Privacy Policy

Shape Image One

The protection of your personal data is essential to us. The current privacy policy addresses issues related to the protection of personal data of individuals, collected and processed by the Personal Data Administrator, through the website https://oblachebialo.bg/ , referred to as the “Site” for short, as well as in social networks (Facebook, Messenger, Viber, Instagram), by electronic means, telephone or through other means of communication, in which the individual, referred to for short as “Subject of personal data”, voluntarily provides data to the Administrator.

When collecting and processing personal data, the Administrator complies with all applicable regulations in the field of personal data protection, including, but not limited to, the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 regarding the protection of individuals with regard to the processing of personal data and regarding the free movement of such data and for the repeal of Directive 95/46/EC) and the Personal Data Protection Act.

  1. Information about the Personal Data Administrator:

For the purposes of this policy, the Personal Data Administrator is “Oblache Bialo” LTD, EIC 206974457, with registered office and management address at: Sofia, street “Smrika” 24, e-mail: office@oblachebialo.com.

  1. Definitions:

For the purposes of this privacy policy, the following definitions have been adopted:

– “Personal data” is any information relating to an individual that is identified or can be identified directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier, or by one or more characteristics, specific to that individual’s physical, physiological, genetic, mental, economic, cultural or social identity;

  • “Processing of personal data” is any operation or set of operations performed with personal data or a set of personal data by automatic or other means such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmitting, distributing or otherwise making the data accessible, arranging or combining, restricting, erasing or destroying;

– “The Administrator of personal data” means an individual or legal person, public body, agency, or other structure that alone or jointly with others determines the purposes and means of processing personal data. In the context of this policy, “Oblache Bialo” LTD. is the Administrator of personal data.

– “Processor of personal data” means a natural or legal person, public body, agency or other structure that processes personal data on behalf of the Administrator;

– “Recipient” means an individual or legal person, public body, agency or other structure to which personal data are disclosed, whether or not it is a third party.

– “Consent of the data subject” means any freely expressed, specific, informed, and unequivocal indication of the will of the data subject, by means of a statement or a clear affirmative action, which expresses his consent to the processing of his personal data.

– “Personal Data Security Breach” means a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access of Personal Data that is transmitted, stored, or otherwise processed.

– “Legislation in the field of personal data protection” – The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 regarding the protection of individuals with regard to the processing of personal data and regarding the free movement of such data and for the repeal of Directive 95/46/EC) and the Personal Data Protection Act.

 

  • Personal data subjects whose data is processed:

The Personal Data Administrator processes personal data provided by individuals, users of the site; individuals who made inquiries and requests by phone call, e-mail, the contact form on the site, a message on social networks, or by other means of communication; individuals whose information is contained in inquiries made or documents submitted in connection with the services provided by the administrator; individuals with whom a contract has been concluded.

  1. What kind of personal data is collected and processed by the Administrator?

The Personal Data Administrator processes the following data categories:

  • Data regarding the physical identity of the person: three names; contact address; e-mail address; phone number; username and password used to authenticate access to the data subject’s user profile;

  • Demographics data: age; gender; country;
  • Data regarding the economic identity of the person: payment data. The Administrator provides the possibility to pay for the services with credit cards through a payment service provider. Only the payment service provider collects and processes the complete information from the credit cards.
  • Data regarding the social identity of the person – education, marital status;
  • Technological data: data about the orders made through the user profile; location data – location derived from an IP address or data that indicates where the user is, such as a physical address provided by the user; e-mail address, letters, information about troubleshooting requests, litigations, requests, complaints.

  1. Principles for collecting and processing personal data:

The personal data administrator collects and processes personal data, subject to the following principles:

  1. legality, good faith and transparency of personal data processing;
  2. expediency of the processing of personal data, namely: the data is collected for specific, explicitly indicated and legitimate purposes and is not further processed in a manner incompatible with these purposes;

  1. proportionality of the processing of personal data, namely: only data that is relevant is processed, related to, and limited to what is necessary in relation to the purposes for which it is processed(the so-called “minimization of data”);

  1. actuality of processed personal data;

  1. term – the data is stored in a form that allows the identification of the data subject for a period no longer than is necessary for the purposes for which the personal data are processed;

  1. integrity and confidentiality – the data is processed in a way that ensures an appropriate level of personal data security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures.

  1. For what purpose are the personal data processed?

The collected personal data is processed for the purpose of fulfilling contractual obligations assumed by the administrator, for which is necessary each one, but not only, of the listed actions is required:

  • establishing the identity of the client;
  • management and execution of a request and execution of a concluded contract;
  • preparation and sending a bill/invoice for the services used;
  • maintaining correspondence in connection with the placed orders, processing requests, reporting problems, etc.;
  • creating a user profile;

  • On what basis are the personal data processed?

The Administrator processes personal data on one of the following grounds:

  • Expressly stated consent by the person in connection with a response to an inquiry or performance of a contractual obligation/provision of a service;
  • Fulfillment of an obligation of the Personal Data Administrator that is legally established.

  • For what period are personal data stored:

A basic principle in the processing of personal data is the principle of urgency, which is manifested in the fact that the data are stored in a form that allows the identification of the data subject for a period no longer than is necessary for the purposes for which the personal data are processed. Once the purposes of processing have been achieved and the basis for processing has ceased, the collected personal data are destroyed, bearing in mind that if a longer term is provided for in a regulatory act, e.g. 5 years, this term applies.

  1. Are personal data provided to third parties?

Personal data processed by the Administrator may be disclosed, in addition to the individual to whom they relate, to the following categories of recipients, namely:

  • persons for whom the right of access is provided in a legal act, such as e.g. public bodies;
  • persons with whom a contract has been concluded in connection with the provision of services or the fulfillment of obligations /e.g. payment service providers; software product providers; persons performing consulting services in various fields, including law firms and marketing consultants/ in the presence of at least one of the following prerequisites: express consent of the data subject; legally established obligation of the Personal Data Administrator; protection of a vital interest or if necessary for the purposes of criminal prosecution.

 

Х. Personal data protection measures:

In order to ensure the protection of stored and processed personal data, the Administrator implements all the necessary organizational and technical measures provided for in the legislation for the protection of personal data. The main risks that exist regarding personal data are: leakage of information; breach of security; unlawful access by unauthorized persons; loss/unlawful destruction of data.

In order to eliminate the possibility of the occurrence of any of the listed risks, the following measures have been taken, namely, the data is stored in premises with limited access; if the data is stored on electronic media such as disks and flash drives, the latter are kept in premises with limited access; the computers on which personal data are stored have appropriate anti-virus protection; personal data is not saved on devices such as mobile phones, smartphones, and tablets. Additional protection mechanisms are used such as encryption, pseudonymization, etc.

ХI. Rights of Personal Data Subjects:

The subjects of personal data whose data are processed have the following rights:

  1. Right to information about the data that identifies the Administrator and his representative, the purposes of personal data processing, the recipients or categories of recipients to whom the data may be disclosed, the mandatory or voluntary nature of providing the data, and the consequences of refusing to provide them, the term of data storage; the purposes of data processing; the procedure for giving and withdrawing consent.

  1. Right of access to data relating to them, as in cases where, when granting the right of access to the individual, personal data may also be disclosed to a third party, the Administrator is obliged to provide partial access to them without disclosing data to the third party.

  1. Right to deletion, correction, or blocking of personal data, the processing of which does not meet the requirements of the legislation, as well as the right to request that the third parties to whom the personal data were disclosed be notified of any deletion, correction or blocking, which has been carried out, except in cases where this is impossible or involves excessive efforts;

  1. Right to object to the Administrator against the processing of the individual’s personal data if there is a legal basis for this and against the processing and disclosure of his personal data to third parties for the purposes of direct marketing; right to be notified before his personal data is disclosed for the first time to third parties or used on their behalf for direct marketing purposes;

  1. Right “to be forgotten” / personal data to be deleted – the personal data being processed to be deleted in the presence of an express request for this and in consideration of the public interest. The subject of personal data may request that they be deleted in the presence of one of the following conditions: the data are no longer necessary for the purposes for which they were collected or otherwise processed; the subject has withdrawn his consent on which the data processing is based and there is no other legal basis for the processing; the subject objects to the processing of the data and there are no overriding legal grounds for the processing; the personal data were processed unlawfully.

  1. Right to restriction of processing;

  1. Right to data portability – to receive the personal data concerning him and which he has provided to the Administrator in a structured, widely used, and machine-readable format and has the right to transfer this data to another Administrator without hindrance from the Administrator to whom the personal data provided;

  1. Right of defense – right to appeal before the CPLD and in court.