PRIVACY AND PERSONAL DATA PROTECTION POLICY

LION`S HEAD INVESTMENTS AD

LION`S HEAD INVESTMENTS AD respects the privacy of its clients and the individuals with whom it works and communicates, and ensures maximum protection of their personal data. This Privacy and Personal Data Protection Policy (hereinafter referred to as the “Privacy Policy” or the “Policy”) aims to explain what personal data we collect about you, how and why we process it, and what your rights are. It is prepared on the basis of the applicable Bulgarian and European legislation on personal data protection, including but not limited to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) and the Personal Data Protection Act. This Privacy Policy does not affect, limit, or revoke your rights arising from the Personal Data Protection Act, the Regulation, or other applicable legislation.

Please read this Policy carefully before using our services, as well as before entering into commercial, civil legal or other relations with us. If you do not wish your personal data to be processed as described in this Privacy Policy, please do not provide it to us. If your personal data has been provided to us by a third party whose employee or contractor you are, you may also contact your employer or principal for information.

I.Who processes and is responsible for your personal data?

LION`S HEAD INVESTMENTS AD (“we”) is a company registered with the Commercial Register and the Register of Non-Profit Legal Entities at the Registry Agency under UIC 204831478, which collects, processes, and stores your personal data under the conditions of this Privacy Policy. LION`S HEAD INVESTMENTS AD is a personal data controller within the meaning of the Personal Data Protection Act.

You can contact us at the following address:

Sofia, Sredets District, 47A Tsarigradsko Shose Blvd., floor 3

E-mail: regulatorycompliance@lhinv.eu

LION`S HEAD INVESTMENTS AD is a company that manages investment projects. It processes personal data in connection with and insofar as necessary for the management of companies owning the investment projects, as well as for administrative and managerial support for their management.

II. Channels through which personal data is collected / Sources of personal data

1. Personal data may be provided directly by you voluntarily when:

Youinitiatecontactwithusexpressinginterestinenteringintocommercialorothercivillegal relationsasanindividual,orwhenactingonbehalfoflegalentitiesthatareclientsorpartners ofLION`SHEADINVESTMENTSAD.

In this case, the scope of the data we process is limited to the information you provide and that is necessary for the lawful performance of our commercial activities.

1. If you are an employee of our client or supplier/subcontractor, or subcontractor of our tenant, your data may be provided to us by your employer or its principal.
2. We may process data collected or generated by us during the execution of our commercialactivities.
3. To ensure proper performance of services and obligations under client contracts, we may process information available in public registers (including but not limited to the Commercial Register and the Register of Non-Profit Legal Entities, public databases, informationdisclosedonline,etc.),aswellasinformationreceivedfromthirdpartiesforthe purposeofcompliancewithlegalrequirementsconcerningclients.

LION`S HEAD INVESTMENTS AD has the right and obligation to verify the accuracy of personal data collected in this manner by requesting that you verify or, if necessary, correct or confirm its accuracy.

III. Purposes and legal grounds for processing personal data

1. Processing necessary for entering into or performing contracts We process your data for the following purposes:

Identifying the client when entering into or amending a contract;
Negotiating contract terms and pre-contractual relations;
Administering contracts concluded with you, performing obligations, and exercising rights.

1. Processing required by law We process your data for:

Compliance with obligations under accounting and tax legislation, including the

Accounting Act and the Tax and Social Security Procedure Code; issuing invoices; tax and social security inspections; compliance with anti-money laundering legislation (if applicable), etc.

Providing information to the Commission for Personal Data Protection as required by data protection legislation.

1. Processing based on legitimate interest

Video surveillance (if applicable);
Access control to our office;
Administering contracts between LION`S HEAD INVESTMENTS AD and partner legal entities, including processing personal data of their representatives, employees, and contact persons.

IV. Categories of personal data we process

1. Data processed by the access control system
  - For employees of tenants and other contractors: names, employer, possibly vehicle registration number.
  - For visitors: names and the tenant or specific area they will visit.
2. Video surveillance

Weprocessvideoimagesofpeoplepresentinorpassingthroughthebuildingwhereour office islocated.

1. Data processed in connection with contract conclusion and performance

Identification data – names, personal ID number (EGN), ID card data (only exceptionally when required, e.g. notarization of signatures);
Contact details – postal and e-mail addresses, phone and fax numbers;
Financial information – bank account details;
Professional information – employer, position.

V. How long do we store your personal data?

1. Data processed for contract performance – for the duration of the contract and 5 years after its termination.
2. Accounting/tax data – 10 years after the reporting period to which it relates.
3. Video surveillance recordings – up to 1 month.
4. Access control data:

for tenant employees – until notification that the person is no longer employed or until the lease terminates;
for visitors – up to 3 months after access is provided.

Data may be stored longer in case of legal disputes or inspections.

VI. Where do we store your data?

Your data is stored within the EU/EEA.

WedonottransferanddonotplantotransferyourdataoutsidetheEU. AnyfuturechangeswillbereflectedinthisPolicy.

VII. Categories of third parties that may access your personal data

Examples include:

Transport/courier services, postal operators;
IT and software maintenance providers;
Banks;
Subcontractors;
Data processors acting on our behalf;
Consultants – lawyers, accountants, notaries, bailiffs;
Public authorities and institutions as required by law. Some of these entities may act as independent controllers.

VIII. Your rights regarding your personal data

You have the right to:

request access to your personal data;
request correction of inaccurate or outdated data;
request data portability;
request deletion of your data under certain legal grounds;
request restriction of processing;
withdraw consent when processing is based on consent;
object to processing based on legitimate interest.

Right to lodge a complaint

YoumayfileacomplaintwiththeCommissionforPersonalDataProtection,Sofia1592,2 Prof.TsvetanLazarovBlvd.(www.cpdp.bg).

Automated decision-making

We do not use your data for automated decision-making or profiling that may produce legal effects or significantly affect you.

Refusal to provide data

Certain data is necessary to identify the contracting party, representative, and for payments. Failure to provide such data makes it impossible to enter into a contract.

IX. Amendments to the Privacy Policy

This Policy may be updated periodically. Updates will be published on our website. In case of significant changes, we may notify you by e-mail.