your data for statistical purposes, this means for analyses which the results are only generalizing and therefore the data are anonymous. It is not possible to identify a particular person from this information.

How we protect your personal data To ensure adequate protection of the data of the company and its customers, We implement all the necessary organisational and technical measures provided for in the Personal Data Protection Act. For the purpose of maximum safety in the processing, transmission and storage of your Data, we may use additional protection mechanisms such as encryption, Pseudonymisation, etc. Consumer rights Each user of the site enjoys all rights to the protection of personal data Under Bulgarian law and European Union law. Each user is entitled to: ● Awareness (in relation to the processing of personal data by the Controller); ● Access to your own personal data; ● Correcting (if data is inaccurate); ● Deletion of personal data (right "to be forgotten"); ● Restriction of processing by the controller or Processing of personal data;

● Personal data portability between individual administrators; • Objection to the processing of his/her personal data; ● The data subject is entitled and not subject to a decision based on the Automated processing involving profiling, Which produces legal consequences for the data subject or in a similar significantly affecting it; ● The right to protection by judicial or administrative order, in the event that the Rights of the data subject have been infringed. The user can request deletion if one of the following conditions is true: ● Personal data are no longer necessary for the purposes for which they were collected or otherwise processed; ● The user withdraws his/her consent based on the Data processing and has no other legal basis for the Processing ● The user data objects to the processing and does not have legal The grounds for the processing which have an advantage; ● Personal data has been unlawfully processed; ● Personal data must be erased in order to comply with legal Obligation under Union law or the law of a Member State which is the subject of applicable to the controller; ● Personal data have been collected in connection with the provision of services to The information Society of children and consent is given by the carrier Parental responsibility for the child. The user has the right to restrict the processing of his/her personal data by The controller Where: ● Challenge the accuracy of the personal data.. In this case, limiting the Processing is for a period which allows the controller to verify the The accuracy of the personal data; ● The processing is unlawful, but the user does not want the personal data be deleted and requires instead limiting their use; ● The administrator does not need more than the personal data for the purposes of Processing, but the user requires them for the establishment, The exercise or defence of legal claims; ● object to the processing pending verification that the legitimate The administrator's grounds prevail over the interests of the User.

Right to portability. Users have the right to object to the administrator against the processing of their personal data. The data controller is obliged to cease processing unless it proves convincing legal grounds for processing having priority over interests, the rights and freedoms of the data subject, or the establishment, exercise or the defense of legal claims. When objecting to the processing of personal data for direct marketing purposes should be processed stop immediately. Complaint to the supervisory authority Each User has the right to file a complaint against unlawful processing of his personal data by the Commission for Personal Data Protection or by the competent court.