PRIVACY POLICY AND PERSONAL DATA PROTECTION POLICY

by ASTREA RECRUITMENT Ltd. for the websites www.astrea.bg and www.astrea-bg.com

Last updated: June 2026

This Privacy Policy explains how we collect, use, store, and protect the personal data of job applicants, visitors to our websites, individuals who contact us, and representatives of our clients, business partners, and suppliers.

ASTREA RECRUITMENT, Ltd. is a licensed employment agency registered pursuant to Article 5(1) of the Ordinance on the Terms and Procedure for Carrying Out Employment Mediation Activities, holding Registration Certificate No. 1809 / June 18, 2025, issued by the Bulgarian Employment Agency.

Our mission is to connect businesses with talented professionals by providing the best job opportunities while meeting our clients' recruitment needs.

In order to carry out our core business activities—recruitment and career consulting—as well as to comply with our legal obligations to the Bulgarian Employment Agency regarding the administration and supervision of employment placement activities, we collect, store, and process candidates’ personal data while ensuring:

• that your personal data is used solely for recruitment and career counseling purposes;
• the confidentiality, integrity, availability, and accuracy of your personal data through appropriate technical solutions, organizational measures, and internal control procedures;
• transparent procedures that allow you to exercise your rights under Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 („General Data Protection Regulation“ or „GDPR“);
• dedicated career consultants who can provide you with suitable job opportunities, guidance throughout the recruitment process, and assistance in exercising your data protection rights.

We are committed to providing professional recruitment and career consulting services while implementing appropriate technical and organizational measures to protect personal data in accordance with the GDPR and all applicable laws.

For more detailed information, we invite you to read this Privacy Policy in its entirety. Should you require any additional information or assistance, we are here to help.

PRIVACY AND PERSONAL DATA PROTECTION POLICY

ASTREA RECRUITMENT Ltd. collects and processes personal data lawfully, fairly, and transparently, in accordance with the principles set forth in Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian law.

Our Privacy Policy reflects our commitment to processing your personal data only when there is a valid legal basis for doing so.

1. Processing for the Performance of a Contract or Steps Prior to Entering into a Contract

This legal basis applies when we contact you regarding your successful application for a job opening.

In order to assist you in applying for a job with a current or prospective employer, we are required to enter into an Employment Mediation Agreement with you. This is a legal obligation under Bulgarian law governing employment mediation activities.

The agreement is registered in the Bulgarian Employment Agency's information system and retained for the period prescribed by applicable law.

2. Processing Based on Legitimate Interest

If you apply for a position but do not fully meet the requirements of the specific job opening, we may retain your application for the duration of the recruitment process and for a reasonable period thereafter, if necessary to protect our legitimate interests in conducting recruitment activities.

If we contact you regarding other suitable job opportunities, your personal data will be processed only where there is an appropriate legal basis.

3. Processing Based on Your Consent

If you have provided your explicit consent, ASTREA RECRUITMENT Ltd. may retain your application after the completion of a particular recruitment process in order to inform you about future employment opportunities that may be of interest to you.

You may withdraw your consent at any time without affecting the lawfulness of the processing carried out prior to such withdrawal.

Applicable Legislation

This Privacy Policy has been prepared in accordance with:

• Regulation (EU) 2016/679 (GDPR);
• The Bulgarian Personal Data Protection Act;
• The Bulgarian Electronic Communications Act (where applicable);
• The applicable laws governing employment mediation activities.

Scope of the Policy

This Policy applies to:

1. Job applicants applying through ASTREA RECRUITMENT Ltd.;
2. Candidates presented to the Company’s clients;
3. Candidates referred by the Company’s recruitment partners;
4. Visitors to the websites https://astrea.bg and https://astrea-bg.com, as well as applicants applying through third-party recruitment platforms such as Jobs.bg, Zaplata.bg, Rabota.bg, and other recruitment channels used by the Company.

This Policy describes the categories of personal data we process, the purposes and legal bases for processing, the recipients with whom personal data may be shared, the applicable retention periods, and your rights under the GDPR.

Personal Data We Collect

We may collect personal data through our websites, recruitment partners, public job portals (such as Jobs.bg, Zaplata.bg, and others), social media platforms (including LinkedIn), telephone conversations, email correspondence, interviews, and any other communication related to recruitment processes.

Depending on the specific circumstances, we may process the following categories of personal data:

• Full name;
• Phone number;
• Email address;
• Date of birth;
• Nationality;
• Information regarding work permits or employment authorization, if applicable;
• Information contained in your Curriculum Vitae (CV);
• Education, qualifications, and professional experience;
• Language and professional skills;
• References and recommendations you have provided;
• Information obtained during interviews, assessments, and communications throughout the recruitment process;
• Any other information you voluntarily provide to us.

We process your personal data solely for the purposes for which it was collected and do not disclose it to potential employers or any other recipients unless there is an appropriate legal basis for doing so.

We implement appropriate technical and organizational measures to protect your personal data and ensure transparent procedures for its processing.

Our recruitment consultants are available to provide information about ongoing recruitment processes, career opportunities, and assistance in exercising your rights under the GDPR.

Important Notice

We recommend that you do not include special categories of personal data in your Curriculum Vitae (CV), such as information regarding your racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, health status, biometric data, genetic data, or information concerning your sex life or sexual orientation, unless such information is required by law or is directly relevant to a specific position.

We also recommend that you do not include information contained in identity documents, such as your Personal Identification Number (EGN), national ID card or passport number, date of issue, or expiration date, unless such information is requested at a later stage of the recruitment process and there is a valid legal basis for collecting it.

Data Collected Automatically

When you visit the websites of ASTREA RECRUITMENT, Ltd., certain technical information is automatically collected through the server log files.

This information may include:

• The type and version of your web browser;
• Your operating system;
• The referring website (if applicable);
• The date and time of your visit;
• Your IP address;
• Your Internet Service Provider (ISP);
• Information about the device used;
• Other technical information necessary to ensure the security and proper functioning of the website.

This information is not used to identify individual visitors to our websites.

The data is processed for the following purposes:

• Ensuring the proper operation of the website;
• Maintaining and improving the quality and security of our services;
• Preventing, detecting, and investigating unauthorized access attempts or misuse;
• To comply with legal obligations, where applicable.

Server log files are stored separately from any personal data voluntarily provided by users.

Purposes of Personal Data Processing

Personal data is processed solely for legitimate and specific purposes, including:

• Providing recruitment and career consulting services;
• Connecting candidates with prospective employers;
• Managing recruitment and selection processes;
• Communicating with candidates and clients;
• Informing candidates about suitable job opportunities;
• Improving the quality of our services;
• To comply with legal obligations;
• Protecting the Company's legitimate interests.

When you apply for a specific position, your personal data may also be used for the following purposes:

• Assessing your professional experience, qualifications, and skills;
• Conducting interviews and assessments;
• Matching your professional profile with suitable job openings;
• Providing additional career development and professional consulting services.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

COOKIE POLICY

Last updated: June 30, 2026

1. General Information

This Cookie Policy („Policy“) explains how ASTREA RECRUITMENT, Ltd., UIC 203088121, with its registered office and management address at 83 Odrin Street, Vazrazhdane District, Sofia, Bulgaria („the Company,“ „we,“ „us“), uses cookies and similar technologies when you visit our websites www.astrea.bg and www.astrea-bg.com.

This Policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act, and the applicable laws governing the use of cookies.

2. What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or cell phone) when you visit a website.

They allow the website to recognize your device during future visits, remember certain settings and preferences, and ensure the website functions properly.

Cookies do not, on their own, contain information that directly identifies you as an individual.

3. Why Do We Use Cookies?

We use cookies for the following purposes:

• To ensure that our website functions properly;
• To improve website security;
• To analyze website traffic and usage;
• To enhance the user experience;
• To remember user-selected preferences;
• To comply with our legal obligations, where applicable.

4. What Types of Cookies Do We Use?

4.1 Strictly Necessary Cookies

These cookies are essential for the website to function properly.

Without them, certain website features would not be available.

They may include:

• Page navigation;
• Protection of contact forms;
• Protection against malicious activities;
• Technical operation of the website;
• Storage of cookie consent preferences.

These cookies cannot be disabled via the cookie consent banner.

4.2 Analytical Cookies

Subject to your consent, we may use analytical cookies to better understand how visitors use our website.

These cookies may collect information such as:

1. Number of visitors;
2. Most frequently visited pages;
3. Time spent on the website;
4. Type of device used;
5. Browser type;
6. Approximate geographic location.

This information is used solely for statistical purposes and to improve the content and functionality of our website.

4.3 Functional Cookies

Functional cookies allow the website to remember the choices and preferences you have made.

These may include:

• Language preferences;
• User interface settings;
• Other available user preferences.

4.4 Marketing Cookies

As of the date of the most recent update to this Policy, ASTREA RECRUITMENT, Ltd. does not use marketing cookies for user profiling or to display personalized advertisements.

Should such technologies be implemented in the future, this Policy will be updated accordingly.

5. Legal Basis

Strictly necessary cookies are used based on the Company’s legitimate interest in ensuring the proper operation and security of the website.

All other categories of cookies are used only after obtaining your prior consent via the cookie consent banner.

You may change or withdraw your consent at any time.

6. Third-Party Cookies

Our website may use services provided by third parties that may set their own cookies.

Such services may include:

• Website analytics services;
• Social media integrations;
• Embedded maps;
• Embedded video content;
• Other external services.

The use of such cookies is governed by the respective privacy and cookie policies of the relevant third-party providers.

7. Cookie Retention Period

Cookies can be classified as follows:

Session Cookies

These cookies are automatically deleted when you close your web browser.

Persistent Cookies

These cookies remain stored on your device for a specified period or until you delete them manually.

8. Managing Cookies

When you first visit our website, you may choose to:

• Accept all cookies;
• Reject non-essential cookies;
• Customize your cookie preferences.

You can also delete cookies already stored on your device at any time through your browser settings.

Please note that restricting certain categories of cookies may affect the website's functionality.

9. Personal Data Protection

Where the use of cookies involves the processing of personal data, such processing is carried out in accordance with the Privacy Policy of ASTREA RECRUITMENT Ltd.

10. Changes to This Policy

ASTREA RECRUITMENT Ltd. reserves the right to update this Policy from time to time to reflect changes in applicable laws, the technologies used, or the functionality of the website.

The most recent version will always be posted on our website.

11. Contact Information

If you have any questions about this Policy or would like more information about our use of cookies, please contact us:

ASTREA RECRUITMENT, Ltd.

83 Odrin Street
Vazrazhdane District
Sofia, Bulgaria

Data Protection Officer (DPO):
Silvija Djokić

Email: dpo@astrea-bg.com

5. Legal Basis

Strictly necessary cookies are used based on the Company’s legitimate interest in ensuring the proper operation and security of the website.

All other categories of cookies are used only after obtaining your prior consent via the cookie consent banner.

You may change or withdraw your consent at any time.

6. Third-Party Cookies

Our website may use services provided by third parties that may set their own cookies.

Such services may include:

• Website analytics services;
• Social media integrations;
• Embedded maps;
• Embedded video content;
• Other external services.

The use of such cookies is governed by the respective privacy and cookie policies of the relevant third-party providers.

7. Cookie Retention Period

Cookies can be classified as follows:

Session Cookies

These cookies are automatically deleted when you close your web browser.

Persistent Cookies

These cookies remain stored on your device for a specified period or until you delete them manually.

8. Managing Cookies

When you first visit our website, you may choose to:

• Accept all cookies;
• Reject non-essential cookies;
• Customize your cookie preferences.

You can also delete cookies already stored on your device at any time through your browser settings.

Please note that restricting certain categories of cookies may affect the website's functionality.

9. Personal Data Protection

Where the use of cookies involves the processing of personal data, such processing is carried out in accordance with the Privacy Policy of ASTREA RECRUITMENT Ltd.

10. Changes to This Policy

ASTREA RECRUITMENT Ltd. reserves the right to update this Policy from time to time to reflect changes in applicable laws, the technologies used, or the functionality of the website.

The most recent version will always be posted on our website.

11. Contact Information

If you have any questions about this Policy or would like more information about our use of cookies, please contact us:

ASTREA RECRUITMENT, Ltd.

83 Odrin Street
Vazrazhdane District
Sofia, Bulgaria

Data Protection Officer (DPO):
Silvija Djokić

Email: dpo@astrea-bg.com

Data Retention and Updates

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by applicable law.

Where the processing of your personal data is based on your consent, you may withdraw that consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

If necessary, we may contact you to update the personal information you have provided.

Disclosure of Personal Data

ASTREA RECRUITMENT Ltd. does not sell or disclose personal data to third parties, except where this is necessary for recruitment purposes, required by law, or supported by another valid legal basis.

Personal data may be shared with:

• Prospective employers in connection with a specific hiring process;
• IT service providers and system support providers;
• External consultants, auditors, and other data processors, as necessary for the provision of our services;
• Competent public authorities, where required by applicable law.

All data processors engaged by ASTREA RECRUITMENT Ltd. are contractually bound by confidentiality obligations and process personal data solely on our behalf and in full compliance with the requirements of the GDPR.

Your Rights

Under the GDPR, you have the right to:

• Access your personal data;
• Request the correction of inaccurate or incomplete personal data;
• Request the erasure of your personal data when the legal requirements are met;
• Request the restriction of processing;
• Object to processing where it is based on our legitimate interests;
• Receive your personal data in a portable format, where applicable;
• Withdraw your consent at any time if the processing is based on consent;
• File a complaint with the Commission for Personal Data Protection (the Bulgarian supervisory authority).

To exercise any of your rights, you may contact our Data Protection Officer (DPO) using the contact information provided in this Privacy Policy.

We will carefully review every request and respond within the time limits established by Regulation (EU) 2016/679 (GDPR).

International Transfers of Personal Data

ASTREA RECRUITMENT Ltd. processes and stores personal data primarily within the European Economic Area (EEA).

Where it is necessary to transfer personal data outside the European Economic Area or Switzerland, such transfers will take place only where a valid legal basis exists and in full compliance with the requirements of Regulation (EU) 2016/679 (GDPR), including the implementation of appropriate safeguards to ensure the protection of personal data.

Protection of Personal Data

ASTREA RECRUITMENT Ltd. implements appropriate technical, organizational, and administrative measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized access, disclosure, or any other unlawful form of processing.

Access to personal data is granted only to employees and other authorized individuals whose duties require such access. All persons processing personal data on behalf of the Company are bound by confidentiality obligations and receive appropriate training on personal data protection.

The Company conducts periodic risk assessments related to the processing of personal data and, where necessary, implements measures to improve its internal rules, procedures, and information security practices.

Where the nature, scope, context, or purposes of the processing so require, the Company conducts a Data Protection Impact Assessment (DPIA) in accordance with the requirements of the GDPR.

In the event of a personal data breach, ASTREA RECRUITMENT Ltd. will take all necessary measures to mitigate its consequences and, where required by law, will notify the Commission for Personal Data Protection within 72 hours upon becoming aware of the breach.

If the breach is likely to pose a high risk to the rights and freedoms of the affected individuals, the Company will also notify those individuals without undue delay, in accordance with the GDPR.

Updates to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in applicable laws, the Company’s activities, or the way in which personal data is processed.

If significant changes are made, the updated version will be published on the Company’s website, and the „Last Updated“ The date at the beginning of this Policy will be amended accordingly.

Contact Us

If you have any questions regarding this Privacy Policy or wish to exercise your rights as a data subject, you may contact us at:

ASTREA RECRUITMENT, Ltd.

Data Protection Officer (DPO):
Silvija Djokich

Email: dpo@astrea-bg.com