# CNextUp PRIVACY POLICY **Version:** 1.0 **Effective from:** 15 September 2026 ## 1. About this Policy This Privacy Policy explains how **Ultra Consult EOOD** processes personal data in connection with the use of the **CNextUp** mobile application (the “Application”). We are aware that the Application may be used by children and minors. For this reason, we aim to provide information about personal data in a clear and understandable manner and to collect only the information necessary to provide and protect the service. ## 2. Who is the controller of personal data? The controller of personal data is: **Ultra Consult EOOD** UIC: 175412079 Address: 4A Dr. Stoyan Chomakov St., Office 54 Email for personal data enquiries: privacy@quantum-drift.tech When we use “we”, “us” or the “Provider” in this Policy, we mean Ultra Consult EOOD. ## 3. What personal data do we process? Depending on the functionalities used, we may process the following categories of information. ### 3.1. User account data When registering and using the Application, we may process: * email address; * a unique user account identifier; * status and technical information necessary for account authentication. The email address is used only during registration to receive a verification code and when registering the school / university, if this is required by the institution itself. We do not require users to provide more personal information than is necessary to provide the service. ### 3.2. Information necessary for educational functionalities To display the correct information for a particular user, we may process: * country; * city; * educational institution; * grade; * class; * user type, where necessary for a particular functionality. For example, this information enables us to determine which timetable or school events should be displayed. ### 3.3. Technical and security information When the Application is used, our systems may automatically process limited technical information necessary for the security and operation of the service, such as: * date and time of a request; * technical request identifiers; * IP address, where included in infrastructure or security logs; * error information; * actions related to security and authentication. We do not use this data to create advertising or behavioural profiles. ## 4. What data do we not collect for advertising purposes? At present, the Application **does not display advertisements**. We do not process personal data for the purposes of: * personalised advertising; * behavioural advertising targeting; * creating advertising interest profiles; * remarketing; * tracking users across different applications; * selling personal data to advertisers. We do not provide individual user profiles to advertisers. If advertising functionalities are introduced in the future, this Policy will be updated before we begin any related processing of personal data. ## 5. Why do we use personal data? ### Providing the Application We use account, school, grade and class data, to the extent necessary, to: * create and manage a user account; * authenticate the user; * display the correct educational information; * provide the functionalities of the Application. The legal basis is generally that the processing is necessary to provide the service requested by the user and to perform the relationship between the user and the Provider — Article 6(1)(b) of the GDPR, where that legal basis is applicable. ### Security and prevention of misuse We may process limited technical data in order to: * protect user accounts; * prevent unauthorised access; * detect misuse; * diagnose technical problems; * protect the infrastructure. Where applicable, the legal basis is our legitimate interest in providing a secure and reliable service — Article 6(1)(f) of the GDPR. ### Legal obligations In certain cases, we may process or retain information where necessary to comply with an applicable legal obligation. In such cases, the legal basis is Article 6(1)(c) of the GDPR. ## 6. Do we rely on consent? We do not use consent as a universal legal basis for all personal data processing operations. Where processing is necessary to provide the core functionality of the Application, we rely on the relevant applicable legal basis. If consent is required in the future for a specific additional functionality, it will be requested separately, clearly and before that processing begins. For persons under the age of 14, the special rules of Bulgarian law apply where the processing of their personal data is based on consent. ## 7. Children’s data The Application may be used by children and minors. We apply the principle of data minimisation and do not request information merely because it might be useful in the future. Where information is not necessary for a particular functionality, we aim not to collect it. Where applicable law requires the involvement of a parent, guardian or other legal representative, we will take the appropriate measures. A parent or legal representative may contact us at privacy@quantum-drift.tech regarding the processing of a child’s data. ## 8. Do we receive data from the school? The Application may contain information about educational institutions, timetables, teachers, classrooms, holidays and school events. The mere fact that a timetable or other school information is included in the system does not necessarily mean that the school provides us with the personal data of a particular user. If, in the future, a specific educational institution begins to provide personal data concerning its students through the Application, or if we process such data on its behalf, the relationships and responsibilities will be governed in accordance with applicable law and, where necessary, by a separate agreement. ## 9. With whom may we share data? We do not sell users’ personal data. To technically provide the service, we may use specialised service providers that process information on our behalf, such as providers of: * cloud infrastructure; * hosting; * databases; * authentication; * monitoring and information security. Where these providers act as processors of personal data, our relationships with them are governed by appropriate contractual and organisational measures for data protection. At present, the Application’s infrastructure may use cloud services, including services related to infrastructure, databases and user authentication. Personal data may also be disclosed where necessary: * to comply with a legal obligation; * in response to a lawful request from a competent public authority; * for the establishment, exercise or defence of legal claims; * to protect the security and rights of users. ## 10. Transfers of data outside the European Economic Area Where processing involves the transfer of personal data outside the European Economic Area, such transfer will take place only where a permitted mechanism under the GDPR is in place. Depending on the particular provider, this may include an adequacy decision, Standard Contractual Clauses or another permitted mechanism. ## 11. How long do we retain personal data? We do not retain personal data for longer than necessary for the purposes for which it is processed. If an account is not used for a period of one year, the user account is automatically deleted from the system. ### Account data Data necessary for the existence of the account is retained while the account remains active. After an account is deleted, the data is deleted or irreversibly anonymised within **one week**, unless the law requires a longer retention period. ### Backups Information may temporarily remain in protected backups for up to **thirty days**, after which it is deleted through the normal backup cycle. ### Security logs Technical and security logs are retained for up to **ninety days**, unless a specific incident requires longer retention for its investigation or in order to comply with a legal obligation. ## 12. How do we protect information? We use appropriate technical and organisational measures to protect personal data against: * unauthorised access; * accidental loss; * unlawful alteration; * unlawful disclosure; * destruction. These measures may include access controls, user authentication, encrypted communications, restrictions on administrative access, action logging, backups and other appropriate mechanisms. No information system can guarantee absolute security, so the measures are reviewed and improved according to the level of risk. ## 13. Your rights Under the GDPR, where the relevant legal requirements are met, you have the right: * to obtain information as to whether we process your personal data; * to obtain access to your personal data; * to request correction of inaccurate data; * to request deletion of your data; * to request restriction of processing; * to receive certain data in a structured, commonly used and machine-readable format; * to object to processing based on legitimate interests; * to withdraw your consent at any time where a particular processing operation is actually based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. To exercise your rights, you may contact us at: **privacy@quantum-drift.tech** We may request reasonable information necessary to verify your identity before fulfilling a request, where this is necessary to protect the data. ## 14. Right to lodge a complaint If you believe that your personal data is being processed in breach of applicable law, you have the right to lodge a complaint with the competent supervisory authority. In Bulgaria, this is: **Commission for Personal Data Protection (CPDP)** 1592 Sofia 2 Prof. Tsvetan Lazarov Blvd. You may also contact us first at privacy@quantum-drift.tech so that we can try to resolve the issue. ## 15. Automated decision-making and profiling At present, we do not use users’ personal data for automated decision-making that produces legal effects concerning them or similarly significantly affects them. We do not carry out advertising profiling of users. ## 16. Changes to this Policy We may update this Policy in the event of: * changes to the functionalities of the Application; * changes to the way personal data is processed; * changes to the service providers used; * changes in applicable law. If a material change is made, we will notify users in an appropriate manner. The effective date of the current version will always be stated at the beginning of the document. ## 17. Contact details If you have questions about this Policy or the way we process personal data, you may contact us at: **Ultra Consult EOOD** UIC: 175412079 Address: 4A Dr. Stoyan Chomakov St., Office 54 Email: privacy@quantum-drift.tech