I. PURPOSE AND SCOPE

This Distributor Privacy Policy ("the Policy) is intended to inform you about the processing of personal data of you, Distributors and/or Distributor Candidates, by the company Estnaila, UAB, legal entity code 304215302 (hereinafter referred to as - We are or Company).

We understand that the protection of personal data is very important and we are committed to respecting your privacy and the protection of personal data.

II. CONCEPTS

You or Candidate to Distributors and/or Representatives - a person applying to become a Distributor and/or Representative of the Company's Products.

You or Distributor and/or Representative - a natural or legal person distributing the Company's Products on the basis of a contract.

Product - Products under the company's Victoria Boro brand.

III. THE DATA COLLECTED, THE PURPOSES AND THE LEGAL BASIS FOR PROCESSING

In order to ensure that our Products are distributed by suitable product distributors who are in line with the Company's values and ethics, we may process a variety of your personal data.

Depending on. Below are the main, but not all, categories of personal data processed by the Company:

• Basic personal data: name, surname, date of birth (age);
• Contact details: residential address, correspondence address (if different from permanent residence), telephone number, email address;
• Communication Information: the content of email correspondence or any other form of communication with us (i.e. live chats, blogs, messages);
• Social networking data: names of the social networking accounts you manage, audience size;
• Business Data: information about the business you run that distributes the Company's products or wishes to distribute the Company's products;
• Contract performance data: information about the goods distributed, customer feedback, communication content, financial information, etc;
• Information about your activity on our website: technical information, including the Internet Protocol (IP) address your device uses to connect to the internet, browser type and version, time zone settings, operating system and platform, type of device used, unique device identifier.

The table below sets out the purposes, legal basis and categories of personal data we process.

IV. Where do we get your personal data from?

We receive a large part of your personal data directly from you, for example, when you fill in a Distributor form on a website operated by the Company or when you sign cooperation agreements.

We may also obtain certain information from public administrations, registers, databases, customers and other sources.

V. To whom can your data be disclosed?

In order to ensure that our Products are distributed only by authorised Distributors and/or Representatives, we may publish your personal data on the Company's website. In certain cases, we may also make your personal data available to other third parties to ensure the performance of your functions as a Distributor and/or Representative. These third parties (data processors) include:

1. The company's existing and potential customers.
2. Freelance IT professionals.
3. Courier services.
4. Companies providing direct marketing and service station (server) rental services.

Your personal data is transferred to third parties only to the extent that it is necessary to achieve specific goals.

We may also disclose and/or transfer your personal data to the following categories of recipients:

1. State and municipal institutions, bodies, organisations and other public administration bodies.
2. Pre-trial investigation agencies, courts, bailiffs, notaries.
3. Commercial banks, other financial institutions.
4. Advisors in law, finance, tax, business management, HR, accounting, etc.
5. To our partners or other persons who are a necessary part of our service provision.
6. To other persons with whom we intend to enter into or have entered into contract(s).

We may also disclose your personal data if we are required to disclose or share your personal data in order to comply with legal requirements or requests.

VI. What rights do you have?

As a data subject, you have the right to:

• to know (be informed) about the processing of your data (right to know);
• to know your data and how they are processed (right of access);
• request the rectification or completion of incomplete personal data (right to rectification);
• request the erasure of personal data relating to you ("right to be forgotten");
• require the Company to restrict the processing of personal data relating to you (right to restrict);
• to object at any time to the processing of your personal data where it is in the public interest or necessary for the legitimate interests of the Company or a third party (right to object);
• to receive the data relating to you that you have provided to the Company in a structured, commonly used and computer-readable format and to transmit it to another data controller (right to data portability);
• lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania.

VII. Procedure for exercising your rights

To exercise your rights and get answers to your questions, please contact us at info@borobeauty.lt.

Your requests will be processed within 30 (thirty) calendar days from the date of receipt of the request. In special cases, depending on the complexity of the requests and the amount of personal data, the period of 60 (sixty) calendar days may be extended, upon prior notification to you. The answer to your request is provided in the same form as the request was submitted, except if you prefer to receive the information electronically.

VIII. Data retention period

We will keep your personal data as long as they are needed for the purposes for which they were collected and processed, but no longer than required by applicable laws and other legal acts.

If the legal acts of the Republic of Lithuania do not establish any personal data storage period, we will determine this period, taking into account the legal purpose of data storage, the legal basis and the principles of legal processing of personal data. Data not specified below are stored in accordance with the legal acts of the Republic of Lithuania:

1. The personal data of the company's partners/representatives are stored for 10 years after the conclusion of the contract;
2. If your candidacy for Distributors is successfully approved and we conclude the contract, your personal data will be transferred and processed in accordance with the rules on the processing of personal data in force at our Company.
3. If you are unsuccessful in your application to the Distributors, the personal data you provide will be stored until the end of the selection process, but not longer than 3 months.

We also inform you that in certain cases your personal data may be stored longer:

1. if it is necessary for the Company to be able to defend itself against claims, claims or lawsuits and to exercise its rights;
2. there are reasonable suspicions of an illegal act, which is the subject of an investigation;
3. personal data are necessary for the proper resolution of a dispute or complaint;
4. a request to access your personal data is received;
5. in the presence of other legal grounds.

IX. Right to lodge a complaint

If you believe that your personal data is being processed in violation of your rights and legitimate interests as set out in the applicable legislation, you may lodge a complaint with the supervisory authority - the State Data Protection Inspectorate. You can find the State Data Protection Inspectorate's complaints procedure here: https://vdai.lrv.lt/lt/veiklos-sritys-1/skundu-nagrinejimas/.

X. How your data is stored

We confirm that we process personal data in accordance with the requirements of the applicable European Union and Republic of Lithuania legal acts, as well as the instructions of the controlling authorities. We implement all necessary technical and administrative measures to protect the collected data against loss, unauthorised use and alteration. Our employees and beauty professionals providing services within the Company are obliged not to disclose to third parties or disseminate to third parties any information obtained in the workplace or in the course of the provision of services, including information about Distributors and/or Distributor Candidates.

XI. Policy updates

We keep this Policy under regular review and will notify you of material changes to it.