OMV BULGARIA CUSTOMER PORTAL

The controller, "OMV Bulgaria" Ltd, with registered office at: Sofia 1766, Vitosha District, "Malinova Dolina" residential estate, "Donka Ushlinova" Street No. 2, Building 4, Floor +1, Room 411, UIC 121759222 ("OMV"), with the contact email address for the Data Protection Officer: privacy.bg@omv.com, operates a web-based customer portal ("Customer Portal"). In this regard, we provide you with the following information:

1. Scope

This notice applies to you if you are an authorised user of the OMV Customer Portal, i.e. if you are an employee or representative of an OMV corporate customer and a user account has been created for you to access the Customer Portal.

2. Personal data processed

The personal data we collect and process when you use the Customer Portal includes the following categories:

User account details:

• Screen Name (username) — user identifier;
• Email address;
• First name;
• Surname;
• User's preferred language;
• User ID - an automatically generated numerical identifier for the user account.

Log data (Audit logs, Error logs, File logs):

• When using the Customer Portal, the system records technical logs which may contain a screen name, email address, IP address, identifier and date of the event, the action performed (e.g. LOGIN) and additional information. These logs serve to ensure the security of the system and to resolve technical errors

User content:

• When a user completes a form, the content of the form is stored in the Customer Portal and linked to the user's account.

Email data:

• When a user account is created or amended, emails containing the user's name are sent to the user's email address. When a user completes forms, an email containing the user's name and email address is sent to the OMV Bulgaria team.

Technical cookies

• The Customer Portal uses the following technical cookies. Web tracking cookies or analytical cookies are not currently used.

3. Purpose of processing

The personal data we collect via the Customer Portal is processed for the following purposes:

• User identification and provision of access to the user's contractual data on the Customer Portal;
• Account management - creation, modification and deactivation of user accounts; fulfilment of business requests and identification of who requested what within a business process;
• Security and troubleshooting - through audit logs and error logs;
• Traceability - to be able to prove that the user has submitted the relevant form;
• Fulfilment of the contract with the corporate client and maintenance of the services provided via the Customer Portal.

4. Legal basis for processing

All processing of personal data must have a legal basis in accordance with the General Data Protection Regulation ("GDPR").

The processing of your personal data on the Customer Portal is carried out on the following legal grounds:

• Performance of a contract (Article 6(1)(b) of the GDPR) - insofar as the Customer Portal is intended for employees of corporate customers with whom OMV has concluded a contract, the processing of user account data is necessary for the performance of the contractual relationship with the customer and the provision of services via the Customer Portal (e.g. access to contract data, invoices, capacity booking, etc.).
• Compliance with a legal obligation (Article 6(1)(c) of the GDPR) - the processing of certain personal data is also necessary for the fulfilment of OMV's obligations arising from applicable legislation (e.g. the Accounting Act, the Value Added Tax Act), from sector-specific regulation in the energy sector, as well as from the reporting obligations under the GDPR.
• Legitimate interest (Article 6(1)(f) of the GDPR) - the processing of data from audit logs, error logs and file logs is necessary to safeguard OMV's legitimate interests, namely: ensuring system security and resolving technical issues and errors.

5. Disclosure of data

The following categories of recipients have access to the data processed via the Customer Portal:

• Sopra Steria GmbH and companies within the Sopra Steria group - developer of the Customer Portal. Sopra Steria GmbH acts as a data processor on behalf of and in accordance with the instructions of OMV Bulgaria.
• Infrastructure and hosting service providers - the Customer Portal is hosted in data centres located in Germany. These providers act as data processors and do not have independent access to the content of the data.
• OMV Petrom SA - in the course of providing services via the Customer Portal, it is possible that certain personal data may also be technically accessible to OMV Petrom SA, Romania, to the extent that this is necessary for the technical maintenance and operation of the Customer Portal.
• Where disclosure is required by law, data may be disclosed to law enforcement, judicial and other authorised bodies acting in their capacity as data controllers.

6. Transfer of data outside the EU/EEA

No personal data is transferred outside the EU/EEA.

7. Processing, storage and retention periods for data

The retention periods for personal data processed via the Customer Portal are as follows:

The retention periods specified above may be extended to the extent necessary to comply with applicable legal obligations or to establish, exercise or defend legal claims.

8. Automated decision-making and profiling

No automated decision-making (without human review) is carried out that restricts the user's rights or access.

9. Your rights

With regard to the processing of your personal data, you have the right of access to your personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object to processing, the right not to be subject to a decision based solely on automated processing, including profiling, where this produces legal effects concerning you or significantly affects you, as well as the right to lodge a complaint with the Personal Data Protection Commission and to seek judicial redress. Each of these rights may be exercised subject to certain conditions.

More specifically, in the context of the Customer Portal:

• Right of access and rectification: The user may view and amend the data in their account (username, email address, language, first name, surname, password) themselves via "Account Settings" in the Customer Portal.
• Right to erasure: A user acting on behalf of a client cannot delete their own account. A request to delete an account must be submitted via the "Complaints" form.
• Right to data portability: Data entered by the user in the Customer Portal (e.g., form content) may be exported.

To exercise any other rights, please contact us using the contact details provided below.

10. Changes to this privacy notice

OMV reserves the right to make changes to this privacy notice in the event of a change in the circumstances under which we process personal data. The current privacy notice will be available on the Customer Portal page.

11. How to contact us?

If you wish to exercise your rights or have any other questions regarding this privacy notice, you may contact us at the following email address: privacy.bg@omv.com, or at the following postal address: Sofia 1766, Vitosha District, "Malinova Dolina" residential estate, "Donka Ushlinova" Street No. 2, Building 4, Floor +1, Room 411.

Data Protection Officer: Simeon Stoychev, phone number: +359 2 9329712, email: privacy.bg@omv.com.