GDPR policy

General Information

As of 25 May 2018, a new regulation for the protection of personal data (General Data Protection Regulation) entered into force, adopted by the European Union in 2016. The Regulation aims to guarantee the protection of the data of natural persons from all EU Member States and to harmonize the regulations for their processing.

In its capacity as a personal data controller, the Association “SOUTHEAST DIGITAL INNOVATION HUB”, owner of the website https://www.digihub.bg/, complies with all the requirements of the new regulation, collecting only data of individuals to the extent necessary for the provision of the service, and storing it responsibly and lawfully, in accordance with all regulatory requirements.

Information Regarding the Personal Data Controller

1. Name: Association “SOUTHEAST DIGITAL INNOVATION HUB”
2. UIC/BULSTAT: 206045043
3. Registered office and management address: city of Burgas, PC 8000, 28 Knyaz Alexander Battenberg Blvd.
4. Address for conducting business: city of Burgas, PC 8000, 28 Knyaz Alexander Battenberg Blvd.
5. Correspondence details: city of Burgas, PC 8000, 28 Knyaz Alexander Battenberg Blvd.
6. E-mail: info@digihub.bg
7. Phone: (+359)890 962 222

Information Regarding the Data Protection Officer

1. Address: city of Burgas, 28 Knyaz Alexander Battenberg Blvd.
2. Email address: info@digihub.bg
3. Contact phone: (+359)890 962 222

Information Regarding the Competent Supervisory Authority

1. Name: Commission for Personal Data Protection
2. Registered office and management address: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
3. Correspondence details: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
4. Phone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: www.cpdp.bg

The Association “SOUTHEAST DIGITAL INNOVATION HUB” carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This document – the Personal Data Policy – is intended to regulate the relations in the processing of personal data between the Association “SOUTHEAST DIGITAL INNOVATION HUB”, hereinafter referred to as the PROVIDER, owner of the website https://digihub.bg, hereinafter referred to as the WEBSITE, and each of the users, hereinafter referred to as USER(S) of the Website, in connection with its use.

Grounds for Collecting, Processing and Storing Your Personal Data

Art. 1. (1) The PROVIDER, through the website, processes your personal data in connection with its activities, namely – the provision of services supporting the digital transformation and innovation of enterprises and the conclusion of contracts with the association on the basis of Art. 6, para. 1, Regulation (EU) 2016/679, as well as in connection with inquiries made by you for the preparation and provision of a quote for any of the services offered by the Association “SOUTHEAST DIGITAL INNOVATION HUB”, and more specifically on the basis of the following:

• Explicit consent obtained from you as a user of the website;
• Performance of the obligations of the Association “SOUTHEAST DIGITAL INNOVATION HUB” under a contract with you;
• Compliance with a legal obligation applicable to the PROVIDER;
• For the purposes of the legitimate interest of the PROVIDER.

*** What constitutes the processing of personal data – this is any activity involving the collection, storage, destruction, archiving, deletion, restriction, or transfer of your personal data.

(2) The PROVIDER is a personal data controller with respect to your data as users of our services.

Purposes and Principles in the Collection, Processing and Storage of Personal Data

Art. 2. (1) The PROVIDER collects and processes the personal data that you provide to us in connection with the use of our services and for the conclusion of a contract, as well as for inquiries made for the preparation and provision of quotes, including for the following purposes:

• Creating a profile and ensuring full functionality in the provision of our services;
• Identification of a party to the contract;
• Preparation and provision of quotes;
• Accounting purposes;
• Statistical purposes;
• Protection of information security;
• Ensuring the performance of the contract for the provision of the respective service;
• Sending informational messages, messages about changes in the service, recommendations for improving the use of the platform, new services, etc.
• Improving and personalizing the service by offering suitable renewal offers, events and other products and services that may be of interest to you;
• Providing technical support;

(2) The PROVIDER observes the following principles when processing your personal data:

• Lawfulness, fairness and transparency;
• Purpose limitation of processing;
• Relevance to the purposes of processing and data minimization;
• Accuracy and currency of data;
• Storage limitation with regard to achieving the purposes;
• Integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

(3) In processing and storing personal data, the PROVIDER may process and store personal data in order to protect the following legitimate interests:

• Fulfillment of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
• Compliance with the rights and obligations of the parties under a concluded contract.

Types of Personal Data Collected, Processed and Stored by the PROVIDER

Art. 3. (1) The PROVIDER carries out the following operations with personal data for the following purposes:

• User registration on the website and performance of a contract for the provision of services provided by the PROVIDER – the purpose of this operation is to create a profile to be associated with the service used and to manage the content of the service through the created administrative panel, according to the user plan selected by you.
• Conclusion and performance of a commercial transaction with a user – the purpose of this operation is the conclusion and performance of a contract with the user and its administration;
• Sending informational messages – the purpose of this activity is the administration of the process of sending messages to users regarding improvements or changes to services, exceeded parameters, and expiring services, pursuant to the service provision contract.
• Sending a newsletter – the purpose of this operation is the administration of the process of sending newsletters to clients who have indicated that they wish to receive them;
• Preparation and sending of a quote – the purpose of this activity is the administration of the process of preparing and sending a quote based on an inquiry made.

(2) The PROVIDER processes the following categories of personal data and information for the following purposes and on the following grounds:

• Data: Your identifying data (first and last name, email address, company, phone number)
• Purpose for which the data is collected: 1) Registration of the user; 2) Establishing contact with the user and sending information to them, including upon expressed wish – for sending newsletters and promotional messages; for a prepared quote, for concluding a contract for the provision of services/development
• Grounds for processing your personal data – By accepting the general terms and conditions and registering on the website, or upon concluding a written contract, a contractual relationship is created between the PROVIDER and you, on the basis of which we process your personal data
• Additional data provided by you – If you wish to complete your profile.
• Purpose for which the data is collected: Supplementing information about the user in their user account.
• Grounds for processing your personal data – By accepting the general terms and conditions and registering on the website, or upon concluding a written contract, a contractual relationship is created between the PROVIDER and you, on the basis of which we process your personal data
• Other data processed by the PROVIDER – When accessing our website or your profile, the PROVIDER collects data about the IP address used.
• Your data for issuing an invoice to a natural person – If you wish to have an invoice issued to you as a natural person, you must provide your personal identification number (EGN).
• Purpose for which the data is collected: Issuing an invoice for payments under a concluded contract for the provision of services.
• Grounds for processing your personal data – By accepting the general terms and conditions and registering on the website, or upon concluding a written contract, a contractual relationship is created between the PROVIDER and you, on the basis of which we process your personal data

1. The PROVIDER does not collect or process the following categories and types of personal data:

• Personal data revealing racial or ethnic origin;
• Personal data revealing political, religious or philosophical beliefs, or trade union membership;
• Genetic and biometric data, health data or data concerning a person’s sex life or sexual orientation.

(4) The personal data has been collected by the PROVIDER from the persons to whom it relates.

Use of “Cookies”

General Provisions

“Cookies” are small text files that are stored on your computer when you visit our web page.

Retention Period of Your Personal Data

Art. 4. (1) The PROVIDER stores your personal data only to the extent and for as long as it is necessary for the respective activity for which they were provided, or as stipulated in a contract between the provider and the user, in compliance with the requirements and deadlines provided for in the Accounting Act, tax laws and other applicable legislation in force in the Republic of Bulgaria.

Data that has been provided to the PROVIDER for marketing purposes is retained until the user notifies the provider that they no longer wish to receive the respective information.

After achieving the purposes of processing, the users’ personal data is destroyed in due order.

Transfer of Your Personal Data for Processing

Art. 5. (1) The PROVIDER may, at its own discretion, transfer some or all of your personal data to data processors for the fulfillment of processing purposes in compliance with the requirements of Regulation (EU) 2016/679, such as service providers, subcontractors and others, solely for the purposes of performing tasks and providing services for the user on behalf of the PROVIDER.

(2) The PROVIDER notifies you in case of intention to transfer some or all of your personal data to third countries or international organizations.

Your Rights in the Collection, Processing and Storage of Your Personal Data

Withdrawal of Consent for Processing Your Personal Data

Art. 6. (1) If you do not wish all or part of your personal data to continue to be processed by the PROVIDER for a specific or all processing purposes, you may at any time withdraw your consent for processing by means of a request in free text, submitted in writing to the PROVIDER via the specified email address.

(2) The PROVIDER reserves the right to request that you verify your identity and that you are the person to whom the data relates.

Right of Access

Art. 7. (1) You have the right to request and receive from the PROVIDER confirmation as to whether personal data relating to you is being processed.

(2) You have the right to access the data relating to you, as well as the information pertaining to the collection, processing and storage of your personal data.

(3) The PROVIDER shall provide you, upon request, with a copy of the processed personal data relating to you, in electronic or other appropriate form.

(4) Access to the data is provided free of charge, but the PROVIDER reserves the right to impose an administrative fee in the case of repetitive or excessive requests.

Right to Rectification or Completion

Art. 8. You have the ability to rectify or complete inaccurate or incomplete personal data relating to you directly through your profile on the website or by submitting a request to the PROVIDER.

Right to Erasure (“Right to Be Forgotten”)

Art. 9.(1) You have the right to request from the PROVIDER the erasure of personal data relating to you, and the PROVIDER is obligated to erase them without undue delay when one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• You object to the processing of personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
• The personal data has been unlawfully processed;
• The personal data must be erased for compliance with a legal obligation under EU law or the law of a Member State applicable to the PROVIDER;

The erasure of personal data (“the right to be forgotten”) is carried out upon a written request submitted by you, verification of identity in person by presenting an identity document, in case the request is filed at the Company’s office, or through an authorized representative, duly and properly authorized with an explicit power of attorney with notarized signature. In case the request is submitted via email, the PROVIDER accepts that any request sent from the email with which the user is registered on the PROVIDER’s website is a legitimate one and originates from the person to whom that email address belongs.

(2) Pursuant to the General Data Protection Regulation, the PROVIDER is not obligated to erase personal data if it stores and processes them:

• For exercising the right of freedom of expression and the right to information;
• For compliance with a legal obligation which requires processing under EU law or the law of the Member State applicable to the Controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
• For reasons of public interest in the area of public health;
• For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
• For the establishment, exercise or defense of legal claims.

(3) The PROVIDER does not erase data that it is legally obligated to retain, including for defense against judicial claims brought against it or for proving its own rights.

Right to Restriction

Art. 10. Pursuant to the General Data Protection Regulation, you have the right to request the Association “SOUTHEAST DIGITAL INNOVATION HUB” to restrict the processing of data relating to you when:

• You contest the accuracy of the personal data, for a period enabling the PROVIDER to verify the accuracy of the personal data;
• The processing is unlawful, but you do not wish your personal data to be erased, and instead request the restriction of their use;
• The PROVIDER no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defense of your legal claims;
• You have objected to the processing pending verification of whether the legitimate grounds of the PROVIDER override your interests.

Right to Data Portability

Art. 11. You may request the PROVIDER to directly transfer your personal data to a controller designated by you, where technically feasible.

Right to Receive Information

Art. 12. You may request the PROVIDER to inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. The PROVIDER may refuse to provide this information if it would be impossible or require disproportionate effort.

Right to Object

Art. 13. You may object at any time to the processing of personal data by the PROVIDER relating to you, including if they are being processed for profiling or direct marketing purposes.

Your Rights in the Event of a Personal Data Security Breach

Art. 14. (1) If the PROVIDER identifies a breach of the security of your personal data that is likely to result in a high risk to your rights and freedoms, the PROVIDER shall notify you without undue delay of the breach, as well as of the measures that have been taken or are to be taken.

(2) The PROVIDER is not obligated to notify you if:

• The Company has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
• The Company has subsequently taken measures that ensure the breach is unlikely to result in a high risk to your rights;
• The notification would require disproportionate effort.

Persons to Whom Your Personal Data Is Provided

Art. 15. The Controller does not transfer your data to third countries.

Other Provisions

Art. 16. In the event of a violation of your rights under the above or the applicable personal data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

1. Name: Commission for Personal Data Protection
2. Registered office and management address: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
3. Correspondence details: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
4. Phone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: www.cpdp.bg

Art. 17. When you assign the PROVIDER to process the personal data of a third party for the purposes of using the service, the PROVIDER acts in the capacity of a data processor.

This personal data protection policy enters into force for users of the website as of 01.06.2020.