Privacy Policy of Afranga

Contact information:

If you have any questions about this Privacy Policy, please contact us at the contacts listed below:

• Contact phone number: +359 889 405 572

• Email: [email protected]

• Address: Alexander Malinov 91 Blvd., floor 6, 1715 Sofia, Bulgaria

• You can contact the Data Protection Officer at Email: [email protected]

If you are not satisfied with the way we have responded to your complaint about data protection, you have the right to complain to the Bulgarian Data Protection Commission. You can contact the supervisory authority as follows:

• Email: [email protected]

• Phone: 02/91-53-518

• Address of the Commission: Sofia 1592, Prof. Blvd. Tsvetan Lazarov" No. 2. 

I. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

Afranga Ltd. (in short ''We'' or ''the Company'' or “Afranga”) is committed to protecting your personal data and we do not use it for any purpose other than to provide, maintain and improve our services and as required by law. The basic principles applied by the Company in processing personal data are:

1. lawfulness, fairness and transparency;

2. purpose limitation;

3. data minimisation;

4. accuracy;

5. storage limitation;

6. integrity and confidentiality;

7. accountability.

This privacy policy (in short, ''Policy'') describes how and why we process your personal data, how we protect and store it, and what your rights are in relation to your personal data.

II. PERSONAL DATA CONTROLLER 

1. The personal data controller is "Afranga” with registered office and registered address. The registered office and registered office of the company are located at: Alexander Malinov 91 Blvd., floor 6, 1715 Sofia, Bulgaria.

2. The Controller processes personal data in connection with the provision of crowdfunding services, conclusion of employment contracts and the advertising of its services, determining the purposes and means of their processing, in compliance with the relevant regulations.

3. Personal data shall be processed independently by the controller.

4. The controller may designate one or more persons to be responsible for coordinating and implementing the measures for personal data protection.

III.TYPES OF PERSONAL DATA THAT AFRANGA COLLECTS, PROCESSES AND STORES 

1. Where we process your basic personal data and the other data described for the purposes of providing our crowdfunding services, for their payment, for the fulfilment of your requests/ applications and in order to fulfil our regulatory obligations, this processing is mandatory in order to fulfil these purposes. Without this data, we could not provide the relevant services. If you do not provide us with identification data, we cannot provide crowdfunding services to you. 

2. The identification data required in the context of pre-contractual and contractual relations:

• Three names, personal identification number, date and place of issue, validity, issuing authority, permanent and current address, telephone number, contact e-mail;

• Three names, personal identification number, address, telephone number and other details of representative power if you are the authorized person to represent a legal entity before Afranga;

• Address for delivery of documents (in case it is different from the one provided at the place of residence when concluding the consumer credit agreement);

• Onboarding questionnaire, investor appropriateness test and where applicable – source of wealth documents.

• A unique customer number created by the Company to identify a registration application made and/or an agreement concluded; 

• Information about your chosen payment method, payments made, bank account number or other banking and payment information in connection with payments made to the Company;

• A voice recording of telephone calls initiated by you with an operator of the Company's national telephone number;

• A video recording of a visit to Afranga’s office made with video surveillance equipment for security purposes;

• IP address when visiting our webpage - www.afranga.com (the "Website");

• Electronic correspondence, letters, complaints, requests, alerts, complaints and/or troubleshooting requests to/from you and other feedback that Afranga Ltd. receives

IV. PURPOSES FOR THE PROCESSING OF PERSONAL DATA

Afranga Ltd. processes your personal data:

1. For the performance of agreements to which you are a party, for the purpose of providing crowdfunding services (in short, the ''Services'') or for taking steps at your request prior to entering into such an agreement; 

2. Because the processing is necessary to comply with a legal obligation applicable to Afranga;

For example, as a licensed crowdfunding services provider whose activities are supervised by the Bulgarian Financial Supervision Comission, we have obligations to provide information to the competent authorities in compliance with the applicable Bulgarian and European legislation. The Company may provide information to the Consumer Protection Commission or third parties provided for in the Consumer Protection Act, the Personal Data Protection Commission and any other public authorities in accordance with applicable law; 

3. to prevent or remedy fraud;

4. for the purpose of managing claims arising from contracts;

5. for the purpose of tax reporting; 

6. for the purpose of arranging payments; 

7. Where processing is necessary for our legitimate interest - to carry out a basic analysis of your data, in order to check whether you are fit for the crowdfunding services provided by the company or in order to tailor the Services we offer to your individual needs and to offer you new Services to meet them, as well as to notify you of changes to the Services and to maintain communication with you. 

8. Within the scope of your consent - for example for marketing and promotional purposes. If you have consented to us processing your personal data for marketing purposes, the processing will only be carried out in accordance with the purposes set out in your consent. Any consent you have given to the processing of your personal data for marketing purposes may be withdrawn by you at any time and this will not affect the Services we provide in any way. To withdraw the consent you have given, you only need to use the contact details on our website.

V. CATEGORIES OF PERSONS TO WHOM AFRANGA DISCLOSES PERSONAL DATA

1. We provide your personal data to certain categories of third parties in order to offer you a quality, fast and comprehensive service and to ensure that our services meet your expectations and also to meet our regulatory requirements.

2. We do not disclose your personal data to third parties until we are satisfied that all technical and organisational measures have been taken to protect that data, and we implement strict controls to fulfil this purpose. We remain the responsible Administrator for the confidentiality and security of your data.

3. Persons who, on the basis of a contract with Afranga, process your personal data on behalf of the Company or have direct/indirect access to such personal data:

• Identity and document verification providers

• Banks, payment institutions or electronic money service providers 

• Postal operators and courier companies - with a view to sending parcels containing supplementary agreements and other documents and the need to authenticate identity when delivering them;

• Services and undertakings providing electronic communication services;

• Entities who, upon Afranga’s assignment, maintain equipment and software and hardware used for processing personal data and necessary for the construction of the Company's network, as well as for the performance of various reporting services, technical support, service maintenance of terminal devices, etc.;

• Public or private enforcement agents;

• Security companies licensed to carry out private security activities, processing video recordings from Afranga’s office and/or maintaining other records in the process of ensuring the access regime at the same premises;

4. Other personal data controllers to whom Afranga can provide personal data include competent authorities which, by virtue of a legal act, have the authority to require the Administrator to provide information, including personal data, such as a Bulgarian court or a court of another EU country, various supervisory and regulatory authorities on a national and EU level.

VI. STORAGE PERIOD

1. We process your personal data for the full duration of the Contract you have entered into with us and retain it for a period of five years after termination and/or after you have applied for using crowdfunding services, in the event that you have not entered into a Contract with us, in order to comply with applicable anti-money laundering legislation, as well as the expiry of certain limitation periods for claims and obligations to provide information to the court, competent government authorities and other grounds provided for in applicable law (After the expiry of the time limits set out above, the Company will delete or anonymise your personal data unless it is necessary for a pending judicial, administrative or complaint proceeding of yours against us.

2. Anonymisation is an alternative to data erasure and is a process whereby all personally identifiable data (data that allows you to be identified) is irreversibly deleted. Anonymised data does not constitute personal data and is not subject to legal requirements for erasure.

VII. COOKIES

1. Cookies are small text files that are saved on your computer or mobile device when you visit the Site. They collect information about how you use the Site in order to improve its performance and allow us to remember your preferences so that you do not have to enter them each time you visit the Site or move from one page to another. This way you cannot be identified personally. For more information, check our Cookie policy. 

VIII. RIGHTS OF OUR CUSTOMERS REGARDING THEIR PERSONAL DATA

You have the following rights in relation to the collection, processing and storage of your personal data by Afranga: 

1. The right of information - the right to request at any time from Afranga information about the personal data stored by the Company about you, as well as about their origin, recipients or categories of recipients to whom they are transferred and the purpose of storage.

2. Right of access - the right to obtain confirmation as to whether Afranga processes your personal data, the right of access to it, and information regarding its processing.

3. Right of rectification - the right to request Afranga to correct and/or supplement inaccurate personal data stored by the Company in a timely manner.

4. Right of erasure (the right to be forgotten) - the right to request Afranga to erase (delete) or block your personal data, the processing of which does not comply with the requirements of the Personal Data Protection Act and/or the General Data Protection Regulation, as well as to notify the third parties to whom such data have been disclosed, of any such erasure or blocking, except where this is impossible and/or where there is an essential justification and/or a legal obligation for their processing.

5. Right to restriction of processing - the right to require Afranga to restrict the processing of your personal data where:

5.1. you contest the accuracy of the data, for the period in which Afranga must verify their accuracy;

 5.2. the processing of your personal data is without legal basis, but instead of Afranga deleting them, you request their limited processing;

 5.3. you have filed an objection to the processing of your personal data, pending a check of whether Afranga’s grounds are legal. 

6. The right to data portability - the right to receive your personal data that you have provided to Afranga and that relates to you, in a structured, popular, machine-readable format, and to use this data for another controller at its discretion. 

7. Right to object - at any time you have the right to:

7.1. object to the processing of your personal data by Afranga if there is a lawful basis for doing so. Where the objection is justified, the right of Afranga to process the personal data shall cease;

7.2. you object to the processing of your personal data by Afranga for direct marketing purposes.

8. The right not to be subject to a decision based solely on automated processing involving profiling - the right to request human intervention by Afranga in the processing of your data, the right to challenge the Company's decision and the right to make your point of view known.

9. Right to withdraw consent - the right to withdraw at any time your consent to the collection, processing and storage of your personal data by Afranga (such as for marketing purposes). The withdrawal of consent will not affect the lawfulness of the processing previously given on the basis of the consent given prior to its withdrawal, and will not affect the processing and storage of personal data by Afranga in cases where the Company has a legal obligation to keep such data, in accordance with the provisions of Bulgarian and/or European Union legislation.

10. Right to complain to a supervisory authority. In case you believe that we are in breach of the applicable legislation regarding the processing of your personal data, we ask that you contact us to clarify the matter. Of course, you have the right to lodge a complaint with a supervisory authority, which in the Republic of Bulgaria is the Commission for Personal Data Protection, whose address is. Sofia 1592, Sofia 1592, Bulgaria. "1595 Prof. 02/91-53-518; e-mail: [email protected]. More information on the Commission's activities can be found at https://www.cpdp.bg/.

IX. PROTECTION OF PERSONAL DATA

1. The security of your personal data is important to us, and we therefore implement various organizational and technical measures to ensure that your data is protected and kept confidential. We have systems and procedures in place to prevent unauthorized access, improper modification or disclosure, misuse or loss of information. We protect your personal data by maintaining physical, electronic and procedural measures and policies in accordance with applicable laws and regulations. Some of the measures we apply to ensure a high level of security regarding the management of personal data include, among others:

• Pseudomonization - we process your personal data in such a way that it can no longer be linked to a specific person without the use of additional information, which additional information is stored separately and is subject to specific technical and organizational measures to ensure that the personal data are not attributed to a specific natural person;

• Encryption - we apply cryptographic methods that convert certain information or data into code to make them unreadable by unauthorized users;

• Minimization - the personal data we request from you is relevant and is limited to only what is necessary in relation to the purposes for which it is processed;

• Strict internal control over access to personal data - access to your personal data is allowed only to those of our employees who need this information to properly perform their professional duties.

• Penetration testing - we apply an authorized simulation attack on a specific computer system, performed to assess the security of this system. Regular scanning and penetration testing is used to identify potential security vulnerabilities and implement appropriate remedies;

• Providing ongoing training on the protection of personal data to all our employees and constant internal control on the implementation of privacy measures.

Please note that you also play an important role in protecting your personal data. When you register on our site and/or use the crowdfunding services through your e-mail, it is important that you choose a password of sufficient length and complexity, that you do not disclose this password to anyone, and that you notify us immediately if you discover any unauthorized access or use of the account and /or your mail. Given the nature of communications technology and information processing technology, we cannot guarantee that information, during transmission over the Internet or while stored on our systems or otherwise, will be absolutely secure from intrusion by others.

Our site may contain links to third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and Afranga is not responsible for them.

X. HANDLING OF CUSTOMER COMPLAINTS

1. General provisions

This point has been developed on the basis of the current legislation regulating customer complaints in connection with the activity of Afranga in providing consumer loans to natural persons. The main goal of this policy is to resolve customer complaints of Afranga clearly, fairly and impartially, within the previously established response deadlines. In the resolution of disputes, the aim is speed and objectivity in making decisions and preparing the response, preventing legal disputes, preserving the good name of Afranga, analyzing and eliminating the reasons that led to the filing of complaints.

2. Review of complaints

Our representative accepts customer complaints and forwards them to the manager by the end of the next working day at the latest. He familiarizes himself with the complaint and contacts our customer. When the complaint is fully or partially justified, the manager makes every effort to satisfy the client's claims and prevent potential litigation.

3. Categories of complaints according to the order of their submission

A complaint, within the meaning of this point, is any oral or written expression of dissatisfaction, suggestion or remark from a customer regarding the quality of the services provided. Afranga groups its customers' complaints according to the manner in which they are handled as:

3.1 customer complaints sent to the official e-mail of Afranga;

3.2 written complaints submitted to Afranga; 

Written customer complaints forwarded to Afranga through supervisory or other administrative and state bodies (Bulgarian National Bank, Consumer Protection Commission, Personal Data Protection Commission, Competition Protection Commission, etc.).

4. Deadlines for responding to customer complaints

Afranga prepares responses to complaints within 30 working days from the date of receipt of the complaint, and in case of factual or legal complexity, the period may be extended, of which the complainant is expressly notified.

XI. Changes to this privacy policy

The policy may be amended or supplemented due to a change in the applicable legislation, at the initiative of Afranga, the natural persons, subjects of personal data and/or a competent authority (e.g. the Commission for the Protection of Personal Data).

This Policy was adopted by a Decision of the Manager of Afranga on 01.03.2025 and comes into force on 01.03.2025, on which date it was published on the website of Afranga.