Confidentiality Statement of "FURISTO" Ltd.

I. Privacy Policy

"FURISTO" Ltd. strictly monitors the security and integrity of all personal data collected from our customers. We pay special attention to the legal, conscientious and transparent processing of personal data. We collect and process the data provided only for specific, explicitly stated and legitimate purposes and do not further process it in a manner incompatible with these purposes. The data we collect and store is kept to a minimum and is related to and limited only to what is necessary to fulfil the purposes for which we collected it. We make every effort within our organization to ensure that your personal data is always accurate and up to date, and we also rely on you if you find an inaccuracy in the data, so we can correct it in a timely manner. We never store your data for a period longer than necessary for the purposes for which it is processed. We provide you with the opportunity at any time and without giving reasons to withdraw your consent to process your data, as well as to delete it, if you notify us of your wish. At the same time, it is a priority for us that processing is carried out in such a way as to guarantee the appropriate level of security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage. We have taken the technical and organizational measures necessary and prescribed by applicable legislation to ensure the protection and security of our customers' personal data.

"FURISTO" Ltd. is the controller of personal data and, in this capacity, complies with the provisions of applicable legislation (the General Data Protection Regulation — Regulation (EU) 2016/679, the Personal Data Protection Act, etc.)

Definitions

"Personal data" is any information relating to an identified natural person or an identifiable natural person. Personal data includes name, national identification number, email address, telephone, postal address, etc.

"Processing" means any operation or set of operations performed on personal data or a set of personal data by automatic or other means, such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making the data available, alignment or combination, restriction, erasure or destruction.

Our privacy policy also describes the options we provide for you to access, update or otherwise take control of the personal data we process about you. If you have any questions about our practices or any of your rights described below, you can contact our team at orders@furisto.com. This mailbox is actively monitored and managed.

II. What Information We Collect — Personal Data, Purposes, and Grounds on Which "FURISTO" Ltd. Processes It

"FURISTO" Ltd. collects and processes your personal data in connection with the use of the online store — www.furisto.com — and the conclusion of contracts with the company, and more specifically the following personal data with a view to the purposes stated below:

1. Data for registration, concluding a contract (placing an order), and receiving a newsletter — name and email

Purpose for which the data is collected: making contact with the user and sending information to them, registering the user in the online store, ensuring the fulfilment of the contract for the provision of the relevant goods, and sending an information newsletter.

Basis for processing this personal data: express consent received from you as a customer; taking steps to conclude a contract and concluding a contract — with your registration in the online store or placing an order without registration, as well as with a requested purchase and delivery from our online store, a contractual relationship is created with you, on the basis of which we process your personal data.

2. Delivery details — your name, phone, email, address

Purpose for which the data is collected: fulfilment of the administrator's obligations under a distance sales contract and delivery of the purchased food.

Basis for processing this personal data: fulfilment of the administrator's obligation to deliver the purchased food.

3. Data for issuing an invoice for the purchase of food offered by us — name, national identification number, address, email

Purpose for which the data is collected: we process this personal data in order to fulfil obligations arising from accounting and tax legislation — tax and accounting legislation in the Republic of Bulgaria requires certain accounting and commercial information to be compiled, including that this information be stored for a certain period of time, as well as any other information and documents relevant to taxation. In fulfilling this obligation, the relevant information and documents, which also contain personal data, are stored for the periods stipulated in the relevant laws.

Basis for processing this personal data: compliance with a legal obligation that applies to the company.

4. Children's data

The company does not collect or process data on persons under the age of 14, except with the express consent of their parents or legal representatives.

We process information about a child's food allergies for the purpose of providing food that is appropriate and tailored to the child's health.

III. Sharing/Transfer of Personal Data

"FURISTO" Ltd. does not sell, rent, trade, or transfer personal information collected from its customers.

There are exceptions where your personal information may be disclosed to third parties as follows:

It may be transferred as an asset in connection with a business merger or sale, or as part of our business or a corporate reorganization or other changes in corporate governance.

It may be provided to service providers who assist us in providing our goods — couriers, accountants. No supplier may have access to personal data stored by "FURISTO" Ltd. without a prior data confidentiality agreement, which entitles "FURISTO" Ltd. to check compliance with the obligations accepted under the agreement. We transfer collected personal information only to our trusted partners, together with whom we carry out the organization and provision of the goods we offer. Before any such data transfer, we check that these providers give sufficient guarantees that they apply appropriate technical and organizational measures, in such a way that processing complies with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679), the Personal Data Protection Act, its implementing regulations, and our privacy policy, and to ensure the protection of the data subject's rights. In accordance with the principle of data minimization, these providers receive only the personal information they need to perform their functions.

Service providers are not permitted to retain data for their own or independent benefit, nor to retain it for longer than is necessary to perform the specified service.

We share personal data with a provider when we have your express permission to do so, or when there is another legal basis.

Finally, personal data may be provided to state authorities (e.g. control authorities and their subdivisions, authorities for the detection and prevention of crimes and violations), only when provided for by law and under the conditions specified therein.

"FURISTO" Ltd. does not transfer or share your personal data with administrators or processors in countries outside the EU.

IV. Term and Duration of Personal Data Processing by "FURISTO" Ltd.

"FURISTO" Ltd. stores your personal data for a period not longer than the existence of your account in the online store, or until you withdraw your consent to processing. After deletion of your account or withdrawal of your consent, "FURISTO" Ltd. takes the necessary care to delete and destroy all your data without undue delay, or to anonymize it (i.e. reduce it to a form that does not reveal your identity).

"FURISTO" Ltd. stores your personal data, provided in connection with online orders, for a period of 5 years for the purpose of protecting the legal interests of "FURISTO" Ltd. in legal or administrative disputes with users of the online store, while accounting documents are kept for the relevant statutory period.

"FURISTO" Ltd. will notify you in the event that the data storage period needs to be extended in order to fulfil a legal obligation or to serve the legitimate interests of the controller, or otherwise.

V. Your Rights Regarding the Personal Data Provided

1. Right to information

You have the right at any time to request information about whether your personal data is stored, the purposes for which it is processed, what categories of personal data are processed, the recipients to whom the personal data is disclosed, the expected period for which it will be stored, and whether automated decision-making or profiling of the data takes place.

2. Right of withdrawal

If you have given consent to the use of your data, you can withdraw it at any time with effect for the future, without having to give reasons.

You can send us your request to withdraw your consent at the following email: orders@furisto.com

3. Right to rectification

If you find that the data we hold about you is inaccurate, you can contact us to have it corrected.

4. Right to erasure of data

You have the right to request that we delete your data without undue delay. We will delete it within a reasonable time, as soon as we are satisfied that there are no other grounds requiring its processing/storage.

Once your data has been deleted, it is no longer possible to provide information about it.

5. Right to restriction of processing

In certain cases — for example, when you dispute the accuracy of the data, or when the grounds for their storage are being verified, etc. — you have the right to request that we restrict the processing of your personal data. During the restriction, we may only store the personal data, and any other processing activities are only possible with your consent.

6. Right to data portability

Upon your request, we will transmit or transfer the data to you or to another controller in a structured, commonly used and machine-readable format. Direct transfer of the data only takes place if this is technically feasible.

7. Right to object

You may at any time and without giving reasons object to the processing of your personal data for direct marketing purposes, including profiling, as well as in cases where your data is processed on the basis of the performance of a task carried out in the public interest, or where processing is necessary for the purposes of our legitimate interests.

8. Right not to be subject to a decision based solely on automated processing, including profiling

"FURISTO" Ltd. does not carry out such data processing.

9. Right to lodge a complaint

You have the right to lodge a complaint about the processing of your personal data with the competent supervisory authority (in Bulgaria, the Commission for Personal Data Protection or the courts) if you believe that your data protection rights have been violated.

Contact details for "FURISTO" Ltd. and its data protection officer:

Please note that when you contact us via the email above, the data you provide (your email and, where given, your name and phone number) is processed by us in order to answer your questions and resolve the issue you have raised. We undertake to delete the data retained in this connection once its processing is no longer necessary, or to restrict its processing where legal storage obligations apply.