We at BUL STREAM Ltd. take a responsible approach to privacy, security and protection of our customers personal data and we want you to be familiar with how we collect, use and process your personal data. We process your personal data in accordance with the principles of lawfulness and transparency.
GENERAL PROVISIONS
This Privacy Policy applies to the personal data we process when you interact with our website located at www.bullstream.org, no matter if you use a computer, mobile phone, tablet, television, device in a home appliance, or other device to access our services.
This Privacy Policy may be amended at any time in the event of changes in applicable laws, as well as changes in the way your personal data is processed. In case the latest updates of the Privacy Policy are not published on the website, your rights and obligations are governed by the applicable current legislation.
The processing of personal data will always be in accordance with the General Data Protection Regulation 2016/679 (“Regulation”). For the purposes of this Privacy Policy, the terms “personal data”, “data subject”, “processing”, “third party”, “data subject consent”, shall have the same meaning as provided by the European legislator when implementing the Regulation.
DATA WE PROCESS
You do not need to provide personal data to use our website, but if you wish to use certain services through our website, then the processing of personal data may become necessary.
We collect the following personal data that you provide to us while using our website: name and surname, telephone number, email address, your company data and other personal data provided by you.
In addition, if you give your prior consent, we collect information about your use of our website – this is done through the so-called cookies. Information could include time and frequency of website visits, browser type, operating system type, network and IP address information, and more. For more information about cookies and how you can manage them, see our Cookie Policy.
PURPOSES OF PROCESSING
We use your personal data only for specific purposes specified in advance at the time of collection and after your explicit consent (where consent is the legal basis for processing), or for additional compatible purposes in accordance with the legislation. The purposes for which we process your personal data are:
to respond to your inquiries submitted via our contact form;
to provide efficient service to our customers and to improve the content and functionality of our website;
to improve the quality of our services;
to contact you to provide newsletters, special offers, useful tips, updates and information we think will be of interest to you;
to contact you with information about your use of our website;
to ask for your feedback on our products and services;
for marketing and advertising purposes;
for any other purpose consistent with this Privacy Policy or for which we have obtained your specific consent.
Provision of personal data to third parties
Your personal data may only be provided to third parties only when the latter undertake the same obligation to ensure adequate levels of protection as set out in the Regulation.
Your personal data may also be transferred to third parties acting on our behalf for further processing in accordance with the purposes for which it was originally collected, or to be processed lawfully in other ways, such as service provision, evaluation of the usefulness of this website, marketing, data management or technical support.
Our contractual relationship with these third parties obliges the latter to use your personal data only for the agreed purpose and not to sell your personal data to third parties or disclose it to third parties except as required by the Regulation or as permitted by us or as set out in this Privacy Policy.
The personal data we collect from you may be processed, accessed and stored outside the European Union in countries with a lower level of data protection than that provided for in the Regulation. In the event that we transfer your personal data to external companies in other jurisdictions, we shall ensure that these transfers of personal data are protected against the appropriate guarantees provided by the Regulation, such as standard data protection clauses. You have the right to request a copy of the applicable data protection law on the basis of which we transfer your personal data to such countries. Where the risk to the protection of your personal data is very low, we may rely on your informed consent for such transfers.
We may disclose your personal data to third parties if we are required to do so by applicable law, court order, subpoena or governmental act; if we believe in good faith that disclosure is necessary to protect legal rights, protect your safety or that of others; as part of a criminal or other legal investigation or proceeding in the Republic of Bulgaria or abroad.
We do not transfer, sell or exchange your personal data to third parties (including for marketing purposes).
Analytics data may be provided to third parties due to the use of cookies. For more information about cookies and how we use them, see our Cookie Policy.
LEGAL BASIS FOR PROCESSING
Chapter II Article 6(1)(a) of the Regulation is the legal basis for which we require your consent for the more specific purposes of the processing. If the processing is necessary for the performance of an agreeement to which you are a party, for example where the processing is necessary for the provision of another service, it is based on Chapter II Article 6(1)(b) of the Regulation.
The same applies to processing that is necessary to implement pre-contractual measures, for example in the case of inquiries concerning our products or services. If our company has a legal obligation to which the controller is subject, such as for the fulfilment of tax obligations, it is based on Chapter II Article 6(1)(с) of the Regulation. Processing which does not fall within the legal grounds set out above but is necessary for the legitimate interests of our company, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, is based on Chapter II Article 6(1)(f) of the Regulation.
In this case, the legitimate interest of our company is to carry out its activities for the benefit of our clients and employees.
Personal data retention periods
Your personal data will not be kept longer than is necessary for the purposes for which it was collected. This means that once the purposes have been met, the data will be deleted or anonymised.
Also, your personal data is stored for the period specified by our contractual relationship and for a certain period thereafter imposed by legal obligations.
Where there are no other grounds that oblige us to store (part of) your personal data, you can request the deletion of your information.
DATA SECURITY
We strive to use appropriate organisational, technical and administrative measures to protect personal data within our organisation. To this end, we apply all legal and technical measures to protect personal data in accordance to Article 32 of the Regulation, as well as the latest technological developments. Note, however, that despite adequate steps to protect information, no website, Internet connection, computer system or wireless connection is completely secure.
YOUR RIGHTS
Right to information and access: At any time, you have the right to obtain free information about whether we process your personal data and the ways in which we process it, including the purposes of the processing, the types of data, the recipients of the data, your rights and more. If you wish to exercise your right of access, you may contact us at any time at the contacts listed at the end of this Privacy Policy.
Right to transfer your personal data:
Where the processing of your personal data occurs in an automated manner on the basis of your consent or on the basis of a contractual agreement, you have the right to receive a copy of your data in a structured, commonly used and machine-readable format transferred to you or to another party.
Right to rectification:
You have the right to have your personal data corrected without undue delay if it is inaccurate, and to have the data completed in the event of incomplete information. You can correct your personal data by contacting us at the contacts listed at the end of the Privacy Policy.
Right to erasure (right to be forgotten):
You have the right to request the erasure of all personal data processed by us at any time in the following situations:
- The personal data is no longer necessary for the purposes for which it was collected or processed.
- You wish to withdraw your consent on which the processing is based according to Chapter II, Article 6(1)(a) or Article 9(2)(a) of the Regulation and there is no other legal basis for the processing;
- You wish to object to processing of personal data according to Chapter III, Section 4, Article 21(1) of the Data Protection Regulation and there are no legitimate grounds for the processing which override, or you object to the processing according to Chapter III, Section 4, Article 21(2) of the Regulation;
- The personal data have been unlawfully processed;
- The personal data must be erased in order to comply with a legal obligation under European Union law or the law of a member state to which the controller is subject;
- The personal data were collected in connection with the provision of information society services as referred to in Chapter II, Article 8(1) of the Regulation
If we have provided your personal data to third parties, we are obliged – subject to available technology and the costs of implementation – to take appropriate steps, including technical measures, to inform those third parties that you have requested erasure of your data or copies or replicas of that personal data.
The right “to be forgotten” may not be exercised in the following situations:
- if you have an outstanding debt to us, regardless of the method of payment;
- if you are suspected of abuse or have abused our services;
Right to object to processing on the basis of legitimate interest:
You have the right to object to the processing of your personal data on the basis of our company legitimate interest. We will cease processing your personal data unless it can be demonstrated that there are convincing legal grounds that override your interests and rights against it or due to legal claims.
Right to object to direct marketing:
You have the right to object to receiving marketing communications, including profiling and analytics for direct marketing purposes.
You can opt out of direct marketing in the following way:
- by following the instructions in any message received in your email.
Right to restriction of processing
You have the right to request restriction of processing where one of the following applies:
- if you claim that your personal data is inaccurate, we will restrict processing until a data accuracy check has been passed;
- the processing is unlawful, but the data subject does not wish the personal data to be erased, but requests instead that we restrict its use;
- if we no longer need your personal data for the purposes of the processing, but it is necessary for the establishment, exercise or defence of legal claims;
- if you object to the processing on the basis of our legitimate interest, in which case we will restrict the processing.
Right to withdraw consent
You have the right to withdraw your consent to the processing of your personal data at any time where such processing is based on consent.
Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her, unless the decision: (1) is necessary for the conclusion or performance of an agreement between a data subject and a controller; or (2) is permitted by Union or member state law applicable to the controller and which also provides for appropriate measures to protect the rights, freedoms and legitimate interests; or (3) is based on the data subject's explicit consent.
For your information, the conduct of our business does not require making and application of automated decisions, including profiling.
Right to file a complaint with a supervisory body:
If you believe that we are processing your personal data in an unlawful manner, you have the right to file a complaint with a supervisory body in the European Union and/or the Supervisory Authority of the Republic of Bulgaria.
How can you exercise your rights?
If you wish to exercise any of your legal rights or need assistance in exercising them, or have any questions relating to them, you may contact us at any time at the contacts listed at the end of this Privacy Policy.
Protection of personal data of persons under the age of 16
The processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Information about the personal data controller and contacts
BUL STREAM Ltd. 206539615, Republic of Bulgaria, postal code: 1404, Sofia Province, Sofia Municipality, Sofia, bul. Bulgaria 81 V, fl.5, office III-А2, +359875419635, [email protected]