PERSONAL DATA PROTECTION POLICY OF BENEFIT SYSTEMS BULGARIA OOD

1. WHO ARE WE – INFORMATION ABOUT THE PERSONAL DATA CONTROLLER

1.1. We are BENEFIT SYSTEMS BULGARIA, registered with the Bulgarian Commercial Register under UIC 203418971, with the seat in Sofia 1612, Krasno selo region, Bulgaria, 11-13 Yunak Str, fl. 1 (hereinafter referred to as: “Benefit Systems”, “us”, “we”)

1.2. We exercise all due care and diligence to ensure that your personal data are processed in accordance with the applicable legislation including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation or GDPR in short”)

1.3. Benefit Systems perceives as priority the security of the data processed by us. We have implemented appropriate policies and procedures in this respect. We conduct trainings to our staff with regard to data protection, data confidentiality and security. We also conduct regular checks of the implemented security models in terms of their adequacy to the security of the data processed by Us.

1.4. In order to provide our services, we process certain personal data. The purpose of this Policy is to inform about the scope of the data, we are processing, the purposes, the legal basis for the processing, the storage periods, the persons to whom the personal data may be disclosed as well any other information required by law.

2. CONTACT DETAILS FOR BENEFIT SYSTEMS BULGARIA OOD

2.1. Contact details of Benefit Systems are as following:

address: Bulgaria, Sofia 1612, 11-13 Yunak Str., fl. 1;

e-mail: dpo@benefitsystems.bg;

telephone: +359 2 820 57 70 и +359 879 280 284;

3. WHAT PERSONAL DATA WE ARE PROCESSING, WHY IS THAT NEEDED AND ON WHAT LEGAL BASIS? HOW DO WE COLLECT PERSONAL DATA, PROCESSED BY US?

3.1. Personal data regarding issuing and use of MultiSport and MultiSport Kids cards

– all natural persons, using the MultiSport card are included here, including regular card; test card; card,  as well as persons, who use MultiSport Kids cards.

3.1.1. In order to issue the MultiSport to particular card user, Benefit Systems collects the first name and the family name of the card user as well as the name of the client company, paying to benefit System the fee for the card under the terms of contract, concluded by and between Benefit Systems and the client company. These data are printed on the MultiSport card together with the unique number (bar code) of the card. We receive these data by the client company or . in case that we have signed contract with you in your capacity of Multisport card user and you requested issuance for your Accompanying person ). The data for the persons, who use Multisport card as companions, are being collected by the person who pays Us the price for the companion card MultiSport and namely the client company, with which we have signed contract, or from the person-user of MultiSport card which whom we have signed contract

3.1.2. In order to issue MultiSport Kids, benefit Systems needs to collect the first name and the family name of the child who will use MultiSport Kids card, the consent of his parent/ holder of parental responsibility over the child for the use of MultiSport Kids card, month and year of birth. These data are needed for Benefit System because different services, included in the MultiSport Kids Program are intended to be used by children of different age and also because of safety precautions for the children – so that MultiSport Kids card user to be identified upon visit to the sport facility. Adult parents who request MultiSport Kids card for their child, need also to provide their e-mail address in case that they want to fill-in on-line consent for the processing of the user of MultiSport Kids card requested by them.

3.1.3. If contract for providing of services under program MultiSport and MultiSport Kids card between Benefit Systems and client company/person- user of MultiSport card (if there is any) supposes fee for second issuing of card due to loss/theft/brakeage/damage, Benefit Systems can store information for number of cases in which certain card is declared lost/ stolen/broken/damaged.

3.1.4. In order МultiSport/MultiSport Kids user to utilize sports, recreational and other services, included in the programs MultiSport or MultiSport Kids by the issued card, Benefit Systems shall process information for visited sports facilities, date of visits and the services, used by the particular person. This is being collected by Us through the employees of the visited sport facilities. We need this information for the fulfilment of our financial obligations to the persons who manage the sports/recreational centers, included in the Program as well for checking if the registered sports/recreational services are really utilized by the use of active card Multisport/MultiSport Kids.

Please, read carefully! Benefit Systems does not share with company clients information for visits at the facilities, as well as the services, used by particular card user, except for cases of established misuse of certain card or breach of the Terms of Use of MultiSport or MultiSport Kids Cards and only in case if Benefit Systems decides to exercise its rights and to block particular MultiSport or MultiSport Kids card which had been misused.

3.1.5. All МultiSport and MultiSport Kids cards are personal – they are being provided to certain natural persons to be used personally by them. In order In order МultiSport/MultiSport Kids user to utilize sports, recreational and other services, included in the programs MultiSport or MultiSport Kids upon visit to the sports facility, the card user must identify himself by presenting document issued by competent state, municipal, educational and other institution and which contains first name, family name and picture (e.g ID card, driving license, student ID card, transportation card ID, etc.). This is necessary to make sure that the person who really uses the MultiSport/ MultiSport Kids cards at the certain facility is really the person whose name is printed on the particular card.

Please, read carefully! Benefit Systems does not require and does not need copies from ID documents. That is why, if any MultiSport/ MultiSport Kids card user is requested to provide such ID copies they have the right to refuse presenting such and we thereby encourage such users to contact Beneft Systems immediately to inform about such practice.

3.1.6. For purposes of prevention, establishment and managing with cases of misuse of MultiSport/ MultiSport Kids card (unauthorized use) or noncompliance of the Terms of Use of MultiSport/ MultiSport Kids card (published on this Web Site or described thereunder in the respective agreements between Benefit Systems and client companies/persons, who use the cards on the grounds of direct contract with Benefit Systems), Benefit Systems is entitled to require from the card users to confirm their visits at certain sports facility, by signing of application form, located at the sports facility or to analyze internally the information for activity of the particular MultiSport/ MultiSport Kids card.

3.1.7. In order to process and answer to applications/requests/complaints, filed by MultiSport/ MultiSport Kids card users, Benefit Systems may process the following personal data with regard to the means by which contact with Benefit Systems had been made:

- First and family name of the user of MultiSport/ MultiSport Kids card, number of the car and the name of the client company;

- Their e-mail address (in case the communication is by e-mail) or telephone number (in case communication is through telephone conversation) or address (for applications/requests/complaints sent by mail);

- Information, contained in the application/request/complaint document.

- voice recording of inbound and outboubd call with call-center ot with our employee.

3.1.8. In order to defend their lawful rights against claims of MultiSport/ MultiSport Kids card users, client companies or facilities, part of MultiSport/ MultiSport Kids Program, Benefit Systems retains the collected personal data of MultiSport card users, described above for the period stated hereunder in this Policy, after termination of the service contract between Benefit Systems and the relevant client company or of the contract between Benefit Systems and the relevant sports facility or the contract between Benefit Systems and the relevant card user (in case there is any).

3.1.9. In order to comply with the requirements of the applicable tax, accounting and other legislation for storage of documents for taxation and social-security control, Benefit Systems stores collected personal data of card users described above, for definite time period, specified hereunder in this Policy, after termination of the contract between Benefit Systems and the respective client company or of the contract between Benefit Systems and the respective facility, part of the MultiSport/ MultiSport Kids Program and/or the contract between Benefit Systems and the respective user of MultiSport the card (in case of such contract). The reason for this is that Benefit Systems collects and uses the above-mentioned personal data in order to fulfill their financial obligations to the entities, operating and managing the sports/recreational facilities included in the MultiSport/MultiSport Kids program and in order to settle their financial relations with the persons who pay Benefit Systems the price for the MultiSport/MultiSport Kids cards.

3.1.10. In order to inform the users of MultiSport cards for new services or changes in the network of sports and other facilities, included in the MultiSport / MultiSport Kids Program or other changes related with the Program MultiSport/ MultiSport Kids, Benefit Systems may process e-mail addresses of contact persons included in the contracts of the company clients.

3.1.11. For purposes of broadening the partners network (i.e for purpose of including more sports facilities) Benefit Systems may process generalized statistic information for the visited sports facilities or the services, used by the card holders.

3.1.12. The purpose for processing of personal data by Use is not to create individual profiles to combine data bases or to perform any kind of advertising targeting. We do not perform automatized decision making without human interference and do not use automatized systems with purpose to create individual profiles of persons who use MultiSport/ MultiSport Kids cards. Cases in which information can be used about particular MultiSport/MultiSport Kids cards and this is done only by person (benefit systems employee) comprise the following: in case of doubt for unregulated use of the MultiSport/MultiSport Kids card for purpose to check, establish and cope with consequences of unpermitted use of MultiSport/MultiSport Kids card or for purposes of adding new sports facilities to the Program MultiSport/ MultiSport Kids if Benefit Systems registers increased interest for specific service.

3.1.13. For purpose to provide high quality of the service, including for purpose of clarification of details concerning applications/requests/complaints filed by MultiSport/ MultiSport Kids card users as well as for exercising of control over the employees and training of employees, performing the callas with Users or callers, Benefit Systems may record and process voice records from phone calls through the telephone central system.

3.1.14. In case you have chosen to use the Multisport Digital Card available through the My multisport application, your personal data will also be processed. The Digital card is a functionality representing a digital form of a personal MultiSport Card that allows you to use sports and entertainment services at the Sports Facilities. Specific information about the Digital Card and the data that is processed is contained in the application's data protection policy, LINK

3.2. Personal data of representatives of contracting parties and contact persons of contracting parties

3.2.1. In order for Benefit Systems to conclude contract with contracting party – legal entity, either partner (i.e person, managing sports, recreational or other center), client (company employer) or other contracting party, benefit Systems processes (checks and uses) information about the representative of the contracting party, who will sign the contract. In case that the person who signs the contract on behalf of the contracting party. In case that the contract is signed by attorney, benefit Systems shall collect and process the Power of Attorney as document containing personal data.

This information is necessary so that Benefit Systems to check if the person who signs the contract on behalf of the contracting party is entitled with due power of representative. These data are being collected directly from the contracting party or by public accessible resources – Commercial register, BULSTAT register.

3.2.2. For purposes of making contact with contracting party of benefit Systems which is legal entity, the contract with contracting party usually includes contact details of certain physical person (telephone number and/or e-mail address and/or name and family) These data are used in case communication is necessary for concluding, fulfilment or termination of the contract with the contracting authority or if electronic signature of documents must be performed.

3.2.3. For purposes of providing high quality of the service regarding requests, questions and suggestions for amendments of the agreement with the contracting party, solving of problems, receiving of information and cooperation in relation with the used services and MultiSport/MultiSport Kids cards it is possible that we record inbound and outbound calls of our employees with the contact persons, appointed by the contracting party. Recordings will be made only to phone calls performed through the telephone central system.

3.2.4. For complying of legal requirements about data which must be entered in accounting documents or registers, the data about legal representatives of contracting parties may be used and stored by Benefit Systems upon issuing of accounting documents, for entering of accounting documents in accounting registers upon fulfilment of obligation for storage of accounting documentation and information, upon performing of legal defense of Benefit Systems (if necessary).

3.3. So that we can assess your suitability for a particular job position you are applying for, announced by Benefit Systems Bulgaria OOD, we process certain personal data, in compliance with our Policy for personal data processing of job applicants.

3.4. Personal data of persons, who use the contact from on the Web Site or who communicate with us in any other way by any

3.4.1. You can send us questions, requests and publish comments by variety of means – for example by signing a contact form, integrated on our website, as well as through our profiles and fan sites in the social networks. In order to identify you and to process your message and send you our response (if such is required) we process your identification data and contact data who are filled upon sending of your message to us. .

3.3.2. Processing of your personal data by us is separate and different from processing of your data by controllers of the respective social networks for purposes and on the basis, defined thereunder.

3.4.3. Signing of contact form, sending it to us and the publishing by you of questions, requests, and comments is completely voluntarily, performed upon your initiative and with your consent. Your personal data processed for the purposes for review and feedback for received questions, requests and other statements and for the purposes of publishing of your comments on our profiles and fan sites in social networks shall be stored by us for a period of one month after processing by us of the statement sent to us.

3.4.4. For purpose of providing better quality and proving the subject of conversation it is possible that we record telephone calls, initiated by our employee who communicates with potential contracting parties, by using publically accessible contact details through registers while offering services in ordert o conclude agreement with Benefit Systems. . Recordings will be made only to phone calls performed through the telephone central system

 

3.4.5.  Personal data that we process in connection with reports submitted under the Act on the Protection of Persons Submitting Reports or Publicly Disclosing Information on Violations-

Benefit Systems processes the following types of personal data in the whistleblowing channels under Act on the Protection of Persons Submitting Reports or Publicly Disclosing Information on Violations : information for identification of the whistleblower, such as three names, address, telephone number, email address, quality of the whistleblower, information about a natural person named in the report as the person who committed the violation or with whom the named person is related, such as three names, place of work, position; Breach information that may allow inferences to be made about an individual.

3.5. Legal basis on which personal data are being processed

Benefit Systems processes the above mentioned personal data on the following legal basis:

3.5.1.  Legitimate interests of Benefit Systems, as described above and namely:

  • to provide the services under the contracts with the client companies pursuant the terms and conditions of these contracts, including to issue and deliver the MultiSport and MultiSport Kids cards,
  • to provide the availability of using of these card in the respective sports facilities, to fulfil its financial obligations to the persons, who manage the sports/recreational facilities, to check, establish and remedy cases of misuse of MultiSport/ MultiSport Kids cards (e.g not allowed use of the cards) or violation of the Term of use of MultiSport/ MultiSport Kids cards,
  • to seek and include new sports facilities in Programs MultiSport or MultiSport Kids,
  • to provide information for newly included facilities to current clients, to process recordings of telephone calls of employees of Benefit Systems or call-centers.
  • when conducting marketing research involving our Clients;
  • to collect and process contact data provided via a contact form on a Benefit Systems website would be , via a message on a social network, e-mail, in a telephone conversation
  • if necessary, to carry out its legal defense in the event of legal claims against Benefit Systems, as well as the legitimate interests of Benefit Systems in processing information about violations submitted through internal channels according to the order of Act on the Protection of Persons Submitting Reports or Publicly Disclosing Information on Violations.
  • necessity for carrying out legal defense in cases of legal claims against Benefit Systems.

3.5.2. fulfillment of obligations provided by law, for example:

  • 38 of the Tax and Insurance Procedural Code, Art. 12 of the Accounting Act, etc. (e.g. obligation to store documentation for tax and insurance control);
  • The Law on the protection of whistleblowers or publicly disclosing information about violations;
  • Personal Data Protection Act;

3.5.3 consent to the processing of personal data given by a parent of a MultiSport Kids card user,

3.5.4. performance of a contract to which the MultiSport card user is a party (if one has been concluded);  to enter into a contract with its counterparty, a legal entity, regardless of whether it is a partner

4. TO WHOM PERSONAL DATA MAY BE DISCLOSED AND WHO ARE THE PERSONS WHO PROCESS PERSONAL DATA ON OUR BEHALF

4.1. On condition that the disclosure of personal data is in compliance with the respective personal data legislation, Benefit Systems discloses or may disclose, if necessary the following personal data to the following persons:

- Printing works, printing the cards, usually we use external vendor for printing of MultiSport or MultiSport Kids, to whom we disclose only data, which is necessary to be printed on the cards- – name and surname, name of the client-company with whom we have signed contract for providing of services under Program MultiSport/ MultiSport Kids, optionally term of validity of the card (f applicable) and unique barcode, printed on the card. The printing works may be provided also with information for the office address, to which the cards must be delivered;

- Our partners (sports and recreational facilities) upon registration of visit of user of MultiSport/ MultiSport Kids card for using of services within their establishments, record data in our system and in the forms, samples of which are sent by us. Data which partners are instructed to collect is limited to information described in the Terms of Use of the of MultiSport/MultiSport Kids cards. In case that partners wish to collect personal data, different from the data described in the Terms for Use of Cards, they act as sole controllers and they are obliged to inform you about the processing of the data by them in the capacity of sole controllers;

- Clients (employers who signed contract with Benefit Systems) – in case of established misuse with MultiSport/ MultiSport Kids cards or breach of the Terms of Use, breach of contract with consequent blocking of particular MultiSport/ MultiSport Kids card, we will inform the client who pays us the price of the card. Upon exercising of some of the rights descried hereunder, it might be necessary to reveal to client information about these rights, if, in order to comply with your rights, it will be necessary to inform the client who pays us the price of the respective MultiSport/ MultiSport Kids card. Upon necessity of payment of price for issuing of duplicate of damaged/lost/stolen MultiSport/ MultiSport Kids card information for number of losses/damages/reported thefts may be disclosed to client company, who pays Us the price of the card ad issuing of duplicates (if it is stipulated in the contract);

- Vendors of additional services, supplied within the Program Програмата MultiSport/ MultiSport Kids (included, but not limited to organizers of sports contests and other events for which the users of cards had manifested their will to participate, as in this case only data, needed for the specific sports event are disclosed);

- Companies, providing informational systems, which we use and their maintenance including the terminals – barcode readers in the sports facilities, which are included in the Program MultiSport and MultiSport Kids;

- Companies, providing payment services – in case that some payment is needed by virtue of contract or act of legislation;

- Persons, providing services, related to servicing of MultiSport/ MultiSport Kids cards– e.g. persons who are in charge of telephone line for questions from users of cards (call-center). These persons are not granted with any access to data, related to use of Your card but can check if your card has been valid for the discussed month or other basic information. In case that we are processing your request, we must review your data, related to the use of the MultiSport/ MultiSport Kids cards the call-center sends us the request and we process it internally within our organization;

- Companies, who provide to Benefit Systems legal, accounting, consultancy and auditor services – upon necessity part of your data may be disclosed to our suppliers of accounting services for the purposes of updating of our accounting registers with necessary information or from the purposes for issuing of accountancy documents or for the purposes of performing of financial or other audit. In case of Benefit Systems needs legal services, we may disclose your personal data to our legal services suppliers;

- marketing research agencies - in order to improve the quality of the service and customer experience, we sometimes ask our Clients for feedback by conducting satisfaction or other surveys, which are conducted no more than several times a year. To do so, we contact by phone or e-mail the respective point of contact indicated by the Client.Benefit Systems processes the following personal data of the contact persons related to the abovementioned surveys: basic data: name, business email, employer data. Benefit Systems may also assign a marketing research agency to conduct the survey in question;

- As Benefit Systems is part of multinational group – Benefit Systems Group, your personal data may be disclosed to: Benefit Systems International Sp. z o.o., with address: Młynarska 8/12 01-194 Warsaw Warsaw, Poland and Benefit System SA, Pl. with address: Europejski 2, 00-844 Warsaw, Poland. Reasons for tat may include: providing of administrative, managerial and other services by the company to us (e.g. IT support of some software systems that we use)

- If necessary, competent state authorities might fulfill their legitimate obligations, envisaged for Benefit Systems, - e.g. National Revenue Agency for tax accountability purpose.

4.2. Benefit Systems does not transfer or by any other means process personal data outside the EU.

5. FOR HOW LONG WE PROCESS PERSONAL DATA AND WHY

5.1. All personal data are being processed by Benefit Systems for limited period of time. Depending on the purpose, Benefit Systems is processing personal data as following:

5.1.1. Personal data associated with a specific MultiSport/MultiSport Kids card, including (first, last name, E-mail, phone number, year and month of birth for MultiSport Kids users) is stored for a period of 18 months, after deactivation of the card MultiSport/MultiSport Kids.

5.1.2.Personal data, processed for purposes of issuing of invoices and fulfilment of other our legitimate obligations regarding compliance with tax and accounting legislation and other legal acts, may be stored for maximal term established by law – 10 years (or other term which to be provided in the law and (Art. 38 of the Tax-Insurance Procedural Code, Art.121 from the Act for VAT, Art.12 from the Accountancy act).

5.1.3. Personal data, which is contained in accounting documents and registers, as well as personal data related to payments from or to Benefit Systems are also being stored within the term described in the previous provision.

5.1.4. In the event of claims/claims for violations by card users, client companies and partners, the personal data related to a specific MultiSport/MultiSport Kids card of the respective user are also stored until the expiration of the limitation period for repayment of these claims/claims for violations by card users, client companies and partners. In general, the maximum period is 5 years, which period is included in the period for storing tax or accounting information specified in the transition points

5.1.5. The processing for data for contact with persons appointed for contact persons under contracts with client companies of Benefit Systems, for purposes of sending of up-to date information for the sites in which MultiSport or MultiSport Kids cards may be used, changes in the terms of use of MultiSport or MultiSport Kids cards or other relevant information, shall be suspended by the termination of contract for services upon change of contact person of the client company, in case of objection for the processing of personal data for such purposes by the data subject.

5.1.6. Voice records from telephone conversations are stored for 3 (three) months from the date of their occurrence and in case of filed claim or argument, the record will be stored for the term, necessary for the final solving of the claim/argument;

5.1.7. The data received in connection with a signal received under the order of Law on the protection of whistleblowers or publicly disclosing information about violations is usually stored until the follow-up measures are completed. In general, the data of the signal is deleted after 6 months after the proceedings have been definitively closed, unless the initiation of further legal actions requires their continued storage (e.g. initiation of administrative, criminal or disciplinary proceedings). Personal data related to the report will be deleted by us immediately if we determine that it is unfounded. Reports relating to violations committed more than 2 (two) years ago will be immediately deleted.

6. WHAT ARE THE RIGHTS OF THE PERSONS WHOSE PERSONAL DATA ARE BEING PROCESSED (DATA SUBJECTS) AND HOW TO EXERCISE THESE RIGHTS

6.1. Pursuant the GDPR provisions the data subject is entitled with the following rights regarding processing of his or her personal data:

6.1.1. right to withdraw his or her consent at any time, as the e withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal, if the processiing is based on consent - it can be exercised when the data subject contacts Benefit Systems to the contact details, mentioned above;

6.1.2. right to access to the personal data (i.e. to request whether his/her personal data are being processed and to receive copy from the processed data as well as information about the purpose of processing to whom personal data are or will be disclosed – Art.15 of the GDPR);

6.1.3. right to rectification of the personal data (i.e. the data subject to request rectification of inaccurate personal data concerning him or her or completing of incomplete personal– Art.16 of the GDPR);

6.1.4. right of erasure of personal data (i.e. to request personal data to be erased upon the condition of Art.17 of the GDPR, including data for which there is no legal basis for processing or which have been unlawfully processed);

6.1.5. right to restriction of processing of personal data (i.e. to request personal data to be stored without being processed by other means under the conditions of Art.18 from the GDPR);

6.1.6. right to data portability (i.e under the conditions of Art.20 from the GDPR to obtain personal data in in a structured, commonly used and machine-readable format, and to request from Us to transmit them to another data controller if the transfer is technically feasible and the oher controller agrees to accept them);

6.1.7. right to object against processing of personal data for purposes of direct marketing and to object against processing of personal data for purposes of legitimate interests of the controller under the conditions of Art.21 of the GDPR;

6.1.8. right to lodge a complaint with a supervisory authority to the Commission for Personal Data Protection (address : Sofia,1592, 2, Prof. Tzvetan Lazarov, blvd.,) in case of violation of the applicable legislation concerning personal data protection.

The above rights can be exercised by filing of a written statement, prepared in compliance with the Personal Data Protection Act regulations, sent to Our contact details, specified above and the right to lodge a complaint – sent to the Commission for Personal Data Protection.

7. AMENDMENTS IN THIS POLICY

7.1. We shall review and update this Policy on regular basis in order to comply with legislative changes and to make effort to improve the level of the personal data security.

Final version of this Policy is dated January 10th, 2024