SharePark LIMITED LIABILITY COMPANY which operates under the GimleParking brand (hereinafter referred to as the "Controller") in this Personal Data Processing Notice (hereinafter referred to as the "Notice") describes how it processes personal data of adult individuals (hereinafter referred to as the "Personal Data Subjects") and/or "Users" when using the GimleParking website, web application, mobile application (hereinafter referred to as the "Software") and in any other case of obtaining personal data of Users.

II. Terms:

1. Controller - an individual or legal entity that determines the purpose of processing personal data, establishes the composition of this data and the procedures for its processing.
2. Processing of personal data means any action or set of actions, such as collection, registration, accumulation, storage, adaptation, modification, updating, use and dissemination (distribution, sale, transfer), depersonalization, destruction of personal data, including with the use of information (automated) systems.
3. Software means the gimleparking.com website, web application and mobile application of the Controller.
4. Personal data means information or a set of information about an individual who is identified or can be specifically identified.
5. The legal basis for processing personal data is one of the grounds for which the processing of personal data is permitted by law. There are the following grounds:

• Consent;
• Legitimate interest of the Controller;
• Conclusion of a contract;
• Other grounds defined by the legislation of the Republic of Bulgaria

6. Termination of a legal entity is the termination of a legal entity in the event of liquidation or reorganization. In the case of reorganization of legal entities, property, rights and obligations are transferred to legal successors. Types of reorganization:

• Merger - two legal entities merge into one;
• Merger - one legal entity merges with another;
• Division - two legal entities are formed from one legal entity;
• Transformation - one legal entity changes its organizational and legal form.

7. Processor - a natural or legal person who is authorized by the Personal Data Owner or by law to process this data on behalf of the Controller;
8. Personal data subject is an individual whose personal data is processed;
9. Third party - any person, except for the personal data subject, the Controller or Processor and the Supervisory Authority to whom the Controller or Processor transfers personal data.
10. The Independent Supervisory Authority (hereinafter referred to as the "Supervisory Authority") is a government agency of the Republic of Bulgaria - the Personal Data Protection Commission, authorized to supervise compliance with the provisions of the personal data protection legislation. More information is available at the link.

IV. Realization of the rights of personal data subjects:

1. To exercise the rights specified in Section III of this Notice, the personal data subject or his/her representative must send the Controller an application for the exercise of the personal data subject's rights (hereinafter referred to as the "Application") to the email address _____ or to the support service.
2. The application must contain:

• Name, surname and patronymic, address, unified civil or personal number of a foreigner or other similar identifier or other identification data of an individual;
• Description of the request;
• Preferred form of obtaining personal data in the exercise of rights;
• Signature, date of application and address for correspondence.

3. If the application is submitted by a representative, he or she must provide a notarized power of attorney issued to the representative by the relevant personal data subject.

IX. Personal data in case of termination and bankruptcy of a legal entity.
The bankruptcy of a legal entity is the inability to repay debts by methods provided for by law, except for liquidation.

1. The Controller performs the following actions with personal data during reorganization:

2. In the event of liquidation and bankruptcy, personal data is destroyed or transferred to a third party in accordance with the section Transfer of personal data to a third party.

XI. Transfer of personal data outside of Bulgaria:

1. The controller has the right to transfer your personal data by default to:

• Other member states of the European Union and the European Economic Area;
• States that are recognized by the European Commission as generally providing an adequate level of personal data protection, or, partially, in certain areas.

2. The Controller has the right to transfer your personal data to other states and international organizations on the basis of:

• Standard Contractual Clauses approved by the European Commission;
• Mandatory corporate rules;
• Codes of conduct;
• Certifications;
• Other grounds determined by the legislation of the European Union and Bulgaria.

XII. Notification of a personal data security breach:

1. The Controller is obliged to notify the Supervisory Authority within 72 hours of a cyber incident (meaning any event that has led to a breach of the conditions for processing personal data in accordance with this Notice). The Controller is also obliged to document this event.
2. The Controller is obliged to notify the personal data subject of a personal data leak and/or cyber incident that has led to a violation of the terms of personal data processing in accordance with this Notice by sending an e-mail to the subject's e-mail, posting a message in the Software and/or providing information by any other means of communication within 7 calendar days from the date on which the Controller became aware of the cyber incident.
3. The controller provides the following information to the personal data subject:

• Information about the Controller;
• A description of the specifics of the personal data protection breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records affected;
• Notification of the individual and contact details of the data protection officer or other focal point where more information can be obtained;
• A description of the likely consequences of the personal data protection breach;
• A description of the measures taken or proposed to be taken by the Controller to respond to the personal data protection breach, including, if necessary, measures to mitigate its potential negative consequences.

4. The controller may not send the above information to the personal data subject if

• The controller has implemented appropriate technical and organizational protection measures and these measures have been implemented with respect to the personal data affected by the cyber incident, in particular measures that make the personal data unintelligible to any person not authorized to access them, such as encryption;
• The controller has subsequently taken measures to ensure that the high risk to the rights and freedoms of the data subjects will no longer occur;
• Notification would result in a disproportionate effort; in this case, a public announcement or other similar measure is taken to ensure that data subjects are equally effectively informed.

XVI. Information about the Personal Data Controller:

Name: SLLC SharePark
Identification code: 207049614
Registration address: Bulgaria, 8000, Burgas, Georgi Kirkov Str., 16, floor 2
E-mail: info@gimleparking.com / gimle.parking@gmail.com
Manager: Sergii Kravetskiy