RINCIPLES OF PROCESSING PERSONAL DATA

The policy of APOLIS OOD with UIC: 102937528 and address: BULGARIA, Burgas, 16 ALEKSANDAR STAMBOLIYSKI Str. aims to ensure compliance with the provisions of the Regulation. APOLIS OOD collects and processes personal data lawfully, fairly and in accordance with the principles and rights of individuals in relation to the processing of their personal data. APOLIS OOD processes personal data of individuals only in the following cases: • processing is necessary to comply with a legal obligation of APOLIS OOD; • processing is necessary for the performance of a contract (including an order) with APOLIS OOD to which an individual is a party, or to take steps at the request of an individual prior to entering into a contract, where his or her identification is required; • an individual has given his/her unambiguous consent for a clear and transparently defined purpose by APOLIS OOD for which the processing of his/her personal data is necessary; • the processing is necessary to protect the vital interests of the individual whose personal data are processed or of another individual; • the processing is necessary for the purposes of the legitimate interests of APOLIS OOD or of a third party, in accordance with the provisions of the Regulation; • the other cases provided for in the Regulation. APOLIS OOD does not collect and does not process personal data of individuals that exceed its obligations under law or its needs for doing business. In all cases where it is necessary for collected and processed personal data of individuals to be used for purposes other than the initial ones, APOLIS OOD notifies the relevant individuals, requests their consent and proceeds with the processing of their personal data for other purposes only after their explicit consent. APOLIS OOD collects and processes only the minimum necessary personal data of individuals that: • are provided for by law; • are necessary for the performance of a contract; • are necessary for the fulfillment of the purposes for which they are collected. APOLIS OOD ensures that the processing of personal data of individuals is carried out with maximum accuracy and, if possible, always up-to-date. APOLIS OOD ensures that access to and processing of personal data of individuals is carried out by the minimum number of persons (operators) who have the necessary competence for their processing and the necessary commitment to their protection.

STORAGE PERIODS APOLIS OOD

stores personal data within the following periods: • Data for the register of accommodated tourists within the meaning of Art. 116 of the Tourism Act, which include identification data of the accommodated persons and data related to hotel accommodation - In accordance with the procedure and period provided for in the Tourism Act and the subordinate legislation. • Information related to requested and used hotel accommodation services, for events and for restaurant services, incl. for cancelled hotel accommodation reservations (insofar as they are related to the refund of prepaid amounts and/or withholding of amounts due) - From the making of the relevant reservation/request up to 5/five/ years from the provision of the service/completion of the contract/cancellation of the reservation. In cases where the services are requested and used on the basis of a contract with continuous performance, the period begins to run from the final performance and/or termination of the contract• .Financial and accounting documents; invoices; authorization forms; other information related to tax and social security control - Up to 10 /ten/ years, starting from the beginning of the year following the one in which payment of the obligation for the relevant year is due. • Unstructured communication, correspondence, complaints, signals, etc. similar - 5 years. • Video data – up to 1 week • Data processed based on the explicit consent of the Data Subject - From the moment of granting consent until its withdrawal by the Data Subject. • Until the request of the individual for their deletion, when there is a basis for such a request. The personal data specified in this Policy may be processed for a longer period than those specified above, if this is necessary to achieve the purposes provided for therein or to protect the rights and/or legitimate interests (including in court) of APOLIS OOD or if the current legislation provides for the processing of the data for a longer period. In all cases, FIRMA APOLIS OOD ensures that the collected and processed personal data is reviewed at least once a year and those of them that fall into any of the above hypotheses are deleted without undue delay.

RULES FOR PROCESSING PERSONAL DATA

 Personal data is processed with the necessary levels and measures for protection FIRMA APOLIS OOD ensures the necessary levels of physical, organizational and technological protection in view of: • the nature, scope, context and purpose of the processed personal data; • the probability, levels of impact and severity of the risk to the rights and freedoms of natural persons in the event of a breach of the security of processing presonal data. • its financial and organizational capabilities. FIRMA APOLIS OOD also provides all necessary measures for the timely recovery of collected and processed personal data in the event of their loss as a result of accidental, malicious or force majeure events. • Personal data are processed with controlled and traceable access FIRMA APOLIS OOD provides the necessary and appropriate technical, organizational and technological measures for controlled and traceable access to the personal data of individuals. • Personal data are processed with the necessary accountability for compliance with the Regulation FIRMA APOLIS OOD provides the necessary accountability and registers in order to be able to prove that the provisions of the Regulation have been complied with.

DATA SUBJECTS

In connection with the services provided, FIRMA APOLIS OOD processes information about the following Data Subjects: • individuals visiting the hotel website; • individuals who make reservations on their own behalf or on behalf of another individual or legal entity through the Website; • individuals using the services provided by FIRMA APOLIS OOD, including, but not limited to hotel accommodation services, restaurant services and related services, provision of premises for organizing other events, as well as individuals representing or otherwise acting on behalf of legal entities that use these services; • FIRMA APOLIS OOD services can only be requested by legally capable individuals who are 18 years of age or older. RIGHTS OF INDIVIDUALS WHOSE DATA ARE PROCESSED FIRMA APOLIS OOD ensures compliance with the rights of individuals whose personal data are collected and processed, which includes: • right to be informed about the processing of personal data; • right to access personal data - what data is available; • right to correct inaccurate personal data; • right to delete personal data - the right to "be forgotten"; • right to restriction of processing of personal data; • right to be informed of actions taken as a result of a request for rectification, erasure or restriction of processing of personal data; • right to data portability; • right to object to processing of personal data; • right not to be subject to automated decision-making, including profiling.

PROCESSED PERSONAL DATA

Processed Personal Data in the Capacity of Administrator: • of employees; • of clients, individuals; • of suppliers, individuals; PURPOSES OF PROCESSING PERSONAL DATA FIRMA APOLIS OOD as Administrator performs the following operations and processes only the necessary personal data for the following purposes: • for concluding, executing and terminating employment contracts and calculating employee salaries and benefits; • accepting, administering and processing reservations and canceling them; • administering, executing and delivering purchases made through the Website; • administration and receipt of payments for the services provided, incl. remotely; • for the provision of services to clients; • ensuring an individual approach to the provision of services, consistent with the preferences stated by their users. • for the conclusion and execution of contracts with suppliers and individuals; • for direct marketing for sales purposes;

RECIPIENTS AND CATEGORIES OF RECIPIENS

In connection with the implementation of the objectives specified above, FIRMA APOLIS APOLIS OOD provides personal data of individuals to the following recipients: • NRA in connection with the calculation of staff salaries; • NSSI in connection with the calculation of staff benefits; • Occupational Medicine Company in connection with the obligation to maintain an up-to-date health status of staff and conduct periodic medical examinations; • Main Labor Inspectorate, NSSI and Ministry of Interior - in connection with occupational accidents; • Ministry of Interior - in connection with the transmission of information about hotel guests; • Other state and municipal authorities and/or institutions – in connection with legal obligations to them or in connection with legal requests from them for information containing personal data: • Subcontractors for the performance of contractual obligations.

VIDEO SURVEILLANCE AND SECURITY

In accordance with the requirements of applicable legislation, FIRMA APOLIS OOD applies security measures, which include the following technical and organizational means for access control and for ensuring physical security against encroachments on buildings and facilities and for protecting the life and health of citizens: a video surveillance system, performing 24-hour video surveillance and consisting of recording and storage devices. Video surveillance and video recording can be carried out in publicly accessible areas and premises in the buildings of FIRMA APOLIS OOD and in those for which a special access regime is provided. Video surveillance is not carried out in guest rooms, sanitary and hygienic premises, recreation rooms, etc. etc. Data from video surveillance activities are stored for a period of seven days. Through information boards placed in a prominent place, Data Subjects and other visitors who may be filmed are notified of the use of technical means of surveillance and control and of any other relevant information in connection with the surveillance carried out.

CONTACT DETAILS WITH THE COMPANY

If you have any questions or ambiguities regarding the processing of your personal data or wish to exercise any of your rights, you can contact: • e-mail: info@hotel-apolis.com • telephone: +359 885 057 530 • address: 8000 Burgas, 16 Aleksandar Stamboliyski Str. 

COMPETENT SUPERVISORY AUTHORITY On the territory of the Republic of Bulgaria, the competent supervisory authority is the Personal Data Protection Commission. In case of doubt that your rights related to the protection of your personal data have been violated, you can file a report to: . Address: Sofia 1592, “Prof. Tsvetan Lazarov” № 2 • Email: kzld@cpdp.bg .

Phone: 02 / 91-53-518