Personal Data Protection Policy

This PERSONAL DATA PROTECTION POLICY is an integral part of the TERMS OF USE of the website www.meta-health.nl, administered by "CONSCIENTIA LTD".

Here, we detail how we collect and process personal data of data subjects - end users. We also describe the ways in which you can contact us if needed.

Grounds and Purposes for Using Your Personal Data

We process your personal data on the following grounds:

• Contract between you and us: To fulfill our obligations under it.
• Explicit consent from you: The purpose is specified for each specific case.
• Legal obligation: As required by law.

In the following paragraphs, you will find detailed information regarding the processing of your personal data based on the grounds on which we process them.

1. FOR CONTRACT PERFORMANCE OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONS

We process your personal data to fulfill contractual and pre-contractual obligations and to exercise the rights under the contracts concluded with you.

Purposes of processing:

• Establishing your identity;
• Managing and fulfilling your request and executing the concluded contract;
• Preparing an offer for concluding a contract;
• Preparing and sending an invoice for the services you use with us;
• Providing the necessary comprehensive service and collecting amounts due for the services used;
• Retaining correspondence related to orders, request processing, problem reporting, etc.;
• Notifying you about anything related to the services you use with us;
• Analyzing customer history;
• Detecting and/or preventing unlawful actions or actions contrary to our terms for the respective services;

Data we process on this basis: Based on the contract concluded between us, we process information about the type and content of the contractual relationship, as well as any other information related to the contractual relationship, including:

• Personal contact details - contact address, email, phone number;
• Identification data - full name, personal identification number or foreigner's identification number, current and/or permanent address;
• Data on orders made;
• Correspondence related to overall service - email, letters, information about your requests for problem resolution, complaints, applications, feedback received from you;
• Information on credit or debit card, bank account number, or other banking and payment information related to payments made;

Other information such as:

• Customer number, code, or other identifier created for identification;
• IP address when visiting our website;
• Demographic data;
• Social media profile data;
• Information from your actions on the site;

Processing the specified personal data is mandatory for us to conclude and execute the contract with you. Without providing the aforementioned data, we would not be able to fulfill our contractual obligations.

Providing personal data to third parties: We provide your personal data to third parties with the primary goal of offering you quality, fast, and comprehensive service. We do not provide your personal data to third parties before ensuring that all technical and organizational measures for data protection have been taken, striving to exercise strict control to achieve this goal. In this case, we remain responsible for the confidentiality and security of your data.

We provide personal data to the following categories of recipients (personal data administrators):

• Postal operators and courier companies;
• Persons contracted to maintain equipment, software, and hardware used for processing personal data and necessary for the company's activities;
• Persons providing consultancy services in various fields.

When we delete data collected on this basis: Data collected on this basis are deleted 5 years after the termination of the contractual relationship, whether due to expiration, cancellation, or another reason. The period is determined by the 5-year limitation period for possible claims under the contract.

2. FOR COMPLIANCE WITH LEGAL OBLIGATIONS

It is possible that the law requires us to process your personal data. In these cases, we are obliged to carry out the processing, such as:

• Obligations under the Law on Measures against Money Laundering;
• Fulfillment of obligations related to distance selling, off-premises sales, provided in the Consumer Protection Act;
• Providing information to the Consumer Protection Commission or third parties, as provided in the Consumer Protection Act;
• Providing information to the Personal Data Protection Commission regarding obligations provided in the personal data protection regulations;
• Obligations provided in the Accounting Act and the Tax and Social Security Procedure Code and other related regulations, concerning the maintenance of lawful accounting;
• Providing information to the court and third parties, within the framework of court proceedings, in accordance with the requirements of the applicable regulations;
• Verifying age when shopping online.

When we delete personal data collected on this basis: Data collected under a legal obligation are deleted after the obligation for collection and storage is fulfilled or ceases. For example:

• Under the Accounting Act for storage and processing of accounting data (11 years),
• Obligations for providing information to the court, competent state authorities, and other grounds provided in the applicable legislation (5 years).

Providing data to third parties: When the law provides for an obligation for us, it is possible to provide your personal data to the competent state authority, a physical or legal entity.

3. WITH YOUR CONSENT

We process your personal data on this basis only after your explicit, unambiguous, and voluntary consent. We will not foresee any adverse consequences for you if you refuse the processing of personal data.

Consent is a separate basis for processing your personal data, and the purpose of the processing is specified therein, and it is not covered by the purposes listed in this policy. If you give us the relevant consent and until its withdrawal or termination of any contractual relationships with you, we prepare appropriate product/service offers for you by conducting detailed analyses of your basic personal data;

Detailed analyses is a method for performing analysis that allows processing large volumes of data using statistical models and algorithms, among others, which include the use of personal data, as well as processes of pseudonymization and anonymization of the same, with the aim of extracting information about trends and various statistical indicators.

Data we process on this basis: On this basis, we process only the data for which you have given us your explicit consent. The specific data are determined for each individual case. Usually, this data includes an email address.

Providing data to third parties: On this basis, we may provide your data to marketing agencies, Facebook, Google, or other similar entities.

Withdrawal of consent: Provided consents can be withdrawn at any time. The withdrawal of consent does not affect the performance of contractual obligations. If you withdraw your consent for personal data processing for some or all methods described above, we will no longer use your personal data and information for the specified purposes. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To withdraw the given consent, you need only to use our website or contact us.

When we delete data collected on this basis: Data collected on this basis is deleted at your request or 12 months after their initial collection.

How we protect your personal data: To ensure adequate protection of the company's and its clients' data, we apply all necessary organizational and technical measures provided for in the Personal Data Protection Act. The company has established rules to prevent abuse and security breaches, which support the processes of safeguarding and securing your data. To ensure maximum security during processing, transfer, and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.

Personal data we receive from third parties: We do not receive data from third parties.

User Rights: Every user of the site is entitled to all rights for the protection of personal data under Bulgarian law and EU law.

The user can exercise their rights through the contact form or by sending a message to our email.

Every user has the right to:

• Information: (related to the processing of their personal data by the administrator);
• Access: to their personal data;
• Correction: (if the data is inaccurate);
• Deletion of personal data: ("right to be forgotten");
• Restriction of processing by the administrator or the processor of personal data;
• Data portability between different administrators;
• Objection to the processing of their personal data;
• **Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way;
• Protection: in judicial or administrative proceedings if the data subject's rights have been violated.

The user may request deletion if any of the following conditions are met:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• The user withdraws their consent on which the processing is based, and there is no other legal ground for the processing;
• The user objects to the processing, and there are no overriding legitimate grounds for the processing;
• The personal data has been unlawfully processed;
• The personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
• The personal data has been collected in relation to the offer of information society services to children, and the consent has been given by the holder of parental responsibility for the child.

The user has the right to restrict the processing of their personal data by the administrator when:

• They contest the accuracy of the personal data. In this case, the restriction of processing is for a period that allows the administrator to verify the accuracy of the personal data;
• The processing is unlawful, but the user opposes the erasure of the personal data and requests the restriction of their use instead;
• The administrator no longer needs the personal data for the purposes of the processing, but the user requires them for the establishment, exercise, or defense of legal claims;
• The user has objected to processing pending the verification of whether the legitimate grounds of the administrator override those of the user.

Right to data portability: The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or a contractual obligation and the processing is carried out by automated means. When exercising their right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Right to object: Users have the right to object to the processing of their personal data. The data controller must cease the processing unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. When objecting to the processing of personal data for direct marketing purposes, the processing shall cease immediately.

Complaint to the supervisory authority: Every user has the right to file a complaint against the unlawful processing of their personal data with the Commission for Personal Data Protection or the competent court.

Information about the data controller:
"CONSCIENTIA" Ltd, is a company registered in the Commercial Register of the Registration Agency with EIC 206832504, with headquarters and management address: Veliko Tarnovo, Vasil Levski St. No. 13; Telephone: 0888740568; E-mail address: office@meta-health.nl