1. With the signing of this document, I hereby state my wish (request) to apply for and receive an offer for provision of a loan by UniCredit Consumer Financing EAD ( hereinafter “Data Controller”).

2. I agree that the Data Controller – UniCredit Consumer Financing EAD, UIC 175070632, having its registered seat in the city of Sofia and management address: Vazrazhdane district, postal code: 1303, Serdica quarter, 14 Gyeshevo Street shall process my personal data and use them for credit checks, performed electronically or manually, in relation to my requested loan, and also in case of possible provision of credit services by third parties, including the other UniCredit Group entities in Bulgaria, different from the Data Controller: UniCredit Bulbank AD, , UniCredit Fleet Management EOOD, UniCredit Leasing EAD, UniCredit Insurance Broker EOOD, for which I agree my personal data to be included and stored in a database and to be processed for or in relation to an analysis of my debts, collection of receivables from me related to the loan provided to me, anti-money laundering and fraud prevention, and also in relation to the management of the loan provided to me.

3. The consent for processing of my personal data, which is expressly given with my signature at the end of this document, has the purpose to allow the Data Controller to check my creditworthiness and verify my personal data in accordance with the Personal Data Protection Act (PDPA) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the “Regulation”), by receiving statements from registers of third parties - private and state data controllers located in the country and abroad, such as the Central Credit Register of the BNB, the National Revenue Agency, the National Social Insurance Institute, etc., including data on loans used, on my paid social security contributions, my employment contracts and my insurable earnings, and also to make inquiries and receive information about my civil registration from the National Population Database, and these data to be processed in accordance with the PDPA and Chapter Five of the Regulation.

4. The consent to the processing of my personal data, expressed in this request, is also intended to allow each of the above-mentioned personal data controllers to use my personal data for the preparation and submission of the aforementioned inquiries/ statements requested by UniCredit Consumer Financing EAD. If necessary, I agree to the Administrator providing for personal credit risk assessment purposes my personal data, including: credit data and history of payments on all opened and closed credit accounts in my name with UniCredit Bulbank AD, in compliance with the requirements of the PDPA, to the following categories of persons on the territory of the Republic of Bulgaria and abroad: other credit institutions and financial institutions, or alternatively: other providers of services for data provision from a database, as well as to persons with whom the Data Controller has concluded contracts for the provision of products and services on their part.

I also declare my awareness that my data can be used for the purposes of market research or for reporting the level of customer satisfaction with the quality of services provided and the activities carried out by the UniCredit Bulgaria Group. I am aware that I may object to such processing at any time.

5. I agree that the results of the check, collected by the data controllers for the purposes of the loan agreement, shall be stored on electronic media and on paper in my credit file for the term of my contractual relationship with the Data Controller, and thereafter, in cases where the Data Controller has a legal obligation to keep the data in accordance with the provisions of the Bulgarian legislation and the laws of the European Union. In case I am not approved for a loan and the Data Controller does not conclude a loan agreement with me, I ask the Data Controller to delete my personal data within the technically necessary period for this, as of the date of its refusal to enter into a loan agreement.

6. In addition, I am informed that the legal basis for the processing of my personal data by the Data Controller is both the current request for processing of my personal data and the grounds referred in Art.6, para. 1. letter b) of the Regulation – the processing is necessary for the performance of an agreement to which I am a party, or for taking steps at my request as a data subject before the conclusion of an agreement. I also understand that UniCredit Consumer Financing EAD has a legal obligation to process my personal data in connection with the company's obligations arising from the anti-money laundering legislation.

7. I am informed that I have the right to: (a) have access to my personal data kept by both the Data Controller and third parties – data controllers; (b) request the rectification, modification and updating of such data; (c) to request restriction of their processing, (d) to request from the Data Controller to erase (delete) my personal data, the processing of which does not meet the requirements of the PDPA. (e) to object to the processing of my personal data (only in cases specified by the law). I am informed that I have the right to data portability, which allows me to receive the personal data that concern me and that I have provided to the Data Controller, in a structured, widely used and machine-readable format and I have the right to transfer this data to another Data Controller, without obstruction on the part of the Data Controller, including the right to request from the Data Controller to make a direct transfer of the data related to me to the other Data Controller indicated by me, if this is technically possible.

The address for receiving access to my personal data is: the city of Sofia, Vazrazhdane district, postal code: 1303, Serdica, 14 Gyueshevo Street. I am informed that at the same address I can also receive information about the data controllers to whom personal data related to me have been disclosed. I am informed that I can exercise the rights under this item by submitting a written request at the specified address or in any branch of UCB, as well as by e-mail, provided that my letter is signed with a qualified electronic signature in accordance with with the Electronic Document and Electronic Certification Services Act.

8. I am informed that the personal data related to me are processed by the Data Controller in connection with making individual decisions based on: (a) manual processing according to predefined criteria; (b) automated processing according to predefined criteria and (c) automated processing (without human intervention), including profiling, where the decisions formed in this way shall be used for concluding/refusing to conclude an agreement between me and the Data Controller. I am aware of the possibility to express my point of view, to object (including to refuse) against decisions concerning me that are based solely on automated processing, including profiling, and to request, when making a decision concerning me, the participation of a person engaged by the Data Controller for this purpose.

9. I confirm that I am aware of the fact that the Data Controller has a legal right and interest in the access to the credit registers in order to protect its interests, the interests of its management bodies and its partners/shareholders, as well as to ensure the legitimacy of its activities, in accordance with the requirements of the law.

10. The Data Controller may request also additional information, including but not limited to recommendations from banks and other credit or financial institutions, to research my credit history and current creditworthiness in all public and private databases, including, but not limited to, databases of credit bureaus, state bodies and banks on the territory of the Republic of Bulgaria and abroad, as well as in the databases of UniCredit Group companies of, personal data controllers (hereinafter referred to as the “Companies”). In this regard, the Data Controller has the right to disclose to the Companies my personal data provided to the Data Controller with this consent.

11. I confirm the Data Controller’s the right to check all data voluntarily provided by me through independent sources, and I herewith give my explicit consent so that it may use the data to carry out checks on my creditworthiness, before the provision of any services or products, and at any time since the existence of the potential contractual relationship between me and the Data Controller.

12. I herewith give my explicit consent to the Data Controller so that in connection with the submitted loan application it may perform the necessary checks in the above-cited registers, including but not limited to the Central Credit Registry, of all companies (including non-profit ones) and Sole Trader companies (ET), of which I am a legal representative. 
12.1. If necessary, the Data Controller to request from the National Social Security Institute /NSSI/, including through its information system, and also to receive, personally or through other legal entities, the available data concerning:
12.1.1. my income and the social security contributions made in my favor, made by the merchant, of which I am the sole owner, as well as other data, which constitute trade secrecy or personal data within the meaning of the Personal Data Protection Act (PDPA), and I authorize the Data Controller to use the information thus collected for the purposes of my credit assessment, in connection with the granting of a targeted POS loan/cash loan in my name in compliance with the legislation related to personal data protection and any other protected information;
12.1.2. accrued insurable earnings for persons employed under an employment contract and insured by the merchant (without information about the personal data of these persons themselves), amount of contributions made by funds and other data that could constitute trade or business secrecy.

13. I hereby give this consent out of my free will as a person of full age, and I am aware that it is governed by Chapter Two and Chapter Three of the Regulation, and I have been informed that I have the right to refuse to submit this request, as well as to withdraw it at any time, where in such cases my request for the provision of the service I wish may not be fulfilled.

14. I am informed that the contact details of the data protection officer responsible for UniCredit Consumer Financing EAD are: address: 7, Sveta Nedelya Sq., E-mail: EQPAVojDsfejuHspvq/CH/ I am aware that I can contact this person for assistance regarding my personal data processed by the Data Controller.

15. I am informed that for exercising the rights listed above, I have the right to appeal to the Commission for Personal Data Protection (CPDP) in the event of a dispute between me and the Data Controller regarding the legal compliance of the processing of my data.

16. By signing the present document, I declare that I am aware of and accept the need for the Data Controller to make a copy of my personal ID card in order to fulfill its obligations under the Measures against Money Laundering Act. The copy – electronic or on paper, shall be used and kept only for the needs of the checks related to the approval and granting of a loan provided by the Data Controller. I am aware that the copy will be kept in the file of the loan agreement, as proof of my identification as a borrower or a guarantor.

---

Consent for processing of my personal data for the purposes of direct marketing by UniCredit Consumer Financing EAD:

I agree that the Data Controller can processes the data provided by me for the purposes of direct marketing in order to offer me goods and services of UniCredit Consumer Financing EAD, UniCredit Bulgaria Group companies, as well as products and services of business partners of the company outside the UniCredit Group, through processing of data provided by me for contact by mail, e-mail, telephone, SMS or other direct means, to perform statistical surveys and analyzes for marketing purposes (sending offers/ commercial messages, etc., in connection with the services of the Data Controller), including my personal data to be provided to personal data processors providing services in connection with direct marketing (advertising agencies, call centers, telecom companies, persons providing other types of direct communication services, etc.).

I have been informed that my request for processing of my personal data for marketing purposes is valid and constitutes an appropriate legal basis for the processing of my personal data – until its explicit withdrawal by me, which I can exercise by sending an application/request to the Data Controller at the above specified addresses, including the e-mail address. I have been informed that by giving my consent, the direct marketing offering will continue after the termination of the commercial relationship, within the statutory period for data processing or until the withdrawal of consent. I have been informed that the personal data concerning me shall be processed by the Data Controller in connection with making individual decisions, which are based on: (a) manual processing under predefined criteria; (b) automated processing under predefined criteria, and (c) automated processing (without human intervention), which includes also profiling, where the decisions made in those ways shall be used for direct marketing purposes. I am aware of the possibility to express my viewpoint, to object against (including to reject) decisions concerning me, which are based solely on automated processing, including profiling, and to request the involvement also of a person engaged for such purpose by the Data Controller in the decision-making process.

By signing a Loan Agreement, each Borrower/consumer undertakes, declares and confirms that he/she is aware of the obligation of UniCredit Consumer Financing EAD (UCF) to comply with the laws and regulations related to the application of economic and financial sanctions or a trade embargo or any other restrictive financial and economic measures taken or imposed by the UN, the European Union, the United States of America, the United Kingdom, Italy, the Federal Republic of Germany and/or governments, institutions or agencies (hereinafter referred to as the “sanctions”) and in connection with the above stated hereby declares that: (i) as far as it is aware, neither the Borrower/consumer, nor the other parties to this Agreement are currently subject to sanctions, are a sanctioned person or have violated the sanctions; (ii) the Loan and/or any proceeds related to it will not be directly or indirectly used or borrowed in any way directly or in partnership with a third party (i) to finance a prohibited activity or an activity of or with any person or in any country or territory, which during such financing is a sanctioned person or a sanctioned country, (ii) or in any other way, which could lead to the sanctions being violated by any person. Having regard to the above: (i) “Sanctions” shall mean all laws, regulations, restrictive measures for compliance with economic, financial or commercial sanctions or other sanctions that are introduced, applied, imposed, enforced or publicly announced by the above specified bodies; (ii) “Sanctioned country” shall mean every country or other territory, which is subject to or its governance is subject to sanctions applicable to the entire country or territory; (iii) “Sanctioned person” shall mean a person that is or is owned or controlled by a specific sanctions target.