Policy on privacy

What data we collect, why, and what rights you have over it.

PRIVACY POLICY

FOR USE OF THE SOFTWARE PRODUCT

hype SOFTWARE

(Version No. 2/ 10 August 2026, effective from 12 August 2026)

Personal data controller:

Name: PRO SOFT AD

Company registration number: 207707051

Registered office and business address: 17 Borisova Street, floor 2, office 3, Ruse 7000, Bulgaria

Supervisory authority:

Name: Commission for Personal Data Protection

Registered office and business address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia, Bulgaria

Correspondence address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria

Telephone: 02/91-53-519; 02/91-53-555; 02/91-53-583; 02/91-53-525

E-mail: [email protected]

Website: https://cpdp.bg/

DEFINITIONS

Article 1. For the purposes of Regulation (EU) 2016/679, the Personal Data Protection Act, and this policy, the following terms have the meanings set out below:

1. „Personal data” means any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to that person's physical, physiological, genetic, psychological, mental, economic, cultural, or social identity.

2. „Processing of personal data” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

3. „Restriction of processing” means marking stored personal data to limit its future processing.

4. „Profiling” means any form of automated personal data processing using personal data to evaluate certain personal aspects of a natural person, particularly to analyse or predict aspects of their work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

5. „Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly, determines the purposes and means of personal data processing. Where these are determined by Union or Member State law, that law may specify the controller or the criteria for its appointment. Here, the Controller is PRO SOFT AD, company registration number 207707051, unless the context indicates another person.

6. „Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller.

7. „Recipient“ means a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether a third party or not. Public authorities receiving personal data in a particular inquiry under Union or Member State law are not considered recipients; their processing must comply with applicable data protection rules according to the purposes of processing.

8. „Third party” means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons authorised to process personal data under the direct authority of the controller or processor.

9. „Consent of the data subject” means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by a statement or clear affirmative action agreeing to the processing of their personal data

10. „Personal data breach” means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored, or otherwise processed.

PRINCIPLES OF PERSONAL DATA PROCESSING

Article 2. (1) All personal data you provide in connection with using the Software, as defined in PRO SOFT AD's Terms and Conditions for use of hype Software, available at www.hype-software.com (the “Terms and Conditions”), is collected transparently from data subjects. PRO SOFT AD complies fully with the principles and requirements for personal data processing, without departing from the relevant statutory requirements.

(2) Necessary personal data is collected for specific, clearly defined, and lawful purposes and is not processed in a manner incompatible with or different from those purposes.

(3) Personal data collected and processed is limited to what is necessary for the specified purposes and is consistent with the established legal bases for processing.

(4) Personal data is processed in a manner ensuring an appropriate level of security and safety, including protection against unauthorised or unlawful access or disclosure, accidental loss, destruction, or alteration, using appropriate technical or organisational safeguards.

Article 3. (1) Personal data under this Privacy Policy means data provided by Users, as defined in the Terms and Conditions, in connection with:

1. Use of the Software;

2. Responding to enquiries;

3. Meeting statutory and contractual obligations;

4. Exercise of data subjects' rights.

(2) For this Privacy Policy, personal data provided by Users also includes data concerning their employees, representatives, directors, shareholders, partners, counterparties, and similar persons in connection with use of the Software.

PERSONAL DATA PROCESSING

Article 4. When processing individuals' personal data, the Controller ensures that the available data is processed lawfully, fairly, and in a manner allowing the data subject to monitor processing at any time.

Article 5. (1) Personal data is collected when the Individual Agreement, as defined in the Terms and Conditions, is concluded and when the Software is activated and used. It may also be collected in other situations connected with the legal relationship governing the User's use of the Software. Collected data includes email addresses, which may constitute personal data if they identify an individual, as well as names or other personal data.

(2) The Controller complies with all personal data processing principles under Regulation (EU) 2016/679 and the Personal Data Protection Act.

(3) The Controller does not collect or store special categories of personal data. If a User intentionally provides sensitive data, the Controller undertakes to delete it and discontinue processing where possible.

(4) Cookies may be collected when using the Software. If the Controller uses cookies through the Software, it notifies Users by an explicit notice and informs them of their rights through a dedicated cookie policy.

(5) The Controller collects and processes personal data provided voluntarily.

(6) The Controller does not use personal data for purposes other than those specified in this Privacy Policy.

(7) The Controller does not collect or store credit and/or debit card data. When you use a bank card to pay through the Software, your card details are collected and processed by the payment service provider handling your payment, according to its privacy policy.

(8) The Controller does not carry out profiling.

Article 6. (1) The Controller takes all necessary action and implements reliable technical and organisational measures to fully protect personal data against destruction or loss due to unlawful access, unlawful alteration or dissemination, and other unlawful processing.

(2) (Amended by Order of 10 August 2026, effective from 12 August 2026.) Personal data may be provided to third parties, namely the Controller's subcontractors or providers (such as hosting, technical support, accounting, or legal services), only when necessary to perform a contract or statutory obligation and with appropriate safeguards. Data may also be provided to third-party service providers integrated with the Software or requested by the User, where and insofar as providing data, such as identification and contact details, is necessary to request, activate, or operate that service at the User's request or with their consent. Where the recipient is outside the European Economic Area, transfers take place subject to appropriate safeguards under Chapter V of Regulation (EU) 2016/679.

PERSONAL DATA RETENTION PERIOD

Article 7. The Controller retains personal data provided by Users for 5 (five) years unless a longer statutory retention period applies to certain data.

PURPOSES AND LEGAL BASES FOR PERSONAL DATA PROCESSING

Article 8. The Controller processes personal data provided by Users for the following purposes:

1. providing access to the Software and services and managing core business processes, including information security measures

2. maintaining effective communication with Users;

3. performing necessary financial and accounting activities;

4. fulfilling statutory obligations, including but not limited to submitting declarations, maintaining mandatory records, participating in inspections by competent authorities, assisting administrative and judicial proceedings, exercising legal rights and remedies, and complying with internal policies;

5. protecting the Controller's legitimate interests, including the privacy, security, and property of the Controller, its employees, counterparties, and Software users, and preventing fraud or other risks;

6. ensuring business continuity, protecting the health and safety of employees, Users, and visitors, and protecting the Controller's IT infrastructure and other property;

7. managing and maintaining IT and communications systems, including access control, asset management, incident recovery, technical audits and reporting, and organising events and training;

8. reusing and combining publicly available information where permitted by law;

9. conducting business analysis and statistical assessments to improve service efficiency and the user experience;

10. (Added by Order of 10 August 2026, effective from 12 August 2026.) requesting, activating, and enabling third-party services integrated with the Software, at the User's request or with their consent, including by providing necessary identification and contact details to the relevant provider.

Article 9. (1) The Controller processes personal data for the purposes above on one or more of the following legal bases:

1. your express consent;

2. performance of a contract to which you are a party, including taking steps at your request before entering into it, such as processing enquiries or providing a quote;

3. compliance with statutory obligations applicable to the Controller;

4. the Controller's legitimate interests, provided they do not override data subjects' interests or fundamental rights and freedoms.

(2) When relying on legitimate interests to process personal data, the Controller ensures that those interests do not override data subjects' interests or fundamental rights and freedoms through:

1. full transparency about the personal data processed and the purposes of processing;

2. an approach recognising the importance of privacy protection;

3. regular assessments and reviews of privacy practices;

4. ensuring that data subjects can exercise their rights.

(3) Unless required or expressly permitted by applicable law, or necessary to protect a data subject's vital interests, the Controller does not process your personal data for purposes other than those specified in this Privacy Policy.

DATA SUBJECTS' RIGHTS

Article 10. (1) The Controller must process personal data provided by Users in a manner allowing data subjects to receive timely and accurate information about how and to what extent it is processed.

(2) Upon a request from a User or data subject whose data is processed, the Controller must provide information about the available personal data concerning them and access to that data where grounds exist.

(3) Data subjects may ask the Controller to rectify inaccurate personal data concerning them and complete incomplete personal data.

(4) Upon an erasure request, the Controller must erase the data subject's personal data without undue delay where grounds exist. The Controller must do so where any ground in Article 17 of Regulation (EU) 2016/679 applies. The Controller deletes all personal data relating to a data subject who has deleted their user account for the Application.

(5) Data subjects may request restriction of processing where a ground in Article 18 of Regulation (EU) 2016/679 applies.

(6) Upon a portability request, the Controller must provide the personal data it holds and processes concerning the data subject, which the data subject supplied, in a structured, commonly used, machine-readable format, where processing is based on consent or a contractual obligation and carried out by automated means.

(7) Data subjects may object to processing at any time on grounds relating to their particular situation.

(8) Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.

(9) Where a personal data breach is likely to create a high risk to users' rights and freedoms, they must be notified of the breach without undue delay.

(10) Data subjects may complain to a supervisory authority if they consider that processing of their personal data infringes Regulation (EU) 2016/679 and/or the Personal Data Protection Act.

(11) Every data subject has the right to an effective judicial remedy against a legally binding supervisory authority decision concerning them. Proceedings against a supervisory authority are brought before the competent court in the Republic of Bulgaria.

(12) Without prejudice to available administrative or non-judicial remedies, including complaints to a supervisory authority, data subjects have the right to an effective judicial remedy if they consider their rights under Regulation (EU) 2016/679 and/or the Bulgarian Personal Data Protection Act infringed through unlawful processing. Proceedings are brought before the competent courts of the Member State where the Controller or processor is established.

(13) A person who has suffered proven material or non-material damage resulting from a culpable infringement of Regulation (EU) 2016/679 and/or the Personal Data Protection Act by the Controller or processor is entitled to compensation. Proceedings to exercise this right are brought before the competent courts of the Member State where the Controller or processor is established.

(14) Data subjects exercise these rights by submitting a written request to the Controller, personally as the holder of the data or through a duly authorised representative.

HANDLING REQUESTS

Article 11. (1) Requests to exercise rights under Regulation (EU) 2016/679 must be submitted to the Controller at its registered office, through the contact form, or by email.

(2) The Controller reviews and responds to requests within 30 (thirty) days of receipt. If necessary, this period may be extended by two calendar months, considering the complexity and number of requests.

(3) The Controller notifies the requesting data subject of its decision.

CHANGES AND ADDITIONS TO THE PRIVACY POLICY

Article 12. (1) The Controller reserves the right to change, amend, and update this Privacy Policy at any time without prior notice to users of proposed changes.

(2) Changes, amendments, or updates are made according to Article 32 of PRO SOFT AD's Terms and Conditions for use of hype Software.

Article 13. The following appendices form an integral part of this Privacy Policy:

1. Appendix No. 1: Template request to withdraw consent for processing;

2. Appendix No. 2: Template request to be forgotten: erasure of my personal data;

3. Appendix No. 3: Template request for personal data portability; and

4. Appendix No. 4: Template request to rectify data.

Request to withdraw consent for processing

From

Your name: __________________________

Your email: __________________________

Phone number: __________________________

To

Name: PRO SOFT AD

Company registration number: 207707051

 I hereby withdraw my consent to the processing of the personal data I have provided. I am familiar with the conditions for withdrawing consent under PRO SOFT AD's Privacy Policy for use of hype Software.

Yours faithfully: __________________________

(signature)

/ _________________________ /

(name)

Request to be forgotten: erasure of my personal data

From

Your name: __________________________

Your email: __________________________

Phone number: __________________________

To

Name: PRO SOFT AD

Company registration number: 207707051

Please erase from your databases all personal data that you collect, process, and store concerning me, provided by me or third parties, according to the identification supplied.

I acknowledge that the Controller may continue processing and storing some or all of my personal data to fulfil its statutory obligations.

Yours faithfully: __________________________

(signature)

/ _________________________ /

(name)

Request for personal data portability

From

Your name: __________________________

Your email: __________________________

Phone number: __________________________

To

Name: PRO SOFT AD

Company registration number: 207707051

Please send all personal data concerning me that is collected, processed, and stored in your databases, in XML or another suitable format, to:

e-mail: __________________________

Receiving data controller:

Name: __________________________

Company registration number: __________________________

Registered office and business address: __________________________

E-mail: __________________________

Yours faithfully: __________________________

(signature)

/ _________________________ /

(name)

Request to rectify data

From

Your name: __________________________

Your email: __________________________

Phone number: __________________________

To

Name: PRO SOFT AD

Company registration number: 207707051

Please rectify the following personal data concerning me that you collect, process, and store, provided by me or third parties, as follows:

Data to be rectified:

_________________________________________________________________

______________________________________________________________________

______________________________________________________________________

______________________________________________________________________

Please correct it as follows:

_________________________________________________________________

______________________________________________________________________

______________________________________________________________________

______________________________________________________________________

Yours faithfully: __________________________

(signature)

/ _________________________ /

(name)