General Terms and Conditions Applicable to Personal Data Processing Activities

• 1."EUROPING" LTD, registered in the Commercial Register at the Registry Agency with Unified Identification Code (EIK) 207237210, with its registered office and management address at 15 Nancho Popovich Street, Shumen 9700 (the Client), acts as the data controller regarding personal data contained in the information carriers provided to the Contractor. The data controller determines the purposes of processing personal data and the deadlines for carrying out such processing. The Contractor acts as the data processor with respect to this personal data and guarantees that under no circumstances will they process it for purposes not specified by the Client.

• 2. The Client and the Contractor undertake, in the performance of their obligations and exercise of their rights, to comply with the requirements of the General Data Protection Regulation and all other provisions for the protection of personal data, including the Medical Establishments Act, the Personal Data Protection Act, and other regulatory acts. In this regard, the Client guarantees that the personal data provided to the Contractor is collected and processed in compliance with the requirements of the specified regulatory acts, including those related to the storage of medical documentation.

• 3. The Contractor undertakes to take technical and organizational measures to ensure the confidentiality of the personal data provided for processing and to promptly inform the Client if the security for their protection is compromised.

• 4. The Contractor will comply with the agreed conditions for data processing and will follow the Client's instructions regarding the performance of the tasks delegated by the latter for the processing of personal data. The Client sends its instructions in writing, including by email, according to the specified order of exchanging information with the Contractor, with a minimum 7-day deadline for their execution. If urgent actions are required due to the risk to the security of the processed personal data, the Client specifies this circumstance, and the Contractor is obliged to take the necessary actions without delay.

• 5. The Contractor undertakes to promptly inform the Client of any threat to the security of personal data, according to the specified order of exchanging information.

• 6. The Contractor will inform the Client if the instructions contradict the requirements for the protection of personal data, including cases of obvious contradiction between the order and the rules for processing personal data, when these instructions threaten the security of personal data or other confidential information held by the Contractor, or require actions that are disproportionate to the risk to the processed personal data. If the Contractor unjustifiably and in violation of the undertaken obligations fails to comply with the Client's instructions, thereby endangering the security of personal data or other confidential information for the Client, the Client may terminate the contract with a 1-month notice.

• 7. The Contractor guarantees that all its employees performing functions related to the provided services have signed a declaration according to a template or have undertaken an obligation to preserve the confidentiality of the data by the force of another binding document, have committed to protecting it, and have been instructed about the consequences arising from the breach of confidentiality obligations. The Contractor also guarantees that the specified employees are familiar with and strictly adhere to the standards for the protection of personal data, regular training sessions are conducted regarding the identification and prevention of threats to the protection of personal data, and there are designated employees responsible for immediate action in the presence of a risk to or breach of the security of processed personal data.

• 8. The organizational and technical measures taken by the Contractor to ensure data protection include measures to restrict physical access to data carriers, measures to prevent unauthorized access, and securing the premises where processing takes place. Measures are also in place to identify unauthorized access and the data affected by it. The Contractor guarantees that the provided data is encrypted, limiting the risk for the individuals concerned, protected from damage, alteration, or destruction, including through the recording of a backup electronic medium that allows timely recovery. The organizational and technical measures applied by the Contractor enable tracing authorized access to data and actions performed within its framework.

• 9. The Client, and specifically its employee responsible for data protection, will be authorized to take all necessary measures for monitoring. Monitoring is carried out in coordination with the Contractor, who provides the necessary assistance. The Client has the right to access all information about the processing of personal data carried out by the Contractor in accordance with the delegated activity, with the exception of information that would expose personal data to risk or would lead to the disclosure to the Client of other information that is confidential to the Contractor.

• 10. The Contractor will engage third parties (subcontractors) only if the Client has given its written consent in the contract or later in a separate letter of agreement. The Contractor will ensure compliance with data protection provisions and will adhere to the Client's right to instruct and verify each subcontractor.

• 11. The Contractor undertakes not to store, process, or transmit personal data provided by the Client to countries outside the EU without the prior written consent of the Client. If the Client and the Contractor agree on the rules and measures to ensure the rights of data subjects regarding the storage, processing, or transmission of data to a third country.

• 12.The Contractor guarantees the execution of the Client's instructions regarding obligations towards data subjects, instructions related to correction, deletion of data, restriction of processing, provision of data for the purpose of the right to data portability, or objections to automated data processing. The Client commits to providing a minimum 10-day period for the execution of such instructions, and within the same period, the Contractor must confirm receipt of the instruction and indicate whether it can be fulfilled within the given timeframe.

• 13. In the event that the Contractor collects and performs automated processing of personal data on behalf of the Client, the Contractor undertakes to assist in informing data subjects during the initial collection of information about them and in connection with objections to automated data processing.

• 14. The Contractor is obliged to promptly forward to the Client any requests received from individuals whose personal data is processed in connection with the previous two points.

• 15. The Contractor and the Client will mutually inform each other immediately of any breaches and irregularities related to data protection, especially suspicious non-compliance with data protection provisions. The Contractor promptly notifies the Client if an unauthorized access to the provided personal data has been detected. In this case, the Contractor provides information about the nature of the breach, the individuals whose data is affected, the potential consequences of the breach, and the measures taken to limit these consequences, as well as measures to address the security breach. The Contractor may delay providing information about the breach only if there is a legitimate reason to do so, and is obligated to provide information to the Client about this reason. Information about the breach may be provided to the Client in parts, ensuring that the information is provided as soon as possible.

• 16. The Client is obligated to organize notification to the Commission for Personal Data Protection (CPDP) and the individuals affected by the breach, with the Contractor providing any necessary assistance in this regard.

• 17. The Contractor assists the Client in fulfilling its obligations to ensure the security of personal data, providing recommendations and opinions regarding the implemented data protection measures known to them, as well as the means implemented by the Client to access the information carriers stored by the Contractor. When conducting an impact assessment carried out by the Client, the Contractor provides information about the implemented technical and organizational measures for the protection of personal data and gives an opinion on the risk associated with processing while complying with the provisions of point 6 of these general terms and conditions.

• 18. After the completion of the contract, if the destruction of the data carriers by the Contractor is not agreed upon, they are returned to the Client.

• 19. These general terms and conditions apply unless otherwise provided in a contract between the Client and the Contractor, or the rules specified above are inapplicable due to the nature of the data processing delegated.