Kinetik.bg (also known as "KINETIK", "Kinetik Automotive", "we", "us", "our", etc.), is the owner and operator of the website www.kinetik.bg - a web-based fundraising platform. This Privacy Policy applies to the website www.kinetik.bg and all its subdomains and API integrations. Here is how we collect and process personal data. The ways in which you can contact us, if necessary, are also described.

1. What information do we collect

The personal data of the website visitors can be collected directly from the Visitor and/or automatically through the website, using cookies and other similar solutions.

We process the following data:

• Information you provide when making a donation through the platform, such as your name and email address;

• Information about transactions you make through kinetik.bg as a part of the donation process. Kinetik.bg partners with Stripe to process payments and the payment information you provide is collected and used by them by their privacy policies. We do not have access to card data, or authentication data when paying by bank card and we do not register or store such information in any way, except for the last four digits of your bank card and its expiration date, which we are permitted by law;

• Location information, including location information provided by a mobile or other device associated with your IP address, where we are legally permitted to process this information;

• Usage, review, technical and device data when you visit our site or open emails we send, including your browser or device type, unique device ID and IP address;

• Information that you send by e-mail or share on kinetik.bg in the form of comments;

• Information from other sources, such as our partners, specialized companies that provide information about their customers with their consent, in public or anonymous form (e.g. companies for marketing, financial institutions, social networks, etc.), including information about you which is publicly available.

2. How do we collect data

Website visitors’ personal data can be collected personally directly provided by the visitor and/or automatically through the website.

• We collect information that you provide to us when you make a donation, link your account on a third party site or platform (Facebook) to your account to leave a comment, participate in public forums or other activities on our site, or interact online or offline with us.

• We collect information through various technologies, such as cookies, pixels, tags and analysis tools. You can visit our Cookie Policy for more information.

• We obtain information from other trusted sources to update the information you provide, or we have collected it automatically, for example, when we verify postal address information using third-party services. Applicable law may require you to authorize a third party to share your information with us before we can obtain it.

• If you have access to the service through a third party connection or login (such as a social network), we may collect certain information from your social network account. For a description of how social networking sites process your information, please refer to their privacy policies and terms of use, which may allow you to change your privacy settings.

3. How do we use your information

Consistent with applicable law and choices and controls that may be available to you, we may use information collected from you, or from devices associated with you, to:

• Communicate with you about donations made by you;

• Send you information about the crowdfunding campaign, in case you have given your consent to receive such;

• Send you information or request feedback about features on our sites and applications or changes to our policies;

• Personalize your content and experiences on our website;

• Provide you with targeted advertising based on your activity on our sites and applications and on third-party sites and applications;

• Develop and improve our website, services and operations, including by performing user market research and using analytics tools;

• Detect, investigate and prevent activities that may violate our policies or be illegal.

4. Data retention period

We keep your personal data ensuring that the period for which the personal data are stored is limited to a strict minimum. We make regular checks in order to ensure that all personal data will be deleted within the necessary period of time. However, due to the fact that we process your personal data for different purposes, the actual period for which personal data will be retained depends on specific circumstances, including compliance with legal, accounting and reporting requirements.

In order to determine the appropriate period for storage of personal data, we take into account:

• The volume, nature and sensitivity of personal data;

• The potential risk of harm from unauthorized use or disclosure of your personal data;

• The purposes for which we process your personal data and whether we can achieve these purposes by other means;

• Applicable legal requirements.

An example of a retention period:

• Two names and an email address are stored for a period of 2 years (based on Art. 6, par. 1) - necessary for compliance with a legal obligation

5. Data protection

We protect the personal data of our Visitors. We use cryptographic protection and technical and organizational data protection softwares. Only highly qualified people have access to the relevant registers and databases.

6. Data sharing with third parties

The company does not share personal data of the Visitors.

It is possible in certain situations to share your personal information with a special authority (administrative, judicial and/or executive authority) on the basis of Art. 6, par. 1, item “c” and item “f” of the GDPR, when this is necessary for resolving legal disputes or is absolutely necessary for prevention, establishment or prosecution of criminal activity or fraud.

7. Rights in relation to personal data

Website visitors are data subjects within the meaning of the General Data Protection Regulation (GDPR). Below we present the rights that are applicable to the use of the site: a) Right to information, b) Right of access to data, c) Right to edit data, d) Right to delete, e) Right to restrict processing, is ) Right of transmission, g) Right of appeal. (For more information, see Articles 12 - 22 of the GDPR)

You can learn more about your rights and how to exercise them on the European Data Protection Supervisor’s website or the Supervisory Authority for the Republic of Bulgaria - https://www.cpdp.bg/

The visitor can always and at any time exercise his/her rights. For this purpose, you need to send us a letter or email to the addresses below.

When using our website, we are the personal “data collector”.

Contact details of the “data controller”

8. Changes to this Privacy Policy

This policy was last updated on 06/10/2021. Kinetik reserves the right to change it, to keep it up to date with applicable law or our privacy policies. We will post any changes to this page and encourage you to follow it regularly to stay informed. If we make changes that materially affect your privacy rights, we will provide you with additional notice. If you do not agree with changes to this policy, you may discontinue using the website.

If you have questions or comments about this privacy policy, you can send an inquiry by mail or email to the following email address: [email protected].

Date of approval and publication: 10.06.2021