Body Aesthetics’ Privacy and Data Protection Policy

IIntroduction

1. BODY AESTHETICS Ltd, UIC 205983275, managed by Valentina Tracheva, Kamelia Petrova-Ivanova and Georgi Ivanov, registered office: Plovdiv, Trakia residential estate, Block 203 B, address of the Body Aesthetics Laser Centre: Sofia, Orehova Gora Street No. 2, contact telephone number +359 87 773 7772, email info.bodyaesthetics@gmail.com — respects the privacy of its customers and guarantees the highest possible level of protection for their personal data. This Privacy and Personal Data Protection Policy has been drawn up and is applied in accordance with Regulation (EU) 2016/679 („GDPR") and the Personal Data Protection Act („PDPA").

2. This Policy governs the processing of personal data relating to individuals or representatives of legal entities — our customers or potential customers, as well as users of our website www.bodyaesthetics.bg (the „Website") — in connection with the services provided.

3. It sets out the rules we follow when processing personal data, and does not affect, restrict or override your rights under the GDPR or the Personal Data Protection Act.

4. If you have any questions or comments regarding this Policy, please contact us at info.bodyaesthetics@gmail.com.

5. The provision of personal data is voluntary, except where a specific category of data — in particular the data referred to in Section III, point 1(vii) — is a necessary condition for the safe performance of the requested procedure; in which case a refusal to provide such data will prevent the service from being carried out.

IIWho processes your personal data and is responsible for it?

6. BODY AESTHETICS Ltd („Body Aesthetics", „we") is a data controller within the meaning of Article 4(7) of the GDPR, registered in the Commercial Register under company registration number 205983275. Contact details:

• Registered office address: Plovdiv, Trakiya residential estate, Block 203 B
• Telephone numbers: +359 87 773 7772 / +359 2 996 3362
• Email: info.bodyaesthetics@gmail.com
• Data Protection Officer: Kamelia Petrova, office@bodyaesthetics.bg

IIICategories of personal data processed

7. Body Aesthetics may process publicly available personal data and/or personal data provided by you, including:

• (i) personally identifiable information (name, email address, language of communication, etc.);
• (ii) contact details (email address, telephone number – either yours or that of a contact person you have specified);
• (iii) financial information (bank account details, etc.);
• (iv) details of a representative (legal representative or authorised representative) of a client that is a legal person;
• (v) data from a profile on the Website (name, postal and email addresses, telephone number, date of birth, etc.);
• (vi) data relating to the conclusion of contracts for sale, dealerships, wholesale, deferred payment, etc. (names, personal identification numbers, etc.);
• (vii) health data provided voluntarily when completing the informed consent form prior to a procedure — including allergies, contraindications, medication use and pregnancy. This data constitutes a special category of personal data within the meaning of Article 9 of the GDPR.

8. Body Aesthetics may process data generated in the course of providing its services:

• (i) details of the end-user electronic communication device used, the type of device, the operating system, the IP address and the location;
• (ii) information about the goods and services you prefer;
• (iii) data relating to communications between us and you, habits, preferences and satisfaction;
• (iv) information regarding visits to the Website, including transactions and usage history;
• (v) data obtained in the course of fulfilling obligations under legislation;
• (vi) video recordings made during visits to the premises or the head office;
• (vii) a video recording or photograph for the purpose of taking part in games and/or promotional campaigns.

IVPurposes and legal grounds for the processing of personal data

9. Processing necessary for the conclusion or performance of contracts: Customer identification, preparing quotations, handling complaints, providing technical support, debt collection.

10. In compliance with legal obligations: Issuing invoices, tax and social security compliance, and compliance with the Consumer Protection Act and the Personal Data Protection Act.

11. On the basis of explicit consent: For direct marketing, participation in surveys, competitions and promotions.

12. Regarding the legitimate interests of Body Aesthetics: CCTV security, customer satisfaction surveys, purchase analysis, quality assurance.

13. For a specific category of data (health status): Data is processed solely on the basis of explicit written consent, provided via an informed consent form, for the purposes of ensuring the safety of the procedure. Consent may be withdrawn at any time by emailing info.bodyaesthetics@gmail.com.

VCategories of third parties with access to the data

14. Personal data may be disclosed to the following categories of persons:

• (i) transport/courier firms and postal operators;
• (ii) persons responsible for maintaining equipment and software;
• (iii) debt collection agencies, solicitors, notaries, bailiffs;
• (iv) banks processing payments;
• (v) external consultants — accountants, marketing agencies;
• (vi) competent public authorities by virtue of the law;
• (vii) security firms (video recordings);
• (viii) providers of analytics and advertising services (Google Analytics, Meta Pixel).

VIRetention period for personal data

15. Contract details: For the duration of the contract and until the expiry of the limitation periods.

16. Accounting documents: At least 11 years, in accordance with tax legislation.

17. Direct marketing: Until such time as consent is expressly withdrawn.

18. Health information: For the duration of the contract plus 3 years from the date on which the procedure was carried out (in accordance with Article 110 of the Civil Code).

19. CCTV footage: Within 60 days of the record being created.

VIIYour rights

20. You have the right to access, rectify, erase ("right to be forgotten"), restrict processing, data portability, withdraw consent and object to direct marketing.

21. Requests must be made in writing to: info.bodyaesthetics@gmail.com.

22. You have the right to lodge a complaint with the Personal Data Protection Commission (Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard, www.cpdp.bg).

VIIIHow we protect your data

23. Body Aesthetics implements organisational, physical and technical security measures, including internal procedures, access controls and ongoing alignment with best practice.

IXLinks to other websites

24. The website may contain links to other websites. Body Aesthetics accepts no responsibility for the content or privacy policies of external websites.

XPersonal data relating to children

25. We do not knowingly collect personal information from children under the age of 16 without the express consent of a parent or guardian.

XIChanges to the Privacy Policy

26. This Policy may be amended from time to time, with any amendments coming into effect upon their publication on the Website.