PRIVACY POLICY

General information about the General Data Protection Regulation

The General Data Protection Regulation (GDPR)[”Regulation (EU) 2016/679”] became applicable in the European Union as of 25 May 2018. The purpose of this Regulation is to harmonise the rules of the EU Member States relating to the collection, processing and use of personal data, with the ultimate aim of safeguarding the right to protection and privacy of all European citizens and providing the appropriate security against their abuse. The Regulation is directly applicable in the Republic of Bulgaria, as a Member State of the European Community. The main Articles of GDPR, as well as information about it business impact, can be found on the following website https://eugdpr.org.

In its capacity as a controller, with regard to the provision of services relating to the access to information and databases over the Internet, the creation, storage and processing of electronic documents, Ivy-SM OOD meets all the requirements of the new regulation by collecting the persons' data, insofar as they are necessary for the provision of the service, by safekeeping them in a responsible and lawful manner.

This Privacy Policy aims to inform you about what personal data are being processed in connection with the use of the services provided, why and how they are being processed, when it is necessary to disclose them to third parties. It also provides information about the rights of the users with regard to the processing of their personal data under Regulation (EC) 2016/679 and the Personal Data Protection Act.

Information about the Controller

• Business name: Ivy-SM OOD
• UIC/BULSTAT:200622470
• Seat and registered office: 1612 Sofia, Hipodruma District, 3 Sotir Andonov Street
• E-mail: ivy.sm.ood@gmail.com

Ivy-SM OOD shall carry out its activities in compliance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Basis for collecting, processing and storing your personal data

Ivy-SM OOD shall collect and process your personal data in connection with the provision of services relating to the access to information and databases over the Internet, the creation, storage and processing of electronic documents, and in particular on the basis of the following:

• Your explicit consent as a customer;
• Compliance with a legal obligation to which the Ivy-SM OOD is subject;
• For the purposes of the legitimate interest of Ivy-SM OOD.

Ivy-SM OOD is a controller regarding your data as a user of our services. Ivy-SM OOD shall act in its capacity as a processor regarding the personal data you are processing by using our services.

Purposes and principles of collecting, processing and storing your personal data

Ivy-SM OOD shall collect and process the personal data provided by you in connection with the use of our services, including for the following purposes:

• creating an account and ensuring full functionality during the provision of our services;
• accounting purposes;
• statistical purposes;
• protecting information security;
• sending information messages, service change messages, recommendations for improving the use of the platform, new and upgraded subscription plans, etc.
• improving and personalising the service by providing you with suitable offers for renewal, events and other products and services that may be of interest to you;
• providing technical support;

When processing your personal data, Ivy-SM OOD shall comply with the following principles:

• lawfulness, fairness and transparency;
• processing purpose limitation;
• consistency with the purposes of the processing and data minimisation;
• data being accurate and up-to-date;
• purpose-based storage limitation;
• integrity and confidentiality of processing and guaranteed appropriate security of the personal data.

When processing and storing personal data, Ivy-SM OOD may process and store personal data for the purpose of protecting protect its following legitimate interests:

• compliance with its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

Types of personal data being collected, processed and stored by Ivy-SM OOD

Ivy-SM OOD shall perform personal data operations for the following purposes:

• User registration on the website / mobile application and actions relating to the access to information and databases over the Internet, the creation, storage and processing of electronic documents;
• Concluding and executing a commercial deal with a customer or partner;
• sending information messages – the purpose of this activity is administering the process of sending messages to customers relating to improvements or changes in the services exceeded parameters and expiring services.

Ivy-SM OOD shall process the following categories of personal data and information with regard to the relevant purposes and grounds:

1. Data: Your identification data - first and last name, e-mail, address, phone number
   • Purpose for which the data are collected: 1) User registration; 2) Contacting and sending information to the user.
   • Basis for processing your personal information – By accepting the general terms and conditions and registering on the website / mobile application and purchasing a service, between Ivy-SM OOD and you is created a contractual relationship on the basis of which we shall process your personal data – Article 6(1)(b) GDPR.
2. Other data processed by Ivy-SM OOD – When you are accessing our website or your account, Ivy-SM OOD shall collect data on the IP address used.
   • Purpose for which the data are collected: Improving the security of the service and the interface localisation.
   • Grounds for processing: The IP address shall be collected on the basis of realisation of the legitimate interests of the controller – Article 6(1)(f) GDPR
3. Your data for issuing an invoice to a natural person – If you would like an invoice to be issued to you in your capacity as a natural person, you should provide your unified personal identification number.
   • Purpose for which the data are collected: Issuing an invoice for payments for the provision of services for the use of the platform.
   • Basis for the processing of your personal data: By accepting the general terms and conditions and registering on the website, between Ivy-SM OOD and you is created a contractual relationship on the basis of which we shall process your personal data – Article 6(1)(b) GDPR.

Ivy-SM OOD shall not collect or process personal data that relate to the following:

• revealing racial or ethnic origin;
• revealing political opinions, religious or philosophical beliefs, or trade union membership;
• genetic and biometric data, data concerning health or data concerning the sex life or sexual orientation.

Ivy-SM OOD shall collect personal data from the persons to whom they relate.

The company shall not use data for automated decision-making.

Storage period of your personal data

Ivy-SM OOD shall store your personal data for a period no longer than the existence of your website/mobile application account. After the expiration of this period, Ivy-SM OOD shall take due care to erase and destroy all your data without undue delay. Ivy-SM OOD shall inform you if the data storage period has to be extended in pursuance of the purposes, in view of the legitimate interests of Ivy-SM OOD or otherwise. Ivy-SM OOD shall store the personal data that it is required to keep under applicable law for the relevant period which may exceed the existence of your registration.

Transferring your personal data for processing

Ivy-SM OOD may, at its own discretion, transfer all or part of your personal data to processors for the purposes of processing, subject to the requirements of Regulation (EU) 2016/679. Ivy-SM OOD shall notify you of any intentions to transfer all or part of your personal data to third countries or international organisations.

Your rights when collecting, processing and storing your personal data

Withdrawal of your consent to the processing of your personal data

If you do not want all or any of your personal data to continue to be processed by Ivy-SM OOD for any particular or for all processing purposes, you can withdraw your consent to the processing at any time by a free-text request sent by mail. Ivy-SM OOD may ask you to certify your identity and the identity with the person to whom the data relate. Upon withdrawing the consent to the processing of personal data that are required in order create and maintain your registration for the use of the services, your account shall be deactivated.

Right to Access

You have the right to obtain from Ivy-SM OOD confirmation as to whether any personal data concerning you are being processed. You have the right to obtain access to the data relating to it, as well as to the information concerning the collection, processing and storage of your personal data. Upon request Ivy-SM OOD shall provide you with a copy of the processed personal data concerning you in electronic or other appropriate form. The access to the data shall be free of charge, but Ivy-OOD shall reserve the right to impose an administrative fee in the event of recurring or excessive requests.

Right to rectification or having incomplete personal data completed

You may rectify or fill in the inaccurate or incomplete personal data concerning you directly through your website / mobile application account or by submitting a request to Ivy-SM OOD.

Right to erasure (“right to be forgotten”)

You shall have the right to obtain from Ivy-SM OOD the erasure of personal data concerning you and Ivy-SM OOD shall have the obligation to erase them without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they have been collected or otherwise processed;
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• You object to the processing of the personal data concerning you, including direct marketing purposes, and there are no overriding legitimate grounds for the processing;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which Ivy-SM OOD is subject;
• the personal data have been collected in relation to the offer of information society services.

Ivy-SM OOD is not obliged to erase the personal data if it stores and processes them:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• reasons of public interest in the area of public health;
• archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• establishing, exercising or defending legal claims.

In order to exercise your “right to be forgotten”, you should file a request using the option in your account or a written request submitted to Ivy-SM OOD, as well as to certify to Ivy-SM OOD your identity and identity with the person to whom the data relate by presenting personally your identity card on for identification purposes and, where necessary, entering your login information in the account of the person to whom the data relate before an employee of Ivy-SM OOD.

Ivy-SM OOD shall not erase any data that it has a legal obligation to store, including for protection against legal claims brought against it or as proof of its rights.

Right to restriction of processing

You have the right to obtain from Ivy-SM OOD restriction of processing of your personal data where:

• you contest the accuracy of the personal data, for a period enabling Ivy-SM OOD to verify the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• Ivy-SM OOD no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of your legal claims;
• You have objected to processing pending the verification whether the legitimate grounds of Ivy-SM OOD override your interests;

Right to data portability

You may withdraw the data concerning you which are being stored and processed in connection with the use of the services of Ivy-SM OOD via an e-mail request. You may request Ivy-SM OOD to transfer your personal data directly to another controller specified by you, where technically feasible.

Right to information

You may request Ivey-SM OOD to inform you of all recipients to which the personal data you have requested to be rectified, erased or restricted have been disclosed. Ivy-SM OOD may refuse to provide this information where this proves impossible or would involve a disproportionate effort.



Right to Object

You may object at any time to the processing of personal data concerning you by Ivy-SM OOD, including if they are being processed for profiling or direct marketing purposes.

Your right in the event of a personal data breach

If Ivy-SM OOD discovers a personal data breach that may pose a high risk to your rights and freedoms, we shall notify you of the breach without undue delay, as well as of the measures that have been or are going to be taken. Ivy-SM OOD shall not be obliged to notify you if:

• it has taken appropriate technical and organisational measures in respect of the data affected by the personal data breach;
• it has taken subsequent measures which ensure that the breach shall not result in a high risk to your rights;
• the communication would involve disproportionate effort.

Other Provisions

You may exercise all of your rights regarding the protection of your personal data by any form that contains a statement of that and identifies you as the data owner.

If the consent refers to a transfer, the Controller shall describe the possible risks of the data transfer to third countries in the absence of an adequate decision and appropriate means of protection.

When you entrust Ivy-SM OOD with the processing of the personal data of a third party for the purpose of using the service, Ivy-SM OOD shall act in the capacity as a processor. Ivy-SM OOD shall acts solely on your instruction as a service user and only insofar as it may have control over the personal data that you are processing. Ivy-SM OOD has no control over the contents and data that you, as the service user, choose to upload to the service (including whether or not these data includes personal data). In this case, Ivy-SM OOD takes no part in deciding whether the user uses the service for personal data processing, for what purposes and whether these personal data are secure. Accordingly, the responsibility of Ivy-OOD in this case is limited to providing information about the service and the functionalities through its interface.