Privacy Policy

Information about the Personal Data Administrator
INTELLIGENT SECURITY SYSTEMS OOD is a company registered under the Commercial Act of the Republic of Bulgaria, with UIC (Unified Identification Code): 106012487, having its seat and registered address at: Bulgaria, Vratsa, Ilinden Str. No. 3.

We process your personal data based on the following grounds:

1. A contract concluded between us and you, in order to fulfill our contractual obligations;
2. Your explicit consent – the specific purpose is indicated in each individual case;
3. A legal obligation, where processing is required by law.

In the following paragraphs, you will find detailed information about how your personal data is processed, depending on the legal basis on which we process it.

1. FOR THE PERFORMANCE OF A CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONS

We process your personal data in order to fulfill contractual and pre-contractual obligations and to exercise our rights under the contracts concluded with you.

1.1. Purposes of processing:

• To verify your identity;
• To manage and fulfill your request and perform the concluded contract;
• To prepare an offer for concluding a contract;
• To issue and send an invoice for the services you use with us;
• To ensure the overall service you need, as well as to collect any amounts due for the services used;
• To keep correspondence in relation to orders placed, requests processed, problem reports, etc.;
• To notify you about anything related to the services you use with us;
• To detect and/or prevent unlawful actions or actions in contradiction with our terms for the respective services.

1.2. Data we process on this basis:

On the basis of the contract concluded between us and you, we process information about the type and content of the contractual relationship, as well as any additional information related to that relationship, including:

• Personal contact details – e-mail address, telephone number, and others;
• Identification details – first and last name, delivery address, e-mail;
• Other feedback we receive from you;
• Information from your activities on our website.

The processing of these personal data is mandatory for us to be able to conclude and perform the contract with you. Without providing us with the above data, we would be unable to fulfill our contractual obligations.

1.3. Providing personal data to third parties

We share your personal data with third parties primarily to offer you high-quality, fast, and comprehensive service. Before sharing your personal data with third parties, we ensure that all necessary technical and organizational measures are in place to protect your data, and we maintain strict control over the fulfillment of this goal. In this case, we remain responsible for the confidentiality and security of your data.

We provide personal data to the following categories of recipients (personal data administrators):

• Postal operators and courier companies;
• Persons contracted to maintain the equipment, software, and hardware used for processing personal data necessary for the company’s activities;
• Persons providing consulting services in various fields.

1.4. Data retention period on this basis

We delete the data collected on this basis 5 years after the termination of the contractual relationship, regardless of whether the contract ended due to expiry, termination, or another reason.

2. FOR THE FULFILLMENT OF LEGAL OBLIGATIONS

It is possible that the law obliges us to process your personal data. In such cases, we are required to carry out such processing, for example:

• Obligations under the Measures Against Money Laundering Act;
• Fulfillment of obligations related to distance selling or off-premises sales as stipulated by the Consumer Protection Act;
• Providing information to the Commission for Consumer Protection or third parties as provided by the Consumer Protection Act;
• Providing information to the Commission for Personal Data Protection in relation to obligations under the data protection legislation;
• Obligations under the Accounting Act, the Tax and Social Security Procedure Code, and other related legislation concerning lawful accounting;
• Providing information to the court or third parties within judicial proceedings, in compliance with the applicable legislation.

2.1. Data retention period on this basis

We delete the data collected in compliance with a legal obligation once that obligation to collect and store the data has been fulfilled or no longer applies. For example:

• Under the Accounting Act, data for accounting purposes must be stored and processed for 11 years;
• Obligations to provide information to the court, competent state authorities, etc., as stipulated by the applicable legislation (e.g., 5 years).

2.2. Providing data to third parties

Where we have a legal obligation, we may provide your personal data to the competent state authority, physical or legal person.

3. AFTER YOUR CONSENT

We process your personal data on this basis only after receiving your explicit, unambiguous, and voluntary consent. We do not foresee any adverse consequences for you if you choose to withhold your consent.

Consent is a separate basis for processing your personal data, and the purpose of processing is specified therein. It does not overlap with the purposes listed in this policy. If you grant us the relevant consent, and until you withdraw it or any contractual relations with you end, we may:

• Prepare product/service offers tailored to you, by performing detailed analyses of your primary personal data.

A detailed analysis is a method that allows the processing of large volumes of data using statistical models, algorithms, etc. This may include the use of personal data, as well as processes of pseudonymization and anonymization, with the aim of deriving information about trends and various statistical indicators.

3.1. Data we process on this basis

Under this basis, we only process the data for which you have given us your explicit consent. The specific data will be determined in each individual case. Typically, the data include:

• Email
• Name
• Address
• Phone number
• IP address
• Other

3.2. Providing data to third parties

On this basis, we may provide your data to marketing agencies, Facebook, Google, or other similar platforms.

3.3. Withdrawal of consent

You may withdraw any of your consents at any time. Withdrawal of consent has no impact on the performance of our contractual obligations. If you withdraw your consent for the processing of personal data for any or all purposes described above, we will no longer use your personal data for those specific purposes. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To withdraw your consent, you simply need to use our website’s functionality or our contact details.

3.4. Data retention period on this basis

The data collected on this basis will be deleted at your request or 6 months after their initial collection.

4. PROCESSING OF ANONYMIZED DATA

We process your data for statistical purposes, meaning analyses where the results are aggregated and therefore the data is anonymous. It is impossible to identify a specific individual from this information.

Your data may also be anonymized. Anonymization is an alternative to deletion. During anonymization, all personal identifiable elements (which allow your identification) are irreversibly erased. Since anonymized data are not personal data, there is no legal obligation to delete them.

5. WHY AND HOW WE USE AUTOMATED ALGORITHMS

We partially use automated algorithms and methods when processing your personal data, aiming to continuously improve our products and services and to adapt them to your needs in the best possible way. This process is called profiling.

6. HOW WE PROTECT YOUR PERSONAL DATA

To ensure adequate protection of our company’s and our clients’ data, we implement all necessary organizational and technical measures provided for under the Personal Data Protection Act and the relevant EU regulations.

Our company has established rules to prevent misuse and security breaches.
For maximum security when processing, transmitting, and storing your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.

7. PERSONAL DATA RECEIVED FROM THIRD PARTIES

We may receive personal data about you from other of our users (for example, if they place an order or provide your details as a contact or recipient).

8. USER RIGHTS

Every user of this website benefits from all rights to the protection of personal data under Bulgarian law and the law of the European Union.
You can exercise your rights through our contact form or by sending a message to our email.

Each user has the right to:

1. Be informed (regarding the processing of their personal data by the administrator);
2. Access their own personal data;
3. Rectification (if data are inaccurate);
4. Erasure of personal data (“right to be forgotten”);
5. Restriction of processing by the administrator or the processor of personal data;
6. Data portability between separate administrators;
7. Object to the processing of their personal data;
8. Not be subject to an automated decision (including profiling) which produces legal effects concerning them or similarly significantly affects them;
9. Judicial or administrative remedy, in case their rights have been violated.

8.1. Right to erasure (“right to be forgotten”)

The user may request erasure if one of the following conditions applies:

• Personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• The user withdraws their consent on which the data processing is based, and there is no other legal basis for the processing;
• The user objects to the processing and there are no overriding legitimate grounds for the processing;
• Personal data have been processed unlawfully;
• Personal data must be erased for compliance with a legal obligation under the law of the European Union or the law of a Member State applicable to the administrator;
• Personal data have been collected in connection with the offering of information society services to a child and the consent has been given by the person holding parental responsibility for the child.

8.2. Right to restrict processing

The user has the right to obtain a restriction of processing from the administrator if:

• The user contests the accuracy of the personal data, for a period enabling the administrator to verify the accuracy of the personal data;
• The processing is unlawful, but the user does not want the personal data to be erased and requests the restriction of their use instead;
• The administrator no longer needs the personal data for the purposes of processing, but the user requires them to establish, exercise, or defend legal claims;
• The user has objected to the processing pending the verification whether the legitimate grounds of the administrator override those of the user.

8.3. Right to data portability

The data subject has the right to receive their personal data, which they have provided to an administrator, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another administrator without hindrance from the administrator to whom the personal data have been provided, where the processing is based on consent or a contractual obligation and the processing is carried out by automated means.

When exercising the right to data portability, the data subject also has the right to obtain the direct transfer of personal data from one administrator to another, where technically feasible.

8.4. Right to object

Users have the right to object to the administrator’s processing of their personal data. The administrator must cease processing unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. Where the objection is to the processing of personal data for direct marketing purposes, the processing must be terminated immediately.

9. COMPLAINT TO THE SUPERVISORY AUTHORITY

Every user has the right to lodge a complaint against unlawful processing of their personal data with the Commission for Personal Data Protection or the competent court.

10. MAINTENANCE OF A REGISTER

We maintain a register of processing activities for which we are responsible. This register contains all the information listed below:

• The name and contact details of the administrator;
• The purposes of the processing;
• A description of the categories of data subjects and the categories of personal data;
• The categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations;
• Where possible, the envisaged time limits for erasure of the different categories of data;
• Where possible, a general description of the technical and organizational security measures.

This Privacy Policy was adopted and approved on May 1, 2024, by INTELLIGENT SECURITY SYSTEMS OOD.