Mandatory Information on Data Subject Rights

Information about the company processing your data:

Name: TARPANOVI 1325 LTD
UIC/BULSTAT: 207293807
Registered office and address: Bulgaria, Varna, Odessos District, Struga St., 41
Correspondence address: Bulgaria, Varna, Odessos District, Struga St., 41
Phone: +359 896 109 946
E-mail: info@adibo.bg
Website: www.adibo.bg

Information about the competent supervisory authority for personal data protection:

Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. 2
Correspondence address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. 2
Phone: +359 2 915 3 518
Website: www.cpdp.bg

TARPANOVI 1325 LTD (hereinafter referred to as the “Administrator” or the “Company”) operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (GDPR). This information aims to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to such processing.

---

Legal Basis for Collecting, Processing, and Storing Your Personal Data

Article 1. The Administrator collects and processes your personal data in connection with the use of the online store adibo.bg and the conclusion of contracts with the Company, based on Article 6(1) of Regulation (EU) 2016/679 (GDPR), specifically on the following grounds:

• Explicit consent given by you as a client;

• Fulfillment of the Administrator’s obligations under a contract with you;

• Compliance with a legal obligation applicable to the Administrator;

• For the purposes of the legitimate interests of the Administrator or a third party.

---

Purposes and Principles for Collecting, Processing, and Storing Your Personal Data

Article 2.

1. We collect and process the personal data you provide in connection with using the online store and concluding contracts with the Company, including for the following purposes:

• Creating a profile and providing full functionality of the online store;

• Concluding and executing a distance contract;

• Individualization under the contract;

• Accounting purposes;

• Statistical purposes;

• Information security protection;

• Ensuring the fulfillment of the contract for the provision of the relevant service;

• Sending newsletters upon your expressed consent.

2. We adhere to the following principles when processing your personal data:

• Lawfulness, fairness, and transparency;

• Purpose limitation;

• Data minimization and relevance;

• Accuracy and up-to-date data;

• Storage limitation;

• Integrity and confidentiality with appropriate security measures.

3. The Administrator may process and store personal data to protect its legitimate interests, including compliance with obligations to the National Revenue Agency, Ministry of Interior, and other public authorities.

---

Types of Personal Data Collected and Processed

Article 3.

1. The Company processes the following operations with your personal data:

• User registration and contract execution in the online store: For creating a profile to use the online store, purchase products, and provide contact details for delivery. Registration is optional.

• Conclusion and execution of commercial transactions with clients or partners: Limited personal data is collected, mostly from public sources.

• Newsletter sending: Administering newsletters for clients who have opted in.

• Exercise of withdrawal or complaints: Administering the process for returns or complaints.

2. Categories of personal data processed:

• Identification data (email, name, etc.): For contact, registration, and newsletters. Processing is based on contractual relationship or explicit consent.

• Delivery information (name, phone, address, etc.): For executing purchase and delivery. Processing is based on contractual relationship.

• Additional optional data: For profile completion; processing is based on explicit consent.

3. The Administrator does not process sensitive personal data, such as racial or ethnic origin, political or religious beliefs, union membership, genetic or biometric data, health, or sexual orientation.

4. Personal data is collected from the data subjects themselves.

5. No automated decision-making is performed.

Article 5. The Administrator may use cookies for site functionality, improved user experience, and statistical purposes. You can manage or delete cookies via your browser settings.

---

Data Retention Period

Article 6.

1. Personal data is stored no longer than the existence of your online store profile. After deletion, the Administrator will erase or anonymize your data without undue delay.

2. Data from orders without registration is retained until the order completion unless explicit consent for further processing is given.

3. Data from online orders is kept for 5 years for legal protection.

4. Retention may be extended for legal or legitimate interests.

5. Mandatory data retention may exceed account or order duration per applicable law.

Article 7. Data of legal representatives of commercial partners is kept for contract duration, legal compliance, or legitimate interest purposes.

---

Data Sharing

Article 8.

1. The Administrator may transfer personal data to processors for the agreed purposes in compliance with GDPR.

2. Notification will be provided if data is transferred to third countries or international organizations.

---

Data Subject Rights

Withdrawal of Consent
Article 9. You can withdraw consent for marketing and newsletters at any time via a form or free-text request by email. Withdrawal does not affect lawfulness of prior processing.

Right of Access
Article 10. You have the right to request confirmation if personal data is processed, and to access your personal data and related information. Verification instructions will be provided via email.