To Parties to Contracts Concluded with “ARAPIA INVESTMENT” Ltd.
To Clients of “ARAPIA INVESTMENT” Ltd.

PERSONAL DATA PROTECTION INFORMATION

In compliance with Regulation (EU) 2016/679 of the European Parliament and the Council of April 27, 2016.

Administrator Information:

Who are we?

“ARAPIA INVESTMENT” Ltd. is a company engaged in the construction of residential, commercial, and infrastructure projects, construction and renovation activities, and commercial transactions both domestically and internationally, including barter transactions and re-export.

The details of the company, which is the personal data administrator, and its contact details are as follows:
“ARAPIA INVESTMENT” Ltd., registered office and address of management: Burgas, “Hristo Botev” St. No. 93, 2nd floor, registered in the Commercial Register at the Registry Agency with UIC: 206214739.

Can I find out what personal data you have and process about me?

Upon request, “ARAPIA INVESTMENT” Ltd. is obliged to inform you about what information we store about you and how it is processed.

If we hold your personal data, you may request the following information:

• Contact details of the Data Protection Officer;
• The purposes of the processing;
• The legal basis for the processing;
• The categories of personal data being processed;
• The recipients or categories of recipients to whom the data has been or will be disclosed;
• The intended period for which the personal data will be stored;
• Details of your rights to request correction or deletion of personal data, restriction of processing, and to object to such processing;
• Information on your right to withdraw your consent at any time;
• Details of your right to file a complaint with a supervisory authority;
• The source of your personal data when not collected directly from you;
• Information about the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

Rights Under Regulation (EU) 2016/679 and the Personal Data Protection Act of Bulgaria:

1. Right of Access

You, as a data subject, have the right to obtain confirmation from “ARAPIA INVESTMENT” Ltd. regarding whether your personal data is being processed, as well as access to the following information:

• The purposes of the processing;
• The categories of personal data being processed;
• The recipients to whom the personal data has been or will be disclosed;
• The intended storage period or criteria used to determine this period under Bulgarian law;
• Any available information about the source of the data.

This information is provided to you free of charge. In the event of your death, your heirs may exercise these rights.

2. Right to Withdraw Consent and Request Data Deletion

You have the right to withdraw your consent given under Article 6(1)(a) and request that “ARAPIA INVESTMENT” Ltd. delete your personal data, provided that one of the following conditions applies:

• The personal data is no longer necessary for the purposes for which it was collected or processed;
• You have withdrawn your consent for processing;
• You believe that there are no legal grounds for processing your personal data;
• The deletion is necessary for compliance with a legal obligation.

If you believe your rights have been violated, you have the right to submit a complaint to the Bulgarian Commission for Personal Data Protection or take legal action.

3. Right to Rectification

You have the right to request that “ARAPIA INVESTMENT” Ltd. correct inaccurate personal data concerning you or complete incomplete personal data by submitting a signed declaration.

4. Right to Restriction of Processing

You have the right to request that “ARAPIA INVESTMENT” Ltd. restricts the processing of your personal data under the following circumstances:

• You contest the accuracy of the personal data for a period allowing verification of its accuracy;
• The processing is unlawful, but you oppose the deletion of your personal data and instead request a restriction of its use;
• “ARAPIA INVESTMENT” Ltd. no longer needs your personal data for processing purposes, but you require it to establish, exercise, or defend legal claims;
• You object to the processing of your personal data pending verification of whether our legitimate grounds override your interests.

If processing is restricted, your data will only be processed with your consent or for important public interest reasons in the EU or Bulgaria.

5. Right to Object to Automated Processing and Profiling

You have the right to object to the automated processing of your personal data, including profiling, and to request not to be subject to decisions based solely on automated processing.

6. Right to Data Portability

You have the right to receive your personal data, which you have provided to “ARAPIA INVESTMENT” Ltd., in a structured and machine-readable format and to transfer it to another data controller where processing is based on consent or contract.

7. Right to Object to Processing

You have the right to object at any time, on grounds related to your specific situation, to the processing of your personal data. If you exercise this right, “ARAPIA INVESTMENT” Ltd. must cease processing your data unless compelling legitimate grounds for processing exist that override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

8. Right to Be Notified of a Data Breach

If a personal data breach occurs that poses a high risk to your rights and freedoms, “ARAPIA INVESTMENT” Ltd. will notify you without undue delay, providing details of the breach and the measures taken to mitigate the consequences.

9. Additional Notifications from “ARAPIA INVESTMENT” Ltd.

• The company does not engage in automated decision-making or profiling as per Article 22(1) and (4) of the GDPR;
• Your personal data will not be transferred to third countries or international organizations;
• The company does not process personal data for direct marketing purposes;
• The company conducts workplace video surveillance to prevent abuse.

10. Right to File a Complaint

If you believe your rights have been violated, you may file a complaint with the Bulgarian Commission for Personal Data Protection within one year of becoming aware of the violation but no later than five years from its occurrence. The Commission must issue a decision within 30 days, which may include mandatory instructions, deadlines for compliance, or administrative penalties.

Alternatively, you may challenge the actions of “ARAPIA INVESTMENT” Ltd. in court before the respective administrative court or the Supreme Administrative Court. If successful, you may claim damages resulting from unlawful data processing.

However, you cannot initiate court proceedings if a case on the same matter is already pending before the Commission or if a final court decision has been issued on the complaint.