This document contains the Personal Data Security Policy for individuals (\u201cPolicy\u201d) and is related to the General Terms and Conditions, but is not an integral part of them, as it does not regulate rights and obligations. Instead, its purpose is to explain to users what personal data we process, how we process it, for what purpose, and what security measures apply. Additionally, it provides information about the rights that you, our clients and users, have in relation to the processing of personal data by “IMG CONNECT” Ltd., UIC 207379619, VAT No. BG 207379619, with its headquarters and address at: Varna, 4 Bragalnitsa Street. In case of any changes to this Policy, the changes will be published here.<\/p>\n
Date of last update: January 10, 2024.<\/strong><\/p>\n Your privacy is extremely important to us. This security policy outlines the personal data we collect from you through our interactions and how we use that data.<\/p>\n “IMG CONNECT” Ltd., UIC 207379619, VAT No. BG 207379619, with its headquarters and address at: Varna, 4 Bragalnitsa Street, contact phone +359 886 991 001; email: events@internetmediagroup.org<\/a> (hereinafter referred to as “We”, “online store”, “Site”, “Website”, “administrator”, IMG CONNECT) is the data controller for the information, including personal data, collected or provided when browsing the website www.digital4bulgaria.com<\/a> or making a purchase through it, as well as when browsing or purchasing a service through our Facebook page (hereinafter all collectively referred to as “Site”, “Internet Page”). The Policy also applies in cases where, as individuals (hereinafter “Data Subjects”), you voluntarily provide us with personal data via electronic means (such as email), by phone, or through other methods, including in person at our commercial facility or office. IMG CONNECT processes personal data from inquiries made by you, as well as for marketing and advertising purposes, profiling, participation in games, promotions, and raffles organized by us, and for any other purposes not prohibited by law. In processing personal data, IMG CONNECT adheres to all applicable laws related to data protection, including but not limited to Regulation (EU) 2016\/679 (“Regulation”) and the Personal Data Protection Act, because the security of our clients’ personal data is of paramount importance to us. Therefore, this Policy also applies in these cases.<\/p>\n The responsible person for data protection is Preslav Bobev.<\/p>\n Correspondence address: Varna, 4 Bragalnitsa Street<\/p>\n Email address: events@internetmediagroup.org<\/a><\/p>\n Contact phone: +359 886 991 001<\/p>\n This Policy applies to all our clients \u2013 individuals who use our services through orders placed on the Website or show interest in them by sending inquiries (hereinafter referred to as “data subjects” or “users”).<\/p>\n Partners and third parties who work with or for IMG CONNECT, as well as those who have or may have access to personal data, will be expected to familiarize themselves with, understand, and comply with this policy. No third party can access personal data stored by IMG CONNECT without the company having first entered into a data confidentiality agreement, which imposes obligations on the third party that are no less burdensome than those assumed by IMG CONNECT, and which allows IMG CONNECT to conduct compliance checks on the obligations set out in the agreement.<\/p>\n This policy applies to all employees\/workers (and stakeholders) of IMG CONNECT, as well as external suppliers of products and services with whom IMG CONNECT has contracts. Any violation of the General Data Protection Regulation (GDPR) will be considered a breach of labor discipline, or non-performance of contracts with partners, and if there is any suspicion of a criminal act, the matter will be referred for consideration to the relevant state authorities as soon as possible.<\/p>\n For visitors to the Website who do not place orders or send inquiries, but only browse our internet page, the Cookie Policy published on the Website applies.<\/p>\n “Regulation”<\/strong> \u2013 The General Data Protection Regulation (GDPR) 2016\/679 from April 27, 2016. The aim of this European legislative act is to protect the “rights and freedoms” of individuals and ensure that personal data is not processed without their knowledge, and where possible, is processed with their consent.<\/p>\n “Personal data”<\/strong> \u2013 Any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.<\/p>\n “Special categories of personal data”<\/strong> \u2013 Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership in trade unions, and the processing of genetic data, biometric data for the unique identification of an individual, data related to health or data regarding the sexual life or sexual orientation of an individual.<\/p>\n “Processing”<\/strong> \u2013 Any operation or set of operations performed on personal data or sets of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making data available, alignment or combination, restriction, erasure, or destruction.<\/p>\n “Data controller”<\/strong> \u2013 Any natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU law or the law of a member state, the data controller or the specific criteria for its designation may be provided for in EU or member state law.<\/p>\n “Data subject”<\/strong> \u2013 Any living individual whose personal data is processed by the data controller.<\/p>\n “Data subject’s consent”<\/strong> \u2013 Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by which they, through a statement or clear affirmative action, consent to the processing of their personal data.<\/p>\n “Child”<\/strong> \u2013 The General Regulation defines a child as any person under the age of 16. Processing of personal data of a child is lawful only if the child\u2019s parent or guardian has given consent. The data controller makes reasonable efforts to verify that the holder of parental responsibility for the child has given or is authorized to give consent.<\/p>\n “Profiling”<\/strong> \u2013 Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects related to a natural person, and specifically to analyze or predict aspects concerning the performance of the individual\u2019s professional duties, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.<\/p>\n “Personal data breach”<\/strong> \u2013 A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.<\/p>\n “Recipient”<\/strong> \u2013 A natural or legal person, public authority, agency, or another body to whom personal data is disclosed, whether a third party or not. Public authorities who may receive personal data in the course of a specific inquiry in accordance with EU law or the law of a member state are not considered “recipients”; processing of such data by those public authorities is subject to applicable data protection rules in accordance with the purposes of the processing.<\/p>\n “Third party”<\/strong> \u2013 Any natural or legal person, public authority, agency, or body other than the data subject, the data controller, the data processor, and persons who, under the direct authority of the data controller or the data processor, are authorized to process personal data.<\/p>\n When collecting and processing personal data, we are guided by the following principles: lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.<\/p>\n In connection with its activities, “IMG CONNECT” Ltd. enters into and executes distance contracts, reviews job applications and offers, user rights exercise forms, as well as data subject requests, responds to inquiries, issues and receives invoices, processes statistical data, manages a user panel on the website, and conducts advertising activities through campaigns (promotions, games, etc.). In the course of these activities, IMG CONNECT processes information related to the following data subjects:<\/p>\n (a)<\/strong> Individuals using the website without registration, without providing any personal data (in this case, we process data, but not personal data) and individuals using the website without registration who have voluntarily provided a limited number of personal data (e.g., phone number and\/or email address).<\/p>\n<\/li>\n (b)<\/strong> Individuals using the website with registration as registered users \u2013 in these cases, we process user data entered during registration \u2013 email address, delivery address, name, billing data, order details, and other data entered by the user.<\/p>\n<\/li>\n (c)<\/strong> Individuals who have made inquiries (including via phone), requests, initiatives, complaints, or other correspondence to us, including through the website, phone, email, or other means.<\/p>\n<\/li>\n (d)<\/strong> Individuals whose information is contained in inquiries (including via phone), requests, initiatives, complaints, or other correspondence addressed to us.<\/p>\n<\/li>\n (e)<\/strong> Individuals with whom we enter into contracts (civil, including commercial or employment contracts, mainly distance contracts) electronically (via the website or social networks, as well as by email) or in person at our office or retail location.<\/p>\n<\/li>\n (f)<\/strong> Individuals whose data we have received from third parties (for example, when placing an order intended as a gift).<\/p>\n<\/li>\n<\/ul>\n Depending on the reason for processing personal data, the types of data may vary. The functionalities provided on the website are not intended for the storage and processing of special categories of data within the meaning of Articles 9 and 10 of the Regulation. (Note! Read Articles 9 and 10 of the Regulation here). We only require personal data that is necessary for providing the activity\/service\/product we offer. In the course of using the website, we may also process other data that does not contain personal data but relates to the subject, such as their IP address, activity data on the website, etc.<\/p>\n To fulfill the distance contract entered into between you and IMG CONNECT for participation in an event, we require certain information from you. You decide whether and how to use the options to enter into a distance service contract provided through the Website or Facebook page. In the forms where personal data is entered, we clearly mark the mandatory or voluntary nature of providing the data. Data that is mandatory is data without which we cannot enter into the respective contract. These are: name, email address, delivery address, contact phone number, your payment information (e.g., bank card), billing data, including your ID number if you want an invoice issued to an individual. If you provide data about third parties who will receive the order (e.g., in the case of gift orders or other types of donations), you are responsible for providing this data to those third parties.<\/p>\n If you choose to store your information in the Website through registration of a profile, we store the above-mentioned data as well as the order history for each registered account. The required data corresponds to those requested during an order. Additionally, we process the IP address, activity data (e.g., registration time, acceptance of the Privacy Policy and Terms and Conditions, account login, etc.).<\/p>\n In cases where IMG CONNECT enters into other contracts with individuals, different from distance sales, we require the full name, personal identification number, address, and email address.<\/p>\n In certain cases, you may have the opportunity to share information with social networks or use their websites to create your profile or link your profile on our website with the respective social network. In such cases, the social network may provide us automatic access to certain personal information they have collected about you (e.g., content you have viewed, content you want, and information about ads you have been shown or clicked, etc.). By linking your social network profile with your account on our website, you allow us to access your personal data processed by the respective social network and to collect, use, and store this information in accordance with this Privacy Policy. The linking of your social network profile to our website registration occurs if you click on a link provided to create registration via social media, thereby voluntarily establishing a connection with the respective social media site.<\/p>\n If you provide your personal data to IMG CONNECT via Viber, Skype, Facebook, or another platform\/social network, we inform you that these platforms\/websites\/social networks have their own privacy policies, and we do not accept any responsibility or liability for these policies as their processing cannot be controlled by IMG CONNECT. Therefore, we recommend that you check these policies before submitting your personal data to us via these websites\/applications.<\/p>\n If you leave a post or comment on this website, your IP address will be stored along with your name if you have entered that information. This is for the security of the website operator. If your text violates the law, the operator may need to trace your identity. Additionally, IMG CONNECT has an obligation to store this data (referred to as “traffic data”) for specific periods and for specific purposes, as outlined below. Since sending comments, inquiries, and other messages to the website, Facebook page\/group, or their administrators constitutes sending an electronic statement, according to the Electronic Document and Electronic Certification Services Act (“EDES”), the administrator is obliged to maintain logs of the submission for a period of 1 year. The log contains the date of the statement, name, and email address of the sender.<\/p>\n Employee and Job Application Data<\/strong><\/p>\n We process data when entering into employment contracts and when evaluating and processing job applications. When entering into employment contracts, we require the full name, personal identification number (EGN), address, age, gender, educational background, work experience, and bank details. Subsequently, we process health-related data. When processing CVs, we handle personal information such as names, addresses, email addresses, age, gender, education, work experience, photographs, and data voluntarily provided by the applicant during the interview or in the CV.<\/p>\n Data Provided for Correspondence, Complaints, and Reports<\/strong><\/p>\n In order to resolve submitted complaints, reports, disputes, inquiries, requests, or other matters communicated to IMG CONNECT through electronic forms on the website, via phone calls to IMG CONNECT, or via regular or electronic mail, IMG CONNECT LTD stores and processes this information, as well as the results of this processing. This may include names, email addresses, phone numbers, and addresses.<\/p>\n Additionally, due to the fact that sending comments, inquiries, and other messages to the website, Facebook page, or administrators constitutes an electronic statement under the Law on Electronic Documents and Electronic Signature Services (“ZEDES”), we are required to maintain a log of the fact that the statement was sent (without its content) for a period of 1 (one) year. The log contains the date of the statement, the sender\u2019s name and email address, and identification of the sender.<\/p>\n If you provide us with personal information about someone else, you must do so only with the authorization of that person. You must inform them about how we collect, use, disclose, and store their personal information in accordance with our current Privacy Policy.<\/p>\n Technical Data Collected During the Use of the Website<\/strong><\/p>\n In addition, we collect information from your computer, phone, tablet, or other devices you use. This information may include the following:<\/p>\n Device identifier, type of device, and unique identifier for that device, “log data,” including information automatically sent by your browser when visiting the website; this log data includes IP address, the address and activity of websites you visit, search terms, browser type and settings, date and time of your request, how you used the site, cookie data, and device data; if you want more details about the information we collect, please contact us through the contact form.<\/p>\n<\/li>\n Location information sent by the device if you have set it to share location data \u2013 please note that mobile devices allow you to control or disable location services for any application on your mobile device through the device settings menu.<\/p>\n<\/li>\n Information about the computer and connection, such as statistical data about page views, IP address, browsing history on the website, language settings, date and time.<\/p>\n<\/li>\n Logs for facilitating your searches \u2013 quick links for repeating previous searches give you the option to repeat your searches without entering them each time. This functionality can be used with or without registration. When using the website in your browser, a randomly generated number cookie is stored, allowing the site to show quick links to repeat previous searches. The website stores and shows the last 10 searches associated with this browser. When logged into your account, you can save and use them there. If you use the service with registration (currently an inactive feature), the last 10 searches are stored in your account.<\/p>\n<\/li>\n Logs related to security, technical support, development, etc.:<\/p>\n To ensure the reliable functioning of services and identify technical problems.<\/p>\n<\/li>\n To ensure the security of services and detect malicious activities.<\/p>\n<\/li>\n To develop and improve website services.<\/p>\n<\/li>\n To measure website traffic and usability.<\/p>\n<\/li>\n Logs when required by law (such as logs of electronic declarations).<\/p>\n<\/li>\n Login logs for user accounts \u2013 this log allows the identification and automatic blocking of unauthorized attempts to access accounts; it is maintained for a period of 1 (one) year and contains the date and time of login, status, whether the login was through a mobile version, application, or desktop browser, IP address.<\/p>\n<\/li>\n Server logs, logs from security devices (e.g., Web Application Firewalls), and other similar devices. These logs are necessary to identify technical problems, detect malicious activities, etc., as mentioned above. They are stored for a period of up to 1 (one) year. Logs may contain information such as date and time, IP address, URL, and browser\/device information. Additionally, some devices may use security technology based on cookies.<\/p>\n<\/li>\n Cookies \u2013 the use of cookies is necessary for the functioning of the website. A Cookie Policy has been adopted, and you can review it for more details regarding the types of cookies we use, their storage periods, and usage.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n It is possible that we may choose to reduce the volume of data we store and process, depending on the purposes of the processing.<\/p>\n We do not require and will not collect or process personal data that reveals: race or ethnic origin; political, religious, or philosophical beliefs; membership in trade unions; genetic or biometric data; data concerning health, or data concerning sexual life or sexual orientation. If a subject voluntarily provides such categories of data, IMG CONNECT LTD is not responsible for the provision but is only obliged to apply the same protective measures as those for the required personal data. We do not transfer data to third countries. Additionally, we do not make automated decisions regarding personal data and do not process data of persons under the age of 16. If you are under the age of 16, you should not provide us with personal data about yourself.<\/strong><\/p>\n For what purposes do we process your data?<\/strong><\/p>\n The main purpose for which IMC CONNECT<\/strong> processes your personal data is generally related to providing services through the Website and social networks, namely entering into distance sales contracts and delivering the goods and services you have ordered, as well as accounting for revenue. We use your personal information to provide and improve our services, offer you a personalized experience on our website, communicate with you regarding your profile and our services, provide customer service, deliver personalized advertising and marketing based on your interests, conduct organized raffles and games, and, in certain cases, to detect and investigate fraudulent or illegal activities.<\/p>\n IMC CONNECT<\/strong> collects, uses, and processes the information described above for the purposes set out in this Policy, which may include:<\/p>\n Entering into distance sales contracts for goods\/services<\/strong> between you and IMC CONNECT via the Website or social networks: we require your identification, contact, and payment information to conclude a contract with you and to send your order.<\/p>\n<\/li>\n Entering into consumer credit agreements<\/strong> when you have requested a purchase of goods or services via credit.<\/p>\n<\/li>\n Processing payments and preventing fraudulent transactions<\/strong> (we may share your data with a third party to perform these functions).<\/p>\n<\/li>\n Entering into employment contracts and processing and evaluating submitted CVs<\/strong>.<\/p>\n<\/li>\n Protection and enforcement of the legitimate interests of other service users, third parties, and the Website<\/strong> \u2013 the legitimate interest pursues goals related to the legal interests of IMC CONNECT and\/or third parties. These include:<\/p>\n Identifying and resolving technical issues or functional problems, developing and improving the purpose of the Website.<\/p>\n<\/li>\n Communicating with you, including electronically, regarding important issues related to the services we provide and the execution of concluded contracts.<\/p>\n<\/li>\n Targeting our marketing efforts, updating services, and offering promotional offers based on your preferences.<\/p>\n<\/li>\n Receiving and processing complaints, requests, and other correspondence.<\/p>\n<\/li>\n Safeguarding the rights and legitimate interests of the Website, including in court, and assisting in protecting the rights and legitimate interests of other users and\/or affected third parties.<\/p>\n<\/li>\n Administering and securing the website and application.<\/p>\n<\/li>\n Analyzing and improving the use of our website, application, and retail activities (e.g., tracking how you navigate on our website, App, and\/or stores).<\/p>\n<\/li>\n Measuring and analyzing our advertising and offering suggestions and recommendations based on the information you share with us.<\/p>\n<\/li>\n Communicating with you regarding your profile, resolving issues with your profile. When we contact you by phone to ensure efficiency, we may use automated or prerecorded calls and text messages.<\/p>\n<\/li>\n Informing you about products and services you wish to receive information about via email, postal mail, mobile phone, and\/or other digital means (depending on your stated preferences), including social media platforms \u2013 only when we have obtained your explicit consent for this.<\/p>\n<\/li>\n Registering you on the website (in this case, we will use your personal information to maintain and update your profile, e.g., changing your address or marketing preferences).<\/p>\n<\/li>\n Administering any contests\/raffles\/games organized by IMC CONNECT<\/strong>.<\/p>\n<\/li>\n Providing you with location-based services (e.g., advertising, search results, and other personalized content).<\/p>\n<\/li>\n Fulfilling IMC CONNECT<\/strong>‘s legal obligations, which include:<\/p>\n Complying with legal requirements for retaining or providing information for tax purposes (e.g., based on the Accounting Act and other tax laws such as VAT, income tax, corporate tax, tax procedure code, etc.).<\/p>\n<\/li>\n Fulfilling obligations under the Labor Code, the Commercial Register Act, and the Register of Non-Profit Legal Entities, and other regulations.<\/p>\n<\/li>\n Complying with directives issued by competent state or judicial authorities (e.g., based on the Ministry of Interior Act, Criminal Procedure Code, Electronic Surveillance Act).<\/p>\n<\/li>\n Fulfilling obligations under the General Data Protection Regulation related to informing you of various circumstances related to your rights, the services provided, or the protection of your data.<\/p>\n<\/li>\n Fulfilling obligations under the Consumer Protection Act, such as ensuring the right of withdrawal and statutory warranties.<\/p>\n<\/li>\n Defending IMC CONNECT<\/strong> in court.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n Your data may be processed based on your explicit consent, in which case the processing is specific and limited to the scope and extent set out in that consent. Typically, we request such consent when we wish to process your personal data without a legal obligation or legitimate interest for IMC CONNECT<\/strong>. Such consent is usually required when we wish to inform you about new promotions, products, etc.<\/p>\n Retention period of your personal data<\/strong><\/p>\n When storing data, we apply the general principle of storing data in minimal volumes and for no longer than necessary to provide the services and fulfill the contracts, ensure their security and reliability, and comply with legal requirements.<\/strong> We will retain your personal information for the period necessary to achieve the purposes outlined in this “Privacy Policy,” unless required by law or based on our legitimate interest to retain it for a longer period. Depending on the type of data and the purposes for which it was collected, a specific retention period is determined, after which the information will be permanently deleted.<\/p>\n
\nDATA CONTROLLER<\/strong><\/h2>\n
\nDATA PROTECTION RESPONSIBLE PERSON<\/strong><\/h2>\n
APPLICABILITY OF THE POLICY<\/strong><\/h2>\n
\nDEFINITIONS<\/strong><\/h2>\n
PRINCIPLES<\/strong><\/h2>\n
\nDATA SUBJECTS WHOSE DATA WE PROCESS<\/strong><\/h2>\n
\n
\nPERSONAL DATA WE PROCESS<\/strong><\/h2>\n
Data Provided During Event Registration<\/h3>\n
Data Provided During Website Registration<\/h3>\n
Data Provided During the Conclusion of Other Contracts<\/h3>\n
Data Provided by, Through, and to Other Websites and Applications (Third Parties)<\/h3>\n
Data Provided When Posting a Comment, Review, or Publication<\/h3>\n
\n
\n
\n
\n
\n