Basic information about the General Data Protection Regulation

This Personal Data Protection Rights Policy of Online Services OOD is based on the requirements of the European Union's General Data Protection Regulation (GDPR), which has applied since 25 May 2018.

The EU General Data Protection Regulation (GDPR) replaces Data Protection Directive 95/46/EC. It aims to harmonize data privacy laws across Europe, end harmful intrusion into the private lives of EU citizens, and change the way organizations in the region use this information. 

As a personal data controller providing services related to internet access to information and databases and the creation, storage and processing of electronic documents, Online Services OOD meets all requirements of the new regulation by collecting personal data only to the extent necessary to provide the service and retaining it responsibly and lawfully.

Information about the Personal Data Controller

1. Name: Online Services Ltd.
2. UIC/BULSTAT : 201851739
3. Registered office and management address: Sofia 1113, Izgrev District, 15-17 Tintyava St., Newton Technocenter
4. Business address: Sofia 1113, Izgrev District, 15-17 Tintyava St., Newton Technocenter
5. Correspondence details: Sofia 1113, Izgrev District, 15-17 Tintyava St., Newton Technocenter
6. E-mail: info@icash.bg
7. Phone.: (+359) 2 960 7123;

Information about the competent supervisory authority:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence details: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Email: kzld@government.bg, kzld@cpdp.bg

Website: www.cpdp.bg

Online Services OOD operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing personal data and on the free movement of such data.

Grounds for collecting, processing and storing your personal data

Art. 1. (1) Online Services Ltd. collects and processes your personal data in connection with services involving online access to information and databases and the creation, storage and processing of electronic documents, specifically on the following grounds:

• Your explicit consent as a customer;
• Compliance with a legal obligation applicable to Online Services OOD;
• For the purposes of Online Services OOD's legitimate interests.

(2) Online Services OOD is the personal data controller for your data as users of our services. For personal data that you process using our services, Online Services OOD acts as a personal data processor.

Purposes and principles for collecting, processing and storing your personal data

Art. 2. (1) Online Services OOD collects and processes the personal data you provide in connection with using our services and registering to participate in our events, including for the following purposes:

• creating an account and ensuring full functionality when providing our services;
• registering a participant for an event organized by Online Services OOD;
• accounting purposes;
• statistical purposes;
• protecting information security;
• sending informational messages, service change notices, recommendations for improving platform use, new and upgraded subscription plans, and more.
• improving and personalizing the service by offering renewal offers, events and other products and services suited to you that may be of interest;
• providing technical support;

(2) Online Services OOD follows these principles when processing your personal data:

• lawfulness, fairness and transparency;
• limitation of processing purposes;
• relevance to processing purposes and minimization of the data collected;
• data accuracy and currency;
• storage limitation in view of achieving the purposes;
• integrity and confidentiality of processing and ensuring an appropriate level of personal data security.

(3) When processing and storing personal data, Online Services OOD may do so to protect the following legitimate interests:

• fulfillment of obligations to the National Revenue Agency, Ministry of Interior and other state and municipal authorities.

What types of personal data does Online Services OOD collect, process and store?

Article 3. (1) Online Services OOD performs the following personal data operations for these purposes:

• User registration on the website and activities related to online access to information and databases, and the creation, storage and processing of electronic documents

• Concluding and performing a commercial transaction with a customer or partner
• Sending information messages – this activity aims to administer messages to customers about service improvements or changes, exceeded limits and expiring services.
• Sending newsletters – this operation aims to administer the sending of newsletters to customers who have requested them;

(2) Online Services Ltd. processes the following categories of personal data and information for the following purposes and on the following grounds:

• Data: Your identifying details (first and last name, email, country, phone)

• Purpose of collecting the data: 1) User registration; 2) Contacting the user and sending information, including newsletters and promotional messages where requested;
• Legal basis for processing your personal data – By accepting the General Terms, registering on the website and purchasing a service, you enter a contractual relationship with Online Services OOD, on which basis we process your personal data under Article 6(1)(b) GDPR.

(3) Online Services Ltd. does not collect or process personal data relating to the following:

• reveal racial or ethnic origin;
• reveal political, religious or philosophical beliefs, or trade union membership;
• genetic and biometric data, health data, or data concerning sex life or sexual orientation.

(4) Online Services Ltd. collected the personal data directly from the individuals concerned.

(5) The company does not carry out automated decision-making using data.

Retention period for your personal data

Art. 4. (1) Online Services Ltd. stores your personal data for no longer than the lifetime of your website account. Once this period expires, Online Services Ltd. takes the necessary steps to delete and destroy all your data without undue delay.

(2) Online Services OOD will notify you if the data retention period needs to be extended to fulfill the purposes, serve the legitimate interests of Online Services OOD or for another reason.

(3) Online Services OOD retains personal data required by applicable legislation for the prescribed period, which may exceed the duration of your registration.

Transfer of your personal data for processing

Art. 5. (1) Online Services OOD may, at its discretion, transfer some or all of your personal data to data processors to fulfill the purposes of processing, in compliance with Regulation (EU) 2016/679.

(2) Online Services OOD will notify you if it intends to transfer some or all of your personal data to third countries or international organizations.

Your rights regarding the collection, processing and storage of your personal data

Withdrawal of consent to process your personal data

Article 6. (1) If you no longer wish Online Services OOD to process all or part of your personal data for a particular purpose or for all processing purposes, you may withdraw your consent at any time by sending a free-form request by email.

(2) Online Services OOD may ask you to verify your identity and confirm that you are the person to whom the data relate.

(3) Withdrawing consent to process personal data required to create and maintain your service registration will make your account inactive.

Right of access

Art. 7. (1) You have the right to request and obtain confirmation from Online Services Ltd. as to whether your personal data is being processed.

(2) You have the right to access data relating to you, as well as information about the collection, processing and storage of your personal data.

(3) On request, Online Services Ltd. will provide a copy of your personal data being processed, in electronic or another suitable form.

(4) Access to the data is provided free of charge, but Online Services OOD reserves the right to charge an administrative fee for repeated or excessive requests.

Right to rectification or completion

Art. 8. You can correct or complete inaccurate or incomplete personal data about you directly through your website profile or by submitting a request to Online Services OOD.

Right to erasure (“right to be forgotten”)

Art. 9.(1) You have the right to request that Online Services OOD erase personal data relating to you, and Online Services OOD must erase it without undue delay where any of the following grounds applies:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You withdraw the consent on which processing is based and there is no other legal basis for processing;
• You object to processing of your personal data, including for direct marketing, and there are no overriding legitimate grounds for processing;
• the personal data has been processed unlawfully;
• the personal data must be erased to comply with a legal obligation under EU or Member State law applicable to Online Services OOD;
• the personal data was collected in connection with offering information society services.

(2) Online Services OOD is not obliged to erase personal data if it retains and processes it:

• to exercise the right to freedom of expression and information;
• to comply with a legal obligation requiring processing under EU or Member State law applicable to the Controller, to perform a task in the public interest, or to exercise official authority vested in the Controller;
• for reasons of public interest in the area of public health;
• for archiving in the public interest, scientific or historical research, or statistical purposes;
• for establishing, exercising or defending legal claims.

(3) To exercise your right to be forgotten, you must submit a request using the option in your profile or send a written request to Online Services OOD. You must also verify your identity and that you are the person to whom the data relate before Online Services OOD by presenting your identity card in person for identification and, if necessary, entering the login details of the person concerned in the presence of an Online Services OOD employee.

(4) Online Services OOD does not erase data it is legally required to retain, including data needed to defend against legal claims or establish its rights.

Right to restriction

Article 10. You have the right to ask Online Services OOD to restrict processing of your data where:

• you contest the accuracy of the personal data, for a period enabling Online Services Ltd. to verify its accuracy;
• Processing is unlawful, but you do not want your personal data erased and request only restriction of their use;
• Online Services OOD no longer needs the personal data for processing purposes, but you require them to establish, exercise or defend legal claims;
• You have objected to processing pending verification of whether Online Services OOD's legitimate grounds override your interests.

Right to portability

Art. 11. (1) You may download the data stored and processed about you in connection with using Online Services OOD's services at any time by submitting an email request.

(2) You may ask Online Services OOD to transfer your personal data directly to a controller you specify, where technically feasible.

Right to receive information

Art. 12. You may ask Online Services OOD to inform you of all recipients to whom personal data subject to a request for rectification, erasure or restriction of processing have been disclosed. Online Services OOD may refuse to provide this information if doing so would be impossible or require disproportionate effort.

Right to object

Art. 13. You may object at any time to Online Services OOD processing personal data concerning you, including processing for profiling or direct marketing purposes.

Your rights in the event of a personal data breach

Art. 14. (1) If Online Services Ltd. identifies a personal data breach likely to pose a high risk to your rights and freedoms, we will notify you without undue delay of the breach and the measures taken or planned.

(2) Online Services OOD is not required to notify you if:

• has implemented appropriate technical and organizational safeguards for the data affected by the security breach;
• has subsequently taken measures ensuring that the breach will not result in a high risk to your rights;
• notification would involve disproportionate effort.

Recipients of your personal data

Article 15. To register a domain within or outside .BG, following your request, Online Services Ltd. forwards the necessary information to the relevant domain registrar, which processes your data as a controller for the purpose of registering the requested domain.

Art. 16. The controller does not transfer your data to third countries.

Other provisions

Art. 17. You can exercise all your rights regarding the protection of your personal data using the forms attached to this information. These forms are not mandatory, of course, and you may submit requests in any format that states your request and identifies you as the data subject.

Article 18. If consent relates to a transfer, the Controller describes the possible risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.

Art. 19(1). When you instruct Online Services Ltd. to process a third party's personal data for the purpose of using the service, Online Services Ltd. acts as a personal data processor.

(2). In the cases under paragraph 1, Online Services OOD acts solely on your instructions as the service user and only insofar as it can exercise control over the personal data you process. Online Services OOD has no control over the content and data you, as the service user, choose to upload to the service, including whether or not those data contain personal data. In this case, Online Services OOD has no role in deciding whether the user uses the service to process personal data, for what purposes, or whether those data are protected. Accordingly, the liability of Online Services OOD in this case is limited to providing information about the service and its functionality through its interface.