What is the scope of this Privacy Notice?

This Privacy Notice under the EU General Data Protection Regulation (GDPR) explains how CHIMATECH AD processes your personal data. It may also include personal data relating to other individuals when you share their personal data with us.
This notice provides detailed information on how we collect your personal data, why we collect it, and with whom we may share it. It also explains your rights in relation to your personal data.
This applies to all personal data, including data stored electronically or on paper.

What personal data may we collect about you?

CHIMATECH AD collects and processes your personal data that may be provided directly by you, obtained from publicly available sources, or received from third parties with whom we have contractual relationships (e.g. market research companies, accounting service providers, etc.).

Personal data includes any information that identifies you or can be used to identify you. The types of personal data we collect depend on the nature of your relationship with CHIMATECH AD and applicable legislation. The personal data we process includes data collected directly from you as part of our relationship or through other interactions you may have with us.

Depending on the purpose, the information we process may include the following personal data:

• name;

• contact details (address, phone number, email address);

• personal identification number /where required/;

• demographic data /where required/;

• health and other sensitive personal data /where required/;

• data collected from cookies /where required/;

• data collected from website/mobile device usage and analytics /where required/;

• programs and activities in which you have participated /where required/;

• opinions about us or our products and services /where required/;

• communication and other personal preferences /where required/;

• product information requests /where required/;

• payment-related information; and/or

• financial information (bank accounts, codes, credit card numbers) /where required/.

How will we use your personal data?

Processing of your personal data includes operations such as recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure, or destruction.

We may process your personal data for the following purposes:

• communicating product and service safety information;

• responding to your inquiries regarding information, products, or services;

• corporate compliance and facility/network security considerations;

• authorizing, providing, administering, monitoring, and terminating access to or use of CHIMATECH AD websites, systems, facilities, records, property, and/or infrastructure;

• internal investigations of potential violations of policies and procedures;

• auditing programs and services for compliance purposes;

• legal proceedings and government investigations (such as orders, subpoenas, and court rulings);

• determining eligibility for certain products, services, or programs;

• where we are legally required to process personal data;

• communication related to market research and product development;

• communication related to product information;

• business and marketing research;

• product orders;

• improvement and development of our products and services;

• statistical analysis;

• payment processing; and/or

• website administration.

For any other purposes requiring your notice and consent, including those imposed by local legislation, we will obtain your consent before processing your personal data.

On what legal basis do we process your personal data?

The applicable legal bases for processing your personal data for the purposes listed above include:

Based on your consent
In some cases, we may request your consent to collect and process your personal data, including sensitive personal data. If you provide consent, you have the right to withdraw it at any time by contacting us using the details in the “How to Contact Us” section below.
Please note that withdrawal of consent does not affect processing already carried out. Where processing is based on consent, we will provide more detailed information at the time consent is obtained.

Compliance with legal obligations or performance of a contract
In certain circumstances, we may need to process your personal data to comply with legal requirements or to perform contractual obligations to which you are a party. In such cases, you may not be able to object to the processing, and choosing to object or withdraw may affect our ability to perform contractual obligations.

Our legitimate interests
We may process your personal data based on our legitimate interests in communicating with you and managing interactions related to our products, services, research, and training opportunities.
You have the right to object to such processing by contacting us using the details below.

To whom and when do we disclose or share your personal data?

We may disclose or share your personal data with:

• government authorities, institutions, and persons where required by law;

• third parties contracted to perform services on our behalf, strictly for the purposes described above. Such third parties are contractually required to protect confidentiality and security and may not use your data for other purposes;

• potential or actual third-party buyers in the event of restructuring, sale, merger, or acquisition. Such parties will be required to process personal data in accordance with this Privacy Notice.

How do we protect your personal data?

We apply standard administrative, technical, and physical safeguards to protect personal data against loss, theft, misuse, unauthorized access, alteration, disclosure, or destruction.
Access is restricted to employees and third parties with a legitimate business need. Personal data is shared only with parties who have provided written assurances of adequate protection consistent with this Privacy Notice.

How long will we retain your personal data?

Your personal data will be retained for the duration of your relationship with us and in accordance with our internal record retention policies. Data may be retained longer where required by law or where ongoing obligations exist.

What are your rights?

You have the right to access and receive a copy of your personal data, including an electronic copy, request correction of inaccurate or incomplete data, request erasure when data is no longer necessary, restrict processing, object to processing, or request data portability under certain circumstances.

To exercise these rights, please contact us using the details below. You also have the right to file a complaint if you believe your rights have been violated.

What happens if we update this Privacy Notice?

We may periodically update this Privacy Notice to reflect legal or processing changes. You will be informed of any material changes, which will take effect after notification.

How can you contact us?

You may contact us to:

• ask questions;

• raise concerns or file a complaint;

• opt out of a program or service; and/or

• exercise your rights (access, correction, portability, objection, restriction, and erasure).

Contact person: Nora Pashaliyska
Correspondence address: CHIMATECH AD, 14 Assen Yordanov Blvd., 1592 Sofia, Bulgaria
Email: info@chimatech.bg