In accordance with the requirements of Law for the protection of personal data, and the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “EU General Data Protection Regulation” or “GDPR”), as well as the national regulations enacted for the implementation of the EU General Data Protection Regulation, the company Rompetrol Bulgaria, part of the KMG International Group (hereinafter the “Company”), having its registered office in Sofia, Bulgaria 188, Slivnitsa Blvd. fl. 6 registered at the Trade Registry under no. 117599032, is required to safely process, in good faith and in compliance with the legal provisions in effect, your personal data you supply to us, solely for the specified purposes.

1. Personal Data Controller:

Rompetrol Bulgaria is a Bulgarian company organised and existing under the laws of Bulgaria, which, as controller, stores in good faith the personal data of its customers in accordance with the regulations in force, in full compliance with the principles of personal data processing for legitimate purposes, pursuant to the EU General Data Protection Regulation, the national regulations enacted for the implementation of the EU General Data Protection Regulation.

1. Personal data

The data processed:

• • • • Name and first name,
• Date and place of birth, other data in the marital status documents;
• Address (domicile / residence), telephone/ facsimile, email;
• Personal identification number, identity card series and number;
• Place of work;
• Bank and IBAN account,
• Data on the services and products purchased, such as: quantity, amount, purchase date and place;
• Fill&Go Card Code;
• Data on the incomes obtained;
• Your image;
• Other data.

2. Purposes of the personal data processing

These data are processed by the Company for the following purposes:

1. For the purchase of LPG products, fuels and of other specific products, for the issuance of financial securities for the amounts withheld as surety, as the case may be, for the contracting and administration of the agreements concluded by you, as client and/or user of a Personal Fill&Go Card, as per art. 6 para. 1, letter b) of the General Regulation on data protection with a view to the conclusion and performance of an agreement with the data subject,
2. And for the performance of the payments, respectively of the billing f the services provided as per 6 para. 1, letter b) of the General Regulation on data protection;
3. With a view to verifying the reliability and approval of the credit limit for the Fill&Go Credit clients, as per art. 6 para.1) letter f) of the General Regulation on data protection, respectively in the legitimate interest of the controller for applying credit risk analysis measures;
4. With a view to fulfilling a legal obligation to the Controller, respectively with a view to ensuring security services, by analyzing security incidents, the performance of the money laundering offences prevention measures, as per art. 6, para. 1, letter c) of the General Regulation on data protection;
5. With a view to settling complaints and notifications in the Rompetrol gas stations, by telephone or by mail, as per article 6 para. 1) letter c) and f) of the General Regulation on data protection, with a view to fulfilling a legal obligation  respectively for fulfilling a legitimate interest of the Controller consisting in the analysis and settlement of the incidents notified;
6. For your contacting with a view to obtaining your opinion on the services and products of the Controller and of the KMG International Group purchased by you, by telephone call, email, SMS, website, social media channels and mobile application in compliance with art. 6 para. 1) letter f) of the General Regulation on data protection;
7. For statistical purposes, as per art. 6 para. 1), letter f) and art. 89 of the General Regulation on data protection;
8. For intra group reporting, respectively for the performance of the clients’ attending services through the KMG International Group entities, as per art. 6 para. 1) letter f) of the General Regulation on data protection, in the legitimate interest of the Controller for organizing its clients’ attending activity in the most efficient manner, thus guaranteeing a high level of the quality of the services and products offered;
9. For recovering the debts owed by you to the Controller, amicably/by forced execution, including for settling the different litigations, as per the agreements concluded and the legitimate interest of the Controller in recovering the receivables afferent to the existing contractual relationship with you, as per art. 6, para. 1), letters b) and f) of the General Regulation on data protection, as well as for recovering, by forced execution, the amounts owed as per 6 para. 1), letter c) of the General Regulation on data protection and of the legal provisions applicable;
10. For video surveillance by recording your image in the case where you are visiting the offices of the Controller or Rompetrol gas stations, performed in the legitimate interest of the controller as per art. 6 para. 1) letters f) and c) of the General Regulation on data protection, respectively the Law for private squrity activities ;

In the case where the Company shall decide upon processing your personal data for other purposes, especially under article 6, para. 1, letter a) of the EU General Regulation on data protection, and of the internal legislative acts approved with a view to implementing the EU General Regulation, respectively under your consent, you shall be sent a separate information memorandum, enabling you to give your freely expressed consent.

3. Duration of personal data processing

Within the purposes related to the performance of the agreement concluded with you and the provision of the services and products purchased by you, your personal data shall be stored for a limited period of time in a single place and in accordance with the legal provisions and conditions, as follows:

• The documents containing personal data shall be stored for the duration of the contractual relationship with the Controller, respectively of 10 years after.The duration for keeping video recordings captured by the video surveillance cameras mentioned in item 2, letter i) is of approximately 30 days as of the date of their recording.

4. The need for processing personal data

The data processed for the purposes provided for by item 2 letters a) –d) are necessary with a view to either the conclusion or the performance of the agreement concluded with you or for the observance of a legal obligation of the Controller, so that your refusal in sending these data to the Controller may determine the impossibility for concluding a contractual relationship for certain services, such as Personnel Fill&Drive service.

In the case where you oppose to the processing of your data for the purpose of obtaining your opinion with regards to the services and products offered or purchased as per item 2) letter e), the contractual relationship between you and the Controller shall not be affected in any way.

In the case where you oppose data processing for statistical purposes as per item 2) letter f), we inform you that this option shall be analyzed and, depending on your particular situation, you will receive a reply as per art. 21 of the General Regulation on data protection, your objection for such operation, not having an impact on the continuance of the contractual relationship with the Controller.

5. Empowered persons and Data Recipients

Personal data may be sent by the data subject, the representatives of the data subject, other companies within the same Group as the Controller

• The companies within the KMG International which perform for the Company activities in the field of procurements, work relationships or to who the Company reports the results of its activity, such as KMG Rompetrol Services Center S.R.L., Global Security System S.A. KMG Rompetrol S.R.L.
• The commercial companies servicing gas stations;
• Other companies of the controller’s group, in EU/EEA.
• IT and telecommunication service providers, courier services, advertising agencies, other contractual partners (for example attorneys at law, auditors bound by the confidentiality obligations with regards to the data sent).
• State authorities, base on their competences provided for by the law applicable.

6. Personal data transfer:

Personal data may be accessed by other abroad companies within the KMG International Group, with a view to performing joint projects or auditing the activities of the Group entities, as follows:

• KazMunayGas Trading AG, headquartered in via Cassarinetta 9, 6900, Lugano, Switzerland. We mention Switzerland, which as per the Decision of the European Commission guarantees an appropriate level of protection of the personal data,
• KMG Rompetrol Kazakhstan, headquartered in Astana, 010000, Kazakhstan Republic, Astana, Raion Esil, 4a Sos. Kurgalzhinskoe. We mention that for Kazakhstan, the Controller concluded with KMG Rompetrol Kazakhstan a standard agreement for the processing of personal data.

In the case where your data shall be transferred to other companies abroad, with a view to performing the purpose of the data processing operation, you will be notified and the guarantees provided for by art. 44-49 of the General Regulation on data protection shall apply.

The data sent to third parties shall be appropriate, relevant and non-excessive by reference to the purpose for which these have been collected and which enable the transfer to a certain third party.

7. Rights of the data subject

In order to be fully informed, you, as the data subject, have the following rights exclusively in respect of your personal rights, pursuant to the EU General Data Protection Regulation:

(a) Right of access means that you are entitled to obtain Controller’s confirmation whether or not your personal data are processed and, if processed, you may have access to the respective data and to information regarding how such data are processed.

(b) Right to data portability means the right to receive the personal data in a standard, structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where such data are processed automatically based on consent pursuant to point (a) of Article 6(1) or on a contract pursuant to point (b) of Article 6(1) of the EU General Data Protection Regulation.

(c) Right to object means your right to object, on grounds relating to your particular situation, to processing of your personal data, including profiling based on those data, where processing is necessary pursuant to points (e) and (f) of Article 6(1), to achieve a legitimate interest of the Controller or for the performance of a task carried out in the public interest.

 (d) Right to rectification refers to the right the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement, and your rectified data will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.

(e) Right to erasure (“right to be forgotten”) represents the right to request erasure of your personal data, without undue delay, where your personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed; where you withdraw your consent and there is no other lawful basis for processing; where you object to the processing and there are no prevailing legitimate legal grounds; where your personal data have been processed unlawfully; where your personal data must be erased in order to comply a legal obligation; your personal data have been collected in relation to the provision of information society services. The data erasure will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.

(f) Right to restriction of processing refers to the case where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; where the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; where the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

g) Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for entering into, or performance of, a contract with you, in which case the processing takes place based on the legal provisions in effect or on your free consent.

h) Right to withdraw your consent. Where your personal data are processed based on your consent, you are entitled to withdraw your consent at any time, without effect on the lawfulness of the processing based on such consent prior to the withdrawal thereof.

 Furthermore, as data subject you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or with any competent courts.
All the above rights may be exercised by means of a written signed and dated request transmitted to the headquarter of the Controller Rompetrol Bulgaria. As of May 25^th, 2018, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer at: RPBDPO@rompetrol.com.com or you may call us at the telephone number 0035929855710.

Moreover, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer by sending a letter to the address.

In the case where you will have any questions regarding the exercise of your data protection rights, these will be answered by the Controller within 30 days, in accordance with the EU General Data Protection Regulation no. 679/2016.

The Data Controller guarantees that your data are processed for legitimate purposes, and that it implements adequate technical and organizational measures to ensure data integrity and confidentiality pursuant to Articles 25 and 32 of the EU General Data Protection Regulation.