Политика за използване на „Бисквитки“ на интернет сайта pegascard.com

Dear clients,

With this privacy policy, VESTRANS informs you that when you use the mobile application,
VESTRANS will process your personal data. The purpose of this policy is to acquaint the users of the
mobile application with what data, for what purposes, to what extent and in what ways VESTRANS
will process their personal data. VESTRANS wishes to explain to customers the effect of the
processing and their rights to protect their personal information in this regard. As a controller of
personal data, VESTRANS is aware that it has a responsibility to the users of the mobile application to
process their personal data responsibly, conscientiously and transparently and declares its interest
and proactivity in this regard. This policy is an expression of the desire of VESTRANS to fulfill its
obligations in relation to the protection of personal data with care for customers.
The policy is in line with the requirements of the General Data Protection Regulation.
In order to properly understand the processing of their personal data and the rights they
have in this regard, customers should be aware of the meaning of the following basic concepts under
the General Data Protection Regulation:

(I) personal data;
(II) data subject;
(III) processing;
(IV) administrator;
(V) pseudonymization;
(VI) ( personal profiles (or "profiling").

Annex № 1 (Basic concepts) provides information on the meaning of these
concepts.
Appendix № 1 – Basic concepts
1. Who is the administrator of personal data in the mobile application?
Vestrans OOD, with address in Sofia, Belite Brezi residential district, 52-54 Vorino Str.,
Ground floor and Card Service EOOD, Rebarkovo village, Zli Dol area, Mezdra municipality, control
the processing of personal data on the web and in the mobile application.

2. What information does VESTRANS collect and process for the users of the application?
VESTRANS collects and processes 2 types of information about its customers: (1) data that customers
provide to VESTRANS in connection with the use of the mobile application during and / or after
registration in it; and (2) information that VESTRANS creates for customers in connection with their
participation in connection with the use of the mobile application. The information that VESTRANS
collects from customers includes general personal data such as for example: name, address, email
address and others. In order to use the mobile application, each customer must provide this data,
which is marked with * required. With regard to the other, optional data, the client decides whether
and which of them to provide to WESTRANS.

3. For what purpose and on what legal basis does VESTRANS process personal data of the
users of the application?
VESTRANS processes the personal data of clients of the program for the following purposes:

(1) direct marketing of products and services;
(2) indirect marketing and manifestation of personal attitude and attention to the users of
the application and in this connection knowledge of the group preferences and interests of the
clients;
(3) preparation of various personal profiles for the users of the application (profiling), based
on the personal information provided by them;
(4) identifying trends in consumer behavior and changes in customer attitudes;
(5) reporting and statistics on the program and on the activities of WESTRANS, including to
identify you when using the applications and to answer questions and comments;
(6) analysis and planning of development / changes in the application according to user
behavior and / or group preferences / characteristics of customers. The legal basis on which
VESTRANS processes personal data of clients of the program for the above-described purposes (1) to
(6) is necessary in order to realize the legitimate interests of VESTRANS, ie. pursuant to Art. 6, para. 1
(e) of the General Data Protection Regulation. The processing of personal data of the users of the
application is necessary for VESTRANS in order for it to realize its legitimate interests to:
– offers customers appropriate and effective marketing and advertising;
– maintains and increases the number of loyal customers;
– implements the application in the most effective way;
– develops and optimizes sales of its goods and services;
– has a competitive trade, activity and strategy; and
– keeps records and statistics and to make analyzes in connection with its activity.
Apart from the business purposes of VESTRANS, the processing of data in aggregate form is
sometimes necessary for the purposes of the legitimate interests of third party traders when
VESTRANS negotiates discounts on the prices of goods and services for the benefit of users of the
application. In accordance with the requirements of the General Data Protection Regulation,
WESTRANS has assessed legitimate interests to see if it can use them as a legal basis for the
processing of personal data of users of the application. The result of this assessment is positive.
VESTRANS has established that it has a valid legal basis to process customer data for the purposes of
the stated interests. At the request of a client at the e-mail address: pegascard@abv.bg, VESTRANS
can provide the client with a summary of the assessment.
VESTRANS processes the personal data of the users of the application in order to fulfill its
obligations under the program according to the contract with the clients. WESTRANS does this on the
grounds of the need to fulfill the general conditions for the program – ie. pursuant to Art. 6, para. 1
(b) of the General Data Protection Regulation. Finally, c
In some cases, VESTRANS processes the personal data of the users of the application in order to fulfill
its obligations and requirements under the law. In these exceptional cases VESTRANS processes the
data on the grounds of art. 6, para. 1, item c) of the General Regulation on Data Protection.

4. How does VESTRANS use the personal data of the program's clients?

VESTRANS relies on the good faith and interest of customers that their data is accurate and
correct in view of the purposes of the mobile application and does not verify the accuracy of personal
data provided, except for the email for customer registration. VESTRANS strives to process a
minimum of personal information about the users of the application in view of the services offered
and its business objectives. VESTRANS uses the personal information it collects from customers,
together with that which it generates for them, in a specific, non-aggregated form and / or in
aggregate form, as pseudonymous data. For a limited time after deleting the account, ie.
deregistration from the program, VESTRANS processes for its former clients only a card number
together with the historical transactions with it in anonymous form, ie. the specific customer cannot
be identified. When processing data, VESTRANS does not use automated individual decision making
for the users of the application.

5. Does WESTRANS use profiling in data processing?
Yes. Based on the personal information that clients provide through and about the program,
VESTRANS makes general – not detailed and specific – personal profiles of clients, groups them
according to their user behavior and / or stated preferences and / or features and uses the groups
thus established. to achieve the stated objectives. For some of the purposes, such as identifying
trends in consumer behavior and changes in the attitudes of customer groups; reporting and
statistics on the activities of VESTRANS; and analysis and planning of development / changes
according to consumer behavior and / or group preferences / characteristics of customers, VESTRANS
uses primarily personal profiles of customers, prepared on the basis of their specific personal data.

6. With whom does VESTRANS share personal information about clients of the program?
Does it provide it in third countries? WESTRANS will provide access to the personal information
of the users of the application only when necessary and in accordance with the requirements of the
law. The access granted will be limited to the personal data needed by the person to whom the
access is granted, in view of the purpose for which the access is granted. WESTRANS will disclose
personal data of users of the application to the following persons:

(7). IT Service Providers: In connection with some of the data processing processes, such as their
storage and security, WESTRANS uses the services of third party data processors who use the data
according to the instructions and under the control of WESTRANS. These third parties areestablished
in the EU.

(8). To other traders established in Bulgaria: In the cases when VESTRANS offers its clients the
opportunity to use the goods and services of other traders under more favorable conditions for
the clients; in these cases VESTRANS will disclose to third party merchants only customer card
numbers (without any other personal information about the respective customers).

(9). State bodies and institutions, bodies of local self-government, bodies of the judiciary: In the
cases provided by law for fulfillment of an obligation provided by law. WESTRANS does not
export or provide access to the personal data of users of the application to administrators or
processors in non-EU countries.

7. For how long does VESTRANS process customer data?
In principle, VESTRANS processes personal data of customers while they are registered in the
mobile application or their Pegascard card is active.

8. What rights do users of the application have in order to protect their personal data?
As personal data subjects, users of the amata application have the following rights:

(I) Right of access;
(II) Right of adjustment;
(III) Right of deletion;

(IV) Right to limit processing;

(V) Right to data portability;
(VI) The right to appeal to the Commission for Personal Data Protection, and may exercise them
at any time in accordance with the terms and requirements of law. More information on the
content of these rights is provided in Appendix) (Customer Rights) Users of the application can
exercise their rights (1) directly through direct access to their personal information in the
application, (2) by contacting and requesting assistance from VESTRANS through the customer
feedback form or (3) by email to peascard @ abv.bg

9. How and when can users of the application object to the processing of personal data?
Users of the application may object to the processing of their personal data for the purposes of
its use, as well as specifically to the processing of their data for the purposes of direct marketing,
at any time on certain legal grounds in relation to the specific situation of the customer. Users of
the application can exercise their right to object through the feedback form with VESTRANS
in the application or by e-mail to VESTRANS at pegascard@abv.bg. If the objection is justified,
VESTRANS will stop processing the data on the objected client, unless VESTRANS shows that
there are compelling legal grounds for the processing, which take precedence over the interests
of the client. In this case VESTRANS will notify the customer by email. With regard to personal
data, users of the application who are provided by customers at will (ie not marked with *),
customers may object to the processing by deleting those personal data that do not wish to be
processed. If a customer objects to the processing of his personal data for the purposes of using
the application as a whole and no longer wishes to use it or to the processing of personal data
that the customer must provide in order to use the application (ie those that are marked with *),
VESTRANS will be forced to ask the client to deregister from the application and, if the client
does not do so within the given short time, VESTRANS will deregister it on its own grounds.

10. How and when can users of the application object to the use of their personal data for
direct marketing?
Each user of the application determines whether or not to be the subject of direct marketing in
connection with it. In order to be the subject of direct marketing messages, the user of the
application must explicitly agree to this by checking the box for consent to receive direct
marketing messages when registering or in your personal folder. If the user of the application
also agrees to direct marketing, VESTRANS will process the personal data of the client, including
by creating customer profiles for the purposes of direct marketing and will send him messages
for direct marketing. The user of the application can withdraw an already agreed direct
marketing consent at any time after giving it, by unchecking the active field for consent to
receive direct marketing messages. If and when a customer withdraws his consent for direct
marketing messages, VESTRANS shall suspend the sending of direct marketing messages to the
client, as well as the processing of his personal data, including through the creation of customer
profiles for direct marketing purposes. A customer can also use the application when he does not
consent to receive direct marketing messages. In this case, the client leaves the active consent
field blank – unchecked. If a customer does not consent to direct marketing messages, VESTRANS
will not send direct marketing messages to the customer and will not process his personal data,
including through the preparation of customer profiles, for direct marketing purposes.

11. What are the consequences for the users of the application from the processing of their
personal data?
As a result of the processing, VESTRANS will have some idea of the preferences, consumer
behavior, and some individualizing traits (such as preferred address, approximate age,
profession, etc.) of customers. Personal data are not of such a nature that their processing
creates a risk of significant intrusion into the privacy of users of the application or damage
12. How is the security of personal data in the program ensured?
VESTRANS is interested in and aims to ensure and maintain the security of personal data of
customers. VESTRANS maintains appropriate physical, procedural, administrative, organizational
and technical protection measures designed to prevent the loss, misuse, unauthorized access to,

disclosure or alteration of personal data of its customers, which VESTRANS controls and
administers. If a customer has reason to believe that the personal data he has provided to
VESTRANS are no longer protected, he may contact VESTRANS and share his concerns using the
contact details provided in this policy.

13. If users of the application have questions, who should they contact?
If a customer has a question that is not answered in this policy, he can contact VESTRANS and
ask it via the feedback form in the application or by phone 02/9581783. The purpose of this
policy is to answer in advance the usual questions of customers in connection with the
processing of their personal data by WESTRANS within the use of the application.

14. How can application users update their data?
Each client has control over the personal data they provide to WESTRANS forprocessing, at any
time while registered in the application. A customer may update their data, supplement or delete
it (if it is not mandatory), and / or give or withdraw their consent for direct marketing through
their account in the application. At any time VESTRANS processes the personal data of the clients
according to their current personal profile in the mobile application.

15. How will users of the application find out about the change in this policy?
In case of a change in the current policy, VESTRANS will send an official message by e-mail to all
registered clients. Information about this will be available for some time in the profiles of
registered customers in the application, in the gas stations of VESTRANS, and on
www.pegascard.com.
Appendix № 1: Basic concepts
Annex № 2: User rights of the application
Appendix № 1: Basic concepts Importance of basic concepts related to the processing of personal
data under the General Data Protection Regulation: "General Data Protection Regulation" means
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016
on the protection of individuals with regard to the processing of personal data and on the free
movement of such data and repealing it. of Directive 95/46 / EC;
'Personal data' means any information relating to an identified or identifiable natural person
(this person is defined as a 'data subject'); an identifiable natural person is a person who can be
identified, directly or indirectly, in particular by an identifier such as name, identification number,
location data, online identifier or one or more features specific to the natural, the physiological,
genetic, mental, intellectual, economic, cultural or social identity of that individual;
"Processing" means any operation or set of operations carried out with personal data or a set of
personal data by automatic or other means such as collecting, recording, organizing, structuring,
storing, adapting or modifying, retrieving, consulting, using, disclosing, disseminating or otherwise
making the data accessible, arranging or combining, restricting, deleting or destroying it;
'Controller' means a natural or legal person, public authority, agency or any other body which
alone or jointly with others determines the purposes and means of the processing of personal data;
"Pseudonymisation" means the processing of personal data in such a way that personal data can
no longer be linked to a specific data subject without the use of additional information, provided
that it is stored separately and subject to technical and organizational measures. in order to
ensure that personal data do not relate to an identified or identifiable individual;
"Profiling" means any form of automated processing of personal data, in the form of the use of
personal data for the assessment of certain personal aspects relating to an individual, and in
particular for the analysis or forecasting of aspects relating to the performance of professional
duties of this individual, his economic condition, health, personal preferences, interests,
reliability, behavior.
Appendix № 2: Rights of the clients of the program
(1) Right of access. Each client of the program has the right to receive confirmation from
VESTRANS whether his personal data is processed by VESTRANS. This includes the right of access
to personal data, the right to receive a free copy of the data (except in cases of excessive and

repeated inquiries), unless otherwise provided in the applicable data protection rules, and the
client's right to be a description of the main characteristics related to the processing of his
personal data, including:
(I) the purposes of the processing;
(II) the relevant categories of personal data;
(III) the recipients or categories of recipients to whom the personal data are or will be disclosed,
in particular recipients in foreign countries;
(Iv) the intended period for which the personal data will be kept and, if that is not possible, the
criteria used to determine that period;
(V) the existence of the right to require the controller to correct or delete personal data, as well
as the right to object or request a restriction on processing;
(VI) the right to appeal to a supervisory authority;
(VII) where personal data are not collected personally by the customer, any available
information about their source;
(VIII) the existence, mechanism and importance of automated decision-making, including
the creation of personal profiles (profiling). When personal data are transferred to
third countries or international organizations, data subjects have the right to be
informed of the appropriate safeguards in

connection to the transmission.
(2) Right of adjustment. Each client of the program has the right to correct, without undue delay,
inaccurate, incomplete or outdated personal data relating to him.
(3) Right to be erased (right to be forgotten). Each client of the program has the right to request
from WESTRANS the deletion of the personal data related to him without undue delay, when any
of the following grounds is applicable:
(I) Personal data are no longer necessary for the purposes for which they were collected or
otherwise processed;
(II) The Client objected to the processing (see item 9 of the text of the Policy);
(III) The personal data of the client have been processed illegally; or
(IV) The customer's personal data must be deleted in order to comply with a legal obligation
under EU law, the law of a Member State or the law of another country.
VESTRANS may refuse to delete the personal data of a client of the program if their processing is
necessary for:
(I) to exercise the right to freedom of expression and the right to information;
(II) to comply with a legal obligation requiring processing provided for in EU law or the law
of a Member State, or the law of another country, or to carry out a task in the public
interest;
(III) for reasons of public interest in the field of public health, for the purposes of scientific
or historical research, or for statistical purposes; or
(IV) for the establishment, exercise or defense of legal claims. The clients of the program
can independently, without the assistance of VESTRANS, exercise the right to correct
and the right to be "forgotten" by correcting or changing their data in the program or
deleting their personal profile from it. In case of deletion of a profile, the personal data
provided by the specific
VESTRANS client will be deleted automatically. (4) Right to limit processing. Each client
of the program has the right to request from VESTRANS to limit the processing of his
personal data in the following cases:
(I) When disputing the accuracy of personal data as provided by the VESTRANS customer and
processed by WESTRANS (the limit is for a certain period of time, which allows VESTRANS to verify
the accuracy of personal data);
(II) When the processing is illegal, but the client does not want the personal data to be deleted,

but instead requires a restriction

Policy for the use of „Cookies“ on the website pegascard.com

What are cookies?

„Cookies“ are textual computer data/codes,
stored in the User’s browser, intended for use by
web pages. This data allows the device to be identified
The user and the correct behavior of a given website according to
his individual preferences. „Cookies“ usually contain the name
of the website, storage time on the end device and unique
number.

How do we use cookies?

„Cookies“ are used to adapt the content of
page to the User’s preferences and to optimize the
the use of the website. They are also used to create an anonymous
statistics (about the User’s behavior on the site) with a purpose
improving the structure and content of the site.

Delete cookies

By default, the browser allows placing the
cookies. These settings can be changed in such a way that
to block the automatic management of cookies in the browser or
the browser to inform each time a cookie is attached to
the User’s device. Detailed information about the possibilities and how
cookies are used is available in the browser settings.

The limitation
of the use of „cookies“ may affect some of the
the functionalities that the website www.pegascard.com provides to
The user.