Personal Data Privacy and Security Policy www.mytesy.com and mobile application "tesyCloud", owned by Tesy OOD

Our mission

On 25 May 2018, the General Data Protection Regulation (GDPR) entered into force for all EU Member States. It applies directly in Bulgaria just as any national law, and covers the rights and obligations of administrators, processors and subjects of personal data; some of the details are further regulated by the Bulgarian Data Protection Act. All MyTesy users are personal data subjects and have different rights in this connection. This policy aims to tell more about MyTesy users' personal data protection principles, about our responsibilities as a personal data administrator, and about the measures we have taken to prevent your data from being used without your knowing by whom and for what purposes or without being able to object or withdraw your consent to its processing. The policy will not remain the same throughout the time MyTesy service is available; as the development of IoT ("the Internet of Things") is making progress, and the regulation of data processing relations is evolving. We at TESY OOD strive to constantly improve and adapt our practices to this development, which in turn will be reflected in our policy.

This policy was approved by the TESY Manager ("TESY") on 25 May 2018 and covers all activities related to the processing of personal data within the MyTesy service.

You can contact the personal data protection officer at TESY regarding any ambiguities related to the application of this policy or the exercise of your rights at dpo@tesy.com.

Key terms

"Personal Information" - this is any information that concerns users of www.mytesy.com and the “tesyCloud” mobile application, which, alone or in combination with other information, can help us establish your identity or link your user behavior to a specific device from which you access www.mytesy.com and "tesyCloud".

"Subject of Personal Data" - this is you, the visitor of www.mytesy.com and "tesyCloud”.

"Processing of personal data" - this is any action we perform or can do with your personal data, including, but not limited to, collecting, analyzing, storing, destroying, etc.

“Administrator of personal data” - "TESY OOD" (TESY), registered under the laws of the Republic of Bulgaria, with a registered office and business address: Republic of Bulgaria, town of Shumen, 48 Madara Blvd., entered in the Commercial Register at the Registry Agency of the Republic of Bulgaria with unified identification code (UIC): 040029337, owner of the tesyCloud mobile application and the domain www.mytesy.com. We determine the purpose of processing your data, on one of the grounds provided for by the law; in essence, we also determine the means by which this processing is carried out - for example, the technical infrastructure and the applications with which the processing is done.

“Personal Data Processor" - this is a third person processing your personal data under our assignment, where TESY has strictly defined the purpose of the processing, the means by which it is done, and has verified that the person meets the GDPR requirements. Such a processor can be, for example, an agency responsible for a TESY marketing campaign on a social network and reports on its success.

“Cookies” are small text files stored in browser directories used by the user. Cookies are used to help users effectively use Web sites and make certain functionalities available. Cookies play an important role in facilitating and improving the usability of websites; therefore, if deleted or blocked, may cause some websites or certain functionalities to become inaccessible to users.

"Information society services" are services that are normally provided for remuneration and at a distance, via electronic means. The recipient of such a service must have requested it explicitly. E-commerce is also a type of service.

Aim of the policy

This Policy is intended to inform you of the manner in which your data is collected and processed, as well as of your rights relating to your personal data. Your personal data is processed in accordance with the principles of lawfulness, good faith and transparency. TESY collects your personal data for specific, explicit and legitimate purposes and does not process it further in a manner inconsistent with these purposes. TESY processes as much personal data as is needed in connection with the purposes for which it was collected and you were notified.

TESY strives to keep the data accurate and up to date, with each user cooperating with TESY and updating their account when changed.

Personal data shall be processed in such a way as to ensure an adequate level of data security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures.

The personal data you fill in the registration form and modify/add after creating your profile, as well as after connecting your appliances, are necessary so that we can meet your needs or the requested service that TESY provides, namely a remote connection with your appliances and their management by you at any time of any place. In order for us to provide this service in good quality, we collect and process your personal data.

Marketing activity

When registering an account for the MyTesy service, we have provided the option of choosing whether we can use your E-mail address to inform you about new services, available discounts on existing services, or some facilitations in the service that we have created for you. The messages we send the will be in compliance with applicable Bulgarian and EU legislation. You can easily and conveniently object to such use and we will terminate it immediately; the information on how to withdraw an initially given agreement or to object to receiving an unsolicited marketing message will always be placed in a prominent position in the message. You can always withdraw your consent by using the settings menu in your account. If necessary, you can contact us at dpo@tesy.com.

List of the third countries:

Cookies

“Cookies” are small texts or data which are sent to the device (computer, laptop, tablet, smartphone) to be stored and may be requested again by the sender. Cookies may have different functions: from keeping your “logged in” status while you are filling in a registration form, through storing your language preferences for browsing our website, to monitoring your behavior while you are surfing the internet, sometimes for a long period of time and regardless of the device used: in the latter case, as in all similar cases, cookies cannot be used without your prior consent for this based on received detailed information.

The cookies we use are:

• Absolutely needed: without the cookies you cannot use the service and its functionalities which we have developed for you;

• Functional: these cookies make the website perform better. We do not monitor your surfing habits;

• Sessional: they “live” only within a single user session.

www.mytesy.com and the "tesyCloud" mobile application use these cookies because they are important for their operation. By registering we consider that you accept the use of cookies.

Categories of personal data

We collect and process the following categories of data in order to effectively provide our services:

Aims of processing

The data above is required in connection with providing the MyTesy service and in connection with Art. 6 (1) (b) of the General Regulation.

If you have checked that you wish to receive information materials when registering for the service, we may use your e-mail address for marketing purposes. The reason for this processing is your consent in accordance with Art. Article 6 (1) (a) of the General Regulation.

Your rights

Right to information

As a user, you have the right to receive information about important features of your personal data processing, including the purposes, timing, and reason, about the recipients and categories of recipients of personal data, and others. Depending on how we first collected the information, we will show the most important thing in this connection in an appropriate and easily visible way every time.

Right to access

You can access your personal information in the user's profile www.mytesy.com and the "tesyCloud” mobile application at any time through logging into tour profile.

Right to portability

We can provide you, on request, with information about all the personal data we process in order to render the service at your request, or collected from you with your consent, in a machine readable format. The request shall be addressed at dpo@tesy.com and we will endeavor to respond to it within 30 days of receiving it via an electronic communications channel that you have specified.

Right to correction

You have the right to ask us to correct incorrectly recorded or stored personal data about you through www.mytesy.com and the "tesyCloud" mobile application. The right to correction is exercised by logging into your profile and correcting the entered data. If necessary, you can address dpo@tesy.com for cooperation.

Right to request restrictions on the processing of your personal data

You have the right to request that we temporarily suspend the processing of your personal data (without deleting it) in the case of your objection to a specific processing, or in the case of your filing a claim or complaint with the competent supervisory authority. The request shall be addressed atdpo@tesy.com.

Processing on the grounds of a legitimate interest on the part of TESY or a third party and objection to such processing

TESY processes your data on the basis of consent and for the purposes of performing the service you have requested through your registration at www.mytesy.com and the "tesyCloud” mobile application. When your consent is not requested and given for the purpose of a particular processing, or it is not immediately necessary to fulfill the service you requested, we are most likely to have a legitimate interest on our part or on the part of a third party, which we have determined will not harm or otherwise adversely affect your right to data protection. Such a judgment will always be documented by us and will follow certain criteria and argumentation. You have the right to acquaint yourself with the its key elements on request, as well as to object that, given the peculiarities of your particular situation, the processing in question affects your right to privacy and/or protection of personal data in a way more substantial than foreseen in justification. In these cases, we shall consider your objection and give a well-grounded opinion on its acceptance or rejection within 10 workdays. By objecting to this processing, you can also exercise your right to objection above. The objection may be addressed to us at dpo@tesy.com.

Withdrawal of your consent

In cases where we have requested your consent to a particular processing of your personal data, you can always withdraw it. If you are not sure on what grounds we process your personal data, you can always ask us, and you can also ask about the exact way you gave your consent, we will respond within 7 workdays. We maintain an up-to-date basis of personal data processing consents that we can refer to at any time. Withdrawal of consent is done in the same as you gave it, and we will provide you with information - a link or an email where you can do this easily and conveniently in responding to your inquiry.

Right to file a complaint with the competent personal data protection authority

Whenever you feel that your GDPR rights have been violated, you can file a complaint with the personal data protection authority. In Bulgaria, it is the Commission for personal data protection. However, if you have any comments or complaints with TESY concerning the processing of your personal data, you can first contact our Data Protection Officer atdpo@tesy.com, to discuss the arisen issue.

We are committed to responding to you within 30 workdays of receiving your complaint or your question.

Fees and expenses

Any information, communication and actions in connection with your rights is implemented and provided free of charge. When user requests are clearly unfounded or excessive, in particular because of their repetitiveness, TESY may either charge a reasonable fee, taking into account the administrative costs of providing information or communication or undertaking the requested action.

Technical and organizational measures

As a MyTesy User, it is important for us that you know that at the moment, the MyTesy data server is located in Amsterdam. In developing and delivering the service, we have undertaken, and on the basis of technological progress, we will continue to develop and implement appropriate technical and organizational measures, both at the design stage of the various functionalities and the default ones, to ensure the security and protection of your data.

TESY will not disclose your data to third parties unless we are under an obligation to do so by law. In such cases, you will be duly advised of such disclosure.

The policy is available to any User on www.mytesy.com and the "tesyCloud" mobile application when creating a MyTesy account, and after signing up in the account settings menu.

The policy was last updated on 25 May 2018 and has been in force since the date of its update.