1. Who We Are and Scope of this Policy

Minerva Consulting Ltd. ("Minerva", "we", "us") is the data controller for the personal data described in this Privacy Policy, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"). • Company name: Minerva Consulting Ltd. • UIC (EIK): 204276311 · VAT number: BG204276311 • Registered office: No. 51, Malchika Street, Levski, Pleven 5900, Bulgaria • Contact for data protection matters: [email] • Supervisory authority: Commission for Personal Data Protection of Bulgaria (CPDP) This policy applies to visitors of our website [website], to people who contact us or request a conversation, to our clients and their representatives, and to the leaders who take part in our engagements ("Participants"). Given our size and activities, we are not required to appoint a Data Protection Officer; all requests are handled directly by the principals.

2. Personal Data We Collect

We collect only the data needed for the purposes described in Article 3. • Identification and contact data: name, job title, organisation, professional email address, telephone number, country. • Enquiry data: the information you share when requesting a conversation, such as your role and the leadership aspiration you are pursuing. • Engagement data: session dates, notes taken during sessions, agreed leadership factors, progress observations and reports. • Assessment data: answers to the Energy Leadership Index™ (ELI) questionnaire and the resulting scores and profile. • Billing data: billing address, VAT number, invoices and payment records. Card details are processed by our payment providers and are never stored by us. • Browsing data: IP address, browser type, pages visited and cookies, subject to your consent where required (see Article 8). We do not seek to collect special categories of data within the meaning of Article 9 GDPR, such as health data. If a Participant chooses to share such information during a session, it is used solely to conduct that session with the necessary care, is not recorded beyond what is strictly needed, and is never passed on to the Sponsor.

3. Purposes, Legal Bases and Retention

Each processing activity relies on one of the legal bases of Article 6 GDPR and is kept only for the period indicated, after which the data is deleted or anonymised. Handling enquiries and initial conversations Legal basis: Art. 6.1.b - Pre-contractual steps · Retention: 3 years after last contact Engagement management and sessions Legal basis: Art. 6.1.b - Contract · Retention: engagement + 5 years ELI assessment and progress reports Legal basis: Art. 6.1.b - Contract · Retention: engagement + 5 years Invoicing and payment Legal basis: Art. 6.1.b + 6.1.c - Contract / Legal obligation · Retention: 10 years Commercial communications Legal basis: Art. 6.1.a - Consent · Retention: until withdrawal Cookies and analytics Legal basis: Art. 6.1.a - Consent · Retention: 13 months max Fraud prevention and security Legal basis: Art. 6.1.f - Legitimate interest · Retention: 12 to 36 months Legal obligations and defence of legal claims Legal basis: Art. 6.1.c / 6.1.f · Retention: 10 years Where a Professional Client's representative is our contact, we process their professional data on the basis of our legitimate interest in managing the business relationship (Art. 6.1.f). We do not sell personal data and we do not carry out automated decision-making or profiling producing legal or similarly significant effects within the meaning of Article 22 GDPR. ELI results are always interpreted by a coach together with the Participant.

4. Corporate Engagements: Sponsor and Participant

When an organisation (the "Sponsor") commissions an engagement for one of its leaders, the Participant's personal data is processed by Minerva as an independent controller, in order to deliver the service agreed with the Sponsor. Before the engagement begins, the Participant is informed of what will be shared with the Sponsor. Unless otherwise agreed in writing and made known to the Participant: • the Sponsor receives the final report described in the engagement proposal, which covers baseline ELI indices and progress on the agreed leadership factors; • the content of individual sessions, personal notes and any personal circumstances discussed remain confidential between the Participant and Minerva; • Minerva does not provide the Sponsor with any opinion intended to support a disciplinary or dismissal decision. Where the Sponsor passes on personal data about the Participant to Minerva, the Sponsor is responsible for having informed the Participant and for having a valid legal basis for that transfer.

5. Recipients, Sub-processors and Transfers outside the EU

Your data is accessible only to the principals of Minerva and, where applicable, to associates involved in an engagement, who are bound by confidentiality. It may also be processed by service providers acting on our instructions under a data processing agreement (Article 28 GDPR). We may also disclose data to public authorities where required by law. Where data is transferred outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies, or on Standard Contractual Clauses (Article 46 GDPR). A copy of the relevant safeguards can be obtained on request.

6. Security, Confidentiality and Data Breaches

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, in particular restricted access to engagement files, password-protected and encrypted storage, two-factor authentication on our professional accounts, and confidentiality commitments from anyone working on an engagement. In the event of a personal data breach, we notify the CPDP within 72 hours of becoming aware of it (Article 33 GDPR) and inform the persons concerned without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).

7. Your Rights

Under Articles 15 to 22 GDPR, you have the right to: • access your data and obtain a copy of it; • have inaccurate data rectified; • have your data erased, unless we are legally required to keep it; • restrict processing in certain circumstances; • receive the data you provided in a portable format; • object at any time to processing based on our legitimate interest, and to direct marketing without having to give a reason; • withdraw your consent at any time, without affecting processing carried out before withdrawal. To exercise these rights, write to [email]. We may ask for proof of identity where there is reasonable doubt. We respond within one month, extendable by two months for complex requests, in which case we inform you of the extension within the first month. If you consider that your rights have not been respected, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg) or with the supervisory authority of your EU country of residence or place of work, such as the CNIL in France.

8. Cookies

Only cookies strictly necessary for the operation and security of the Website are placed without your consent. Analytics, advertising and personalisation cookies are placed only after you have accepted them through our cookie banner, in accordance with Directive 2002/58/EC (ePrivacy) and EDPB guidelines. Refusing cookies is as easy as accepting them, and you can change your choice at any time via the "Cookie settings" link in the Website footer. Consent is stored for a maximum of 13 months, after which we ask you again.

9. Minors, Changes and Contact

Our services are intended for adults in a professional context. We do not knowingly collect data from persons under 18. We may update this Privacy Policy to reflect changes in our activities or in the law. The date of the latest version appears below, and any substantial change is notified by email to clients with an ongoing engagement. For any question about this policy or about your data, please contact us at [email] or by post at Minerva Consulting Ltd., No. 51, Malchika Street, Levski, Pleven 5900, Bulgaria.

Minerva Consulting Ltd. · Last updated: November 2026 [email] · [website]

Privacy policy