PRIVACY AND DATA PROTECTION POLICY

I. Introduction

Emma Location Ltd., hereinafter referred to as the Company, respects the privacy of its clients and guarantees the protection of their personal data to the maximum extent possible. This Privacy and Data Protection Policy (hereinafter referred to as the "Privacy Policy") has been developed and is based on the applicable Bulgarian and European legislation on personal data protection.

This Privacy Policy governs the processing of personal data of individuals or representatives of legal entities of our customers or potential customers, as well as users of our website www.emmalocation.com ("the Site"), in connection with the services provided by us, including those provided through and available on the Site.

This Privacy Policy, together with the General Terms and Conditions for Use of the Website, the Cookie Policy and any other documents referred to on the Site, sets out the rules that the Company will observe upon processing the personal data we collect from you or about you, or which you provide us. This Privacy Policy does not affect, restrict or revoke your rights arising from the Personal Data Protection Act (“PDPA”) or any other relevant legislation.

If you have any questions or comments about this Privacy Policy, please contact us at: www.emmalocation.com

Please read this Policy carefully before using the Site or providing your Personal Data, whether electronically on the Site or on paper, since by providing your Personal Data you agree to its terms and conditions. If you do not want us to process your personal data in the manner described herein, please do not provide such data to us. The provision of personal data by you is voluntary, in order to use certain services provided by us and the use of the Site and/ or access thereto, as well as for the purposes of online shopping on the Site. Please note that in some cases we will not be able to provide you with the service and / or sell the product you have requested if you do not provide us with the required information. Please also note that in certain cases your consent to the processing of personal data may not be required if the Company applies other legal grounds, e.g. fulfillment of its legally established obligations.

II. Who processes and who is responsible for your personal data?

Emma Location Ltd. collects, processes and stores your personal data under the terms and conditions of this Privacy Policy. The company is a personal data controller within the meaning of the Personal Data Protection Act (PDPA). You can contact us using any of the following contact details:

Registered address: Sofia, Lozenets Region, Vitosha district, 1 A Asen Raztsvetnikov St., Ground floor, office 4.

Phone: 0888/851289

e-mail: office@emmalocation.com

Personal Data Protection Officer: Lyubka Stoycheva Ilinova

III. Categories of personal data processed by Emma Location Ltd.

1. The Company may process both publicly available personal data and/ or personal data provided by you. The main types of personal data we process include:

(i) Personal identification information (including name, PIN, age, identity card data, language of communication, number of family members, etc.);

(ii) Contact details (including mailing and e-mail addresses, telephone and fax numbers of you or a contact person designated by you, etc.);

(iii) Financial information (bank account and others);

(iv) Information about a representative (legal representative or proxy of such) of our clients - legal entities;

(v) Interests (any information you provide us about your interests, including the types of vehicles you prefer);

(vi) Sales and service information - purchase information, including preferred sales representative, customer number and contract number, maintenance and service, including complaints and claims.

2. The company may process data prepared and generated by it in the process of providing the services, such as:

(i) details of the end electronic communications device used, the type of device, the operating system used, the IP address, the location;

(ii) details of your preferred goods and services

(iii) Data derived from the communication between us, your habits, preferences, your satisfaction with our services (activity upon using the services, complaints, requests, etc.);

(iv) Information about your visits to the Site and your use of the Site, including operations and history of site use;

(v) Data obtained in the performance of obligations arising from legal regulations (i.e. data arising from inquiries, regulations, investigative bodies, notary, tax authorities, court, enforcement agents);

3. In order to ensure the proper performance of the services and the obligations arising from our customer contracts, the Company has the right to process any data available in public registers (including public databases and data published on the Internet), as well as information received from third parties in connection with the implementation of legal provisions concerning our customers.

4. "Emma Location" Ltd. is entitled to and is required to verify the accuracy of any personal data recorded in the database, and for this purpose requires you to verify the data and, if necessary, to correct or confirm the accuracy of your data.

5. The various types of personal data may be processed individually or in combination with each other.

IV. Purposes and legal grounds for personal data processing

1. Processing of personal data that is required for the conclusion or execution of contracts with us or in connection with the preparatory process for the conclusion of contracts with us.

Emma Location Ltd. processes your data for the following purposes:

(i) Identification of a client upon: concluding a new or amending an existing contract with us; explanations on the services used; contract implementation.

(ii) Car reservation - at the office, by phone, online.

(iii) Provision of the "car rental" service upon the conclusion of a rental agreement;

(iv) Preparation of offers for concluding contracts, sending pre-contractual information and a draft contract;

(v) Processing the transactions that you can carry out in connection with the car rental;

(vi) Data submitted by you in the performance of obligations arising from contracts concluded with you or a company represented by you, the exercise of rights and ensuring the performance of contracts by our customers;

(vii) Administration and response to customer complaints / inquiries / claims; refunds and return of goods; product replacement;

(viii) Technical assistance for creating account(s) and recovering a forgotten password for access to our Site, for electronic servicing of electronic invoices.

(ix) Identification and validation of the statutory age for online use;

(x) Payment of debts, rescheduling of amounts due; management of receivables collections;

(xi) Warranty and service;

(xii) Update of offers to dealers; sharing important information regarding amendments to our policy and other administrative information;

2. In pursuance of its legal obligations, the Company processes your data for the following purposes:

(i) Issuance of invoices;

(ii) Tax and social security control by the relevant competent authorities;

(iii) Fulfillment of obligations in connection with distance renting, distance selling, off-site sales, provided for in the Consumer Protection Act;

(iv) Provision of information to the Commission for Personal Data Protection in connection with obligations provided for in the data protection regulations - Personal Data Protection Act, Regulation (EU) 2016/679 of 27 April 2016, etc.;

(v) Obligations provided for in the Accounting Act and the Tax and Social Security Procedure Code and other relevant regulations for the purpose of keeping proper and lawful accounting.

3. The company processes the relevant data provided with the explicit written consent of the client for their processing for the following purposes:

(i) Creating and managing a personal account on the Site; technical assistance for creating account(s) and recovering a forgotten password for access to our Site;

(ii) Direct marketing of products and services;

(iii) Participation and management of surveys, games with gifts, promotional campaigns;

4. The processing is required for the protection of the legitimate interests of the Company.

(i) In order to secure and ensure the protection of the property, interests and security of the Company, its visitors and employees.

(ii) Evaluate and establish the level of customer satisfaction, as well as the effectiveness of the advertising we offer to you and others, and meet your expectations by adequate advertising processes;

(iii) Analysis of purchase history, preferences and customer behavior data;

V. Categories of third parties provided with access to and processing your personal data

(i) Transport / courier companies, postal operators for the purpose of fulfilling our contractual obligations, sending correspondence and communications relating to our contract with you, sending purchased goods;

(ii) Persons who, on behalf of the Company, maintain the equipment and software used to process your personal data;

(iii) Debt collectors, notaries, lawyers, bailiffs or other third parties if the customer has breached an obligation arising from our contract;

(iv) Banks servicing the payments made to and by you;

(v) Persons to whom the Company has subcontracted part of the activities or obligations related to a specific service that we need to provide you; data processors who, on the basis of a contract with the Company, process your personal data on our behalf;

(vi) Persons providing consulting services in various fields - lawyers, auditors, accountants, marketing agencies, etc.;

(vii) Authorities, institutions and persons to whom we are obliged to provide personal data under the applicable law;

VI. How long do we keep your personal data?

The term for keeping your personal data depends on the processing purposes for which they were collected:

1. Personal data processed for the purpose of concluding / amending and executing contracts with you or a company represented by you - for the term of the contract and until the final settlement of all financial relations between the parties. "Emma Location" Ltd. may keep some of your personal data for a longer period until the expiration of the relevant limitation periods for the purpose of protection against any customer claims relating to the implementation / termination of contracts with us, as well as for longer terms in case of a legal dispute that has already arisen and until its final settlement with a court/ arbitration decision that has entered into force;

2. Personal data processed for the purpose of issuing accounting / financial documents for tax and social security control, including, but not limited to: invoices, debit, credit notices, handover reports, contracts for the provision of services / goods are kept for at least 10 years after the expiry of the limitation period for repayment of the public claim, unless the applicable legislation provides for a longer period.

3. Personal data processed for direct marketing purposes - until the explicit withdrawal of the consent given for direct marketing or upon receiving an objection for personal data processing for direct marketing.

VII. Your rights in connection with Personal Data processing

1. General rights

In view of the processing of personal data, you have the following rights, which you can exercise at any time for the term of storage or processing of your personal data, by sending a request at the address of "Emma Location" Ltd., mentioned above, or electronically at: office@emmalocation.com

You have the right to request the Company:

• to provide you with a copy of your personal data and access thereto at any time;

• to rectify without undue delay your inaccurate personal data, as well as any data that are no longer up to date;

• to provide you with your personal data in a form convenient for transfer to another data controller, or to ask us to do so without being hindered by us (right of portability);

• to delete your personal data without undue delay in the presence of any of the legal grounds for that;

• to restrict the processing of your personal data, in which case your data will only be stored and not processed. Our refusal to restrict such processing will be provided explicitly in writing and we are obliged to justify it by specifying the lawful reason for our refusal;

You also have the right to:

• withdraw your consent for the processing of your personal data at any time with a separate request addressed to "Emma Location" LTD., for processing based on your consent;

• object to the processing of your personal data;

• object to any automated processing, including profiling;

• not to be subject to a decision based solely on automated processing, including profiling;

2. You have the right to submit a complaint to the supervisory authority

You have the right to file a complaint directly to the supervisory body, namely the Commission for Personal Data Protection, address: Sofia 1592, 2. "Prof. Tsvetan Lazarov” Blvd. (www.cpdp.bg).

If you wish to file a complaint regarding the processing of your personal data by the Company, you can do so using the contact details of the Controller or directly to the Data Protection Officer (using the above contact details).

3. Automated processing and profiling

When you visit our Site, we use automated processing to tailor our products and services to your needs in the best way possible.

4. Objection to the use for direct marketing

You have the right to object to the future processing of your personal data for direct marketing and advertising purposes, as well as to their disclosure to third parties and their use by such parties for direct marketing and advertising purposes, by withdrawing your consent at any time. To do so, you need to send an e-mail requesting that your data is no longer used for direct marketing purposes at: office@emmalocation.com.

5. Can you refuse to provide personal data to the Company and what are the consequences of such refusal?

In order to enter into a contract with you and/ or to provide you with the products and / or services ordered and / or to deliver the goods ordered in accordance with our legal and subsequent contractual obligations, the Company needs certain data to identify the party to the contract, its proxy, contact details, payment details.

Your failure to provide such data prevents us from entering into a contract with you.

In order to make a purchase from our Site and to be delivered the goods or services you have ordered, you must have created an account on the Site. During the process of creating an account, "Emma Location" Ltd. needs certain data to identify you, your contact details, payment data. Your failure to provide such data makes the purchase and delivery of goods or services to you impossible.

VIII. How do we protect your data

Emma Location Ltd. applies organizational, physical, information technology and other measures required to ensure the security and protection of your personal data and the monitoring of personal data processing.

Among others, such security measures include the following activities:

- The company has established requirements for processing, registration and keeping of personal data in its internal procedures, the compliance with which is constantly monitored;

- the access of the Company's employees to personal data and the permission for personal data processing in the database is limited, depending on their obligations;

- the company has established confidentiality obligations for its employees;

- the access to the office equipment of the Company and the computers of each employee is limited.

- we apply all necessary organizational and technical measures provided for in the GDPR, as well as the best practices from various international standards

- In order to ensure maximum security in the processing, transmission and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.

The security measures we apply are subject to continuous improvement and adaptation to the state of art technologies.

IX. Links to other websites

Sometimes the Site may contain links (hyperlinks) to other sites. We do not operate the linked sites and do not endorse the content, services and products of such sites. We advise you to use the linked sites carefully and with due regard to their content and terms of use. Emma Location Ltd. is not responsible for the privacy policies or the content of such sites and we encourage you to review their privacy policies. However, as soon as the Company receives information about any illegal activities or illegal information on such websites, it will take immediate measures to remove the links to them.

Personal data of children

We do not knowingly collect personal data of children under the age of 14. If we learn that we have collected personal data of a child under the age of 14, we will take steps to delete such data as soon as possible or obtain the consent of the person having custody of the child.

Amendments to the Privacy Policy

We may periodically update our Privacy Policy. In the event of a change to this policy, a notice will be published on our website, together with the updated Privacy Policy. All changes and additions to the Privacy Policy will be applied only after the publication of its current content, available on our website.

The information on this Site is intended to provide customers with general information on issues that may be of interest to them. The customer is free to decide whether to use the website. Although we strive to maintain up-to-date and accurate information on the Site, there may be some omissions and errors. In addition, the site may contain references to certain laws and regulations, and they could be amended later on and therefore such references should be interpreted as references to the relevant regulations at a specific moment.

Our organization disclaims any liability related to errors, omissions or unauthorized changes in the content of this Site.

The entire content of the website and any services provided by it are offered without giving any guarantee of completeness, accuracy or timeliness and therefore we cannot be held liable for any contractual or non-contractual tangible or intangible damages occurring as a result of the use of our Site.