Privacy and Cookie Policy

Appendix 1: Privacy and Cookie Policy Charter
Welcome to the website https://bg.totalenergies.com.
By accessing or browsing this website, you acknowledge that you have read, understood and accepted, without limitation or reservation, this Privacy and Cookie Policy (the “Policy”) and our Terms of Use. Please note that other TotalEnergies Group websites may be governed by different terms and privacy policies, and we recommend that you read them carefully. 
The purpose of this Policy is to inform you about the rights and freedoms that you may exercise regarding the use of your personal data and to describe the measures we take to protect such data. 
The Company acts as the data controller responsible for the processing of personal data used for the management of this website. Such processing operations are carried out in accordance with applicable laws. 

1. Purpose of Processing, Legal Basis, Retention Period and Types of Data Collected
When you visit the website, you may be required to provide certain personal data, such as your first and last name, to use the available services. 
The Data Controller processes your personal data for the purpose of providing services and managing requests submitted through the contact form. More specifically, we may collect certain personal data for external communications purposes, to respond to your requests for information and better understand how to meet your needs.
The information is necessary for us to process your request; without it, your request cannot be handled. You have the right to withdraw your consent at any time, without affecting processing operations already completed, by writing to: [email protected]. 
In our online forms, mandatory fields are marked with an asterisk (*). If you do not provide the required information, we will not be able to provide the requested service(s).  
Your personal data will not subsequently be processed in a manner incompatible with the purposes described above or below the data collection forms. Your data will be retained for no longer than one year. 

3. Data Recipients
Your personal data may be communicated to one or more departments of the Data Controller, to companies within the TotalEnergies Group, and to one or more partners, independent distributors or subcontractors for analysis and research purposes. 

4. Data Security and Confidentiality
The Data Controller implements appropriate measures to ensure the security and confidentiality of your personal data, including measures intended to prevent distortion, damage, or disclosure to unauthorized third parties. 

5. Cookie Management
5.1. Principle
A cookie is a file that enables a website to store information related to your browsing activity on the website https://bg.totalenergies.com  in order to facilitate your future visits to the website. 
At any time, you may delete cookies stored on your computer, refuse the storage of new cookies and receive notifications before new cookies are stored by changing your browser settings as described below.  
Please note that if you delete cookies or refuse their storage on your device, you may not be able to use certain services available on the website
5.2. Types of Cookies, Cookies and Statistics, and Settings
Cookies that may be stored on your device while you browse the website include cookies whose sole purpose is to enable or facilitate electronic communication, cookies that are strictly necessary for the provision of services requested by you (such as language preference cookies, authentication/login cookies, etc.), statistical cookies, and other cookies as described below.
Where cookies require your consent before being stored, we request such consent through the “Learn More” link displayed on the homepage of the website you are visiting, which explains that by continuing to browse the website, you agree to the use of these cookies.
5.2.1. Which Cookies Are Stored?
Cookies Issued by the Data Controller

Third-Party Cookies

Statistical Cookies

Statistical cookies enable the measurement of the number of visits, page views, and general visitor activity on the website, including repeat visits.
For this purpose, the Xiti – AT Internet analytics tool places a cookie containing a unique identifier, which is retained for a maximum period of 13 months.
Your IP address is also collected to identify the city from which you connect. It is anonymized immediately after your browsing session ends, preventing your identification as an individual. Website traffic data is first collected by the service provider and then returned to the Data Controller in aggregated and anonymous form through an interface accessible only to the Data Controller.
This information is not disclosed to third parties and is not used for any other purpose. You may disable these cookies at any time by following the opt-out procedure available at:
http://www.xiti.com/en/optout.aspx.
Statistical cookies enable the measurement of the number of visits, page views, and general visitor activity on the website, including repeat visits.
For this purpose, the Xiti – AT Internet analytics tool places a cookie containing a unique identifier, which is retained for a maximum period of 13 months.
Your IP address is also collected to identify the city from which you connect. It is anonymized immediately after your browsing session ends, preventing your identification as an individual. Website traffic data is first collected by the service provider and then returned to the Data Controller in aggregated and anonymous form through an interface accessible only to the Data Controller.
This information is not disclosed to third parties and is not used for any other purpose. You may disable these cookies at any time by following the opt-out procedure available at:
http://www.xiti.com/en/optout.aspx.
5.2.2. How to Delete Cookies, Receive Notifications About Them or Change Your Browser Settings?
How do you delete cookies already stored on your computer?
On your computer:

• Open the Windows folder on drive **C:**.
• Open the Temporary Internet Files folder.
• Select all files (Ctrl + A).
• Choose Delete.

How do you change your browser settings to refuse cookies or receive notifications before cookies are stored?
Internet Explorer 5 (Microsoft)

• Select Tools > Internet Options.
• Click the Security tab, then Custom Level.
• Scroll down to the Cookies section.
• Under Allow cookies that are stored on your computer, select:
  • Prompt to receive a notification before a cookie is stored; or
  • Disable to refuse all cookies.

Internet Explorer 6, 7 or 8 (Microsoft)

• Select Tools > Internet Options > Privacy.
• Choose the privacy level you wish to apply.

Firefox

• Click Tools and select Options.
• Under Privacy & Security, uncheck Accept cookies from websites.

Google Chrome

• Click Customize and control Google Chrome and select Settings.
• Under Privacy and Security, click Content Settings.
• Enable Block third-party cookies.

6. Your Rights / Contact Information
You have the right to access, inquire about, modify, correct and delete your personal data.
You may also obtain disclosure of your personal data and object to the processing and dissemination of your personal data. The Company reserves the right to reject requests it considers inappropriate.
In accordance with applicable legislation, you have the right to object to direct marketing and prospecting communications sent by electronic mail, fax or automated calling systems.
If you wish to exercise any of these rights or obtain additional information, please send your request by email to [email protected] or by post to:
TotalEnergies Marketing Bulgaria EOOD
Customer Service Department
63 Kazbek str., Viridian offices, 1st Floor
1680 Sofia
Bulgaria

Appendix 2: Privacy Policy Glossary

1. IDENTIFICATION OF THE DATA CONTROLLER (DC)
The Company, acting as the Data Controller, processes your personal information in accordance with applicable regulations.
2. PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
Your data is processed for the purpose of providing the requested service.

• Processing is based on your consent.
• The information is necessary to process your request; without it, your request cannot be handled.

3. OPTIONAL SECTION – MANDATORY INFORMATION IN DATA COLLECTION FORMS
All mandatory fields in forms are marked with an asterisk (*).
4. RECIPIENTS OF PERSONAL DATA
For the purposes described above, your data may be transmitted to the Company.
5. RETENTION PERIOD
Your data will be retained only for the period necessary to fulfill the purpose of processing, namely one year.
6. DATA SUBJECT RIGHTS
In accordance with applicable regulations, you have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Request deletion of your data;
• Exercise your right to data portability;
• Provide instructions regarding the handling of your personal data after your death.

You also have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.
In addition, you may request a restriction on processing, object to the processing of your data, and/or lodge a complaint with the competent supervisory authority.
You may exercise your rights by contacting:
Customer Service Department
63 Kazbek str., Viridian offices, 1st Floor
1680 Sofia, Bulgaria
For matters related to personal data protection, you may also contact the Data Protection function.
Appendix 3: List of Legal Bases for Data Processing Activities

Important: For children under the age of 18, consent or authorization from the person exercising parental responsibility may be required.
In practice, valid consent may be obtained through:

• An unchecked consent box that the user actively selects;
• A choice made through technical settings;
• A statement or behavior that clearly indicates acceptance of the proposed processing activity in the given context.

Examples:

• Use of visitors’ photographs in an internal company magazine;
• Subscription to newsletters or marketing communications;
• Participation in surveys, campaigns, or promotional activities requiring consent.

There may also be other legal grounds that justify processing, including legitimate interest. Since this is typically assessed on a case-by-case basis, it is not detailed further in this section. If necessary, consult the Legal Department regarding the appropriate legal basis for a specific processing activity.