BEST BRAINS BULGARIA PRIVACY POLICY

1. Introduction

Best Brains respects your privacy and is committed to protecting personal data in accordance with applicable European Union and Bulgarian data-protection laws.

This Privacy Policy explains how BULGARIAN BEST BRAINS, with a registered address at Angel Bukoreshtliev 11, Plovdiv, Bulgaria ("Best Brains Bulgaria," "Best Brains," "we," "us," or "our"), collects, uses, stores, shares, transfers, and otherwise processes personal data through:

• The Best Brains Bulgaria corporate website and its related webpages
• Online inquiry, enrollment, placement-test, event-registration and contact forms
• Best Brains educational platforms, parent portals and applications made available through the website
• Franchise-development and business-opportunity inquiries
• Employment and contractor applications
• Marketing, advertising and social-media activities
• Communications with parents, guardians, students, franchise candidates and other visitors
• Other services that link to this Privacy Policy.

This Privacy Policy applies to individuals located in Bulgaria and, where applicable, elsewhere in the European Economic Area ("EEA").

2. Who Is Responsible for Your Personal Data?

For the processing activities described in this Privacy Policy, the data controller is:

Best Brains Bulgaria

Registered Address:
Angel Bukoreshtliev 11
Plovdiv, Bulgaria

Email: plovdiv@bestbrains.com

Telephone: (003) 598-88330347

Best Brains International Corporate Entities

Certain technology, curriculum, administrative, marketing, support, or franchise-management services may be provided by:

BEST BRAINS INC
135 E Algonquin Road, Suite B
Arlington Heights, IL 60005

Depending on the particular processing activity, the international corporate entity may act as:

• A service provider or data processor acting on instructions from Best Brains Bulgaria
• A separate data controller for its own corporate, franchise, or legal purposes
• A joint controller where the entities jointly determine why and how personal data is processed.

Where joint-controller arrangements apply, individuals may contact either relevant Best Brains entity to exercise their data-protection rights.

Independently Owned Best Brains Learning Centers

Individual Best Brains learning centers may be independently owned and operated by franchisees or other local businesses.

When you contact, select, enroll with, or receive services from a particular Best Brains learning center, that center may act as a separate data controller for information relating to:

• Local enrollment
• Class scheduling
• Tuition and payment administration
• Student attendance and progress
• Parent communications
• Local staffing
• Local events and promotions
• Compliance with local business and education requirements.

The applicable learning center should provide its own privacy information when it collects personal data directly from you. This corporate Privacy Policy does not replace the privacy notice of an independently operated center.

3. Applicable Legal Framework

Our processing of personal data is governed, as applicable, by:

• Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR)
• The Bulgarian Personal Data Protection Act
• The Bulgarian Electronic Communications Act and other applicable electronic-communications and cookie requirements
• Applicable consumer-protection, accounting, tax, employment, education, and commercial laws
• Other European Union or Bulgarian laws applicable to particular processing activities.

The Bulgarian Commission for Personal Data Protection is the national supervisory authority responsible for overseeing compliance with data-protection requirements in Bulgaria.

4. Personal Data We Collect

"Personal data" means information relating to an identified or identifiable natural person. It does not include information that has been irreversibly anonymized so that no individual can reasonably be identified.

Depending on how you interact with us, we may collect the following categories of personal data.

4.1 Parent and Guardian Information

We may collect:

• Full name
• Postal address
• Email address
• Telephone number
• Relationship to the student
• Preferred language
• Communication preferences
• Account or portal login information
• Information included in inquiries, complaints, or support requests
• Records of communications with Best Brains or a learning center.

4.2 Student and Child Information

Because Best Brains provides educational services to children, we may collect:

• Student's name
• Date of birth or age
• Grade or year level
• School or general educational background
• Parent or guardian contact information
• Requested subjects, programs, or educational services
• Placement-test answers and results
• Enrollment information
• Attendance records
• Assignments, assessments, and educational progress
• Teacher observations and instructional notes
• Learning-platform activity
• Information necessary to provide educational accommodations
• Photographs, audio recordings, or video recordings, where appropriate permission has been obtained
• Other information voluntarily provided by a parent, guardian, or student.

We ask parents and guardians not to provide sensitive information about a child unless it is necessary for the child's education, safety, or requested accommodations.

4.3 Website and Technical Information

When you visit our website or use our digital services, we may collect:

• Internet Protocol address
• Browser type and version
• Device type
• Operating system
• Device identifiers
• Language and regional settings
• Referring webpage
• Pages viewed
• Date and time of visits
• Links selected
• Approximate location derived from an IP address
• Cookie identifiers
• Consent preferences
• Session, diagnostic, and security information
• Information regarding interactions with advertisements or website features.

4.4 Enrollment, Transaction and Payment Information

We may collect:

• Selected center, program, and subjects
• Enrollment dates
• Tuition and fee information
• Discounts, promotional codes, or scholarships
• Billing address
• Payment status
• Transaction identifiers
• Refund or cancellation information
• Limited payment-card information supplied by a payment processor.

We generally use authorized payment-service providers to process payment-card transactions. Best Brains should not receive or retain complete card numbers or card-security codes unless specifically required and appropriately secured.

4.5 Franchise and Business Inquiry Information

When you inquire about a Best Brains franchise or other business relationship, we may collect:

• Name and contact details
• Country, city, and preferred territory
• Business and professional history
• Résumé or curriculum vitae
• Education and qualifications
• Financial capability or investment-range information
• Business ownership information
• References
• Records of meetings and communications
• Information supplied in franchise application forms
• Information necessary to evaluate or establish a prospective business relationship.

Any request for financial information should be limited to what is reasonably necessary for the franchise-evaluation process.

4.6 Employment and Contractor Information

If you apply for employment or contract work, we may collect:

• Name and contact information
• Résumé or curriculum vitae
• Employment history
• Education and qualifications
• Professional licenses or certifications
• References
• Interview notes
• Work-authorization information
• Salary expectations
• Availability
• Background-screening information where permitted by law
• Other information voluntarily submitted with an application.

Applicants should not provide unnecessary sensitive personal data in résumés or application materials.

4.7 Marketing and Event Information

We may collect:

• Email address and telephone number
• Marketing preferences
• Event registration and attendance
• Responses to surveys
• Promotion participation
• Social-media username or profile information
• Testimonials, reviews, or feedback
• Photographs or recordings from events, where appropriate notice and permission have been provided.

4.8 Sensitive or Special-Category Personal Data

Certain information receives additional protection under the GDPR. This may include information concerning health, disability, racial or ethnic origin, religious beliefs, biometric identification, or other legally protected characteristics.

Best Brains does not generally request special-category personal data through the corporate website. However, limited health, disability, allergy, accessibility, or accommodation information may be processed when necessary to:

• Protect a student's health and safety
• Provide an appropriate educational accommodation
• Respond to an emergency
• Comply with a legal obligation
• Provide a service requested by the parent or guardian.

Where required, we will obtain explicit consent or rely on another lawful condition permitted by Article 9 of the GDPR.

5. How We Obtain Personal Data

We may obtain personal data:

• Directly from you
• From a parent or legal guardian
• From a student, where appropriate
• From an independently operated Best Brains center
• From Best Brains corporate affiliates
• Through our website, applications, and learning platforms
• From franchise candidates or business partners
• From recruitment agencies and professional references
• From payment and technology providers
• From social-media platforms when you interact with our pages
• From advertising and analytics providers, subject to your consent where required
• From publicly available business or professional sources
• From government authorities or other parties where permitted or required by law.

If you provide personal data about another individual, you should ensure that you are authorized to provide it and that the individual has received any required privacy information.

6. Why We Process Personal Data

We process personal data only when we have an appropriate purpose and lawful basis.

6.1 Responding to Inquiries

We process contact details and inquiry information to:

• Respond to questions
• Arrange placement tests, consultations, or center visits
• Provide program and pricing information
• Direct inquiries to an appropriate learning center
• Take steps requested before enrollment or another agreement.

Lawful basis: Steps taken at your request before entering into a contract, performance of a contract, legitimate interests, or consent, depending on the circumstances.

6.2 Providing Educational Services

We process parent, guardian, and student information to:

• Assess educational needs
• Conduct placement tests
• Recommend programs and instructional levels
• Enroll students
• Deliver classes and educational materials
• Track attendance, assignments, and progress
• Provide parent updates
• Operate learning platforms
• Provide academic support
• Maintain appropriate educational records.

Lawful basis: Performance of a contract, steps taken before entering into a contract, legitimate interests in providing and improving educational services, legal obligations, and, where necessary, consent.

6.3 Operating the Website and Digital Services

We process technical and website information to:

• Provide website functionality
• Maintain security
• Authenticate users
• Remember preferences
• Diagnose technical problems
• Improve website performance
• Protect against fraud, abuse, or unauthorized access.

Lawful basis: Legitimate interests, legal obligations, and consent where required for non-essential cookies or similar technologies.

6.4 Marketing and Communications

Subject to applicable consent requirements, we may process personal data to:

• Send newsletters
• Announce new centers, events, or educational programs
• Provide promotional offers
• Invite participation in surveys or competitions
• Measure the effectiveness of marketing campaigns
• Personalize communications.

Lawful basis: Consent, legitimate interests, or another lawful basis permitted under applicable law.

6.5 Franchise Development and Business Administration

We process franchise and business information to:

• Evaluate franchise applications
• Conduct due diligence
• Arrange meetings and interviews
• Prepare agreements
• Administer business relationships
• Protect confidential business information.

Lawful basis: Steps prior to entering into a contract, performance of a contract, legitimate interests, and legal obligations.

6.6 Recruitment

Applicant information may be processed to:

• Review applications
• Arrange interviews
• Verify qualifications
• Conduct reference checks
• Evaluate suitability for employment
• Administer employment relationships.

Lawful basis: Steps requested before entering into an employment contract, legitimate interests, legal obligations, and consent where applicable.

6.7 Legal Compliance and Protection

We may process personal data to:

• Comply with legal obligations
• Maintain accounting and tax records
• Respond to lawful requests from courts or regulators
• Protect children and vulnerable persons
• Investigate fraud or misuse
• Exercise or defend legal claims
• Protect our rights, systems, staff, students, parents, franchisees, and the public.

Lawful basis: Legal obligations, legitimate interests, protection of vital interests, and establishment, exercise, or defense of legal claims.

7. Children's Personal Data

Best Brains provides educational services to children. We recognize that children's personal data deserves enhanced protection.

7.1 Collection from Parents or Guardians

Except where legally permitted otherwise, we expect personal data relating to children to be provided by a parent or legal guardian.

Where a child directly provides information, we may take reasonable steps to verify that any necessary parental authorization has been obtained.

7.2 Educational Records

Student information is processed only for educational, administrative, safeguarding, communication, and related purposes connected with providing educational services.

We do not use children's educational records for unrelated commercial purposes.

7.3 Marketing

We do not knowingly direct behavioural advertising to children or knowingly use children's personal data for profiling or targeted advertising without an appropriate lawful basis and, where required, parental authorization.

7.4 Photographs and Recordings

Photographs, videos, voice recordings, testimonials, or examples of student work will only be used where an appropriate lawful basis exists and any required parental consent or authorization has been obtained.

Parents or guardians may withdraw permission for future promotional use, subject to lawful processing already completed.

8. Cookies and Similar Technologies

Our website may use cookies, local storage, pixels, tags, software development kits, and similar technologies.

These technologies may be used for:

• Website operation
• Security
• Authentication
• Remembering preferences
• Analytics
• Performance measurement
• Embedded content
• Advertising measurement
• Social-media functionality.

Except where legally exempt, non-essential cookies will only be activated after you have provided consent through our cookie banner or preference center.

You may withdraw or change your cookie preferences at any time.

Disabling certain cookies may affect website functionality.

9. Direct Marketing

Where permitted by applicable law, we may send information regarding:

• Educational programs
• Events
• Center openings
• Special promotions
• Newsletters
• Franchise opportunities.

You may stop receiving marketing communications at any time by:

• Selecting the unsubscribe link in an email
• Updating your communication preferences
• Contacting us at plovdiv@bestbrains.com.

We may retain limited suppression records to ensure your opt-out request is respected.

Administrative, educational, payment, security, or legal communications are not marketing communications and may continue where necessary.

10. When We Share Personal Data

We do not sell personal data. We disclose personal data only where necessary for the purposes described in this Privacy Policy or where required or permitted by law.

10.1 Best Brains Corporate Entities

We may share personal data with Best Brains corporate affiliates for:

• Technology and platform support
• Administrative services
• Customer support
• Curriculum development
• Marketing administration
• Legal and compliance activities
• Franchise management.

10.2 Independently Operated Learning Centers

Where you request information from or enroll with a particular Best Brains learning center, we may disclose relevant information to that center.

The center may process the information as an independent data controller for its own educational, operational, billing, and legal purposes.

10.3 Service Providers

We may engage carefully selected service providers for:

• Cloud hosting
• Website operation
• Learning platforms
• Customer relationship management
• Email and messaging services
• Payment processing
• Analytics
• Cybersecurity
• Technical support
• Document management
• Professional consulting
• Marketing support.

Service providers process personal data only under written contractual instructions and are required to implement appropriate security and confidentiality safeguards.

10.4 Professional Advisers

Personal data may be disclosed where reasonably necessary to:

• Lawyers
• Accountants
• Auditors
• Insurance providers
• Financial advisers
• Other professional consultants.

10.5 Legal and Regulatory Authorities

We may disclose personal data where required or permitted by law, including to:

• Courts
• Law-enforcement authorities
• The Bulgarian Commission for Personal Data Protection
• Tax authorities
• Consumer-protection authorities
• Child-protection authorities
• Other competent public authorities.

We may also disclose information to establish, exercise, or defend legal claims or to protect individuals, property, or systems.

10.6 Corporate Transactions

Personal data may be disclosed in connection with:

• A merger
• Acquisition
• Business restructuring
• Investment
• Sale of assets
• Transfer of operations
• Insolvency proceedings.

Any recipient will be required to respect applicable privacy and data-protection obligations.

11. International Transfers

Best Brains may transfer personal data outside Bulgaria and the European Economic Area where necessary to provide services or support international operations.

Where personal data is transferred outside the EEA, we will implement an appropriate transfer mechanism, which may include:

• A European Commission adequacy decision
• Standard Contractual Clauses
• Binding Corporate Rules
• Another safeguard recognised under the GDPR
• A permitted derogation under Article 49 of the GDPR.

Where appropriate, we will conduct transfer-impact assessments and implement supplementary technical and organisational safeguards.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal, contractual, accounting, tax, safeguarding, and regulatory obligations.

Typical retention periods include:

• General inquiries: Normally up to 24 months after the last meaningful interaction.
• Parent and student educational records: During the educational relationship and for an appropriate period afterwards, subject to legal requirements.
• Marketing records: Until consent is withdrawn or the information is no longer required, together with suppression records where appropriate.
• Recruitment records: Normally up to 12 months after completion of the recruitment process unless another lawful basis applies.
• Franchise inquiries: For the application process and an appropriate legal and business-retention period.
• Financial records: For the retention period required under Bulgarian accounting and tax legislation.
• Security logs: For a limited period necessary for operational and cybersecurity purposes.
• Legal matters: Until the applicable limitation period and any related proceedings have concluded.

When retention is no longer required, personal data will be securely deleted, anonymised, or otherwise disposed of using appropriate methods.

13. Security Measures

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures may include:

• Role-based access controls
• Authentication and password management
• Encryption where appropriate
• Secure hosting environments
• Network monitoring
• Regular backups
• Incident-response procedures
• Employee confidentiality obligations
• Vendor security assessments
• Data-minimisation practices.

Although we implement appropriate safeguards, no internet transmission or electronic storage system can be guaranteed to be completely secure.

14. Personal Data Breaches

We maintain procedures for identifying, investigating, containing, documenting, and responding to personal-data breaches.

Where required under the GDPR, we will notify the Bulgarian Commission for Personal Data Protection within the applicable legal timeframe and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

15. Automated Decision-Making

We may use automated tools to support website administration, cybersecurity, inquiry routing, analytics, scheduling, and customer-service workflows.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by law and accompanied by appropriate safeguards, including the right to obtain human intervention where applicable.

16. Your Rights Under the GDPR

Subject to applicable law, you may have the following rights regarding your personal data:

• The right to be informed about how your personal data is processed
• The right to access your personal data
• The right to obtain a copy of your personal data
• The right to rectify inaccurate or incomplete information
• The right to erasure ("right to be forgotten") in appropriate circumstances
• The right to restrict processing
• The right to data portability
• The right to object to certain processing activities
• The right to withdraw consent where processing is based on consent
• The right not to be subject to certain decisions based solely on automated processing
• The right to lodge a complaint with the competent supervisory authority.

These rights are not absolute and may be limited where an exemption applies under the GDPR or Bulgarian law.

16.1 Right of Access

You may request confirmation as to whether we process your personal data and request access to that data together with the information required by Article 15 of the GDPR.

16.2 Right to Rectification

You may ask us to correct inaccurate personal data or complete incomplete information.

Please notify us whenever your contact information or other relevant details change.

16.3 Right to Erasure

You may request deletion of personal data where the requirements of Article 17 of the GDPR are satisfied.

We may retain information where continued processing is required for legal obligations, public-interest purposes, legal claims, or other lawful grounds.

16.4 Right to Restrict Processing

You may request restriction of processing in the circumstances described in Article 18 of the GDPR.

16.5 Right to Data Portability

Where applicable, you may request a structured, commonly used, machine-readable copy of personal data that you have provided to us and request its transmission to another controller where technically feasible.

16.6 Right to Object

You may object to processing based on legitimate interests or processing for direct-marketing purposes.

If you object to direct marketing, we will stop processing your personal data for that purpose.

16.7 Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal will not affect processing carried out before consent was withdrawn.

17. Exercising Your Rights

To exercise your rights or submit a privacy request, please contact:

Best Brains Bulgaria

Email: plovdiv@bestbrains.com

Telephone: (003) 598-88330347

Please include:

• Your full name
• Your contact details
• A description of your request
• The Best Brains center or service involved
• Information sufficient to identify the relevant records.

We may request reasonable proof of identity before responding to your request.

We will normally respond within one month. Where permitted by law, this period may be extended for complex or multiple requests.

Requests are normally free of charge. A reasonable fee may be charged where permitted by the GDPR for manifestly unfounded or excessive requests.

18. Complaints

If you believe that we have not handled your personal data appropriately, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

You also have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (CPDP)

The CPDP is responsible for supervising compliance with data-protection legislation in Bulgaria.

19. Third-Party Websites

Our website may contain links to:

• Best Brains learning-center websites
• Payment-service providers
• Social-media platforms
• Educational partners
• Recruitment services
• Government resources
• Other third-party websites.

These websites operate independently and have their own privacy notices. We encourage you to review those notices before providing personal data.

20. Social Media

If you interact with Best Brains through Facebook, Instagram, LinkedIn, YouTube, X, or another social-media platform, that platform may independently process your personal data under its own privacy policy.

We may receive information that you choose to make available through your profile settings or interactions with our official pages.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable law
• Regulatory guidance
• New technologies
• New educational services
• Business or organisational changes
• Updated security practices.

The latest version will be published on our website together with the revised effective or last-updated date.

Where required by law, we will provide additional notice or obtain renewed consent before material changes become effective.

22. Contact Us

Questions, requests, or complaints regarding this Privacy Policy may be directed to:

Best Brains Bulgaria

Registered Address:
Angel Bukoreshtliev 11
Plovdiv, Bulgaria

Email: plovdiv@bestbrains.com

Telephone: (003) 598-88330347