Processing of personal data

Introduction

This Personal Data Privacy Policy governs the processing of personal data provided by users of the website www.venturevolution.pro (the “Website”) in connection with the services available on and through the Website. The Website is registered in the name of and is managed and maintained by VENTURE REVOLUTION PRO Ltd., a limited liability company, with corporate seat, registered address and correspondence address at 1 Asenovgradsko Shose St., City of Plovdiv, Plovdiv Municipality, Plovdiv District, tel.: +359877279990, entered in the Commercial Register with the Registry Agency under UIC: 206525260, represented jointly and severally by Roman Doust, Vladimir Angelov Spasov and Plamen Zapryanov – Managing Directors (hereinafter referred to as “VRP”, the “Company”, or “we”). This Personal Data Privacy Policy (the “Policy”), together with the Terms of Use of the Website and all other documents that are mentioned on the Website, sets out the rules that the Company will follow when processing personal data that we collect about you or that you provide us. This Policy does not affect, limit, or cancel your rights arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), the Personal Data Protection Act (the “PDPA”), as well as other applicable European and national regulations in the field of personal data protection.

• the principles that VRP observes when processing personal data;
• the groups of persons for whom personal data is processed;
• the categories of personal data processed by VRP;
• the purposes for which VRP processes personal data;
• the legal grounds for the processing;
• Your rights in relation to your personal data, including the existence of a right to request from VRP access to, correction, or deletion of your personal data or restriction of the processing thereof, a right to object to processing, a right to data portability and a right to complaint to the Personal Data Protection Commission;
• the period for which your personal data will be stored, and in cases where this is impossible, the criteria used to determine this period;
• the “cookies” that the Website uses;
• the categories of third parties to whom VRP can provide personal data.

Please read this Policy carefully before using the Website. If you do not want us to process your personal data in the manner described in this Policy, please do not provide it to us. The provision of personal data by you is voluntary, with a view to the use of certain services on the Website (including the VRP electronic store), access to it or to certain parts/segments/modules thereof. Your possible refusal to provide your personal data would mean a technical and/or legal impossibility for us to provide you with the relevant services, as well as access to the Website or to certain parts/segments/modules thereof. Please note that in certain cases your consent to the processing of personal data may not be necessary if VRP has another legal basis, for example the fulfillment of statutory obligations in relation to the requirements of the Anti-Money Laundering Measures Act and the Regulations for its application. VRP observes the following principles when processing your personal data:

• legality, good faith and transparency;
• limitation of processing purposes;
• relevance to the purposes of the processing and minimization of the collected data; accuracy and timeliness of the data;
• limitation of storage in order to achieve the objectives;
• ограничение на съхранението с оглед постигане на целите;
• completeness and confidentiality of processing and ensuring an appropriate level of personal data security;
• accountability.

In its capacity as a personal data controller, VRP complies with all requirements governing the protection of personal data by only collecting personal data to the extent necessary and storing it responsibly and lawfully. The Company maintains internal order as a personal data controller by implementing technical and organizational measures regarding its personnel, premises, software, hardware, networks, encryption, control, accountability, monitoring, vulnerability checks, etc. We have provided comprehensive and reliable physical, personal, documentary, and cryptographic protection of the personal data we process against unauthorized or accidental access, loss, alteration, disclosure, or destruction of data, taking into account the risks. All our employees have undertaken an obligation to observe confidentiality regarding the personal data to which they have access in the course of their work.

Groups of persons

Groups of persons, for whom personal data is processed, categories of personal data processed by VRP, and terms for their storage. “Personal data” means any information that can be used to directly or indirectly identify you as an individual, in particular an identification such as name, identification number, location data, online identifier, as well as signs specific to your physical, physiological, genetic, psychic, mental, economic, cultural, or social identity. “Processing” means any operation or set of operations performed on your personal data or a set of such personal data by automatic or other means such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, distribution, or other way in which the data could be made available, arranged or combined, restricted, deleted, or destroyed. In connection with the services available on and through the Website, the Company may collect and process your personal data if you fall into any of the following categories:

• natural persons – users of the Website with or without registration who visit the Website without placing an order/requesting a service;
• natural persons, who place an order/request a service through the Website with or without registration;
• representatives, proxies, or employees of legal entities, on whose behalf an order is made/service is requested through the Website;
• natural persons who corresponded with VRP by phone, regular or electronic mail on any matter related to the services available on and through the Website, with this Policy, with technical problems, etc., and in rare cases – natural persons, information about which is contained in such correspondence.

When you add Personal data of another natural person other than you on the Website, or when communicating such data to an employee of VRP, you declare that you have the necessary authorization and consent from this other person, as well as that you have informed him or her and have acquainted him/her with the Company’s Privacy Policy before doing so. We may collect and process the following Personal data relating to you:

• information you provide or update by completing registration forms/fields/forms or by posting content on the Website (names, permanent address, delivery address, date of birth, telephone and/or fax number, electronic address (e-mail), information, related to payments made and due, such as bank, bank account (IBAN) and bank card information, preferred method of communication, invoice data, information about Website settings and notifications, etc.). This includes information entered when registering to use the Website, subscribing to our service, purchasing goods or using services from VRP, posting materials or requests for new services, as well as publicly available information that we receive, including but not limited to, when you connect your profile on the Website with your Facebook profile or with your profile on another social network/third-party application, insofar as such a technical possibility is available on the Website;
• information you provide when you report a problem on the Website, report another user of the Website, or contact us for any other reason. If you contact us, we may keep a record of the correspondence, as well as the result of this processing of the information, in order to remedy the problem;
• details of visits to the Website, including, but not limited to, date and time of access to the Website, pages viewed, IP address, hardware and software used, traffic data, location data, blog and other communication data and resources used, for example, date, time, and IP address of registering on the Website and agreeing to this Privacy Policy;
• if you access the Website through a mobile device, we may process data about your location, as well as information about that device, for example the identification number and type of your device, with a view to providing greater added value to our services. If you do not want us to receive your location data, you may turn off the relevant features on your device that allow tracking, if the device offers such a possibility;
• only in cases where the current legislation against money laundering and financing of terrorism implies that, in addition to the information in the previous subparagraphs, to collect more extensive personal information about you, including, but not limited to, data about: official personal identification number or other unique element of identification contained in an official identity document, the validity period of which has not expired and which bears your photograph, for example a uniform citizen number, a foreigner’s personal number, a personal number from an identity document issued by a competent administration of the European Union or a third country; passport data – series, number, date, place and authority of issuance and validity period of an identity document; country of permanent residence and address; your participation and/or ownership of shares or securities in companies (if applicable); information about the origin of the funds you use to carry out the relevant transaction, as well as about the purpose and nature of your participation in the business relationship you enter into through the VRP online store; any citizenship you hold; your marital status; data about your professional and work activities – profession, place of work (employer); information on whether you hold a senior political office within the meaning of the Anti-Money Laundering Measures Act; a copy of your official identity document; your signature; additional documents, data or information that the law obliges us to collect and which may be different depending on the specific case.

During the management and maintenance of the website www.venturevolution.pro, VRP does not knowingly collect or process:

• personal data of persons under the age of 18, as the services available on and through the Website are not intended for such persons;
• special categories of (sensitive) personal data that reveal racial or ethnic origin, political, religious or philosophical beliefs, membership of trade unions, nor genetic, biometric data, data of the state of health, sex life, sexual orientation, convictions or violations of users on the Website.

VRP does not make decisions based solely on automated processing of personal data, including profiling, and giving rise to legal consequences or similarly significantly affecting the users of the Website, unless there are grounds provided for in the legislation on personal data protection and suitable guarantees are provided to protect the rights, freedoms, and legitimate interests of the users of the Website. We store your personal data only to the extent necessary for the specific purposes of data processing with the purpose to provide you with the services available on and through the Website, to ensure their security and reliability, and to meet your needs, according to our legal or regulatory obligations, so that we can manage our rights (for example, to file claims in courts), or for tax and accounting purposes. When we no longer need your personal data and have no legal basis for continuing to store it, we would take reasonable care to delete it from our system and destroy it without undue delay, or to make it anonymous so that you can no longer be identified by it. In the event that the term of storage of your personal data needs to be extended in order to fulfill the specific pre-determined purposes of the processing, fulfillment of our contract with you for the provision of a financial service remotely, legitimate interests of the Company, or for another reason, you will be notified of this in advance.

Third parties

THIRD-PARTY INTERACTIVE APPLICATIONS
At the discretion of the Company, the Website may include applications offered by other providers, such as Facebook, Instagram, YouTube, etc. You may be offered a “like”, “share” or other similar feature where the provider of this application may link the information it collects about you to your profile in its application. In this way, the information in your profile on the Website may be available to the provider of the relevant application, to other users, and your friends in the relevant application.

Objectives and grounds

PURPOSES AND LEGAL GROUNDS FOR PERSONAL DATA PROCESSING The Company may process Personal data for the following purposes: Depending on the purpose for which the data is used, the legal basis for us to process your personal data may be one or more of the following:

• creating your profile on the Website;
• providing access to the Website or its parts/segments/modules and the possibility to use the available services and functions (or part of them);
• individualization of a party to the contract for the provision of the relevant service and ensuring its implementation;
• establishing contact with you in connection with items ordered by you via the VRP electronic store;
• communicating with you in relation to a report you have made against another user of the Website, in relation to a problem on the Website that you have reported, or if you have contacted us for another reason (for example, to request additional information about a service available through the Website);
• personalizing your visit to the Website, thereby enabling you to get the most out of the services offered through it;
• we may also use the information we collect about you to notify you of any changes in the functionality of the Website or to provide you with other information related to its use. VRP may provide you with information, products, services, news, newsletters, and special promotions that we think you may be interested in, and respond to your inquiries, and you may request that we stop using your Personal data for such purposes as set out below in the “Your Rights” Section;
• for the fulfillment of legally established obligations of the Company;
• financial and accounting activity;
• for the purposes of direct marketing and advertising of VRP products and services, as you may receive communications from us by regular mail, e-mail or telephone (depending on the information you have provided). You have the right to withdraw your consent to the processing of your Personal data for direct marketing purposes, as set out below in the “Your Rights” Section. Sometimes the Website may contain links or references (hyperlinks) to other sites. We may not operate the linked sites and do not endorse the content, services, and products of those sites. We advise you to use the linked sites carefully and with due regard to their content and terms of use. If you transfer to another site through a link from our Website, we may receive aggregated or otherwise anonymous statistical information about your movement to those sites. VRP is not responsible for the privacy policy or content of such sites and you are advised to review their privacy policies.
• given consent by you to process your Personal data for one or more specific purposes from among those mentioned, in which case your Personal data is processed within the scope and under the conditions provided for in the relevant consent.
• need for the performance of a contract to which you are a party, or for taking steps at your request prior to the conclusion of such a contract, including the processing of personal data necessary for this when registering and creating an account and the activities of providing the services, available on and through the Website. In addition, these purposes include communicating with you, including by e-mail, as necessary in connection with the provision of these services and/or with notifying you of any changes to them.
• need to comply with a legal obligation that applies to the VRP. Due to the Company’s specific field of activity, regulations often oblige us to request more detailed personal information about our customers. This information is needed by VRP and the regulatory authorities in order to ensure security for your funds and to provide you with service in accordance with the current legislation.
• need to protect and implement the legitimate interests of VRP or a third party. These legitimate interests may include ensuring the normal functioning and use of the Website by you and other users, maintaining and administering the services available on and through the Website, resolving disputes, detecting and preventing malicious actions, detecting and resolving of technical or functionality problems, development and improvement of the services available on and through the Website, communicating with you, including electronically, on important issues related to these services, receiving and processing signals received from you or requests for additional information, implementation and protection of the rights and legal interests of the Company, including by court order, as well as providing assistance in implementation and protection of the rights and legal interests of other users of the Website or affected third parties.

Your rights

In relation to the processing of your Personal data, you have the rights listed below, which you may exercise by sending a request in paper form to the VRP correspondence address indicated in the Introduction Section or electronically to the e-mail: info@venturevolution.pro. The application should be in free text, and if necessary, our Data Protection Officer will provide you with full assistance in formulating it. The Company undertakes to fulfill your requests regarding your Personal data in a timely manner. Any received application, inquiry, request, or any other correspondence related to the protection of personal data will be answered within one month, and if it is necessary to extend the said period, you will be informed about the extension, as well as the reasons for the delay. In order to avoid any misuse, we reserve the right to request additional data and actions from you in order to establish the identity of the applicant and the data subject to whom it relates, such as presenting an identity card or entering of your login details in the profile of the person to whom the data relates before an employee of VRP. The right to request access to Personal data relating to you, and in particular to request access to it from the Company:

• confirmation of whether Personal data relating to you is being processed;
• information about the purposes of such processing, the categories of Personal data, the recipients or categories of recipients, to whom personal data relating to you is disclosed;
• a message in an understandable form, containing the Personal data concerning you, as well as any available information about their source;
• information about the logic of any automated processing of Personal data concerning you.

Providing access to your Personal data is free of charge, but VRP reserves the right to impose an administrative fee in case of repetitive or excessive requests. The right to ask the Company to delete, correct, or block Personal data concerning you, the processing of which does not meet the requirements of the Personal Data Protection Act, as well as to ask the Company to notify third parties to whom your personal data has been disclosed of any deletion, correction or blocking, except in cases where this is impossible or involves excessive efforts. You may correct or complete any inaccurate or incomplete Personal data relating to you directly through your profile on the Website. The right to ask VRP to delete your Personal data without undue delay (the so-called “right to be forgotten”) on any of the following grounds:

• the Personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• when you object to the processing – in cases where the processing of your Personal data is necessary for the purposes of the legitimate interests of VRP or a third party, or your Personal data is processed for the purposes of direct marketing, and there are no legal grounds for the processing that take precedence;
• when the processing was unlawful;
• when your Personal data must be deleted in order to comply with a legal obligation under the law of the European Union or the law of a Member State that applies to VRP;
• when you have withdrawn your consent, on which the data processing is based, and there
• is no other legal basis for the processing;
• when your Personal data has been collected in connection with the provision of information society services.

In these cases, VRP may refuse to delete your Personal data for the following reasons:

• А) to exercise the right to freedom of expression and the right to information;
• B) to comply with a legal obligation that requires processing provided for in the law of the European Union or the law of the Member State that applies to VRP, or for the performance of a task in the public interest or in the exercise of official powers that have been granted to VRP;
• C) for reasons of public interest in the field of public health;
• D) for archiving purposes in the public interest, for scientific or historical research, or for statistical purposes;
• E) for the establishment, exercise, or defense of legal claims.

VRP does not delete the data it has a legal obligation to store, including for defense in connection with legal claims made against it or for proving its rights. The right to request from VRP the restriction of the processing of your Personal data when any of the following hypotheses is present:

• You dispute the accuracy of the Personal data, for a period that allows VRP to verify the accuracy of the Personal data;
• the processing is illegal, but you do not want your Personal data to be deleted, but only to have its use restricted;
• VRP no longer needs the Personal data for the purposes of processing, but you require them to establish, exercise, or defend your legal claims;
• You have objected to the processing pending verification of whether the Company’s legal grounds take precedence over your interests.

When the processing of your Personal data is restricted as a result of your request in this sense, such data is processed by VRP, with the exception of its storage, only with your consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural person, or due to important grounds of public interest for the European Union or a Member State. When you have requested restriction of the processing of your Personal data, VRP will inform you before the cancellation of the restriction of processing. The right at any time and on grounds related to your particular situation, to object to processing of Personal data concerning you that is necessary for the purposes of the legitimate interests of VRP or a third party, including profiling based on such interests. In these cases, VRP will stop processing your Personal data, unless it proves that there are compelling legal grounds for the processing that take precedence over your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. The right to object at any time to the processing of your Personal data, including if it is processed for the purposes of profiling or direct marketing and advertising, and to the disclosure of your data to third parties and their use on their behalf for the purposes of profiling or direct marketing and advertising. In these cases, the processing of your Personal data for these purposes is terminated for the future. The right to receive the Personal data concerning you that you have provided to VRP in a structured, widely used and machine-readable format, and the right to transfer this data to another controller without hindrance from VRP (the so-called “right to data portability”) when the processing is carried out in an automated manner and is: based on your consent to the processing of your Personal data for one or more specific purposes, or is necessary for the performance of a contract to which you are a party, or is necessary to take steps at your request prior to entering into such a contract. When you exercise your right to data portability, you have the right to obtain a direct transfer of your Personal data from VRP to another controller, when this is technically feasible. The exercise of your right to data portability does not affect the right to erasure of your Personal data (“right to be forgotten”) and could not be exercised if it would adversely affect the rights and freedoms of others. The right not to be subject to a decision based solely on automated processing of your Personal data, including profiling, which gives rise to legal consequences for you or similarly significantly affects you, unless there are grounds for this provided for in the applicable legislation on personal data protection and appropriate guarantees are provided for the protection of your rights, freedoms, and legitimate interests. The right to request that VRP inform you about all recipients, to whom the Personal data for which correction, erasure, or restriction of processing is requested, has been disclosed. VRP may refuse to provide this information if it would be impossible or would require a disproportionate effort. The right to be notified by VRP without undue delay when, due to a breach of the security of your Personal data, a high risk to your rights and freedoms may arise, including the right to be notified of the measures that have been taken or about to be undertaken. VRP has no obligation to notify you if:

• it has taken appropriate technical and organizational measures to protect the data affected by the security breach;
• it has subsequently taken measures to ensure that the breach will not result in a high risk to your rights;
• the notification would require a disproportionate effort.

The right to be notified in the event that VRP determines that, for any reason, it is unable to fulfill its obligations under this Policy or under current regulations in the field of personal data protection. The right to be notified in advance in the event of a merger, acquisition, or sale of assets of VRP affecting the processing of your Personal data. The right to contact the Data Protection Officer of VRP at the following address: 1, Asenovgradsko Shose St., City of Plovdiv, Plovdiv Municipality, Plovdiv District, e-mail: info@venturevolution.pro, or tel.: +359877279990. The right to file a complaint with the competent supervisory authority: Personal Data Protection Commission, address: 2, Prof. Tsvetan Lazarov Blvd., tel.: +35929153518, e-mail: kzld@government.bg, kzld@cpdp.bg, website: www.cpdp.bg, if you think that your rights related to the protection of personal data, have been violated.

Provision of personal data to third parties

In certain cases, in order to fulfill our obligations under a contract concluded with you or to fulfill legal obligations, it is possible that we will be obliged or a need may arise to disclose Personal data provided by you to third parties, for example our trusted partners or competent authorities, namely:

• competent state and local authorities and their administrations, including, but not limited to, the Personal Data Protection Commission, the Commission for the Protection of Consumers, the National Security Agency, the National Revenue Agency, the Minister of Finance, the Bulgarian National Bank, customs bodies, bodies of the Ministry of Interior, judicial bodies. Your Personal data may be provided to such authorities in order to comply with their order, to comply with a legal obligation, or to protect the rights, property or security of VRP, our customers, or others;
• to courier service providers;
• to providers of IT services, hosting services, services for database maintenance, technical equipment, software and applications that may contain data about you (such services are sometimes associated with access to your Personal data for the performance of these tasks), social networks, web analytics and search engines, using tools to refine user-generated content;
• for the purposes of carrying out various promotional activities, advertising and marketing campaigns, PR initiatives and realization of similar events, as well as for analyzing their effectiveness, through the use of external services of companies and organizations specialized in the specified fields (advertising, marketing, digital and social media agencies), with a view to fulfilling their contractual obligations and responsibilities.

VRP may provide your Personal data to third parties unrelated to VRP selected by us for the fulfillment of predetermined and specific purposes of processing, provided that these third parties undertake to ensure an adequate level of personal data protection, to comply with the requirements of European and national legislation and our instructions in accordance with this Privacy Policy, and to refrain from processing your Personal data for any other purposes, except in connection with the services provided to us. VRP may also provide aggregated statistics about customers, sales, browser types, operating systems, Internet, domain, demographic or profile data, traffic patterns, and related information from the Website to third parties, but these statistics do not contain Personal data that would identify you. VRP will notify you in case of any intention to transfer part or all of your Personal data to a third party or international organization, in which case it will describe the possible risks of data transfer to a third party in the absence of a solution for adequate protection and suitable means of protection.

Inapplicability of the Policy

This Policy does not apply to third parties who view/use user-generated content on the Website after it has been posted on the Website, including, but not limited to, information in your profile, materials you have posted/submitted, etc. Providing your Personal data to other users of the Website is at your own risk and VRP is not responsible for any damages or violations you suffer as a result of such provision.

Final provisions

This Policy can be found at: https://venturevolution.pro/en/processing-of-personal-data/

VRP reserves the right to change and/or supplement this Policy at any time. Changes take effect immediately after they are published on the Website, unless otherwise provided in the updated version of the Policy. You should periodically visit this page to review the Policy. The Policy may be updated at any time without special notice to the users of the Website. VRP is not responsible if users of the Website have not familiarized themselves with the latest version of this Policy.