PRIVACY POLICY

Last Updated: 17 June 2026

1. Introduction

Sustainable Energy Supply Ltd. ("Company", "we", "us", "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when individuals visit our website, contact us, engage in business relationships with us, or otherwise interact with our services.

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), applicable Bulgarian legislation, and other relevant data protection laws.

 

2. Data Controller

The data controller responsible for the processing of personal data under this Privacy Policy is:

Sustainable Energy Supply Ltd.

registered and operating under the laws of the Republic of Bulgaria.

For matters relating to personal data protection, data subjects may contact the Company through the contact details published on this website.

 

3. Personal Data We Collect

Depending on the nature of the interaction, we may collect and process the following categories of personal data:

• Name and surname;

• Business affiliation and job title;

• Telephone number;

• Postal address;

• Information contained in correspondence, inquiries, and communications;

• IP address;

• Browser and device information;

• Website usage and navigation data;

• Security and system log information;

• Any other information voluntarily provided to us.

The Company does not intentionally collect or process special categories of personal data unless required by law or voluntarily provided and necessary for a legitimate business purpose.

 

4. Purposes of Processing

Personal data may be processed for the following purposes:

• Responding to inquiries and communications;

• Establishing and maintaining business relationships;

• Negotiating, concluding, and performing contracts;

• Managing customer, supplier, and partner relationships;

• Complying with legal, regulatory, accounting, and tax obligations;

• Protecting the legitimate interests of the Company;

• Ensuring the security and integrity of our website, systems, and operations;

• Preventing fraud, misuse, and unauthorized access;

• Improving the functionality, performance, and user experience of our website;

• Exercising or defending legal claims.

 

5. Legal Basis for Processing

We process personal data on one or more of the following legal grounds:

• Performance of a contract or pre-contractual measures;

• Compliance with a legal obligation;

• Legitimate interests pursued by the Company or a third party;

• Consent of the data subject where required by applicable law.

Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before such withdrawal.

 

6. Cookies and Similar Technologies

Our website may use cookies and similar technologies to ensure proper website functionality, improve user experience, maintain security, and analyze website performance.

Where required by applicable law, non-essential cookies will only be placed after obtaining the user's prior consent.

Users may manage cookie preferences through browser settings or any cookie management tools made available on the website.

 

7. Disclosure of Personal Data

The Company may disclose personal data to:

• Companies within the Terra Way Holding group;

• Information technology, hosting, cloud, and website service providers;

• Legal, financial, tax, and professional advisers;

• Regulatory authorities, governmental bodies, courts, and law enforcement agencies where required by law;

• Business partners, counterparties, infrastructure operators, and service providers where necessary for contractual or legitimate business purposes.

All recipients are required to process personal data in accordance with applicable data protection laws and appropriate confidentiality obligations.

The Company does not sell personal data to third parties.

 

8. International Data Transfers

Given the international nature of the Company's operations, personal data may be transferred to and processed in countries outside the European Economic Area (EEA).

Where such transfers occur, the Company implements appropriate safeguards in accordance with GDPR requirements, including Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms.

 

9. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, accounting, tax, and reporting obligations.

Retention periods are determined based on the nature of the data, legal requirements, contractual obligations, and legitimate business needs.

When personal data is no longer required, it will be securely deleted, anonymized, or archived in accordance with applicable legal requirements.

 

10. Security Measures

The Company implements appropriate technical and organizational measures designed to protect personal data against:

• Unauthorized access;

• Accidental or unlawful destruction;

• Loss;

• Alteration;

• Disclosure;

• Misuse.

Such measures are regularly reviewed and updated to reflect technological developments and evolving security risks.

While we strive to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

 

11. Rights of Data Subjects

Subject to applicable law, data subjects have the right to:

• Access their personal data;

• Request correction of inaccurate or incomplete data;

• Request erasure of personal data;

• Request restriction of processing;

• Object to processing based on legitimate interests;

• Withdraw consent at any time where processing is based on consent;

• Receive personal data in a structured, commonly used, and machine-readable format where applicable;

• Lodge a complaint with a competent supervisory authority.

The Company may request sufficient information to verify the identity of any individual exercising their rights.

 

12. Children's Privacy

The Company's website and services are not directed toward individuals under the age of 18.

The Company does not knowingly collect personal data from children. If personal data relating to a child is identified, reasonable steps will be taken to delete such information without undue delay.

 

13. Third-Party Websites

This website may contain links to third-party websites. The Company is not responsible for the privacy practices, content, or security of such external websites.

Users are encouraged to review the privacy policies of any third-party websites they visit.

 

14. Changes to this Privacy Policy

The Company reserves the right to amend or update this Privacy Policy at any time to reflect changes in legal requirements, business operations, or website functionality.

Any updated version will be published on this website and will become effective upon publication.

 

15. Supervisory Authority

Individuals located within the European Union have the right to lodge a complaint with the competent data protection authority.

For Bulgaria, the competent supervisory authority is:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria

 

16. Contact Regarding Privacy Matters

Questions concerning this Privacy Policy or the processing of personal data may be addressed to the Company through the contact details published on this website.

By using this website, visitors acknowledge that they have read and understood this Privacy Policy.

6.1 Strictly Necessary Cookies

These cookies are essential for the operation, security, and functionality of the website. They enable core functions such as page navigation, security controls, session management, load balancing, and protection against malicious activity.

The website cannot function properly without these cookies.

6.2 Performance and Analytics Cookies

Subject to applicable legal requirements and user consent where required, the Company may use analytics technologies to understand how visitors interact with the website, improve content, optimize performance, and enhance user experience.

Analytics data is generally aggregated and does not directly identify individual users.

6.3 Third-Party Technologies

The website may utilize services provided by third parties, including but not limited to:

• website hosting providers;
• content delivery networks;
• security and anti-spam services;
• analytics platforms;
• embedded content providers.

Such third parties may place cookies or process technical information in accordance with their own privacy policies.

The Website may use third-party technologies and services, including but not limited to:

- Google Analytics;
- Google Tag Manager;
- Google Ads;
- Google Maps;
- Google reCAPTCHA;
- YouTube embedded content;
- Meta (Facebook) Pixel;
- LinkedIn Insight Tag;
- Microsoft Clarity;
- Hosting and cloud infrastructure providers;
- Content delivery networks (CDNs);
- Security and anti-spam services.

These providers may collect technical information including IP addresses, browser information, device identifiers, cookie identifiers, browsing behavior, referral URLs, and interaction data.

Where required by applicable law, such technologies will only be activated following the user's consent.

6.4 Browser Controls

Users may configure browser settings to block, delete, or restrict cookies. However, disabling certain cookies may adversely affect website functionality and availability of services.

6.5 Withdrawal of Consent

Users may withdraw or modify their cookie preferences at any time through the cookie settings available on the website.

Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.

6.6 Consent Management

The Website utilizes a cookie consent mechanism that enables users to:

- Accept all cookies;
- Reject non-essential cookies;
- Customize cookie preferences.

No non-essential cookies shall be placed on the user's device before the appropriate consent has been obtained where required by applicable law.

 

17. Website Use and Acceptance

By accessing or using this website, visitors acknowledge that they have reviewed and understood this Privacy and Cookie Policy.

Where consent is required under applicable law, users will be provided with appropriate mechanisms to grant, refuse, or withdraw consent regarding non-essential cookies.

The continued use of the website following the publication of any amendments to this Policy constitutes acceptance of the updated version.

The Company reserves the right to restrict access to certain website functionalities where the use of strictly necessary cookies or technical processing required for the operation and security of the website is disabled.

 

18. Limitation of Liability

While the Company implements commercially reasonable measures to maintain the security, availability, and accuracy of the website, the website and its contents are provided on an "as available" and "as is" basis.

To the fullest extent permitted by applicable law, the Company disclaims any liability for:

• temporary interruptions or unavailability of the website;
• technical errors, delays, or inaccuracies;
• unauthorized access by third parties;
• malware, cyberattacks, or security incidents beyond the Company's reasonable control;
• indirect, incidental, special, consequential, or punitive damages arising from the use of the website.

Nothing in this Policy shall exclude liability where such exclusion is prohibited by applicable law.

19. Data Accuracy

Users are responsible for ensuring that any information they provide to the Company is accurate, complete, and up to date.

The Company shall not be liable for consequences arising from inaccurate, incomplete, or outdated information provided by users.

20. Governing Law and Jurisdiction

This Privacy and Cookie Policy shall be governed by and interpreted in accordance with the laws of the Republic of Bulgaria and applicable European Union legislation.

Any disputes arising from or related to this Policy shall be subject to the exclusive jurisdiction of the competent courts of the Republic of Bulgaria, unless mandatory legal provisions provide otherwise.

TERMS OF USE

Last Updated: 17 June 2026

1. Acceptance of Terms

Welcome to the website of Sustainable Energy Supply Ltd. ("Company", "we", "us", or "our").

By accessing, browsing, or using this website, you acknowledge that you have read, understood, and agree to be legally bound by these Terms of Use and all applicable laws and regulations.

If you do not agree with these Terms of Use, you must discontinue use of the website immediately.

 

2. Purpose of the Website

This website is provided for informational and business purposes only.

The information published on this website is intended to provide general information regarding the Company's activities, services, operations, projects, and market presence.

Nothing contained on this website constitutes legal, financial, investment, commercial, trading, technical, or professional advice.

No information published on this website shall be interpreted as an offer, solicitation, recommendation, commitment, guarantee, or promise regarding any transaction, product, service, or investment opportunity.

 

3. Eligibility

By using this website, you represent and warrant that:

• you have legal capacity to enter into binding agreements;

• you will comply with all applicable laws and regulations;

• you will use the website solely for lawful purposes.

The website is not directed toward individuals under eighteen (18) years of age.

 

4. Intellectual Property Rights

Unless otherwise stated, all content available on this website, including but not limited to:

• text;

• graphics;

• logos;

• trademarks;

• trade names;

• images;

• photographs;

• videos;

• audio recordings;

• software;

• design elements;

• layouts;

• databases;

• source code and underlying technology,

is owned by or licensed to Sustainable Energy Supply Ltd. and is protected by applicable intellectual property laws.

No content may be copied, reproduced, distributed, modified, published, transmitted, displayed, sold, licensed, or otherwise exploited without the Company's prior written consent.

Users may view, download, and print content solely for personal, non-commercial, and informational purposes.

 

5. Trademarks

All trademarks, service marks, logos, trade names, and branding elements displayed on this website are the property of Sustainable Energy Supply Ltd. or their respective owners.

Nothing contained on this website shall be construed as granting any license or right to use any trademark without prior written authorization.

 

6. Permitted Use

Users agree to use the website responsibly and in accordance with applicable law.

Users shall not:

• attempt to gain unauthorized access to the website, servers, systems, or networks;

• interfere with the operation or security of the website;

• introduce viruses, malware, malicious code, or harmful technologies;

• conduct data mining, scraping, automated extraction, or similar activities;

• use the website for fraudulent, unlawful, or harmful purposes;

• infringe upon the rights of the Company or third parties.

The Company reserves the right to restrict or terminate access to any user who violates these Terms.

 

7. Accuracy of Information

The Company makes reasonable efforts to ensure that information on this website is accurate and up to date.

However, the Company does not warrant or guarantee that:

• all information is complete, accurate, current, or error-free;

• the website will always remain available;

• information will remain unchanged after publication.

Information may be modified, updated, corrected, or removed at any time without prior notice.

Users are responsible for independently verifying any information before relying upon it.

 

8. No Warranties

To the fullest extent permitted by applicable law, this website and all content are provided on an "AS IS" and "AS AVAILABLE" basis.

The Company expressly disclaims all warranties of any kind, whether express, implied, statutory, or otherwise, including but not limited to:

• merchantability;

• fitness for a particular purpose;

• non-infringement;

• uninterrupted availability;

• security;

• accuracy;

• reliability.

The Company does not warrant that the website will be free from errors, interruptions, viruses, or other harmful components.

 

9. Limitation of Liability

To the maximum extent permitted by law, Sustainable Energy Supply Ltd., its shareholders, directors, officers, employees, affiliates, representatives, contractors, and partners shall not be liable for any:

• direct losses;

• indirect losses;

• incidental losses;

• consequential losses;

• special damages;

• punitive damages;

• business interruption;

• loss of profits;

• loss of revenues;

• loss of opportunities;

• loss of goodwill;

• loss of data;

arising out of or related to:

• use or inability to use the website;

• reliance on information published on the website;

• technical failures;

• cyber incidents;

• unauthorized access;

• third-party actions;

• website downtime;

• errors or omissions in content.

This limitation applies regardless of the legal theory asserted and even if the Company has been advised of the possibility of such damages.

 

10. Third-Party Links

The website may contain links to third-party websites, platforms, services, or resources.

Such links are provided solely for convenience and informational purposes.

The Company does not control, endorse, monitor, or assume responsibility for:

• third-party content;

• products or services;

• privacy practices;

• security practices;

• availability of external websites.

Accessing third-party websites is entirely at the user's own risk.

 

11. Website Security

The Company employs reasonable technical and organizational measures to protect the website and its systems.

However, no electronic communication, network, or system can be guaranteed to be completely secure.

Users acknowledge and accept the inherent risks associated with internet communications and online services.

 

12. User Communications

Any information submitted through contact forms, inquiries, or other communications may be processed in accordance with the Company's Privacy & Cookie Policy.

Users shall not submit:

• unlawful content;

• defamatory material;

• offensive content;

• malicious code;

• confidential information they are not authorized to disclose.

The Company reserves the right to remove, ignore, or report unlawful communications where appropriate.

 

13. Force Majeure

The Company shall not be liable for any delay, interruption, failure, or inability to provide website access resulting from events beyond its reasonable control, including but not limited to:

• natural disasters;

• acts of government;

• war;

• terrorism;

• labor disputes;

• cyberattacks;

• telecommunications failures;

• internet outages;

• utility disruptions.

14. Indemnification

Users agree to indemnify, defend, and hold harmless Sustainable Energy Supply Ltd., its affiliates, officers, employees, agents, and representatives from and against any claims, liabilities, damages, losses, costs, expenses, and legal fees arising from:

• violation of these Terms;

• unlawful use of the website;

• infringement of third-party rights;

• misuse of website content.

 

15. Privacy and Cookies

The collection and processing of personal data are governed by the Company's Privacy & Cookie Policy, which forms an integral part of these Terms of Use.

By using the website, users acknowledge that they have reviewed the applicable Privacy & Cookie Policy.

 

16. Modifications

The Company reserves the right to modify, amend, update, or replace these Terms of Use at any time without prior notice.

Any revised version shall become effective immediately upon publication on the website.

Continued use of the website following publication of revised Terms constitutes acceptance of the updated Terms.

 

17. Severability

If any provision of these Terms is found to be unlawful, invalid, or unenforceable, the remaining provisions shall remain in full force and effect.

18. Governing Law

These Terms of Use shall be governed by and construed in accordance with the laws of the Republic of Bulgaria and applicable legislation of the European Union.

 

19. Jurisdiction

Any dispute arising out of or relating to the use of this website or these Terms of Use shall be subject to the exclusive jurisdiction of the competent courts of the Republic of Bulgaria, unless mandatory provisions of applicable law provide otherwise.

 

20. Contact Information

Questions concerning these Terms of Use may be directed to the Company through the contact details published on this website.

# Personal Data Protection Notice for Clients

The protection of personal data is of utmost importance to **Sustainable Snergy Supply LTD** ("Sustainable Snergy Supply," "we," "us").

Sustainable Snergy Supply LTD respects your privacy and is committed to complying with the General Data Protection Regulation (GDPR) and the applicable personal data protection legislation in force in the Republic of Bulgaria.

This notice informs you how Sustainable Snergy Supply LTD collects and uses your personal data in your capacity as our client.

## Data Controller

The controller of your personal data is Sustainable Snergy Supply LTD, a company registered in the Republic of Bulgaria and entered in the Commercial Register with the Registry Agency under UIC [company registration number], with registered address at 17-19 Damyan Gruev Str., Sofia, Bulgaria.

If you have any questions regarding this notice, or about the personal data Sustainable Snergy Supply LTD processes about you, you can contact us via the contact form on our website, or by telephone using the numbers published on our website, or in writing at the address above, for the attention of the Data Protection Officer. We will respond within 30 days, or sooner if possible.

## Purposes and Legal Grounds for Processing Personal Data

Your personal data is processed in connection with, and for the purposes of, the core and ancillary services provided by Sustainable Snergy Supply LTD in connection with the supply of natural gas, electricity, and petroleum products, including the conclusion and performance of supply contracts, customer identification and registration, metering, invoicing, technical inspection and maintenance, and the organization of related on-site services.

For the purposes of security, access control, and ensuring your safety and that of our other clients while using our services, we collect personal data through video surveillance of publicly accessible areas and common premises in the buildings and facilities we operate (entrances, reception areas, offices, fuel stations, and storage and distribution facilities, among others).

We also use your personal data to provide you with up-to-date information and pricing offers for our services (advertising and marketing), and to ensure an individual approach in the provision of our services (customer service).

Sustainable Snergy Supply LTD collects and stores your personal data on the grounds of performance of statutory and contractual obligations, the taking of steps prior to entering into a contract, and the legitimate interests of Sustainable Snergy Supply LTD or our clients.

Sustainable Snergy Supply LTD processes your personal data only for the purposes for which it was collected, unless further processing is compatible with the original purpose.

Where Sustainable Snergy Supply LTD intends to process your personal data for a purpose that is not compatible with the original purpose of collection, we will duly notify you and inform you of the legal ground permitting that further processing.

Sustainable Snergy Supply LTD does not need your consent in order to process your personal data for the purposes of providing its core (and ancillary) energy-supply services. In limited cases, Sustainable Snergy Supply LTD may approach you for explicit written consent to allow processing of your personal data for other purposes, such as sharing it with our partners so that you can receive information or pricing offers for services or goods.

In all such cases, you will first be given full and clear information so that you can decide whether you wish to give your consent. Please note that giving consent to the processing of personal data is not a condition for using our core and ancillary services.

### Applications and Inquiries

On the grounds of contractual obligations and the taking of steps prior to entering into a contract, Sustainable Snergy Supply LTD processes the following personal data when you apply for the supply of natural gas, electricity, or petroleum products, or request a quote: names, age, nationality, telephone number, e-mail address, the address and/or delivery/supply point, the type and estimated volume of the requested supply, and any special requirements you may have.

On the grounds of performance of statutory and contractual obligations relating to your application, Sustainable Snergy Supply LTD processes your personal data related to payment and invoicing (bank, IBAN, account holder, currency of payment, credit/debit card number, validity and holder, CVV/CVC code, personal identification number (EGN) or other identification number, and other information collected in connection with making a payment).

For inquiries about our services submitted through any of our websites, the contact form, or by telephone, Sustainable Snergy Supply LTD processes your names, telephone number, and e-mail address, on the grounds of taking steps prior to entering into a contract, in order to provide you with up-to-date information and a pricing offer for the requested services.

### Conclusion and Performance of Supply Contracts

When you conclude a contract with us for the supply of natural gas, electricity, or petroleum products, Sustainable Snergy Supply LTD has a statutory obligation to identify you and to collect your names, personal identification number (EGN) or personal number of a foreigner (LNCh), date of birth, gender, nationality, identity document number, country of issue and validity date of the identity document, the supply/delivery address, the metering or installation point, and the start and (where applicable) end date of supply.

Where supply is metered, Sustainable Snergy Supply LTD also processes consumption data recorded by gas, electricity, or fuel meters at your delivery point, for the purposes of accurate billing, technical balancing, and compliance with our statutory obligations as a supplier.

In performance of its statutory and contractual obligations, Sustainable Snergy Supply LTD processes your personal data related to payment and invoicing (bank, IBAN, account holder, currency of payment, credit/debit card number, validity and holder, CVV/CVC code, personal identification number (EGN) or other identification number, and other information collected in connection with making a payment), which are necessary for invoicing, payment, and accounting for the supply provided to you.

### Technical, Maintenance and Other On-Site Services

When we provide technical inspection, maintenance, metering, or other services at our facilities or at your premises, on the grounds of performance of our statutory and contractual obligations we process your names, personal identification number (EGN) or personal number of a foreigner (LNCh), and your personal data related to payment and invoicing (as described above).

Where you expressly state special requirements in connection with these services, we process such preferences on the grounds of performance of our contractual obligations to you.

### Customer Card and Online Account

As our client, you have the right to request a customer card (including, where applicable, a fuel/fleet card for the purchase of petroleum products) or the creation of an online customer account. A customer card or online account allows us to identify you as a client who has already used our services and to offer you preferential terms for certain services. When issuing a customer card or creating an online account, we collect/process your names, date of birth, address, telephone number, and e-mail address. This data is collected/processed on the grounds of the legitimate interests of Sustainable Snergy Supply LTD — to provide you with up-to-date information and pricing offers for our services (advertising and marketing), and to ensure an individual approach in the provision of our services (preferences).

### Marketing and Advertising

On the grounds of the legitimate interest of Sustainable Snergy Supply LTD to provide you with up-to-date information and pricing offers for our services, we use the names and e-mail address you have provided in order to send you our offers, promotions, and discounts. If you do not wish to receive such communications, you may opt out at any time, and we will stop sending you such information.

### Website and Cookies

When you visit our website to browse it and/or to submit an inquiry about any of our services, we collect data about your use of the website through so-called "cookies." Cookies are small text files stored on the device (computer, mobile phone) from which you visit our website for the first time. There are different types of cookies. Some are necessary for our website to function. Others help us improve the functioning of our website by collecting anonymized information about which parts of the website are visited most. The cookies described above do not collect personal data.

Cookies that do collect personal data are of two kinds: cookies intended to improve your use of the website by remembering your preferences (for example, language, font size, location, and others), and so-called "advertising cookies." Advertising cookies collect data about which websites you visit, helping us identify which of our products and services may be of interest to you. The ground for using cookies that collect personal data is our legitimate interest in understanding your preferences so that we can offer you services that best meet your needs.

All categories of cookies can be disabled through the cookie settings menu, except for those that are strictly necessary for the website to function.

## Video Surveillance

Sustainable Snergy Supply LTD processes personal data on the grounds of its legitimate interest in carrying out video surveillance and access control, for the purpose of protecting property and ensuring the physical security of our clients, visitors, and staff. Video surveillance and recording take place in publicly accessible areas and premises at the facilities operated by Sustainable Snergy Supply LTD (including offices, fuel stations, and storage and distribution facilities), as well as in areas subject to a special access regime. Sanitary facilities are not monitored by video surveillance. Visitors and clients are informed of the use of technical surveillance and control equipment by information signs displayed in a visible place.

## Collection of Personal Data

Sustainable Snergy Supply LTD collects personal data directly from its clients when they apply for supply or services, when a contract is concluded, or through inquiries submitted via the contact form on our website or by telephone, and indirectly where an application or contract is made through an authorized representative, agent, or intermediary.

Special cases in which personal data of data subjects are collected include situations where a person other than the data subject applies for services on behalf of the data subject (for example, where your employer applies for services that you, as its employee, will use).

## Recipients of Personal Data

Sustainable Snergy Supply LTD has a statutory obligation to provide the personal data of its clients to public authorities exercising control over energy and fuel trading activities, such as the Energy and Water Regulatory Commission, the Ministry of Energy, the National Revenue Agency, the Ministry of Interior, the Commission for Consumer Protection, the judicial authorities, and other competent bodies.

Sustainable Snergy Supply LTD enters into contracts with subcontractors and partners to whom it transfers personal data necessary for the provision of certain core and ancillary services, such as metering and technical maintenance providers, transmission and distribution network operators, and transport and logistics companies.

Your personal data may also be disclosed to third-party partners who, under a concluded contract and an undertaken confidentiality commitment, assist Sustainable Snergy Supply LTD in performing its statutory obligations, by providing services such as accounting, audit, and the maintenance of information systems.

Recipients of your personal data also include advertising networks, through the so-called "advertising cookies" that you have allowed when visiting our website.

## Retention Period

Sustainable Snergy Supply LTD will process and store your personal data for as long as necessary to achieve the purposes for which it was collected, and in order to comply with statutory requirements for the retention of such data for a certain period.

The personal data we collect in connection with applications and the performance of supply contracts is retained for 5 (five) years from the date of termination of the contractual relationship between you and Sustainable Snergy Supply LTD. In all cases, personal data is retained until the final settlement of all financial relations between the parties, in accordance with statutory requirements. Personal data contained in accounting and financial documents is retained for tax and social-security control purposes in accordance with statutory periods, for at least 10 (ten) years from 1 January of the reporting period following the one to which they relate, unless the law provides for a longer period.

Personal data may be retained for longer periods to protect our legitimate interests, and until the expiry of the relevant limitation period, for the purpose of protection against potential legal claims by clients. Where a legal dispute has arisen, personal data is retained until its final resolution by a court or arbitration decision that has entered into force.

Video recordings from our technical surveillance equipment are retained for up to 30 days from the date of recording.

Cookie data is retained until you change your cookie preferences and disable the use of the categories of cookies that collect personal data.

We will destroy your personal data as soon as reasonably possible after the expiry of the applicable retention period, in a manner that ensures it cannot be reproduced or restored.

## Security

The personal data you provide to us is treated by Sustainable Snergy Supply LTD as strictly confidential.

To ensure the security of personal data, Sustainable Snergy Supply LTD applies technical and organizational measures to protect against unauthorized access, loss, theft, misuse, disclosure, alteration, or destruction. Access to your data within Sustainable Snergy Supply LTD is granted only to staff whose duties require access to and processing of such data.

Sustainable Snergy Supply LTD requires its suppliers, subcontractors, and partners who have access to your data to take appropriate technical and organizational measures to ensure its protection and confidentiality.

Confidentiality clauses covering the personal data to which they have access are included in our contracts with employees and with the third parties to whom we entrust the processing of your personal data.

## Your Rights

In connection with the personal data processed by Sustainable Snergy Supply LTD, you have the following rights:

**Right of access** — You may, at any time, request more detailed information about the processing of your personal data, and you may request a copy of the personal data Sustainable Snergy Supply LTD holds about you.

**Right to rectification** — Where the personal data Sustainable Snergy Supply LTD processes about you is inaccurate, you have the right to request that it be corrected.

**Right to data portability** — You may request that we provide your personal data to you, or transfer it to another controller, in a structured, commonly used, machine-readable format. This right applies where your personal data was collected and is used to perform Sustainable Snergy Supply LTD's contractual obligations, or is processed on the basis of your explicit consent.

**Right to erasure** — You may request that your personal data be deleted where it is processed in performance of contractual obligations, on the grounds of legitimate interest, or on the basis of your explicit consent, and where one of the following applies: (1) the data is no longer necessary for the purposes for which it was collected; (2) the processing is unlawful; (3) you object to the processing and there is no overriding legal ground for it; (4) you withdraw the consent on which the processing is based; or (5) the data must be deleted to comply with a statutory obligation.

**Right to withdraw consent** — Where the sole ground for processing your personal data is your consent, you may withdraw it at any time, with effect for the future.

**Right to restriction of processing** — You may request that we restrict the processing of your personal data: (1) while we verify personal data you have asked us to correct; (2) where processing is unlawful but you do not want the data deleted, and instead want its use restricted; (3) where Sustainable Snergy Supply LTD no longer needs the data but you want it retained for the establishment of legal claims; or (4) while we verify whether our grounds for processing override yours, following an objection you have raised.

**Right to object** — You may object to the processing of your personal data where it is carried out on the grounds of the legitimate interest of Sustainable Snergy Supply LTD or a third party, for the performance of a task in the public interest, or in the exercise of official authority, including related profiling. In such cases, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is necessary to establish, exercise, or defend legal claims, we will stop processing that personal data.

You may also object, at any time, to the processing of your personal data for direct-marketing purposes, including related profiling. Sustainable Snergy Supply LTD will inform you of this right clearly and separately from any other information.

**Right to lodge a complaint** — Sustainable Snergy Supply LTD makes every effort to comply with all applicable rules and security measures governing the processing of personal data, and we hope no situation will arise in which you have cause to be dissatisfied with how we have treated your data. Should any issue arise, you have the right to contact the supervisory authority: the Commission for Personal Data Protection, address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia (www.cpdp.bg).

## Amendments to This Notice

Sustainable Snergy Supply LTD reserves the right to amend this notice on the protection of personal data, in which case you will be given the opportunity to review the updated version.

By accessing or using this website, you acknowledge that you have read, understood, and agree to be bound by all of the above.