Dear stockholders of “SopharmaBuildings” REIT,

Personal data protection is of a particularly high priority to the management of SopharmaBuildings REIT.

“Sopharma Buildings” REIT is a Bulgarian joint-stock company with a special investment purpose as per the meaning of art. 3 of the Special Investment Purpose Companies Act and a public limited company as per the meaning of art. 110 of the Public Offering of Securities Act. The stocks of the capital of the company are registered for trading on the Bulgarian regulated market – Bulgarian Stock Exchange Sofia AD. In regard of its statute as a public company and as per the current legislation, the company’s book of stockholders is compiled, kept, updated and provided to the company by Central Depository AD, whose statute and functions are outlined in title 9 of the Public Offering of Securities Act and Ordinance № 8 dated 12.11.2003 on the Central Depository.

In view of the above, regarding the personal data of natural persons – stockholders of“Sopharma Buildings” REIT, the latter and Central Depository AD have the capacity of a data controller. Central Depository AD,as an independent data controller, applies their own policy for personal data protection. The purpose of the present notice is to introduce the stockholders of“Sopharma Buildings” REIT to its policy for protection of their personal data.

The applicable legislation in this respect includes the Commerce Act (CA), Public Offering of Securities Act (POSA)and the acts on its application (incl. Ordinance № 2 dated 17.09.2003 on the prospectuses for Public Offering and admission to trading on a regulated securities market and disclosure of information and Ordinance № 8 dated 12.11.2003 on the Central Depository), Special Purpose Investment Companies Act (SPICA), Financial Supervision Commission Act and the acts on its application (incl. Ordinance № 15 dated 5.05.2004 on keeping and storing of the registers of the Financial Supervision Commission and the circumstances subject to registration), Financial Commercial register and Register of Non-profit Legal persons Act and Ordinance № 1 dated 14.02.2007 on keeping, storing and accessing the Commercial register and the register of non-profit legal entities, Regulation (ЕС) № 596/2014 of the European Parliament and the Council of 16 April 2014.

On the grounds of art. 28, par. 4 of Ordinance № 8 dated 12.11.2003 the Central Depository is obliged to provide the book of stockholders of “Sopharma Buildings” REIT under request of the person, representing the latter.

  1. Data controller of your personal data:

“Sopharma Buildings” REIT, UIC175346309

1.1. Address (seat and registered address): Sofia, region of Izgrev, 5 Lachezar Stanchev str.,Sopharma Business Towers Complex, Building А, fl. 20;

1.2. Phone number: 02 / 81 34 229;

1.3. Address of electronic mail (e-mail address):

  1. Categories of personal data of yours we process:

2.1. three(or full) names;

2.2. personal identification number/personal number of a foreigner or another substitute identifier as per the person’s national legislation;

2.3. address;

2.4. economical identity:

2.4.1.number of owned stocks of the company’s capital, their percentage of the entire capital, voting rights;

2.4.2. payable dividend;

2.4.3. number of rights (as per the meaning of § 1, item 3 of the Additional provisions of POSA) and stock of increase of capital of the company;

2.4.4. information on existing distraint and/or pledges on stock owned.

  • The source of such data is Central Depository AD on the grounds of art. 28, 4 of Ordinance № 8 dated 12.11.2003 on the Central Depository, as well as the stockholders themselves upon personal identification.

Upon the legal prerequisites therefor, other personal data may be processed, as follows:

2.5. signature –i.e. on the list of present stockholders upon participation in the General assembly;

2.6. identity document– for the purpose of receipt of cash dividend after expiration of the term of payment under art. 10, par. 2 of SPICA and exhaustion of the procedure under art. 38 of Ordinance № 8 dated 12.11.2003 on the Central depository or legitimisation and identification, upon participation in the General Assembly of stockholders(without taking a copy and data different than the contained in the book of stockholders);

2.7. bank account – upon direct request to the company to receive dividend via bank transfer, after expiration of the term of payment under art. 10, par. 2 of SPICA and exhaustion of the procedure under art. 38 of Ordinance№ 8 dated 12.11.2003 on the Central depository;

2.8. email address and other provided by and at the wish of stockholders (if any) personal data upon correspondence with the Investor Relations Director.

  • The source of such data is the stockholders themselves upon their identification as such.

On separate occasions, upon the statutory prerequisites therefor(i. e.chapter 6а, chapter 11 and art. 114 of POSA,art. 19 Regulation (EU) № 596/2014,Ordinance № 2 dated 17.09.2003), other personal data of particular legally set categories of stockholders (i.e. owning over 5 % of the votes in the general assembly, stockholders – interested parties) are processed, as follows:

  • number of indirectly owned stocks of the capital of“Sopharma Buildings” REIT;
  • participation in the management and controlling bodies of entities;
  • ownership directly and/or indirectly of over 25 %of the votes in the general assembly of entities;
  • information on concluded deals with financial instruments of the company for the stockholders discharging managerial responsibilities in “Sopharma Buildings” REIT or closely associated with such;
  • share participation in the capital of“Sopharma Buildings” REIT, subject to disclosure;
  • others, required by the applicable law.
  • The source of such categories of personal data is the explicit declaration/notification of the data subject and/or public registries and publicly disclosed information.
  • Please do bear in mind that upon giving powers of attorney to another person to represent you for participation in the General assembly of the stockholders, we are obliged in fulfilment of the statutory requirements to process the personal data of such attorney, entered into the powers of attorney,for the purpose of the holding of the respective general assembly and fulfilment of the thereto related statutory requirements, including storing of the lists of present shareholders and their attorneys and the powers of attorney within the legally stipulated terms.The policy outlined in the present applies to the personal data of attorneys of stockholders, of which they must be notified by the stockholders upon giving them powers of attorney.
  1. Purpose of the processing of your personal data:
  • fulfilment of the statutory obligations of“Sopharma Buildings” REIT as a public limited company, holding of General assemblies of stockholders, allocation and payment of dividend/liquidation share, allocation of rights and stocks of capital increase; disclosure of regulated information;maintenance of a register on incoming inquiries and provided information to stockholders and persons who have shown interest in investing into the company’s financial instruments under art. 116г, par. 3, item. 6 of POSA;
  • exercising of the stockholders’ rights stemming from their capacity as such.
  1. Legal basis for the processing of your personal data: compliance with statutory obligations which apply to the data controller“Sopharma Buildings” REIT.
  2. Recipients of your personal data:

In fulfilment of the statutory obligations of the data controller “Sopharma Buildings” REIT and as per the legal procedure, your personal data may be transferred to the following recipients, depending on the grounds for such transfer, namely:

  • Central Depository AD and“Sopharma Buildings” REIT’s depositary bank– for the purposes of payment of dividend of persons without client accounts with investment agents;
  • Financial Supervision Commission and the public(publishing on the website of the data controller, in media for the purpose of disclosure of regulated information and public registers) – solely when and about the persons for which the applicable legislation requires so;
  • Trade register – solely when and for the persons for which the applicable legislation requires so;
  • Other public authorities upon the statutory grounds therefor and in exercise of their powers and/or in fulfilment of statutory obligations of“Sopharma Buildings” REIT;
  • Data controllers/data processors, assigned the fulfilment of particular functions/services for “Sopharma Buildings” REIT(e. auditor, investment agent, servicing the increase of capital, etc.), but only to the extent necessary for the performance of such functions/services for the above described purposes and in compliance with the statutory requirements, including implementing appropriate organizational and technical measures for personal data protection;
  • In regard of the specific legal statute of“Sopharma Buildings” REIT as a joint-stock company with a special investment purpose, but only to the extent necessary for the achievement of the purposes of processing, the personal data may be transferred to its servicing company as per art. 18 of SPICA, which shall act as a data processor via its respective responsible employees under assignment of“Sopharma Buildings” REIT on statutory and contractual grounds for the purposes and with the means determined by the latteras per the present and in compliance with the statutory requirements.

Outside of the above, your personal data shall not be transferred to third parties, third countries and/or international organizations, unless there is legal grounds therefor.

  1. Term of storage of Personal Data:Your personal data shall be stored by“Sopharma Buildings” REIT for the necessary for above described purposes for their processing period and until the expiration of the legally set storage terms, as well as of the limitation and preclusive terms, related to the purposes of their processing, including to ensure the exercise of the control power of the respective competent public authorities.On the grounds of art. 134, par. 1 of the POSA the Central Depository maintains an archive of all data indefinitely.
  2. The provision of your personal data for the purpose of acquisition and/or disposal of stocks of “Sopharma Buildings” REIT and exercising of the rights related thereto is a legal requirement.The consequence of the failure to provide the above described personal data would the inability to acquire stocks of the company’s capital, resp. to exercise the stockholders’ rights related thereto, including the right to dispose thereof.
  3. “Sopharma Buildings” REIT applies appropriate technical and organizational measures for personal data protection as per the adopted Personal data protection Policy.
  4. “Sopharma Buildings” REIT does not utilise systems for automated decision-making or profiling.

Your rights in relation to the above and the protection of your personal data are:

Right of access to information:You have the right to obtain confirmation from us on whether, how and for what purposes we process personal data of yours and what data, as well as to receive a copy thereof.

Right to rectification:In case we are processing incomplete/inaccurate personal data of yours, you have the right to obtain from us without undue delay their rectification or completion, if the latter corresponds to the above described purposes of the processing.

Right to erasure:You have the right to obtain from us the erasure of personal data concerning you, if:

Þ it is no longer necessary in relation to the purposes for which they were processed; or

Þ you withdraw your consent on which the processing is based and there is no other legal ground for the processing; or

Þ you object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing for the purposes of the direct marketing; or

Þ the personal data have been unlawfully processed; or

Þ the personal data have to be erased for compliance with a legal obligation to which the controller is subject; or

Þ the personal data have been collected in relation to the offer of information society services to children.

Please, bear in mind that there may be reasons for the erasure not to be executed immediately, in regard of a legal requirement for keeping such data.

Right to restriction of the processing: You have the right to obtain from the controller restriction of processing where one of the following applies:

Þ the accuracy of the personal data is contested by you – for the period enabling us to verify the accuracy thereof;

Þ the processing is unlawful but you do not want the erasure of the personal data but rather request the restriction of their use instead;

Þ we no longer needs the personal data (for the particular purposes), but they are required by you for the establishment, exercise or defence of legal claims;

Þyou have objected to processing of such data (as stipulated below) pending the verification whether the legitimate grounds of the controller override those of your own.

Right to data portability:You have the right to receive the personal data concerning you and which you have provided to Sopharma Buildings REIT, in a structured, commonly used and machine-readable format and have the right to transmit such data to another controller without hindrance from the controller to which the personal data have been provided, where:

Þ the processing is based on consent or on a contract; and

Þ the processing is carried out by automated means.

Right to object:In case we are processing personal data concerning you, where we have stipulated as a basis for it our legitimate interests and/or the performance of a task carried out in the public interest, including profiling on those grounds, you can object to such processing. 

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless:

Þ is necessary for entering into, or performance of, a contract between you and us; or

Þ is authorised by European Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

Þ is based on the data subject’s explicit consent.

Right to withdraw consent, when the processing is based on consent, at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority and to an effective judicial remedy against a controller or processor:In case you believe that we are in breach of the Bulgarian or European legislation, we kindly ask you to contact us to clarify the situation and allow us to take immediate measures. In all cases and without being obliged to notify us under the previous sentence, you have the right to lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement. In Bulgaria this supervisory authority is the Commission for Personal Data Protection, address: Sofia 1592, 2 Prof.Tsvetan Lazarov (

You have the right to an effective judicial remedy when you consider that your rights to protection of your personal data have been infringed as a result of the unlawful processing of your personal data by us.

You are entitled to the stipulated rights without prejudice to any other administrative or judicial remedy you might have under the applicable legislation.

The controller shall review each request, addressed to it,for exercise of the above cited rights, shall assess its legal merit and legitimacy, in regard of which the controller shall conceit to it or not, replying to the data subject within 1 month of receipt of the request, unless there is reason to extend said period but by no more than 2 more months of which the data subject shall be notified.