Privacy Policy for Games, Raffles and Campaigns
Translation provided for convenience; the Bulgarian version prevails.
Who are we?
“NOVA TRADE” EOOD, UIC (EIK): 115144922 (“NOVA TRADE”, “We”, “the Company”), is a controller of personal data within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”, “the Regulation”) and the applicable legislation. We strive to comply with the highest applicable standards and established good practices in the processing of personal data. The competent lead supervisory authority for the protection of the personal data processed by NOVA TRADE is the Commission for Personal Data Protection of the Republic of Bulgaria.
The purpose of this Policy is to inform you of the type of information we collect about you as our customers, partners and counterparties, the purposes for which it is used, the legal basis for its collection and processing, the conditions of its storage in any form – oral, written or electronic – and the security measures applied by the Company with regard to your personal data.
How to contact us
If you have any questions about this Policy, wish to exercise any of your rights set out in the “Your rights” section below, or suspect that your personal data may be processed in breach of the Regulation or of the preferences / consents you have expressed, you can contact us at:
“NOVA TRADE” EOOD3 Shipka Str., 4190 Saedinenie, Bulgaria
Phone: +359 32 277 400
E-mail: [email protected]
What are the principles of personal data processing?
When processing personal data, the Company strictly observes the following principles:
- Personal data are processed lawfully, fairly and in a transparent manner;
- Personal data are collected for specified, explicit and legitimate purposes and are not further processed in a manner that is incompatible with those purposes;
- Personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Personal data are accurate and, where necessary, kept up to date;
- Personal data are kept in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data are processed;
- Personal data are processed in a manner that ensures appropriate security of the personal data.
What are personal data and the related terms?
“Personal data” means any information relating to an identified natural person or to a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“Special categories of personal data” are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the sole purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;
“Data subject” means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
A personal data “controller” is a natural or legal person, or a state or local government authority, which, alone or jointly with others, determines the purposes and means of the processing of personal data;
A personal data “processor” is a natural or legal person, a state authority or a local government authority which processes personal data on behalf of the controller. The relationship between the controller and the processor is governed by a legal act, a written contract or another act of the controller that sets out the scope of the obligations assigned by the controller to the processor;
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data;
“Consent of the data subject” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
“Personal data breach” means an act or circumstance leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
“Applicable legislation” means the legislation of the European Union and of the Republic of Bulgaria relevant to the protection of personal data (the Bulgarian Personal Data Protection Act, etc.);
“Regulation (EU) 2016/679” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), published in the Official Journal of the European Union on 4 May 2016.
How do we collect and receive information about you?
NOVA TRADE mainly processes personal data that you provide to us voluntarily by registering to take part in games / raffles / campaigns organised by us, or by taking part directly in our games on social media platforms – Facebook.
We may also receive information containing your personal data from other persons in connection with games / raffles / campaigns organised by us on our websites and official social media pages on Facebook.
What information do we collect about you?
Participants in games / raffles / campaigns held on our websites and Facebook profile. If you wish to take part in games organised and run by NOVA TRADE (including by posting a comment under a post on our official page), you voluntarily provide personal data such as your names, e-mail address, phone number, delivery address for the prize won, a photo (where this is a condition of participation), or your Facebook profile, through which you identify yourself for the purposes of the game. NOVA TRADE has access solely and exclusively to the information that you have made public and to which you have given access through the security settings of your profile.
We process these data on the basis of your unambiguous consent to take part in the game, by meeting the conditions of participation, and of our interest in establishing and exercising our rights in connection with a potential or actual dispute with you.
The purposes for which we need your data are:
- registering you to take part in our games;
- being able to contact you and notify you if you win;
- announcing the winners and ensuring transparency and equal treatment of all participants by publishing your name or your Facebook profile (if the profile settings allow it) in the game / raffle / campaign on our websites and/or official social media pages on Facebook and Instagram;
- sending you the prize you have won.
The information you provide in your social media profiles is collected and managed by the social networks themselves as controllers of personal data. For this reason, we recommend that you read their privacy policies, terms of use and related information on how they use the personal data you provide to them. NOVA TRADE accepts no responsibility for the use of your personal data by these organisations.
Visitors to the website www.waterbachkovo.com and other websites that we may maintain.
When you visit our websites, we collect information about your IP address and cookies in order to determine the traffic to our websites and to improve our service. To achieve this, when you enter our website you will be asked to give or refuse your consent for us to store cookies on your device. More information can be found in our Cookie Policy.
Storage of your personal data
NOVA TRADE stores your personal data electronically (server systems) and on paper. The storage periods are always consistent with the purposes for which the personal data are processed. The Company stores your data for the above purposes for a period of 90 (ninety) days from the end date of the respective game / raffle / campaign.
To whom do we disclose your personal data?
NOVA TRADE respects and protects the confidentiality of your personal data. In compliance with the legal requirements, the Company may disclose your personal data to third parties:
- So that you can receive your prize, we provide your personal data to third parties – our contractors, couriers and partners – and all necessary measures are taken to protect your personal data when they are shared;
- Service providers: when we use service providers for the technical maintenance of internal information systems and the operational support of our business, as well as software companies responsible for maintaining our websites or individual features of them, or NOVA TRADE’s official Facebook page, the Company may disclose personal data. Such disclosure takes place only where there is a legitimate reason for it and on the basis of a written (where applicable) agreement that the recipients ensure an adequate level of protection;
- State and municipal authorities: in fulfilment of its legal obligations, the Company may be required to disclose your personal data upon an explicit instruction from state or municipal authorities (the National Revenue Agency, etc.).
Special categories of data
NOVA TRADE does not collect or process special categories of personal data in connection with our games / raffles / campaigns. Please do not disclose any special categories of personal data to us through your participation or otherwise.
How do we process children’s personal data?
NOVA TRADE processes children’s data in accordance with the applicable legislation. Participation in our games / raffles / campaigns is restricted for persons under 18.
Profiling and automated processing of personal data
NOVA TRADE does not use your data to create personal or consumer profiles for marketing purposes. Nor do we apply automated processing to your personal data.
Recipients of personal data established outside the Republic of Bulgaria
As a rule, the Company does not disclose personal data to persons established outside the European Union or the European Economic Area.
When personal data are provided to persons established in a Member State of the European Union, the personal data enjoy the level of protection provided by Regulation (EU) 2016/679 (GDPR) and the related legal acts of the European Union.
When personal data are provided to countries outside the European Economic Area, it should be borne in mind that the European Commission recognises some of these countries as ensuring an adequate level of protection. This can be checked on the official website of the European Commission and on the website of the Commission for Personal Data Protection of the Republic of Bulgaria.
What are your rights?
Subject to the applicable legislation, you have the following rights with regard to your personal data processed by NOVA TRADE:
- Right of access and right to obtain a copy of your personal data
You have the right to obtain confirmation as to whether we process your personal data. If so, you may obtain access to your personal data and to certain information about how they are processed, as well as a copy of them. To do so, you can fill in the relevant access request. - Right to rectification of your personal data
You have the right to request the rectification of your personal data that are inaccurate or incomplete. - Right to erasure (“right to be forgotten”)
You have the right to request the erasure of your personal data when they are no longer necessary for the purposes for which they were collected or otherwise processed, as well as in other cases provided for in the Regulation, for example if you wish to withdraw your consent or the data have been processed unlawfully. - Right to restriction of processing
If you contest the accuracy of your personal data, for a period enabling us to verify it, as well as in other cases provided for in the Regulation, you may request the restriction of the processing of your personal data. - Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit those personal data to another controller, where the processing of such personal data:- is based on consent or on a contract with us, and
- is carried out by automated means.
- Right to object
You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on the legitimate interests of the Company. - Right to withdraw your consent
Where you have given consent to the processing of your personal data, you may withdraw it at any time.
If you wish to exercise any of your rights or have questions about the processing of your personal data, please contact us using the contact details given in section 2. We will consider your request/complaint and you will receive a reply within one month of its receipt. Where necessary, this period may be extended by up to two further months, taking into account the complexity and number of requests; you will be informed of this in good time, including of the specific reasons for the delay.
You may exercise your rights free of charge, except in certain cases.
Detailed information on the conditions and procedure for exercising your rights can be found in the Rules for Exercising the Rights of Data Subjects on our website www.waterbachkovo.com
If you believe that your personal data have not been processed lawfully, you can contact the Commission for Personal Data Protection and lodge a complaint by phone at +359 2 91 53 518 or by e-mail at [email protected].
Security of personal data
NOVA TRADE maintains appropriate administrative, technical and organisational measures designed to help protect the security and confidentiality of your personal data and to protect them against accidental or unlawful destruction, loss, unauthorised alteration, disclosure or access, misuse and any other unlawful form of processing. The Company maintains secure computer systems through which personal data are processed. Adequate control mechanisms for the segregation and management of data are applied to our systems, and restricted access to and security of our premises are ensured, which are subject to periodic checks.
In fulfilling its obligations to protect your personal data, NOVA TRADE duly takes into account the state of the art and applies proven methods in managing security systems and possible risks.
The Company has introduced security procedures as well as technical and physical restrictions on access to and use of personal data.
NOVA TRADE trains its employees in personal data protection policies and procedures to help safeguard information and to restrict access to your personal data to those of our employees who need access in order to perform their duties.
We have strict policies and procedures applicable to our staff to minimise the risks arising from the processing of personal data.
Personal data breach
The Company has adopted procedures for the effective detection, reporting and investigation of personal data breaches. In the event of a personal data breach, the Company will take immediate action to limit the effect of the breach and to inform the affected data subjects and the personal data protection supervisory authority.
Additional information
NOVA TRADE will update this Policy in a timely manner, by amending and supplementing it at any time in the future when legal requirements or other circumstances so require.