Privacy Policy

This Privacy Policy applies to all clients of Shift Group EOOD (hereinafter referred to as the “Service Provider”) in connection with the provision of services, including, but not limited to, under Consultancy Services Agreements. Its purpose is to inform the Service Provider’s clients about what personal data are collected and processed in the course of service provision, for what purposes, on what legal basis, with whom such data are shared, how long they are retained, as well as the clients’ rights in relation to their personal data. The processing of personal data is carried out in compliance with the requirements of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Bulgarian Personal Data Protection Act, and other applicable Bulgarian legislation.

I. DATA CONTROLLER

The data controller under this Policy is “Shift Group” LLC, UIC 201424228, with its registered seat and business address at: Sofia 1407, 1V Dimitar Manchev Street.
Contact details: office@shift.group
Clients of the Service Provider may use these contact details to address any questions related to this Policy or the exercise of their rights concerning personal data.

II. CATEGORIES OF DATA SUBJECTS WHOSE DATA ARE PROCESSED BY THE SERVICE PROVIDER

In connection with its business service activities, the Service Provider processes personal data of the following categories of natural persons (data subjects):

• Individual clients – persons who use the Service Provider’s services in their personal capacity;
• Representatives of corporate clients – persons acting on behalf of the Service Provider’s corporate clients;
• Other persons engaged by the client – for example, employees or collaborators of the client (including within the client’s group of companies) participating in the execution of a specific project or providing information necessary for its implementation;
• Prospective clients – persons with whom the Service Provider is in negotiations or communication regarding the provision of services.

Where a client provides the Service Provider with personal data of third parties, the client must ensure that they are entitled to disclose such data to the Service Provider and that the relevant persons have been informed accordingly.

III. CATEGORIES OF PERSONAL DATA PROCESSED BY THE SERVICE PROVIDER

Depending on the specific purposes and context, the Service Provider may collect and process the following types of personal data, individually or in combination:

• Identification data – full name; personal identification number (PIN) or other personal identifier (where necessary for the contract or for the issuance of accounting documents); data from identity documents (only where required by law); job position within the company, etc.
• Contact details – business or personal address; phone number; email address; other contact information provided by the client.
• Data on professional qualifications and experience – e.g., information about education, professional background, skills, and achievements (where relevant for the performance of the services, e.g., when preparing presentations, business analyses, or representing the client’s team to investors).
• Financial information – data necessary for payments and invoicing such as bank account details, payment document data, tax identification number, as well as information about amounts payable or paid under contracts.
• Other information provided by the client or generated during service performance – e.g., business information containing personal data (such as data about key members of the client’s team, clients, or investors, insofar as such data are provided to the Service Provider in connection with the services); results of consultations, assessments, and analyses; correspondence between the client and the Service Provider; and any other data voluntarily provided by the client when using the services.

The Service Provider does not collect or require special categories of personal data (such as data concerning health, ethnicity, political beliefs, etc.) from its clients for the purposes of providing services. Clients should refrain from providing such data to the Service Provider unless absolutely necessary. Should the Service Provider nonetheless receive sensitive data, it will treat them with special confidentiality and in accordance with the applicable legal regime.

IV. PURPOSES OF PERSONAL DATA PROCESSING

The Service Provider processes the personal data listed above solely for specific and legitimate purposes, including:

• Provision of the agreed services – planning, preparation, and performance of business consultancy services, including communication with clients, identification of clients and their needs, development of strategies, analyses, documents, and other materials under the respective agreement; coordination with clients and/or their employees for the execution of services; assistance in attracting investors and carrying out the investment process, etc. All these activities require the Service Provider to process the necessary client data in order to fulfil its contractual obligations.
• Administrative and accounting purposes – issuance of invoices, maintenance of accounting records, tax reporting, and compliance with the requirements of tax, social security, and other applicable legislation.
• Protection of the Service Provider’s legitimate interests – ensuring the proper functioning and security of the Service Provider’s information systems; prevention of malicious acts and security breaches; establishment, exercise, or defense of the Service Provider’s legal claims (e.g., in legal disputes or audits); internal analysis and improvement of service quality. Within its legitimate interest, the Service Provider may retain the necessary correspondence and documentation to protect itself in the event of potential disputes and may also disclose the fact of its cooperation with a client (including the name and logo of the client company) on the Service Provider’s website and in marketing materials, without disclosing any confidential information.
• Compliance with legal obligations – when a law or regulatory act requires the Service Provider to provide or process personal data. For example, obligations under the Accounting Act, the Tax and Social Security Procedure Code, and other acts related to proper accounting and reporting, as well as compliance with orders from competent state authorities (e.g., providing information upon a legally established request from a court or regulator).

The Service Provider does not use personal data provided by clients for marketing purposes unless the explicit consent of the clients has been obtained. The Service Provider processes data primarily for the purpose of providing services and for the related legal and legitimate purposes described above.

V. LEGAL BASES FOR PROCESSING

The Service Provider processes the personal data provided by clients only when there is a lawful basis under Article 6 of Regulation (EU) 2016/679. In the context of the Service Provider’s activities, the following bases apply:

• Performance of a contract or steps prior to entering into a contract – the processing of most personal data provided by clients to the Service Provider is based on the necessity for the Service Provider to take steps at the client’s request prior to entering into a contract or to perform an already concluded contract with the client. This includes cases where clients are parties to the contract in their personal capacity (as natural persons) or where they act as representatives of a corporate client.
• Compliance with a legal obligation – in certain cases, the Service Provider is legally required to process and retain data provided by clients. For example, accounting and tax legislation obliges the Service Provider to retain documents containing personal data (e.g., invoices issued in the name of an individual client or representative) for specific periods.
• Legitimate interest of the controller – where the Service Provider’s legitimate interest does not override the fundamental rights and freedoms of clients, the Service Provider may process data on this basis. Such cases include the processing of data for: protection of the Service Provider’s legal claims and rights (including preventing contractual breaches or defending against claims); internal administrative purposes; ensuring the security of services and information; communication with client representatives, etc. In such cases, the Service Provider always carefully assesses whether its interest is balanced against the clients’ rights.
• Consent – the Service Provider may also process clients’ personal data based on their explicit consent. By signing a service agreement, the client is deemed to have granted the Service Provider such consent for the processing of personal data for purposes directly related to the execution and management of the contractual relationship. The client has the right to withdraw their consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.

The provision of personal data directly requested by the Service Provider for the conclusion and performance of a contract is voluntary but constitutes a necessary condition for acquiring the status of a client of the Service Provider. If a client refuses to provide such essential data required for the conclusion and performance of the contract, the Service Provider will be unable to enter into a contract with the client and, consequently, to perform the requested service.

VI. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

The Service Provider respects and protects the confidentiality of data provided by its clients. However, in certain cases, it is necessary for the Service Provider to disclose or share personal data with third parties when this is required by law or necessary for the provision of its services. Such recipients may include:

• Public authorities and institutions – competent authorities that are legally empowered to require the Service Provider to provide information, including personal data. These may include courts, supervisory/regulatory bodies, the Commission for Personal Data Protection, law enforcement authorities, etc. Personal data may also be provided to the National Revenue Agency or other tax and social security authorities when necessary for tax purposes or inspections.
• Banks and payment institutions – in connection with processing payments under contracts. The Service Provider does not actively provide data received from clients to banks except to the extent required by the payment order or financial transaction itself, or when the bank requests data for compliance with regulatory requirements (e.g., for fraud prevention or anti-money laundering purposes).
• Subcontractors, external experts, and service providers – third parties engaged by the Service Provider in connection with service performance or operational support, such as IT and cloud service providers (email hosting, project management systems, or virtual “data room” platforms for document sharing); software providers and IT system maintenance technicians; external experts or consultants. In such cases, the Service Provider provides subcontractors with only the minimum amount of data necessary and requires them to ensure confidentiality and information security.
• Affiliates or business partners – currently, the Service Provider has no subsidiaries or affiliated entities to which it routinely transfers data. In the event of future corporate reorganization, merger, or business sale, personal data may be disclosed within the framework of such succession, in compliance with legal requirements for notification and protection.
• Other parties in the performance of the contract – for the purposes of providing services and performing contractual obligations, the Service Provider may share information, including personal data, with third parties when necessary and customary for the fulfillment of its obligations. Such cases may include providing data and documents to potential investors, their professional advisers, auditors, or other parties involved in financing, legal and financial due diligence, transaction structuring, and other related activities.

The Service Provider does not disclose personal data provided by clients to third parties for their own marketing purposes. Any data transfer to a third party is carried out strictly in compliance with the principle of data minimization – only to the extent necessary and on a lawful basis.

VII. DATA TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

As a general rule, the Service Provider processes and stores personal data within the territory of the Republic of Bulgaria or within the European Economic Area (EEA). However, in certain cases, data may need to be accessed or stored using cloud services or providers located outside the EEA. In such situations, the Service Provider takes the necessary measures to ensure compliance with the requirements of Chapter V of the GDPR regarding the transfer of data to third countries.

VIII. RETENTION PERIODS FOR PERSONAL DATA

The Service Provider retains personal data provided by clients only for the period necessary to achieve the purposes for which they were collected, unless a longer retention period is required by law. Retention periods are determined as follows:

• Data processed based on contractual relationships – the Service Provider retains core data related to the contract (e.g., identification and contact data, contractual documentation, service records) for up to 5 years after the termination of the contract. Retention during this period serves to protect the Service Provider’s legitimate interests in the event of potential legal claims.
• Accounting and financial documents containing personal data (e.g., invoices, contracts, delivery-acceptance protocols, reporting documents) – are retained in accordance with the requirements of applicable accounting and tax legislation. This means that accounting documentation is kept for at least the statutory period. In case of changes in statutory deadlines, the Service Provider will comply with the requirements in force at the relevant time.
• Communication data (emails, correspondence) – if not part of the contractual documentation, the Service Provider typically retains business communications with clients for up to 5 years after the termination of the respective relationship, unless longer retention is needed (e.g., in case of an ongoing dispute). This allows the Service Provider to maintain a history of interactions and evidence for potential post-contractual matters.
• Prospective clients (pre-contractual relationships) – if a client has made an inquiry or negotiations have taken place without a contract being concluded, the Service Provider retains the personal data and correspondence for up to 6 months from the last contact with the prospective client. This enables the Service Provider to respond to follow-up questions or resume discussions. Upon explicit request of the prospective client, the Service Provider may delete such data earlier.

After the expiration of the relevant retention periods, the data are permanently deleted or anonymized unless the law requires their archiving for a longer period. When assessing retention periods, the Service Provider also considers the possibility of extending retention if necessary for ongoing legal proceedings or investigations – in such cases, data may be kept until the final conclusion of the respective proceedings.

IX. SECURITY MEASURES FOR PROCESSING

To ensure that personal data are protected, the Service Provider applies appropriate technical and organizational security measures. The Service Provider implements information security policies and procedures aimed at preventing unauthorized access, loss or leakage of data, unlawful use, or compromise of data integrity. Such measures may include:

• Restricting access to personal data only to authorized employees, contractors, or subcontractors who require access for the performance of their duties. All employees and engaged external parties are bound by contractual confidentiality clauses.
• Using up-to-date technical information security solutions – antivirus software, firewalls, data encryption where applicable, secure communication channels (VPN) for remote access, secure password management, etc.
• Keeping systems and software updated (regular updates and patches) to minimize the risk of vulnerabilities.

While all reasonable efforts are made to protect data, no method of data transmission over the Internet or electronic storage method is absolutely secure. In the event of a security breach that may threaten clients’ rights and freedoms, the Service Provider will act in accordance with legal requirements – including notifying the Commission for Personal Data Protection and the affected data subjects, where the conditions for such notification are met.

X. RIGHTS OF DATA SUBJECTS

As natural persons whose data are processed, the individuals concerned have the following rights under applicable law:

• Right of access – to obtain confirmation as to whether personal data are being processed by the Service Provider, access to such data, and information about the purposes, categories of data, recipients, retention periods, etc. regarding the processing.
• Right to rectification – to request the correction of inaccurate or incomplete personal data.
• Erasure – deletion of data under specific conditions.
• Right to erasure (“right to be forgotten”) – in certain circumstances, individuals have the right to request the deletion of their personal data, e.g., if the data are no longer necessary for the purposes for which they were collected; if they withdraw their consent in cases where the processing is based on consent and there is no other legal basis for processing. Data that the Service Provider is required to retain by law or that are necessary to establish or defend legal claims cannot be erased.
• Right to restriction of processing – to request temporary restriction of data processing (other than storage) in certain cases, such as when the accuracy of the data is contested, for a period during which the Service Provider must verify its accuracy; or when the processing is contested, pending verification of whether the Service Provider’s legitimate grounds prevail. In such cases, the data (other than storage) will be processed only with the client’s consent or for specific legal purposes.
• Right to object – at any time and on grounds relating to their particular situation, clients may object to the processing of their personal data based on the Service Provider’s legitimate interest. In such cases, the Service Provider will cease the processing unless it demonstrates compelling legitimate grounds for its continuation that override the client’s interests, rights, and freedoms, or where the data are necessary for the establishment, exercise, or defense of legal claims. If a client objects to processing for direct marketing purposes (if any), the Service Provider will immediately cease such processing.
• Right to data portability – in the cases provided for by law, clients have the right to receive the personal data concerning them, which they have provided to the Service Provider, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller without hindrance from the Service Provider, where: (i) the processing is based on the client’s consent or on a contractual obligation, and (ii) the processing is carried out by automated means. Where technically feasible, clients are also entitled to direct transmission (transfer) of data between controllers. This right applies only under the above conditions and does not extend to paper archives or other non-digital data.
• Right to withdraw consent – where the processing of personal data is based on explicit consent, clients have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. In such cases, the Service Provider shall not be considered in default or liable for non-performance arising solely from the withdrawal of consent, and the client is not entitled to claim a refund of fees already paid for the affected services.

The Service Provider undertakes to assist clients in exercising their rights. Clients are not required to pay a fee for exercising any of these rights. An exception applies only if a client’s requests are manifestly unfounded or excessive (e.g., repeated without valid reason), in which case the Service Provider may either charge a reasonable fee based on its administrative costs for providing the information/communication or taking the requested action, or refuse to comply with such an excessive request. In all cases, the Service Provider will inform clients of its decision and the reasons for it.

XI. EXERCISING CLIENTS' RIGHTS

To exercise the above rights, clients may submit a written request to the Service Provider using the contact details specified above. It is recommended that the request contains sufficient information to allow the Service Provider to identify the sender (e.g., name, email address, phone number used in correspondence or contractual relations) and determine which data the request concerns. In certain cases, the Service Provider may request additional information to confirm the sender’s identity and prevent unauthorized access to personal data by third parties.

The Service Provider reviews and responds to each request within the statutory period of 1 month from its receipt. Where necessary, this period may be extended by up to 2 additional months, depending on the complexity and number of requests, in which case the Service Provider will inform the client in a timely manner (within the initial one-month period). The response will be provided in written form – in the manner in which the request was submitted, or in another format preferred by the client, where applicable.

In cases where the Service Provider refuses to comply with a request (only in the cases provided by law), the client will be informed of the reasons for the refusal and of the possibility to lodge a complaint with a supervisory authority or seek judicial protection.

XII. RIGHT TO COMPLAIN TO THE SUPERVISORY AUTHORITY

If clients believe that their personal data rights have been violated or that the processing of personal data by the Service Provider is unlawful, they have the right to lodge a complaint with the supervisory authority for data protection in the Republic of Bulgaria – the Commission for Personal Data Protection (CPDP).

Complaints may be submitted in person at the CPDP offices, by mail/courier, or electronically. Contact details of the Commission: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd. Email: kzld@cpdp.bg, Website: www.cpdp.bg.

Submitting a complaint to the supervisory authority does not exclude the clients’ right to seek judicial protection. If clients choose to first contact the Service Provider, the Service Provider will make efforts to resolve the issue or concern voluntarily.

XIII. PRIVACY POLICY UPDATE

The Service Provider reserves the right to unilaterally amend, supplement, and update this Privacy Policy at any time. All changes take effect as of the date of their publication on the Service Provider’s website (shift.group), unless otherwise specified.

Clients are obliged to regularly review the current version of the Policy, and continued use of the services after the publication of changes shall be deemed acceptance of the updated terms.

In cases of material changes that may significantly affect clients’ rights, the Service Provider may also send individual notifications, including by email.

Last update: 29 July 2025