„Klear Lending“ AD Information Notice

With the present Information Notice we will explain how we process Your personal data, the purposes and grounds for processing, to what parties we may disclose the data and the applicable retention periods, Your rights and how to exercise them.
Latest update: 09.17.2025

I. Information about Us

„Klear Lending“ AD (referred to as “We/Us”) as personal data administrators value transparency and believe that every user of our products and/or services should be completely aware how his personal data is used.

For inquiries related to the usage of Your personal data according to the current Information notice, please address our Data Protection Officer via e-mail: DPO@klearlending.com or post address: 1784 Sofia, Bulgaria, 115 M Tsarigradsko Shose Blvd., European Trade Center, Building D, 1st Floor

II. Personal Data Provisioning

It is important to know that to provide the required personal data for preparation and/or conclusion of agreement for services and/or products We provide is voluntary but also necessary precondition. If You do not provide the required personal data We will not be able to review Your request and/or to provide our products/services.

In the event of established relationship with You the personal data might be required for performance of our contractual and/or legal obligation. If You choose not to provide the data this may result to termination of already concluded agreement(s) between us.

In some cases, we will need Your consent for additional processing, and we will inform You about this accordingly.

III. Persons subjects to the present information notice

The present Information Notice applies to You if you are:
3.1. one of our customers (including registered user of our website) or You are a party in contractual relationship with us;
3.2. person which is interested in our products or services when You provide your personal data (via our website) to contact You;
3.3. member of the family of our customer. Sometimes our customers may share information for their family, when it is necessary to provide them product or services or to study them better;
3.4. related person per § 1, т. 4 и т. 5 the Supplemental Provisions of the Credit Institutions Act and in relation wit p. 94 of the EBO Guidеlines on Credit Origination and Monitoring;
3.5. when You or entity represented by You participate directly or indirectly in the capital of entity and/or You are person exercising control over this entity or subsidiaries which is (are) or would like to be our customer(s) and the decision of the relevant entity body are required/applied for our relationship with this entity or we are required to perform legal obligation to identify its ultimate beneficial owner (UBO);
3.6. our customer’s representative (statutory or authorized) or because You are in the process to apply for our product or service;
3.7. person which files a request, proposal, complaint without being our customer;
3.8. person for whom we have received request and/or guidance in relation with You or entity You represent by state authority/institution or person with public functions e.g. private/state enforcement agent;
3.9. person for which we have received information from public databases, persons related to You or Your business;
3.10. when between You and a person that request to use our product or service exists relation (incl. economic) or there is a relationship which are source for repayment of financing granted by Us (including cases when You are the entity represented by You is a debtor acquired or in the process of acquisition by us), or the receivables by these relations serve or will serve as security for financing granted by Us, and in the cases when you are in contractual or pre-contractual relation with our customer for a deal that will be financed by Us;

When You provide personal data for other people please ensure please ensure, that You have informed them for the disclosure of their personal data and invite them to get acquainted with the present Information Notice.

IV. Your Rights and how to exercise them

You have rights which enable you to exercise real control over Your personal data and how we process them.

4.1. You may request access to Your Personal Data

If You request access to Your personal data, will provide You a copy and information related to the processing.

This right might be limited in cases provided by the legislation and regulatory requirements. Such is the case with the regulatory requirements related to anti-money laundering and counter terrorism financing which preclude us from providing direct access to data processed for these purposes

4.2. You may request correction of Your personal data

If You consider your personal data is incorrect or incomplete, You may request the relevant personal data to be corrected or completed. In some cases we may request additional documents, including identity documents.

4.3. You may request Your personal data to be erased

You have the right to request Your personal data to be erased (deleted) as to the extent this is permitted by the applicable legislation.

4.4. You may object against the processing of Your personal data

You may object against the personal data processing on grounds related to Your specific situation.

If you object to the processing activity based on legitimate interest You may object against this activity on grounds related to Your specific situation by informing us about the processing activity You object to and the objection grounds. We will terminate the personal data processing, unless there are sufficient legal grounds for it or the processing is necessary for the identification, exercise or defend by legal action.

You have the absolute right to object to personal data processing for the purposes of direct marketing, which includes profiling related to such direct marketing.

4.5. You may request to limit the personal data processing

If You question if the personal data we process is correct or object to the personal data processing we will review and evaluate your request. You may request to terminate the usage of personal data while the review is pending.

4.6. You have rights against automatic decisions

You have right not to be subject of decision based only on automatic processing based on profiling or other means which have legal consequences or is significantly concerning You. Nonetheless we may automated such decision if it is necessary to conclude or perform an

agreement with Us, it is permitted by regulatory requirements or You have provided your concern.

In all cases You have the right to object to the decision and to request review by a competent employee.

4.7. You may withdraw your consent

When You have consented to personal data processing You have the right to withdraw the consent at anytime.

The consent withdrawal does not infringe the legally compliant data processing based on the consent given prior to the withdrawal and processing on other grounds.

4.8. You may request transfer of part of Your personal data

You may request a copy of the personal data You provided Us in structured, widely available and machine readable format. When this is technically feasible You may request us to transfer the copy to a third party.

4.9. You may file a complaint to a competent authority – Commission for Personal Data Protection

Additionally to the rights described above, You may file a complaint with the competent supervisory authority, which is regularly the one in Your residence area. For Republic of Bulgaria this is the Commission for Personal Data Protection with address: Sofia, 2 Tzvetan Lazarov blvd., e-mail: kzld@cpdp.bg, web page: www.cpdp.bg.

Should You choose to exercise the rights described above please send a letter or e-mail addressed to the contacts stated in the present Information Notice, Section I” Information about Us”.

V. Purpose and Legal Grounds for Personal Data Processing

In this section we explain why we process Your personal data and the legal grounds for this processing.

5.1. Your personal data is processed to comply with applicable legal requirements.

• We are subjects to legal obligations by legal acts enforced in Republic of Bulgaria and/or the European Union such as, but not limited to:
• preparation, conclusions and performance of credit agreement, payments, debt sale agreements including the storage of related information;
• to verify Your identity as our customer as our customer by collecting, usage, storage including documents, data records which verify identity in order to proceed with Your request/conclusion of credit agreement, debt sale agreement/other products/services/provided by Us;
• Identification of persons whose data is provided in relation to products and services we offer (e.g. debtors connected receivables we acquire, representatives of entities, attorneys), creditworthiness assessment, credit risk analysis based on sufficient data, received by databases used in Republic of Bulgaria for creditworthiness assessment, risk assessment according to lists/registers according to AML/CFT.
• Your identification as customer and verification of your personal data by gathering, usage and storage of personal data including documents, data records which establish Your identity so we can act on Your request/application for conclusion and performance of credit agreement, debt sale agreement/other products/services;
• identification of persons whose data is provided in relation of our products/services (e.g. debtors of receivables we acquire, statutory representatives or attorneys of entities), creditworthiness assessment, credit risk assessment based on enough information acquired from databases used in Republic of Bulgaria creditworthiness assessment, risk assessment from lists (registers) per the AML and CFT legislation.
• If You apply for credit as a natural person or You are representative/ owner/partner in an entity which is a borrower we are obliged to asses Your creditworthiness and to grant you a credit which suits Your assessed ability to perform the credit agreement. In order the creditworthiness assessment to be correct we will access the databases of NOI, CCR, ESGRAON, NRA including trough the Regix environment.
• AML, CFT and embargo controls – Your personal data is processed in compliance of our obligations to apply measures counter, disclose, investigate and report suspicious activity;
• reporting to state and supervisory authorities – taxes, FATCA, the Tax Code for the automatic exchange of finance information for tax purposes (CRS). In relation to the described purposes Your personal data will be processed for accounting and tax reporting with the competent state authorities on grounds from the applicable legislation, access, submission, reporting and changes in personal data and information by „Klear Lending“ AD to state databases in relation with customer’s credit status and the rules for operation of these systems
• monitoring, detection, authentication/proper execution and reporting of transactions, including ones differing from established models;
• processing and security of Your personal data according to the applicable legislation;
• sanctions/embargo, AML/CFT measures, tax fraud, control, notifications, accounting and tax requirements;
• transfer (cession) of receivables and obligations per the COA and processing of Your personal data by every new creditor;
• information exchange and reporting of operations, deals or information provided to a request by duly authorized local or international financial, tax, administrative, criminal or judicial authorities, arbiters or intermediaries, Your request/complaint or such by competent state/public/judicial authority;
• debt collection including judicial procedures, enforcement of court decisions and/or orders;
• Compliance with the issuers of e-signature certificates.
• Any performance of statutory legal obligation, which is not stated in the present Information Notice does not constitute non – compliance with the stated purposes

5.2. Your personal data is processed for performance of agreement You are party to, or for performance of precontractual activities upon Your request.

Your personal data is processed when in order conclude or perform agreement it is necessary:

• to review your request for product/service We offer;
• Your credit risk assessment and Your abilities to repay;
• assessment (e.g. based on your credit risk), which includes among other checks the request for data and the results of this request by of official country registers as but not limited to NOI, CCR, NRA, BR , our custom database, for the possibility to offer You product/service and under what conditions (e.g. what price);
• rendering the product and services under the conditions of the relevant agreement;
• management of existing obligations (identification of customers with unpaid dues) ;
• to contact You or other persons for which You have provided data;
• answer Your questions and to assist You by providing necessary information, including for concluded agreements We are party to, their performance status and other products or services offered by Us;
• verification, checks, analysis, usage and storage of information and documents by/for You and/or entity You represent when you are member of the bodies of entity which is or has applied to become our customer including the persons participating in the decisions of the said bodies when they are relevant for the purposes of our relationship with this entity regarding: income/payments, employment relations by sources: NOI, NRA, AML/CFT lists/registers, CCR, GRAO, RA, BR ,etc.
• upon our discretion at any time until the credit is repaid to check and verify the received information including with/by independent sources and registers ad but not limited to NOI, NRA, CCR, GRAO, BR, etc.;
• credit management or other services provided by Us;
• electronic, hardcopy or other medium records update;
• transfer of obligation to third party;
• communication sent to the provided addresses in relation granted credit/other service;
• checks in registers – private and state personal data administrators in the country or in the EU in relation to fraud prevention, AML/CFT, credits or debt collection;
• development of individual statistical models based on transaction analysis to measure operational risk;
• perform the rights and obligations per the agreements we are party to;
• network, information and physical security, including unauthorized access to electronic communication networks, IT management, infrastructure management (e.g. shared platforms) and business continuity;
• To use information for the customer only in a way the customer or other party to be identified for surveys including to publish or share the information for the customers to third parties as advertisers or partners for scientific, historical, academic, marketing and/or promotional purposes.

5.3. Realization of „Klear Lending“ AD legitimate interest

When we base the processing activities on legitimate interest, we balance this interest against You to guarantee the balance amongst our legitimate interest and Your interests or fundamental rights and freedoms.

5.3.1. For our activity we use Your data to:

• manage the risks to which we are exposed:
  • maintain evidence for operations or transactions, including evidence in electronic format;
  • debt collection activities;
  • review and defend against legal claims in the event of litigation;
  • develop statistical models to help You seld asses Your creditworthiness;
• improve cybersecurity, platform management, websites and provide business continuity;
• use video surveillance to prevent bodily harm and personal or property damage;
• improvement of automation and effectiveness of our operational processes and customer services (e.g. automatic tracing of your requests and improvement of Your service satisfaction on the basis of personal data collected during our interactions with You such as phone call records, e-mails or chats);
• perform statistical surveys and development of prognosis and descriptional models for:
  • commercial purposes: to identify products and services which would suit your needs, to create new offers or identify new trends amongst our customers, to develop our commercial policy with regard to the preferences of our customers;
  • security measures: potential incident prevention and improvement security management;
• Organization of competitions, lotteries, promotional campaigns, customer opinion and satisfaction surveys.

5.3.2. We use Your personal data to send You commercial offers via e-mail, paper copy and the phone

We can propose You access to the full range of products and services which suit Your needs. After You become our customer and if You do not object, we may send You electronically, phone or mail for our products and services similar to the ones You already use.

We will guarantee that these offers are related with products and services which are corresponding to Your needs and compliment these You already use to ensure the parties interest are balanced.

5.3.3. We analyze Your personal data in order to perform standard profiling in order to personalize products and offers

In order to build standard profile of similar data which we source from the following information:

• information you have provided during our interaction with You or website registration;
• resultс of the usage of our products or services as these, connected with Your accounts, including accounts balance, regular or atypical transactions;

Unless You object, we will personalize based on the grounds of standard profiling. We may do a deeper analysis to your needs if You agree individualized adaptation to your precise consumer needs.

5.4. Your Personal data is managed if You have provided Your consent

For some kinds of personal data processing, we will provide You with precise information and we will request Your consent. You may withdraw You consent at any time.

More precisely we will ask Your consent for:

• specially defined consumer needs for our offers and products or services based on more complex profiling, in order to estimate Your needs and behaviour;
• each electronic offer for products and services which are not similar to these You are customer of or products and services of our partners
• offers personalization, products and services based on Your accounts in other banks;
• Usage of Your navigation data (cookies) for commercial purposes or improvement of Your profile.

We may request Your additional consent for personal data processing when necessary.

VI. Types of personal data we process

We collect and use Your personal data to ne extent which is necessary and within the frames of our activities and also to achieve high standard of personalized products and services.

Depending on the products or services we provide You and our interactions with us we collect different types of personal data for us.

Identification information – full names, PIN, ID document number, incl. copy of the document, nationality, date and place of birth, sex, picture, IP address;

Contact information – phone numbers incl. of third persons/related persons, postal address, e-mail;

Information, related to your financial and marital status – marital status, marital ownership status, children and age, family composition, parents or spouse, related persons including property you own: apartment or house;

Educational and occupational information – education degree, occupation, employer, remuneration;

Economic, financial and tax information – tax ID, tax status, country of residence, remuneration and other incomes, asset value;

Banking, financial and transactional data – bank accounts, money trasfers, declared investor profile, credit history, debts, CCR status reports, etc.;

Data related to Your habits and preferences -related to Your usage of Our products and services;

Data from our interactions with You – video interviews, internet pages, applications, social media pages, meetings, calls, chat history, electronic letters, phone conversations, social media pages exchanges and You complaints. Your communication data and tracing such as cookies and flags for non-advertising and analytical purposes at our websites, online services, applications, social media pages;

Data for You devices – mobile phone, computer, tablet, etc.: IP address, technical specifications, unique identification data;

VII. Data Sources:

We collect personal data directly from You but we may collect personal data from other sources such as:

public sources:

• publications/data bases published by state authorities or third parties (e.g. Business register, data bases managed by the financial sectors regulators);
• websites/social media pages of entities or business customers, including information which You have disclosed (e.g. your website or social media page)
• public information such as published in mass media;

third parties:

• by our customers (entities or natural persons);
• our business partners;
• payment initiators and account aggregators (account information providers);
• third parties as credit agencies and fraud prevention agencies;
• Data intermediaries, which are responsible to guarantee the information they provided is collected by legal means;

VIII. Third party access to personal data

Access under confidential conditions to personal data will be granted to employees of „Klear Lending“ AD performance of activities and the purposes stated above only to the extent necessary.

When it is necessary we will disclose Your personal data to:

• data processors which provide services on our behalf (e.g. IT services, logistics, printing, telecommunications, debt collection, consultancy services, distribution and marketing);
• banking and commercial partners, independent agents, intermediaries or brokers, financial institutions, partners if such disclosure is required to provide You products and services or perform contractual obligations or for transaction purposes (e.g. banks, correspondent banks, depositaries, payment intermediaries, exchange platforms, insurance companies, payment systems operators, issuers or acquirers of payment cards, mutual guarantee entities or financial security companies);
• local or international financial, tax, administrative, penal or judicial authorities, arbiters or intermediaries, public bodies or institutions do which we are obliged to disclose information:
  • upon their request;
  • for our defense, legal action or if required by legal procedure;
  • compliance with regulation or recommendation applicable to us issued by competent authority;
• payment services providers from third countries (information for Your bank accounts) for the purposes of payment initiation or service for payment account information if You have granted consent for transfer of Your data;
• some regulated occupations such as lawyers, notary public or auditors when this is necessary under certain circumstances (e.g. litigation, audits, etc.), insurers and to prospective buyers of entities.

IX. Data transfer beyond European Economic Area

In the event of international data transfers originating from the European Economic Area (EEA) to country outside (EEA) a transfer of Your personal data may occur. When the European Commission has determined a country outside the EEA ensures adequate level of data protection, in these cases Your personal data might be transferred on the ground of this determination.

For countries outside the EEA for which the data protection level has not been determined as adequate by the European Commission, we will rely either on derogation applicable to the precise situation (e.g. if the transfer is necessary to perform the agreement with You or in the case of international payment) or we will apply one of the following precautionary measures to ensure the level of personal data protection:

• Standard clauses approved by the European Commission
• Binding Corporate Rules.

In order to receive a copy of these precautionary measures or details where these are available please provide a written request as described in Section I of the present Information Notice.

X. Personal Data Storage Terms

We store the customer persona data for the duration of our agreement and 10 years after the end of the relationship. Information about prospect borrowers is stored for one year.