Privacy Policy of "Finance Tours" Ltd.
I. SUBJECT
This Privacy Policy, hereinafter referred to as the "Privacy Policy", provides information on the manner in which "Finance Tours" Ltd., hereinafter referred to as the "Provider", "Administrator", "we" and/or "us", owner/operator of the website: https://romantika-bg.com, hereinafter referred to as the "Website", processes (including, but not limited to, collects and stores) personal data of data subjects, such as users of the Website and the Provider's services, hereinafter referred to as the "User(s), "You" and/or "Your", as well as on the rights of the latter in this regard.
The term “personal data” used in the Privacy Policy has the meaning given to it in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “General Data Protection Regulation” and/or “GDPR”, namely: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Below you can find brief information about:
The Provider,
The Competent Supervisory Authority,
The legal basis on which we process personal data,
The purposes for which we use personal data,
Principles of personal data processing,
What personal data do we collect,
Period of storage of personal data,
Access to and transfer of personal data, and
The rights and guarantees that the GDPR provides to data subjects.
II. INFORMATION ABOUT THE PROVIDER
1. Name: "Finance Tours" Ltd., UIC 112662094
2. Registered office and address: 74 Svoboda Str., Sarnitsa
3. Tel.: +359 899981280, e-mail: reservations@romantika-bg.com
4. Registration in public registers: Commercial Register at the Registry Agency under the Ministry of the judiciary of the Republic of Bulgaria.
III. INFORMATION ABOUT THE COMPETENT SUPERVISORY AUTHORITY
1. Name: Personal Data Protection Commission of the Republic of Bulgaria
2. Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
3. Telephone: 02 915 3 518
4. E-mail: kzld@cpdp.bg
5. Website: https://www.cpdp.bg/
IV. GROUNDS FOR COLLECTING, PROCESSING AND STORAGE OF PERSONAL DATA
We process (including, but not limited to: collecting and storing) your personal data solely in connection with our activities and in accordance with the requirements of applicable legislation, including the Personal Data Protection Act of the Republic of Bulgaria and the General Data Protection Regulation.
We process your personal data on the basis of at least one of the following grounds:
User's consent to the processing of personal data;
The processing of personal data is necessary for the performance of the Provider's contractual obligations to the User;
The processing of personal data is necessary to take steps at the User's request prior to entering into a contract;
The processing of personal data is necessary for compliance with the Provider's legal obligations;
The processing of personal data is necessary for the purposes of the Provider's legitimate interests in carrying out its activities.
V. PURPOSES FOR COLLECTING, PROCESSING AND STORAGE OF PERSONAL DATA
We collect, process and store personal data of Users in connection with the implementation of the services provided by us and communication in connection with the use of the Website, as well as for the following purposes:
Communication and identification in the performance of a service contract and a purchase and sale contract (including in the performance of a relevant contract);
Communication, identification, processing and execution of inquiries made, orders placed, requests, reservations, purchases of goods or services (including preparation for concluding a contract, acceptance of orders, shipping of goods, solving problems related to cancellation of orders, reservations, return of purchased goods, refund of paid amounts and others);
Fulfillment of tax and other legal obligations;
Accounting purposes in connection with the use of our services;
Protection of our legitimate interests in connection with the fulfillment of our obligations to state and municipal authorities (e.g.: National Revenue Agency, Ministry of Interior);
Protection of our legitimate interests in connection with the storage of information for the purpose of protection against legal or tax claims and for the purpose of improving the presentation of the Website;
Protection of the information security of the Website;
Statistical information on the use of the Website;
Provision of advertising content in accordance with the interests of the User;
If a data subject refuses to provide us with some or all of the personal data that are necessary for the relevant purpose specified above, we may not be able to provide the relevant service (e.g. to perform a contract concluded with the relevant User) or to comply with the relevant legal requirements (e.g. to enable the data subject to exercise his or her rights under the GDPR).
VI. PRINCIPLES OF COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA
We adhere to the following principles when collecting, processing and storing your personal data:
lawfulness, good faith and transparency;
limitation of the purposes of processing;
limitation of the storage period in order to achieve the purposes for which the data are processed;
minimization of the data that are processed;
accuracy and timeliness of the data;
integrity and confidentiality of data processing and ensuring an appropriate level of security of personal data.
VII. PERSONAL DATA
We collect the following categories of personal data of Users for the following purposes and on the following grounds:
Your individualizing data (name and surname, telephone number and email address), as well as other data that you provide to us voluntarily, for the purposes of processing your inquiries, providing service offers and providing services on our part, upon your expressed wish, including communication with you in this regard, and on the basis of taking steps at your request for a possible conclusion of a contract, performance of a contract to which you are a party or consent to processing provided by you;
Your individualizing data (name and surname, telephone number and email address) and information related to payment and selected payment methods for the purposes of issuing and sending accounting/tax documents (invoices) in connection with services used by you, including communication with you in this regard, and on the basis of taking steps at your request for a possible conclusion of a contract, performance of a contract to which you are a party or fulfillment of our legal obligation;
Your IP address, browser settings and preferred language, pages visited, as well as actions taken for the purpose of sending Push notifications, if you have expressed a desire to receive such;
Your IP address, pages visited, for the purposes of protecting information security;
Other data that may be necessary in certain cases or related to the provision of services to Users by us, including those necessary to fulfill contractual obligations (e.g. date of birth, signature, personal identification number) or other data that Users decide to voluntarily share with us, and on the basis of the performance of a contract to which you are a party, consent to processing provided by you or compliance with our legal obligation.
We use cookies on the Website, which are small files that are downloaded to your computer to improve your experience as a user of the site. You can find more information in this regard on our special cookie policy page here.
We do not process, respectively collect from Users, special categories of personal data (for example: data revealing racial or ethnic origin, political opinions, genetic or biometric data, as well as data about the sex life and sexual orientation of the data subject).
We do not make decisions based solely on automated data processing, including profiling.
We usually receive personal data directly from the data subject. However, it is not excluded that we may also receive personal data from other persons such as: other employees, in the company in which the respective data subject works, as well as from publicly available sources such as the Commercial Register and the Register of Non-Profit Legal Entities at the Registration Agency under the Ministry of Justice of the Republic of Bulgaria.
VIII. PERSONAL DATA STORAGE PERIOD
We store the personal data of Users for a period no longer than necessary to fulfill the respective purpose of processing or for the legally established period, where applicable. For example:
personal data provided by you when filling out the contact form will be stored until the request is fulfilled or the inquiry in connection with which you contacted us is satisfied, as well as a maximum of one year thereafter for statistics and marketing analyses;
personal data of our clients processed in connection with contracts concluded between us and the respective User will be stored for a period no longer than ten years, starting from January 1 of the year following the year in which the contract is reported for tax purposes;
personal data of our clients processed in connection with the issuance of tax documents (invoices) will be stored for a period not exceeding ten years, starting from January 1 of the year following the year in which the document is reported for tax purposes;
personal data of our partners/suppliers processed in connection with contracts concluded between us and the respective partner/supplier will be stored for a period not exceeding ten years, starting from January 1 of the year following the year in which the contract is reported for tax purposes;
personal data of participants in recruitment and selection procedures will be stored for a period not exceeding six months, starting from the moment of final completion of the recruitment/selection procedure in which the respective personal data subject participates, respectively after the expiry of the period for appealing the given procedure, unless the personal data subject in question has consented to the storage of his/her personal data for a longer period, in which case the personal data subject has the right at any time and without giving reasons to withdraw his/her consent.
The storage period depends, among other things, on the duration of the legal relationship that has arisen between us and the respective User, as well as on the purposes for which the personal data are processed. Where there is an indication(s) of potential legal claim(s) or liability, these periods will be extended accordingly. When the processing is based on the User's consent (for example: in the case of personal data provided by third parties for direct marketing), we store these personal data as long as we have a valid consent for their processing.
After the expiry of the above periods, we take the necessary care to delete and/or destroy your personal data concerned, without undue delay.
IX. ACCESS TO PERSONAL DATA AND TRANSFER OF PERSONAL DATA TO THIRD PARTIES
In principle, the personal data of Users that we process are accessible to our employees, representatives and partners who need them to fulfill legal obligations and/or to fulfill contractual obligations (for example: providing a service under a contract with a User). In this regard, it is possible, at our own discretion and in compliance with the requirements of the GDPR, to transfer all or part of your personal data to third parties such as accountants, professional consultants, including lawyers (for the purposes of financial, accounting and administrative services of our activities), cloud platforms for data processing/storage (for the purposes of organizational services of our activities, for example: storing and processing contracts with Users on cloud platforms for greater security), companies providing postal services (for the purposes of organizational services of our activities, for example: sending contracts on paper to Users), IT service providers, system administration, marketing services (for the purposes of providing more reliable and high-quality work on the Website and more secure data processing), service providers for storing third-party information (i.e. hosting companies) (for the purposes of fulfilling contracts with Users).
Based on applicable legislation or at the request of public authorities, all or part of your personal data may also be accessible to public authorities.
We do not intend to transfer your personal data to countries outside the European Economic Community or to international organizations.
X. RIGHTS OF DATA SUBJECTS
At any time while we are processing your personal data, and subject to the restrictions set out in applicable law, you, the data subject, have the following rights:
Right of access – you have the right to request information about whether we are processing your personal data, as well as to obtain access to and a copy of such personal data; in case you request more than one copy of such personal data, you may be liable to pay an appropriate fee for each additional copy;
Right to rectification/correction – you have the right to request that your personal data be corrected if you consider that it is inaccurate or incomplete. We will carry out such rectification/correction without undue delay;
Right to erasure/to be forgotten – under certain circumstances (e.g.: the relevant personal data are no longer necessary for the purposes for which they were collected; you have withdrawn your consent to the processing of certain of your personal data for which there is no other legal basis) you may request that your personal data that we process be erased from our records/database without undue delay. In certain cases, We may refuse to erase such personal data of yours (e.g.: the processing of personal data is necessary for compliance with a specific legal obligation or for the establishment, exercise or defence of legal claims);
Right to restriction of processing – where certain conditions apply (e.g.: the processing of certain of your personal data is unlawful, but you do not want these data to be erased), you have the right to request a restriction of the way in which your personal data is processed;
Right to portability – where your personal data have been provided to us by you and are processed in an automated manner, you have the right to request that your personal data be transmitted to you in a structured, commonly used and machine-readable format, as well as to be transferred to another personal data controller, if this is technically feasible;
Right to object – you have the right, at any time, to object to the processing of your personal data for certain purposes, in which case we will stop using the personal data for the specific purpose, unless we have overriding legitimate grounds for doing so (for example: you have the right, at any time, to object to the processing of your personal data for direct marketing purposes, in which case we will stop processing your personal data for those purposes without undue delay);
Right to object to automated processing, including profiling – you have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling, and you also have all the rights that arise for you in the event that you are subject to the legal consequences of such processing;
Right to withdraw your consent to processing – in the event that we process your personal data on the basis of consent, you have the right to withdraw your consent at any time. The withdrawal will not affect the lawfulness of the processing based on consent before its withdrawal.
In the event that, at the request of a User, we delete his/her personal data from our database, we will only store the information that may be necessary to protect our legitimate interests or for public authorities.
You have the right to request that we inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. We may refuse to provide this information if this would be impossible or would involve a disproportionate effort.
In case we are required to transfer personal data to another controller, to rectify or erase personal data, to restrict the processing of personal data or to cease such processing, to provide information about the recipients to whom the personal data for which rectification, erasure or restriction of processing has been provided have been provided, or to provide access to personal data, and in case of concerns regarding the identity of the User making the relevant request, we may first request additional information in order to confirm the identity of the data subject in question.
In case there is a third party in the processing of your personal data to whom all or part of your personal data has been transferred (as referred to in Part IX above), all the above requests will be forwarded to that third party.
The exercise of the above rights is free of charge for Users, unless the requests made are manifestly unfounded or excessive. In such a case, we may either charge a reasonable fee for fulfilling the request or refuse to take action on the request.
Users may exercise the above rights by contacting us by email at: reservations@romantika-bg.com
XI. COMPLAINT TO A SUPERVISORY AUTHORITY
If you believe that your personal data is not being processed lawfully or that any of your rights related to the protection of personal data has been violated, you have the right to file a complaint with the competent supervisory authority for personal data protection, as specified in Part III above of the Personal Data Protection Policy. You also have the right to seek protection of your rights in court.
In the event that the Website contains links to other websites, we recommend that you carefully read the privacy/data protection policies of these other websites, because when you visit these pages, your personal data may be processed by the websites in question, which processing is not covered by the Privacy Policy.
We reserve the right to change the Privacy Policy at our discretion, as well as whenever we see fit.