1. 🏠»
  2. Personal data protection policy»

Personal data protection policy

Below we will introduce you to the Personal Data Protection Policy of V-TAC Ruse EOOD for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons in connection with the processing of personal data, in the services provided to customers of V-TAC Ruse EOOD.

What is the “General Data Protection Regulation”

GDPR (General Data Protection Regulation) or General Data Protection Regulation (EU 2016/679) of the European Parliament and of the Council of the European Union, is a European regulation valid for all member countries, including Bulgaria, regarding the processing of personal data.

Basic information

Personal data protection and data protection are two rights enshrined in the Treaties of the European Union and the EU Charter of Fundamental Rights. The Charter contains an explicit right to the protection of personal data (Article 8) and at the same time the Treaty on the Functioning of the European Union (TFEU) obliges the EU to establish rules for the protection of Personal Data when processing them. The European Union is unique in providing such an obligation in its constitution.

Why is a new regulation needed?

In order to respond to new changes due to rapid technological progress, as well as new digital channels and environments for business, in April 2016 the European Parliament adopted a new regulation: “General Data Protection Regulation (EU 2016/679) on European Parliament and the Council of the European Union”, which imposes new rules in the processing of personal data.

The Personal Data Protection Regulation (GDPR) is fully applicable throughout the European Union, including Bulgaria. From May 25, 2018, Bulgaria, within the framework of the issues left for regulation by each individual member state, can adapt the Regulation and implement measures to strengthen the already existing requirements for the protection of personal data. The GDPR is the most comprehensive and progressive data protection legislation in the world, updated in the most up-to-date way possible to deal with the effects of the digital age. The regulation also applies to companies or organizations not established in the EU, but which offer goods and services to natural persons in the EU or monitor their behavior, created new rights for people in the digital environment and several new and detailed obligations for cooperation between countries in and outside the European Union.

GDPR integrates security policies in the processing of personal data by organizations and companies. At the same time, the risk assessment for the relevant types of personal data is required to take into account the level of technological development and the application of technical measures that guarantee their protection.

Legality of personal data processing

The processing of personal data is lawful only if it is applicable to at least one of the following conditions: the data subject has given consent to the processing of his personal data, the processing is necessary for the performance of a contract to which the data subject is a party; the processing is necessary for compliance with a legal obligation that applies to the controller; the processing is necessary to protect the vital interests of the data subject or another natural person; the processing is necessary for the performance of a task of public interest or in the exercise of official powers that have been granted to the controller; processing is necessary for the purposes of the controller’s legitimate interests.

At V-TAC Ruse EOOD, the collection and processing of personal data is carried out on the basis of legitimate interests and as a necessary condition for the performance of a product or service requested by you. Data subjects are provided with access to the privacy policies relating to the activities concerning them, for the needs of which personal data are collected and processed, where information relating to the processing of the data is presented in a concise, transparent, comprehensible and easily accessible form, in clear and simple language. The information is provided in writing and by electronic means. Data subjects declare that they are aware of the privacy policy as well as their rights regarding the personal data provided.

We at V-TAC Ruse EOOD, by means of a set of internal documents, define clearly and precisely the rules for the behavior of the employees of the organization, regarding the measures for the protection of personal data. We undertake to use the prescribed good practices in the collection, processing, storage and portability defined in REGULATION (EU) 2016/679.

The Company’s management strictly monitors the implementation of the REGULATION, taking into account the specific characteristics of its employees who process personal data, as well as the characteristics of service users. The REGULATION applies to the processing of personal data partially by automatic means, as well as to the processing by other means that are part of personal data registers or are intended to form part of another register.

The GDPR applies to the processing of personal data in the context of the organization’s activities, the establishment of the controller or processor of personal data in the organization, regardless of whether the processing takes place in it or not.

Provision of personal data related to various types of services for customers of V-TAC Ruse EOOD

When processing information provided by data subjects, we rely on the basis of “legitimate interest”, ensuring a fair balance between legitimate interests and the rights of service users. We most commonly collect and process identification data such as:

Three names, if necessary;

Address, if necessary;

Contact information (personal email address, home and/or mobile phone number, work phone number, work email address), if necessary;

Other data provided by information service providers.

Only the persons designated by the management have access to the files for processing personal data. Protection against internal and external unauthorized access is provided.

DEFINITIONS

We comply with the following definitions set out in the regulation:

“personal data” – any information related to an identified natural or legal person that can be identified

“data subject” – a person who can be identified, directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier

“processing” – any operation or set of operations performed on personal data or a set of personal data by automatic or other means such as collection, recording, organization, structuring, storage

“restriction of processing” – marking stored personal data in order to limit their processing in the future

“profiling” – any form of automated processing of personal data consisting in the use of personal data to assess certain personal aspects related to a natural person

“pseudonymization” – the processing of personal data in such a way that it can no longer be associated with a specific data subject without the use of additional information, provided that it is stored separately

“personal data register” – any structured set of personal data that is accessed according to criteria, regardless of whether it is centralized, decentralized

“administrator” – a natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data

“personal data processor” – a natural or legal person who processes personal data on behalf of the controller

“recipient” – a natural or legal person, public body, agency or other structure to which the personal data is disclosed, regardless of whether it is a third party or not. At the same time, public authorities that may receive personal data within the framework of a specific investigation in accordance with Union law or the law of a Member State are not considered “recipients”; the processing of this data by the specified public authorities complies with the applicable data protection rules in accordance with the purposes of the processing

“consent of the data subject” – any freely expressed, specific indication of the will of the data subject, by means of a statement expressing his consent to the personal data relating to him being processed

“third party” – a natural or legal person, public body, agency or other body other than the data subject, the controller, the personal data processor and the persons who, under the direct supervision of the controller or the personal data processor, have the right to process the personal data

“personal data security breach” – a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that is transmitted, stored or otherwise processed

“genetic data” – personal data relating to the inherited or acquired genetic markers of a natural person, which provide unique information about the distinctive features or health of that natural person and which are obtained, in particular, from the analysis of a biological sample of the natural person in question face

“biometric data” – personal data obtained as a result of specific technical processing, which is related to the physical, physiological or behavioral characteristics of a natural person and which allows or confirms the unique identification of that natural person, such as facial images or dactyloscopic data

“health data” – personal data related to the physical or mental health of an individual, including the provision of health services that provide information about his health

“representative” – ​​a natural or legal person established in the Union who, appointed by the controller or processor in writing pursuant to Article 27, represents the controller or processor in relation to their respective obligations under this Regulation

“company” – a natural or legal person that carries out economic activity, regardless of its legal form, including partnerships or associations that regularly carry out economic activity

“mandatory company rules” – personal data protection policies that are observed by a controller or processor of personal data established in the territory of a Member State, when transferring or a set of transfers of personal data to a controller or processor of personal data in one or more third parties countries within a group of enterprises or a group of companies involved in joint economic activity

“supervisory authority” – means an independent public authority established by a Member State pursuant to Article 51 of the Regulation

“affected supervisory authority” – a supervisory authority that is affected by the processing of personal data because:

a) the administrator or personal data processor is established in the territory of the member state of this supervisory authority;

b) data subjects domiciled in the Member State of that supervisory authority are materially affected or are likely to be materially affected by the processing; or

c) a complaint has been submitted to this supervisory authority;

PRINCIPLES

When processing personal data, V-TAC Ruse EOOD undertakes to comply with the following principles laid down in the Regulation:

Legality; Good faith; Transparency – Personal data is processed lawfully, in good faith and in a transparent manner with respect to the data subject

Purpose limitation – Collected for specific, explicitly specified and legitimate purposes and not further processed in a manner incompatible with these purposes; further processing for archiving purposes in the public interest, for scientific or historical research or for statistical purposes is not considered incompatible with the original purposes

Accuracy – Data is accurate and, if necessary, kept up-to-date; all reasonable measures must be taken to ensure the timely deletion or correction of inaccurate personal data, taking into account the purposes for which it is processed

Limitation of what is stored – They are stored in a form that allows the identification of the data subject for a period no longer than is necessary for the purposes for which the personal data are processed; Personal data may be stored for longer periods, insofar as they will be processed solely for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, provided that the appropriate technical and organizational measures provided for in this REGULATION are applied in order to guarantee the rights and freedoms of the data subject

Integrity and confidentiality – Processed in a way that ensures an appropriate level of security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures

Accountability – The administrator is responsible and must be able to demonstrate compliance

Lawfulness of processing

Processing is lawful only if it is applicable to at least one of the following conditions:

the data subject has consented to the processing of his personal data;
the processing is necessary for the performance of a contract to which the data subject is a party;
the processing is necessary for compliance with a legal obligation that applies to the controller;
the processing is necessary to protect the vital interests of the data subject or another natural person;
the processing is necessary for the performance of a task of public interest or in the exercise of official powers that have been granted to the controller;
processing is necessary for the purposes of the controller’s legitimate interests.

We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners.
Cookies settings
Accept
Privacy & Cookie policy
Privacy & Cookies policy
Cookies list
Cookie name Active

Privacy Policy

What information do we collect?

We collect information from you when you register on our site or place an order. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address or mailing address.

What do we use your information for?

Any of the information we collect from you may be used in one of the following ways: To personalize your experience (your information helps us to better respond to your individual needs) To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you) To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs) To process transactions Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested. To administer a contest, promotion, survey or other site feature To send periodic emails The email address you provide for order processing, will only be used to send you information and updates pertaining to your order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to?keep the information confidential. After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be kept on file for more than 60 days.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computers hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, keep track of advertisements and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business. If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders by contacting customer service. Google Analytics We use Google Analytics on our sites for anonymous reporting of site usage and for advertising on the site. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (https://tools.google.com/dlpage/gaoptout/)

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Registration

The minimum information we need to register you is your name, email address and a password. We will ask you more questions for different services, including sales promotions. Unless we say otherwise, you have to answer all the registration questions. We may also ask some other, voluntary questions during registration for certain services (for example, professional networks) so we can gain a clearer understanding of who you are. This also allows us to personalise services for you. To assist us in our marketing, in addition to the data that you provide to us if you register, we may also obtain data from trusted third parties to help us understand what you might be interested in. This ‘profiling’ information is produced from a variety of sources, including publicly available data (such as the electoral roll) or from sources such as surveys and polls where you have given your permission for your data to be shared. You can choose not to have such data shared with the Guardian from these sources by logging into your account and changing the settings in the privacy section. After you have registered, and with your permission, we may send you emails we think may interest you. Newsletters may be personalised based on what you have been reading on theguardian.com. At any time you can decide not to receive these emails and will be able to ‘unsubscribe’. Logging in using social networking credentials If you log-in to our sites using a Facebook log-in, you are granting permission to Facebook to share your user details with us. This will include your name, email address, date of birth and location which will then be used to form a Guardian identity. You can also use your picture from Facebook as part of your profile. This will also allow us and Facebook to share your, networks, user ID and any other information you choose to share according to your Facebook account settings. If you remove the Guardian app from your Facebook settings, we will no longer have access to this information. If you log-in to our sites using a Google log-in, you grant permission to Google to share your user details with us. This will include your name, email address, date of birth, sex and location which we will then use to form a Guardian identity. You may use your picture from Google as part of your profile. This also allows us to share your networks, user ID and any other information you choose to share according to your Google account settings. If you remove the Guardian from your Google settings, we will no longer have access to this information. If you log-in to our sites using a twitter log-in, we receive your avatar (the small picture that appears next to your tweets) and twitter username.

Children’s Online Privacy Protection Act Compliance

We are in compliance with the requirements of COPPA (Childrens Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our website, products and services are all directed to people who are at least 13 years old or older.

Updating your personal information

We offer a ‘My details’ page (also known as Dashboard), where you can update your personal information at any time, and change your marketing preferences. You can get to this page from most pages on the site – simply click on the ‘My details’ link at the top of the screen when you are signed in.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our website and not to information collected offline.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.
Save settings
Cookies settings