Privacy Policy
of StudioTech Ltd.

1. About the Privacy Policy

1.1. StudioTech Ltd., Unified Identification Code 206612535, with seat and registered address at Tsarigradsko Shose Blvd. No. 141, floor 3, 1784 Sofia, Bulgaria, e-mail: [email protected] (hereinafter referred to as the “StudioTech” or the “Company”) is a data controller and as a data controller complies with the rules and requirements of the Bulgarian and European legislation on personal data protection.

1.2. The present Privacy Policy aims to inform you about how StudioTech processes the personal data related to the persons specified below, for what purposes StudioTech collects and processes personal data, what are the grounds for processing personal data, the term of processing personal data, what are the rights of data subjects in relation to this processing, as well as other information aimed at ensuring transparent and conscientious processing of personal data by StudioTech.

1.3. With respect to the processing of personal data relating to individuals who apply for employment with us, this Privacy Policy is applicable in addition to the Privacy Notice for Job Applicants available here.

2. What types of information do we collect and why?

StudioTech processes various categories of personal data that are necessary for the lawful and normal conduct of the Company's business; for the conclusion and execution of various contracts between the Company and third parties; for the provision of services to the Company by suppliers; for the fulfilment of obligations established by law; for the communication and provision of information and documents to national and foreign public and regulatory bodies; as well as for other lawful purposes related to the business activities carried out by the Company.

• Which are the persons whose personal data is processed?

We process personal data related to the following persons (“You”):

2.1. Legal representatives, proxies, subcontractors, associates, and employees of our suppliers and business partners ("Contractors"), as well as personal data of data subjects of legal representatives, proxies, subcontractors, associates, and employees which may become our business partners.

2.2. Visitors of our Website and users of its information resources;

2.3. Persons making inquiries, requests, and other messages to us by mail, e-mail, telephone, and other means of communication;

2.4. With technical means for video surveillance, we process personal data of data subjects who visit, pass through, or otherwise are in the designated video surveillance zones in the offices of the Company.

2.5. The processing of personal data about the abovementioned data subjects is necessary for StudioTech for the conclusion, execution, and/or termination of contracts; identification of beneficial owners of legal entities – our suppliers and business partners, in view of our internal policies and rules. Without processing of the said personal data, StudioTech cannot enter into contracts with its Contractors or fulfill its obligations under them.

3. Contractors

The personal data that may be collected and processed by StudioTech within our relations with Contractors might be the following:

• Identification data of Contractors, their legal representatives and proxies - name, Personal Identification Number (PIN) or another identification number/code, date of birth, citizenship, ID card, and/or passport details, as well as identification data about the ultimate beneficial owners and representatives of the companies with which We are to enter into contractual relations;
• Business contact details - address, contact phone, e-mail;
• Other personal data that may be provided by our business contacts when filling out client/partner questionnaires;
• Other information related to the Contractors, their employees and representatives, provided or created in the context of our business relations and activities, including in negotiations and legal disputes.

4. Website visitors

4.1. When you visit our Website, we may process personal data relating to you through the use of cookies or similar technologies. For more information, please see our Cookie Policy.

4.2. When you make requests, inquiries, and other communications to us, we may process your personal data, such as names and contact details, which you have provided to us voluntarily for the purposes of carrying out communication with you and to respond to your inquiry.

5. Video surveillance

StudioTech provides video surveillance in the common areas and entrances to the offices of the Company, as well as in other commercial sites, such as warehouses. The video surveillance is carried out for the purpose of self-protection of the Company's property, and protection of the life and health of our employees and visitors.

6. For what purposes do StudioTech process your Personal Data?

StudioTech processes personal data for the following purposes:

6.1. Processing of personal data necessary for taking actions before concluding a contract, as well as for concluding, performing, and terminating a contract with Contractors

• Identification of legal representatives, proxies, employees, and beneficial owners through publicly available channels, as well as when these data are provided by the Contractors of StudioTech before the conclusion of the contract;
• Preparation of offers, contracts, and all other documents accompanying the contract, as well as any other documents created in the context of business relations with the business partners of the Company;
• Notices related to our products and services.

6.2. Processing of personal data needed for compliance with a legal obligation

• Personal data necessary for compliance with a legal obligation of StudioTech, including, but not limited to, legal obligations established in the tax and accounting legislation; gambling legislation; whistleblowing legislation; customs legislation, etc.

6.3. Processing of personal data based on legitimate interest

• Video surveillance in our commercial and administrative sites;
• Provision of data by you in our client/partner questionnaires, such as data about politically exposed persons;
• Verification of the existence of licenses, permits, concessions, and/or other rights related to the exercise of regulated activities by our business partners;
• Client satisfaction survey regarding the use of our products/services;
• Exercising and protecting the legal rights and interests of the Company.

7. To whom may StudioTech disclose your Personal Data?

StudioTech may use third parties to support certain contractual activities or with regard to the performance of a legal obligation. StudioTech does not provide personal data to third parties before the requirements for disclosure of personal data to third parties provided for in the applicable legislation are met.

Recipients of personal data may be third-party legal and individuals, such as:

• service providers and their subcontractors;
• postal and courier service providers;
• external consultants in various fields providing services to the Company, such as, but not limited to banks, financial auditors, legal advisers, advertising agencies, security companies, and other service providers;
• service providers which on assignment and on behalf of the Company maintain equipment, software, and hardware used to support the activities of StudioTech, as well as hosting companies and sales agents, etc.;
• state and municipal bodies, including, but not limited to, regulatory bodies, state commissions, institutions and agencies, gaming regulators and laboratories, NRA, NSSI, courts, prosecutor's office, and others, to which StudioTech should provide information that may contain personal data under the applicable legislation.

8. What technical and organizational measures for data protection do we apply?

In accordance with applicable law, StudioTech implements all necessary technical and organizational measures to protect personal data from accidental loss and unauthorized access, use, alteration, or disclosure. The Company has adopted and ensured the implementation of internal policies and procedures designed to protect information from loss, misuse, and improper disclosure.

In addition, StudioTech implements information security measures, including, but not limited to, access control, strict physical protection, and robust practices for collecting, storing, and processing information, such as encryption, pseudonymization, and anonymization of the collected personal data.

9. When do we delete your Personal Data?

StudioTech stores personal data within the statutory time limits, and if there are not explicitly defined statutory time limits, within the time limits set by the Company in order to achieve the purposes of the personal data processing listed above. The Company deletes personal data after the expiration of the statutory deadlines for their storage and/or achieving the purposes of data processing, but in any case, not before the final settlement of all our financial relations.

StudioTech stores personal data for the following periods:

• Invoices and other financial information - 10 /ten/ years, starting from the beginning of the year following the year in which the payment of the debt for the respective year is due;
• Information contained in contracts and work orders - for the period of the contract and up to 5 /five/ years from the termination of the contract, except in cases where this information is related to tax and social security control - then the term is 10 /ten/ years, starting from the beginning of the year following the year in which the payment of the debt for the respective year is due;
• Information contained in correspondence with you - up to 5 /five/ years from the end of the correspondence. In cases where the correspondence relates to a valid contract, the term begins from its termination;
• Surveillance camera recordings – 60 /sixty/ days from the moment of recording.

The personal data may also be processed for a longer period than the above-mentioned terms, if such processing is necessary to achieve the purposes set out therein or to protect the rights and/or legitimate interests of StudioTech, or if the applicable legislation provides for the processing of such data for a longer period.

10. Do we transfer personal data outside EU/EEA?

The transfer of personal data is secured by modern technical means. In principle, StudioTech does not transfer personal data outside the EU / EEA. In the event that such transfer is necessary for the fulfillment of some of the above purposes, the transfer will be carried out in compliance with the requirements of applicable law including but not limited to adopted adequacy decision by the European Commission, standard contractual clauses, binding corporate rules etc.

11. What are Your rights in relation to the protection of your Personal Data?

11.1. In order to fulfill the obligations of StudioTech as a Data Controller, it is important for the Company to process and maintain your Personal Data accurate and up-to-date; if necessary, you may request an update of your Personal Data, correction, and/or supplementation, for which purpose you should send an application/request to the Company in compliance with the terms and conditions provided for in the legislation on Personal Data protection.

11.2. You have certain rights related to the processing of your Personal Data provided in Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”), including:

• Right to information and free and open access to your Personal Data, as well as the right to request a copy of your personal data stored or otherwise processed by StudioTech;
• The right to request correction of your personal data in case it is inaccurate, not up-to-date, or incomplete;
• In the presence of the conditions set out in the GDPR or national law, you also have the right to request the deletion of your Personal Data or the restriction of their processing, as well as to exercise your right to the portability of your Personal Data (when applicable);
• Right to object, as well as rights related to automated decision-making - you have the right to object at any time, on grounds relating to your specific situation against the processing of your Personal Data, including in the event that your Personal Data is used for profiling;
• Right to request for the restriction of the processing of your Personal Data in cases explicitly provided for by law;
• If you have any doubts that your Personal Data is not being processed lawfully by StudioTech, you have the right to file a complaint to the competent data protection supervisory authority listed below in this Notice, or to seek the protection of your rights judicially.

11.3. Please note that StudioTech does not use your Personal Data for profiling or automated decision making.

11.4. The terms and conditions for exercising your rights related to the protection of Personal Data are regulated in detail in the GDPR and the Bulgarian Personal Data Protection Act. You may exercise your rights by making a written request to StudioTech on the contact details provided in this Notice in accordance with the requirements of applicable law. If necessary, StudioTech will provide you with full assistance in exercising the rights granted to you.

12. Data Protection Contact

If you wish to receive additional information on how StudioTech processes your personal data or you have questions related to the operation and application of the present Transparency Notice in the processing of Personal Data of employment applicants, you can contact the Company at: [email protected].

13. Competent national supervisory authority for Personal Data Protection

Commission for Personal Data Protection
Address: 2 Professor Tsvetan Lazarov Blvd., Sofia 1592
Phone number: + 3592 / 91-53-594
E-mail: [email protected]
Website: www.cpdp.bg

14. Changes to the present Personal Data Protection Policy

This Data Protection Policy may be amended over time, and the changes made to it shall become effective promptly after being announced on the Company’s website.

Version approved on 12.01.2026.