I. Introduction
The association “Centre for Active Youth – Together We Can” (from now on referred to as the “Association”) is a non-profit legal entity for carrying out private activities, established according to the provisions of the Law on Non-profit Legal Entities. The association is a non-governmental, non-religious and non-political organization. The association is entered in the Trade Register and the Register of the Non-profit legal entities at the Registration Agency with Unique Business Entity Identification Number 206639213, with headquarters and management address in the city of Sliven, CP 8800, “Gagovets” St. No. 12A, a correspondence address in the city of Burgas, CP 8000 “Aleksanda Veliki” St. No. 68, fl. 1, apartment 2 , and website: www.centreactiveyouth.org.
The association collects and processes personal data as a personal data controller following the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (from now on referred to as “the Regulation”/”the Regulation”). In some cases, the Association is not in the role of an administrator, but of a processor of personal data within the meaning of the Regulation (for example, given the conditions under the Erasmus+ Program, provided for in Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 year for the establishment of Erasmus+ – a program of the Union in the field of education and training, youth and sports and for the repeal of Regulation (EU) No. 1288/2013), hereinafter referred to as the “Erasmus+ Programme”). When running the Erasmus+ Program, data may be transferred to the European Commission, which is the controller of personal data (European Commission website: https://commission.europa.eu/index_bg).
For all questions related to the processing of your and/or your children’s personal data, you can contact us by phone at + 359 887 133 749, as well as write to us at the address: Burgas, CP 8000 Alexander the Great St. No. 68, fl. 1, apartment 2 or at [email protected].
For the purposes of this Notice, “children” means persons under the age of 18. For the avoidance of doubt, wherever data is referred to in this Notice (including where it says “Your data”, “your data”, etc.), it means both children’s data and the data of adults, even if this is not explicitly stated.
It is of great importance that the information we have about you is correct and up-to-date.
Please inform us of any changes or if you notice any errors.
II. Your Responsibilities:
• Read this Notice and review it regularly.
• If you are in a contractual relationship with us, please check the related terms and/or policies: they may contain further details about how we collect and process your data.
• Please also pay attention to additional information and conditions that we introduce you to at various stages of our interaction.
If you provide us with personal information about other people, or if others provide us with your information, we will only use that information for the specific purpose for which it was provided to us. If you provide us with information about third parties, you should have a legal basis for it, and you should also inform the third parties of how we will process their data, including this Notice.
III. What is the information we collect about you?
Information you provide to us:
It is information, which also includes personal data, that you provide to us by filling in forms and other documents for participation in competitions, Olympiads, contests, projects/programs and other events (hereinafter referred to as “Activities” for short), sending inquiries and messages through the Association’s website or in other ways (including through the Viber application), as well as when you make subsequent contact with us in the course of reviewing your documents.
In connection with the organization of Activities, the Association processes information about the following data subjects:
a/ Participants in Activities – for them the Association can process, for example, identification data – the first, last and middle names, date and place of birth, social security number; education and qualification data; contact details; photos; video materials, etc. The Association processes the personal data of children under 14 years of age only if they are provided by their parents/guardians and they have given their consent to the processing of the children’s personal data by the Association. The association processes the personal data of children under the age of 14 to 18, only with the consent of their parents/guardians.
b/ Parents/guardians/custodians of participants in Activities – for them the Association can process, for example, identification data – the first, last and middle names, social security number; contact details; bank account of parents/guardians/trustees of the winners, in the case of awarding a cash prize by the Association, etc.
c/ Natural persons who have sent a message using one of the contact forms on the site or sent correspondence electronically or to the contact address of the Association;
d/ Jury/commission members – for them the Association can process, for example, identification data – the first, last and middle names, education and qualification data; contact details – etc.
e/ Accompanying participants in Activities, for example during trips.
IV. The purposes of personal data processing
We process personal data for specific purposes and on relevant legal grounds, depending on your role with us.
In carrying out its activity, the Association processes information representing personal data for you and your children for the purposes stated below.
1. To carry out its activity and to manage its relationships with participants in Activities organized by the Association. The association processes your personal data, as well as the personal data of your children, in the following cases:
a) Receiving documents for participation in Activities organized/implemented by the Association. Participation in the Activities of the Association is voluntary and the data of the participants is processed only for the purposes of their participation in the relevant Activity and/or promotion of their creativity;
b) Examination of the works of the participants in the relevant Activity and determination of the winners, as well as the announcement of the winners on the website of the Association;
c) Correspondence with the participants in the relevant Activity organized/implemented by the Association;
d) Providing prizes to the winners of the relevant Activity;
e) Organizing exhibitions, as well as publishing books, brochures and other materials containing works by participants in the Activities organized by the Association;
f) Video recording and/or photography of celebrations organized by the Association for awarding the winners of the Activities;
g) Receiving preliminary information that is necessary for the conclusion of a contract, upon request by the Association for the conclusion of a contract;
h) Purposes related to contractual obligations:
– identification of a party to the contract, conclusion of a contract, amendment and/or termination of a contract; making payments; sending information related to payments, correspondence in connection with the concluded contract, fulfillment of contractual obligations, exercise of contractual rights;
– updating your personal data and/or your child’s data.
i) Organization and/or implementation of projects/programs, including trips, overnight stays, etc.
j) The first last and middle names, ages and photos of the winners of Activities are published on the official website of the Association.
k) To promote its activity, the Association could use photos/video materials in which you participate, as well as your name, age, educational institution, etc., by including them in publications on social networks, materials in the media, etc.
If you are a party to a Contract with us:
– to fulfill our obligations under the Contract with you, we will process the information on the basis “for the performance of a contract to which the data subject is a party”.
– we will process the information on the basis “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation (e.g. according to tax/accounting legislation);
– we could process your data on the grounds “for the performance of a task of public interest or in the exercise of official powers granted to the administrator”;
– the rest of the processing activities will be carried out based on our “legitimate interests” to seek/report the performance of the contract between us and to possibly establish, exercise, or defend legal claims.
If you represent/work for an organization that has entered into a contract with the Association:
– we will process the information on the basis “for compliance with a legal obligation that applies to the Association” when there is a corresponding legal obligation (e.g. according to tax/accounting legislation);
– we could process your data on the grounds “for the performance of a task of public interest or in the exercise of official powers granted to the administrator”;
– the rest of the processing activities will be carried out based on our “legitimate interests” to perform and seek/report the performance of the contract and with a view to the possible establishment, exercise, or defense of legal claims.
If you are not a party to a Contract with us and you do not represent/work for an organization that has concluded a contract with the Association, the processing specified in this item 1 could be:
– on the grounds “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation, or
– based on “legitimate interest”, which consists in carrying out the objectives of the Association and/or carrying out activities that it has the right to carry out, or
– on the grounds “for the performance of a task of public interest or in the exercise of official powers that have been granted to the administrator”.
2. Exercising rights within the meaning of Regulation (EU) 2016/679 before the Association, in its capacity as a personal data administrator; consideration of received signals, objections, complaints, carrying out inspections, and providing feedback. In these cases, we process the data:
– on the grounds “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation, or
– based on “legitimate interest”, as the legitimate interests consist in taking care of the organization of the Association’s activities and/or complying with the Association’s founding act/statutes, resp. other documents accepted by its authorities, or
– on the grounds “for the performance of a task of public interest or in the exercise of official powers that have been granted to the administrator”.
3. When you are a visitor/user of our website www.centreactiveyouth.org:
a) Automatically collected information: You may access the website without entering personal data. But even in this case, certain information is automatically processed – log files /event files/.
We process log files /event files/based on “legitimate interest”, the purposes being security, technical support and/or prevention/detection of violations/crimes.
b) Social plugins or buttons /Social Plug-in/ Facebook, Instagram and/or others. Their use is at your discretion. They represent a link to third-party websites that collect and process personal data according to their terms/policies. For your information and rights, please familiarize yourself with the terms/policies of the relevant third parties.
We have placed these plugins/buttons to make our website more functional for visitors and also to promote our business if you voluntarily share our content on relevant websites. We accept this as our “legitimate interest” and accordingly apply the “legitimate interest” basis for data processing under this letter b). More information about the social plugins used can be found here.
c) Other links to third-party websites.
Our website may also link to other websites. If you choose to follow these links, please read the privacy policies of the respective websites in detail to understand how your information will be handled. The use of these links on our website is based on our “legitimate interest” in making the website more functional for visitors, as well as our and the relevant third party’s “legitimate interest” in developing our business.
d) Personal data that you provide to us through the website.
When you use the contact form on our website (if one is available at the relevant time) or another of our services on the website, we process the personal data for the purpose for which you provide it to us, i.e. according to the specific function and your request. The required fields that we have provided (if any) are the minimum information that we have determined that we need. Please do not provide us with personal information about you that is not necessary for the relevant purpose. We also process information that is created given our interaction, for example, the content of messages sent through the website.
There are cases where we process your data on the so-called pre-contractual ground (ground “for taking steps at the request of the data subject before entering into a contract”). We apply this basis in all cases in which you request to enter into a contract with us and we process your necessary data for this purpose. In other cases, there may be a concluded contract between us and the processing of your personal data through the website is in connection with the performance of our contractual obligation (ground “for the performance of a contract to which the data subject is a party”).
In the cases under Art. 6 of the Electronic Document and Electronic Authentication Services Act (e.g. when you send a message through our website), we store information about the time and source of the transmitted electronic statements for a period of one year. We do this on the grounds “to comply with a legal obligation that applies to the Association. The aim is to comply with the relevant legal obligations.
In other cases (for which no other reason is specified in this letter “d)”), the reason for processing your data is our “legitimate interest” to respond to/fulfill your request and/or to fulfill a contract concluded between the Association and a third party person and/or “for the performance of a task in the public interest or in the exercise of official powers which have been conferred on the controller”.
e) Sensitive data about you /special categories of data/.
Special categories of data, or “sensitive data”, are personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the sole purpose of identifying a natural person, data on the state of health or data on the sex life or sexual orientation of the natural person. Please do not provide us with such data if we have not asked you to do so. Providing such data and other personal data that is not necessary for the relevant purpose of our interaction with you exposes your data to unnecessary risk.
4. If you are a visitor to our office:
In this case, we will ask you to introduce yourself and provide us with basic information about yourself /your first, last and middle names, and the organization you work for or represent/. We may also reflect on the day you visited us, possibly the specific time, as well as information about the persons you met.
We will use the information received based on our “legitimate interests”. We process the information to control access to our office and for security reasons. We could also use the information to report/control the activities of the Association, as well as the activities of the Association’s bodies and the persons working for it (including employees).
5. If you are a participant in an event (conference, presentation, cocktail, meeting, forum and other events) that we organize and/or in which we participate:
We will collect the necessary information for your involvement and participation. Sometimes we may ask for information about your preferences to make the event more enjoyable and/or useful.
We will collect the necessary information for your involvement and participation. Sometimes we may ask for information about your preferences to make the event more enjoyable and/or useful.
In some cases, audio, video, audio-video recordings and/or photographs may be taken in connection with the events (eg during the events themselves). We may use such photos/recordings as well as information about your participation to promote our event in the media, on social networks, on our website, in a presentation and/or otherwise. When publishing recordings/photos with you on a social network and/or on our website, it is possible to indicate persons participating in the event, for example through a tag function. If the making, storage and/or use of audio, video, audio-video recordings and/or photographs of you are of concern to you, you may inform us in advance (for example, that you do not wish us to publish information about you and/or that you do not you want us to publish recordings/photos of you) and we will consider how to proceed on a case-by-case basis.
We may also retain your details to contact you from time to time and send you information about other similar events of ours. We may also ask you for feedback on how you rate our event, to analyze, plan and/or improve our operations.
We carry out the data processing activities described in this point 7. based on our “legitimate interests” to fulfill the purposes specified in this point, or on the basis “for the performance of a task in the public interest or in the exercise of official powers that have been granted to the administrator”.
You have the right to object to the above ways of using your data as described below concerning your rights.
6. If you are a participant in our campaign.
We could organize such campaigns, for example through our social network profiles. In these cases, we will process the information you provide to us for your participation in the relevant campaign, based on our “legitimate interest” in running the relevant campaign or on the basis “for the performance of a task in the public interest or in the exercise of official powers which are provided to the administrator’.
7. Blogs, Forums and Social Media.
You may wish to participate in various blogs, forums and social media. Any personal data or other information you share therein is accessible to third parties and may be read, collected and used by other users over whom we have little or no control. We recommend that you review the privacy statement of each third-party site linked to our site to determine how they use your personal information.
If you have “liked” and/or “followed” our profile/page on a social network, following the practices of the relevant social network, you may automatically see messages, posts and/or materials published by us. If you make an inquiry to us through the relevant social network or comment on a publication, we may use the functionalities of the same network to respond to you, and if you have requested that we contact you in another way /for example, by giving us your phone number/, we will try to comply with your wish.
We will process data under item 7. based on our “legitimate interests” to promote/improve our activity and/or to respond to you.
8. If you are a person we contact in connection with contractual relations of the Association:
This means that you are, for example, a donor, beneficiary, beneficiary, partner or supplier related to the Association or you represent/work for an organization that is a donor, beneficiary, beneficiary, partner or supplier related to the Association. For example, the Association could be a party to contracts for financing, donation, purchase of materials, assignment of work, cooperation, publishing, sale and resale of literary publications, as well as to contracts regarding objects of intellectual property. To maintain our business relationship, we will often need information about you, for example: Your first, last and middle names, telephone, e-mail addresses, and information about your position in the relevant organization. We may also process the following information: written/electronic or other correspondence with you; data contained in documentation relating to our relationship, for example, your signatures, description of your conduct, your statements, etc.; data related to payments, accounting and tax obligations; any other information we need in connection with the contractual relations of the Association.
If you are a party with a Contract with us:
– to fulfill our obligations under the Contract with you, we will process the information on the basis “for the performance of a contract to which the data subject is a party”.
– we will process information on the basis “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation (e.g. according to tax/accounting legislation);
– we could process your data on the grounds “for the performance of a task of public interest or in the exercise of official powers granted to the administrator”;
– the rest of the processing activities will be carried out based on our “legitimate interests” to seek/report the performance of the contract between us and to possibly establish, exercise or defend legal claims.
If you represent/work for an organization that has entered into a contract with the Association:
– we will process information on the basis “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation (e.g. according to tax/accounting legislation);
– we could process your data on the grounds “for the performance of a task of public interest or in the exercise of official powers granted to the administrator”;
– the rest of the processing activities will be carried out based on our “legitimate interests” to perform and seek/report the performance of the contract and with a view to the possible establishment, exercise or defense of legal claims.
9. If you are a person with whom we contact in connection with the possible conclusion of a contract:
This means that you are, for example, a potential donor, beneficiary, beneficiary, partner or supplier related to the Association or you represent/work for an organization that is a potential donor, beneficiary, beneficiary, partner or supplier related to the Association. We may have your information from a professional public register, from a person you have worked with or know for other reasons, if you have given us your business card or contacts at an event, meeting or otherwise. In these cases, we will assess what purpose and on what basis we could use your contact details. We will take into account the context in which we received your data, as well as your reasonable expectations regarding the Association’s use of your data.
If we consider that there is a “legitimate interest” basis for us to contact you in order to communicate in connection with a possible future contractual relationship with the Association, you will have the right to object to such use of your data as described below regarding your rights. If you wish to enter into a contract with us, we will process your necessary data for this purpose on the basis “to take steps at the request of the data subject before entering into a contract” (this does not apply if the contract will be with an organization that you represent/for whom you work – in such a case, the “legitimate interest” basis applies according to the previous sentence). We may need to ask for your consent, and if you give it, we will process your data based on ‘consent’. In some cases, we may process your data on the basis “for the performance of a task in the public interest or in the exercise of official powers that have been granted to the controller”.
10. In other cases (outside of those mentioned above in this section IV), if you are a person we contact in connection with the realization of the objectives of the Association
The purpose of such data processing is to achieve the objectives of the Association and/or to carry out activities that it has the right to carry out. We could process data, for example, of members of other non-profit organizations, members of their bodies, members of working groups created by us, as well as individuals working in various institutions/authorities.
The aforementioned processing could be:
– on the grounds “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation, or
– based on “legitimate interest”, which consists in carrying out the objectives of the Association and/or carrying out activities that it has the right to carry out, or
– on the grounds “for the performance of a task of public interest or in the exercise of official powers that have been granted to the administrator”.
11. If you want to become a body/member of a body of the Association:
If you have expressed a desire for such a purpose, we will collect the data necessary for this, according to the founding act/statutes of the Association, other documents adopted by its bodies, and the applicable legislation. The aforementioned processing could be:
– on the grounds “for compliance with a legal obligation that applies to the Association when there is a corresponding legal obligation, or
– based on “legitimate interest”, as the legitimate interests consist in taking care of the organization of the Association’s activities and/or complying with the Association’s founding act/statutes, resp. other documents accepted by its authorities, or
– on the grounds “for the performance of a task of public interest or in the exercise of official powers that have been granted to the administrator”.
12. For what other purposes may we use your personal data?
We have described the most typical purposes for their processing above, but you should also consider the following purposes:
– for administration of our activity, including reporting and analysis within the Association itself;
– we apply the grounds of our “legitimate interest” or “for the performance of a task of public interest or in the exercise of official powers that have been granted to the controller”;
– prevention of fraud and other illegal activities – we apply the grounds of our “legitimate interest” or “for the performance of a task of public interest or in the exercise of official powers that have been granted to the administrator”;
– to establish, exercise and/or defend our legal claims – we apply the basis of our “legitimate interest”;
– to fulfill our obligations under a contract to which you are not a party – we apply the basis of our “legitimate interest”;
– to analyze the effectiveness of our activity and its improvement – we apply the basis of our “legitimate interest”;
– for the performance of our obligations under a contract to which you are a party – we apply the basis “for the performance of a contract to which the data subject is a party”;
– to fulfill our obligations applicable by law (e.g. under accounting legislation, tax legislation, etc.) – we apply the grounds “for compliance with a legal obligation that applies to the Association or “for the performance of a task of public interest or in the exercise of official powers which have been granted to the administrator’.
V. Legal basis for processing personal data
For the processing of your data, we apply legal grounds according to the Regulation.
1. For compliance with a legal obligation that applies to the Association (Article 6, paragraph 1, letter c) of the Regulation)
These are the cases in which the processing of your personal data is necessary to comply with our legal obligation under tax legislation, accounting legislation, etc.
2. Legitimate interest (Article 6, paragraph 1, letter f) of the Regulation)
When we define our legal basis as a “legitimate interest”, we first assess what it is and whether the processing of your data is necessary to achieve it. We also assess whether your interests or fundamental rights and freedoms that require the protection of personal data take precedence over them. Regardless of our discretion, you always have the right to object to processing based on our legitimate interests, as described below in section XII, item 4.
When we process your data based on “legitimate interest”, the description of the legitimate interest matches the description of the purpose of the data processing.
3. For the performance of a contract to which the data subject is a party (Article 6, paragraph 1, letter b, hypothesis one of the Regulation)
This can be applied when you (as an individual) are a party to a contract with the Association.
4. to take steps at the request of the data subject before the conclusion of a contract (Article 6, paragraph 1, letter b, hypothesis two of the Regulation)
This can be applied when, at your request, steps are taken before entering into a contract with you (as a natural person).
5. Your consent (Article 6, paragraph 1, letter a) of the Regulation)
This is any freely expressed, specific, informed and unequivocal indication of your will, by a statement or a clear affirmative action, which expresses your consent to the processing of personal data relating to you.
If we have to process your “sensitive data” (more information about them can be found in section IV, item 3, letter e) above) based on your consent, the same should also be explicitly given. In section XII, item 7, you will find out how you can withdraw your consent at any time.
Note that consent is a different legal basis than those described above. For example, signing a contract between us is not equivalent to giving consent.
6. For the performance of a task of public interest or in the exercise of official powers granted to the administrator (Article 6, paragraph 1, letter e) of the Regulation)
In some cases, our personal data processing activities are also based on the need to perform tasks in the public interest or the exercise of official powers granted to the administrator.
If you have concerns or doubts about what exactly is the applicable basis for a specific purpose of processing your data, you can always contact us.
VI. Are you obliged to provide the Association with personal data and the possible consequences, if the data is not provided:
In general, you are not obliged to provide us with personal data (you are only obliged to do so if you have such a contractual or legal obligation). In some cases, the provision of some of your personal data is a legal requirement (for example under tax legislation) and/or a requirement necessary for the conclusion of a contract (in this case, we will notify you). If you do not provide us with certain personal data, we may not be able to enter into or perform a contract with you or the child, or we may not be able to fulfill any of our other purposes for processing the data.
VII. Combining information. Receiving data from other sources
Sometimes we combine information about you that we receive from you through different communication channels / for example, by email, phone, through our website / or from other sources – public sources, such as the Trade Register, the Register of Non-Profit Legal Entities and the BULSTAT register or from third parties – e.g. our partners with whom you interact in connection with your relationship with us. When we combine this information, we do not use it for a purpose for which you have not been informed. When we receive information from sources other than yourself, this information is limited to what is necessary and related to the purposes for which it is processed.
VIII. Principles in the collection and processing of personal data:
The association respects the following principles when processing your personal data, as well as your child’s data:
• legality, goodwill and transparency;
• limitation of processing purposes;
• relevance for the processing and minimization of the processed data;
• accuracy and timeliness of the data;
• personal data are not used for profiling;
• personal data is not used for direct marketing;
• limiting storage to meet targets;
• integrity and confidentiality of personal data and ensuring an appropriate level of personal data security;
• responsibility.
IX. Submission of your personal data and the data of children for processing:
The Association may, at its discretion, provide your personal data, as well as the personal data of children, to third parties in connection with the organization and implementation of educational and creative events and/or projects organized by the Association – external consultants and service providers, committee members, workers/employees of the Association, partners of the Association in joint initiatives, bodies, organizations and persons with whom we cooperate in organizing/implementing Activities (for example, we receive funds from them), such as the NATIONAL AGENCY CENTER FOR DEVELOPMENT OF HUMAN RESOURCES, with headquarters and management address Sofia 1000, st. “Graf Ignatiev” no. 15, floor 4, entered in the BULSTAT register: 130047747, state and local authorities.
In addition, we may hand over personal data to accountants, lawyers, advertising agencies, banks – for the needs of making payments of monetary prizes, co-organizers of events and other activities in which the person will participate, courier companies and postal operators – for the needs of carrying out of correspondence with natural persons-data subjects, insurers, places of accommodation, persons/organizations carrying out transport. We may be required to share your personal data with service providers, such as hosting companies, information technology service providers (IT services), system administration, mobile operators, and social networks.
During the implementation of the Erasmus+ Program, data may be transferred to the European Commission, which is the administrator of personal data.
The data can also be provided to state and/or municipal authorities, for example, when legal obligations are to be fulfilled and/or checks are carried out by these authorities (including the National Revenue Agency, State Agency for National Security, Commission for Personal Data Protection, prosecutor’s office, courts, etc. state/municipal authorities) and/or given the implementation of the objectives of the Association, as well as in other cases according to the applicable legislation.
In cases of publication of your data (including those contained in recordings, videos, etc.) on our website and/or in a social network, the data will become publicly available (related to social networks – as far as this corresponds to the relevant functionalities/settings). In cases of publication of your data in a social network, the recipient of the data is also the administrator of personal data in the respective social network.
All recipients are legally and/or contractually obliged to maintain the confidentiality and security of all your personal information and personal data.
X. International data transfer
The use of the platforms/tools/services of Google LLC (eg Gmail) and/or Meta Platforms Ireland Ltd. (eg the social network Facebook, the Messenger service) could be related to the transfer of data outside the European Union (EU) and the European Economic Area (EEA). Such transfers of data are based on decisions regarding an adequate level of protection, standard contractual clauses, as well as possibly on your express consent (according to article 49, paragraph 1, letter a) of the Regulation) and/or on another basis, if indicated in The privacy policies of these platforms/tools/services. For more information on this, you should read the relevant Privacy Policies (for Meta Platforms Ireland Ltd. – please visit https://www.facebook.com/privacy/explanation; for Google LLC – please visit https://policies. google.com/privacy?hl=bg), and you can also contact us for help using the contact details indicated in section I of this Notice.
In all other cases, personal data are not transferred to third countries (countries that are not members of the European Union and are not parties to the agreement on the European Economic Area) and are not transferred to international organizations.
XI. Term for storage of personal data
As a data administrator within the meaning of the Regulation, the Association processes your personal data, as well as the personal data of your children for a period of minimum duration according to the purposes of processing and provided for in the current legislation by the principle of storage limitation.
To determine an appropriate retention period for personal data, we take into account the amount, nature and sensitivity of the personal data, the potential risk of value from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve purposes through other means, as well as comply with applicable legal requirements. We will comply with applicable laws and statutes of limitations for repayment of obligations (private and public obligations).
In most cases, we will store your data for a period of 6 (six) years, excluding the termination of our relationship with you.
However, please note that some personal data could be deleted earlier – for example when withdrawing your consent; if the law obliges us to delete/back up data; when we have notified you that we will store certain information for a shorter period, or if we have overestimated that we do not need the given personal data for the purposes determined by us.
The association stores the personal data that it is necessary to keep under the applicable legislation for the relevant period provided for in the legislation, which may exceed the period indicated above.
In the cases under Art. 6 of the Electronic Document and Electronic Authentication Services Act (e.g. when you send a message through the contact form on our website), we store information about the time and source of the submitted electronic statements for a period of one year.
After the expiry of the period indicated above, the Association takes the necessary actions to delete and destroy all your data, as well as the data of the children, without unnecessary delay.
In some circumstances, we may anonymize your personal data for research or statistical purposes, in which case we may use this information for an unlimited period without further notice to you.
XII. Exercise of rights under the Regulation:
Under the law, You have certain rights, including (but not limited to) You have the right to:
1. Request access to your personal data. You have the right to receive confirmation as to whether personal data related to you are being processed. If this is the case, you have the right to access the data and certain information related to its processing, as well as the right to receive a copy of this data.
2. Request correction of your personal data. You can request from us the correction of incorrect personal data related to you and/or the completion of incomplete personal data related to you (taking into account the purposes of the processing).
3. Request deletion of your personal data. This allows you to ask us to delete/remove your personal data when there is no valid reason to continue processing it. You have the right to ask us to delete or remove your personal information also in the case where you have exercised your right to object to the processing (see below).
4. Objections to the processing of your personal data. You have the right, at any time and on grounds relating to your specific situation, to object to the processing of your personal data based on “legitimate interest” or “for the performance of a task in the public interest or in the exercise of official powers that have been granted of the administrator”, including in cases of profiling on any of these grounds. To continue the processing, we must prove that there are compelling legitimate grounds for the processing that take precedence over your interests, rights and freedoms, or for the establishment, exercise, or defense of legal claims.
In addition, you have the right to object in the following cases:
– You have the right at any time to object to the processing of personal data concerning you when we process them for direct marketing purposes, including in cases of profiling related to direct marketing. When you object to processing for the purposes of direct marketing, the processing of personal data for these purposes is terminated.
– When personal data are processed for the purposes of scientific or historical research or statistical purposes, you have the right, based on your specific situation, to object to the processing of personal data concerning you, unless the processing is necessary for the implementation of a task carried out for reasons of public interest.
5. Request restriction of the processing of your personal data. This allows you to ask us to prepare the processing (with the exception of certain post-processing actions provided for in the applicable legislation) of personal information about you, in the following cases:
– the accuracy of the personal data is contested by you, as the limitation of the processing is applied for a period that allows us to check the accuracy of the personal data;
– the processing is unlawful, but you do not want the personal data to be deleted, and you request instead the limitation of their use;
– we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims;
– You have objected to the processing according to Article 21, paragraph 1 of the Regulation pending verification of whether the legitimate grounds we apply take precedence over your interests.
6. Exercise the right to portability of your personal data. If we process personal data based on the “performance of a contract to which the data subject is a party” or based on “consent”, you may require us to receive the personal data in a structured, widely used and machine-readable format and/or to hand over personal data to another personal data administrator. The right to portability does not apply to the processing necessary for the performance of a task of public interest or in the exercise of official powers granted to the administrator.
7. Withdraw your consent – in case we process personal data based on your consent or express consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent, before it is withdrawn.
You can see more about the above rights on the website of the Commission for Personal Data Protection: https://www.cpdp.bg/?p=elementaid=1045.
In cases of processing personal data of a child:
– Their parent/guardian can exercise his right instead of them and on their behalf – if the child has not reached the age of 14;
– The child can exercise their right with the consent of his parents or guardians – if the child is between 14 and 18 years old.
You can make your requests to us and exercise your rights, related to personal data, at the address: city of Burgas, CP. 8000, st. “Aleksandar Veliki” № 68, fl.1, apartment 2, or at our email address [email protected]. We will take all necessary steps, and without undue delay, to assess whether your specific request complies with the legislation and respond appropriately to your request.
If you decide to exercise any of your rights, please contact us at the indicated email, so that we can send you a form for the exercise of the corresponding right, or you can address the request for the exercise of a given right, provided for in the Regulation, with a free text request.
12. Automated processing, including profiling:
The association does not make automated decisions with your personal data, as well as with the personal data of the children.
XIII. Right to appeal to a supervisory authority:
You have the right to complain to the competent supervisory authority. In Bulgaria, this is the Commission for the Protection of Personal Data, with correspondence details: c. Sofia 1592, Blvd. “Prof. Cvetan Lazarov” № 2, phone: 02 915 3 555; e-mail: [email protected], website: www.cpdp.bg.
Date of last update of this Notice: September 1, 2024.