Privacy Policy

PRIVACY POLICY Mandatory Information on Data Subjects’ Rights Regarding Personal Data Protection Information about the company processing your data Name: DIV-DB Ltd. UIC/BULSTAT: 131521066 Registered office and management address: Sofia, Druzhba 2 residential district, Block 414, Apartment 42 Correspondence address: Sofia, Druzhba 2 residential district, Block 414, Apartment 42 Telephone: +359 878 857 466 Email: office@div-db.com Website: www.lockerscenter.com Information about the competent personal data protection supervisory authority Name: Commission for Personal Data Protection Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Telephone: 02 915 3 518 Website: www.cpdp.bg DIV-DB Ltd. (hereinafter the “Controller” or the “Company”) conducts its activities in accordance with the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679 (GDPR). This information is intended to explain all aspects of the Company’s processing of your personal data and your rights in relation to such processing. 1. Legal grounds for collecting, processing and storing your personal data 1.1. The Controller collects and processes your personal data in connection with your use of LOCKERSCENTER locker rental services and the conclusion of contracts with the Company, pursuant to Article 6(1) GDPR and, specifically, on the following grounds: Your explicit consent as a customer; Performance of the Controller’s obligations under a contract with you; Compliance with a legal obligation applicable to the Controller; The legitimate interests of the Controller or a third party. 2. Purposes and principles of collecting, processing and storing your personal data 2.1. (1) We collect and process the personal data you provide in connection with the use of LOCKERSCENTER locker rental services and the conclusion of a contract with the Company, including for: Creating an account and providing the full functionality of the locker rental service; Concluding and performing a distance contract; Identifying a party to the contract; Accounting purposes; Statistical purposes; Protecting information security; Ensuring performance of the contract for the relevant service. (2) We comply with the following principles when processing your personal data: Lawfulness, fairness and transparency; Purpose limitation; Data relevance and minimisation; Accuracy and keeping data up to date; Storage limitation; Integrity, confidentiality and an appropriate level of security. (3) The Controller may process and store personal data to protect its legitimate interests, including fulfilling obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities. 3. Types of personal data collected, processed and stored by the Company 3.1. (1) The Company performs the following operations with the personal data you provide: User registration on the booking website and performance of a locker rental agreement. The purpose is to create an account for using the service and to provide contact details so that the customer can be contacted in the event of forgotten luggage. Impact assessment conclusion: based on the assessment carried out, this operation is permissible and provides sufficient safeguards for the rights and legitimate interests of data subjects in accordance with the GDPR. Conclusion and performance of a commercial transaction with a customer or partner. The purpose is to conclude, perform and administer a contract. Because the scope of personal data is limited and some data comes from publicly available sources, a data protection impact assessment is not required. Exercise of the right of withdrawal or submission of a complaint. The purpose is to administer the relevant customer process. Because the scope of personal data is limited, a data protection impact assessment is not required. (2) The Controller processes the following categories of personal data and information: Identification and booking data. We collect information you provide solely for your bookings and to provide the locker rental service. Email address and telephone number; Booking data: date and time, locker number, status, selected service and payment information; Payment data processed by certified payment service providers/banks, including Stripe. The provider does not store bank card details; Correspondence with the Provider; Video surveillance (CCTV): images from the premises and equipment for security and prevention of misuse. Purposes of processing: User registration; Contacting the user and sending information; Providing and administering the service, including identification, access management and support; Payments and accounting; Security, video surveillance and the prevention and detection of incidents; Customer service and dispute resolution; Improving the functionality and reliability of the Equipment. Legal ground: by accepting the General Terms and Conditions and registering on the booking website or placing an order on site, a contractual relationship is created between you and the Controller. The data is therefore processed under Article 6(1)(b) GDPR. (3) The Controller does not collect or process data revealing racial or ethnic origin; political, religious or philosophical beliefs; trade union membership; genetic or biometric data; health data; or data concerning sex life or sexual orientation. (4) The personal data is collected directly from the persons to whom it relates. (5) The Company does not carry out automated decision-making. 3.2. The Controller may use cookies to provide full website functionality, improve the user experience, collect statistics and facilitate access. You may control or delete cookies through your browser settings. Cookies are not used to identify visitors or users of the online store. 4. Retention period for your personal data 4.1. (1) The Controller stores your personal data no longer than the existence of your account. After account deletion, it will erase, destroy or anonymise the data without undue delay. (2) The Controller processes personal data provided when placing an order on site. (3) Personal data connected with online orders is retained for five years to protect the Controller’s legal interests in judicial or administrative disputes. (4) You will be informed if the retention period must be extended due to a legal obligation, legitimate interest or another lawful reason. (5) Data required by law is kept for the applicable statutory period, which may exceed the existence of your account. Equipment logs: up to 12 months, unless needed for an incident or dispute; CCTV recordings: normally up to 30 days, or until the completion of an investigation or procedure following an incident; Accounting documents: as required by applicable law, for example up to 10 years. 4.2. Personal data of legal representatives of commercial partners is retained for the term of the contract and as necessary to protect legitimate interests and comply with legal obligations. 5. Transfer of your personal data for processing 5.1. (1) The Controller may provide some or all of your personal data to processors for the agreed processing purposes, subject to GDPR requirements. (2) The Controller will inform you if it intends to transfer data to third countries or international organisations. 6. Your rights regarding the collection, processing and storage of your personal data 6.1. Withdrawal of consent If you do not want your data processed for marketing, you may withdraw consent at any time by using Appendix No. 1 or sending a free-text email request. Verification instructions will be sent to the email used for newsletters and advertising messages. Withdrawal does not affect processing already lawfully carried out. 6.2. Right of access You may request confirmation whether personal data relating to you is processed, obtain access to that data and related processing information, and receive a copy after verification. Access is free, although an administrative fee may be charged for repetitive or excessive requests. 6.3. Right to rectification or completion You may at any time request correction or completion of inaccurate or incomplete data by email, using Appendix No. 2 or a free-text request. 6.4. Right to erasure (“right to be forgotten”) You may request erasure where the data is no longer necessary, consent is withdrawn and no other legal ground exists, you object and there are no overriding grounds, processing is unlawful, erasure is legally required, or the data was collected in connection with information society services. Erasure may be refused where processing is necessary for freedom of expression, legal obligations, public interest, public health, archiving/research/statistics, or legal claims. Use Appendix No. 3 or a free-text request. If an order is still being processed, erasure may be requested after its successful completion. 6.5. Right to restriction You may request restriction where you contest accuracy, processing is unlawful but you oppose erasure, the Controller no longer needs the data but you need it for legal claims, or you have objected pending verification of overriding grounds. Verification will be required. 6.6. Right to data portability Where processing is automated and based on consent or contract, you may receive your data in a machine-readable format or request direct transfer to another controller where technically feasible. Use Appendix No. 4 or a free-text request. Following verification, the data will be sent in XML format. 6.7. Right to information about recipients You may ask which recipients were informed of rectification, erasure or restriction, unless providing this information is impossible or involves disproportionate effort. 6.8. Right to object You may object at any time to processing of personal data relating to you, including profiling and direct marketing. 6.9. Rights in the event of a personal data breach Where a breach is likely to create a high risk to your rights and freedoms, the Controller will notify you without undue delay and explain the measures taken or planned. Notification is not required where appropriate safeguards were applied, later measures remove the high risk, or notification would involve disproportionate effort. 6.10. Recipients of your personal data For the purposes of processing and full provision of the service, the Controller may disclose data to: Public authorities, including the Ministry of Interior, the State Agency for National Security, the Prosecutor’s Office, courts, the National Revenue Agency and the Customs Agency; The Communications Regulation Commission and similar bodies, where required by law or an official request; Auditors; Trusted suppliers, subcontractors and partners necessary for security, server maintenance, technical connectivity, logistics, customer support and similar services. Such recipients may process data only to the extent necessary and must follow the Controller’s instructions and applicable law; Public authorities, enforcement officers, lawyers, assignees of receivables and notaries where necessary to protect the rights or legitimate interests of DIV-DB Ltd. or third parties. Where processing is based on consent, the relevant recipients or categories of recipients are identified in the consent form. Otherwise, disclosure takes place only where permitted by law. DIV-DB Ltd. keeps clear and up-to-date records of third-party recipients. (2) Processors comply with all legal and security requirements. (3) The Controller does not transfer data to third countries. (4) You may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, telephone 02 915 3 518, website www.cpdp.bg. (5) The attached forms are optional; any request that clearly states your intention and identifies you is acceptable. (6) Where consent concerns a transfer, the Controller will describe the possible risks in the absence of an adequacy decision and appropriate safeguards. 7. Changes to this Policy We reserve the right to update this Policy when changes occur in our activities, legislation or technology. The latest version is always available on this page and applies from the date stated below. Last updated: 11 July 2026 Appendix No. 1 Consent Withdrawal Form Your name*: ____________________________ Email used for registration or orders*: ____________________________ Contact email*: ____________________________ To: DIV-DB Ltd., UIC/BULSTAT 131521066, Sofia, Druzhba 2 residential district, Block 414, Apartment 42; telephone +359 878 857 466; email office@div-db.com; website www.lockerscenter.com I hereby withdraw my consent to the processing of the personal data I have provided for receiving newsletters, advertising messages or other marketing materials. I confirm that I am familiar with the conditions for withdrawing consent. If your rights are infringed, you may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; telephone 02 915 3 518; website www.cpdp.bg. Appendix No. 2 Request for Rectification of Data Your name*: ____________________________ Email used for registration or orders*: ____________________________ Contact email*: ____________________________ To: DIV-DB Ltd., UIC/BULSTAT 131521066, Sofia, Druzhba 2 residential district, Block 414, Apartment 42; telephone +359 878 857 466; email office@div-db.com; website www.lockerscenter.com Please rectify the following personal data collected, processed and stored by you, whether provided by me or by third parties and relating to me. Data to be corrected: ____________________ Please correct it as follows: ____________________ If your rights are infringed, you may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; telephone 02 915 3 518; website www.cpdp.bg. Appendix No. 3 Request to Be Forgotten – Erasure of Personal Data Relating to Me Your name*: ____________________________ Email used for registration or orders*: ____________________________ Contact email*: ____________________________ To: DIV-DB Ltd., UIC/BULSTAT 131521066, Sofia, Druzhba 2 residential district, Block 414, Apartment 42; telephone +359 878 857 466; email office@div-db.com; website www.lockerscenter.com Please erase from your databases all personal data relating to me that you collect, process and store. I acknowledge that some or all of my personal data may continue to be processed and stored where necessary for the Controller to comply with legal obligations. If your rights are infringed, you may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; telephone 02 915 3 518; website www.cpdp.bg. Appendix No. 4 Request for Data Portability Your name*: ____________________________ Email used for registration or orders*: ____________________________ Contact email*: ____________________________ To: DIV-DB Ltd., UIC/BULSTAT 131521066, Sofia, Druzhba 2 residential district, Block 414, Apartment 42; telephone +359 878 857 466; email office@div-db.com; website www.lockerscenter.com Please send all personal data relating to me that is collected, processed and stored in your databases in XML format to: Email: ____________________ Receiving controller: ____________________ Name: ____________________ Identification number: ____________________ Email: ____________________ If your rights are infringed, you may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; telephone 02 915 3 518; website www.cpdp.bg.