Personal data privacy policy of "marinabg.com"

I. GENERAL INFORMATION ABOUT THE ADMINISTRATOR OF PERSONAL DATA AND PROCESSING ACTIONS

This privacy policy regulates the protection of natural persons in connection with the processing of their personal data by "MARINA" OOD, when:

• access by loading the domain marinabg.com in their browser;
• create a user profile on the marinabg.com site;
• purchase goods offered by marinabg.com;
• make inquiries through our contact form, chatbot or by sending messages by email or physical medium to the company's address;
• make inquiries, requests or initiate correspondence with him on any matter.

Through this policy, we aim to provide you with comprehensive information regarding the processing of your personal data in a transparent, accessible and easily understandable manner in accordance with Art. 13 and Art. 14 of (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/ EO (General Data Protection Regulation or known as GDPR), referred to for brevity in this policy as "the Regulation or GDPR".

"MARINA" OOD (referred to as "Administrator/s" for short in the policy) is a commercial company that processes personal data of natural persons in accordance with the requirements of the Regulation, the Law on the Protection of Personal Data, as well as all other applicable legal acts related to the processing and protection of personal data of natural persons. For the purposes of this policy, "MARINA" Ltd. is the administrator of personal data within the meaning of Art. 4, § 7 of the Regulation, as it defines the purposes and means for processing the personal data of natural persons when carrying out their activity.

DATA ADMINISTRATOR DATA
Name	"MARINA" Ltd.
EIC	817073690
Head office and address of management	city Gabrovo, p.k. 5300, Dr. Tota Venkova St. No. 26, entrance D, fl. 2, apartment 6
Contact Person	Rumyana Venelinova Decheva
Phone	+359 899 960 578
Email	office@marina.bg

In case you have questions, suggestions or need additional information related to the processing of personal data and/or their protection, you can contact us at the coordinates indicated above.

Through this policy you will receive information about:

1. General information about the administrator of personal data and processing actions
2. Terms used and their meaning
3. Data categories, purposes, legal grounds and retention periods
4. What rights you have and how to exercise them
5. Information about the supervisory authority
6. To whom we share your personal data
7. Security Measures

II. TERMS USED AND THEIR MEANING

For the purposes of this policy, the terms used herein shall have the following meanings:

• "administrator" means a natural or legal person, public body, agency or other structure that alone or jointly with others determines the purposes and means of processing personal data. The administrator of your data is "MARINA" OOD.
• “deletion” is the irreversible deletion of the information from the respective medium;
• "personal data" means any information related to a natural person that enables his identification or identifies him, including identifiers such as name, identification number (TIN, LNCH, etc. .), location data (geolocalization), online identifier (e.g. IP) or by one or more characteristics specific to the physical, physiological, genetic, psychic, mental, economic, cultural or social identity of that natural person;
  The processing of special categories of personal data is prohibited, except in a few express hypotheses described in Art. 9, § 2 of the Regulation. Such data are personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the sole purpose of identifying a natural person, data on the state of health or data on the sexual life or sexual orientation of the natural person.
• “supervisory authority” is an independent public body that is responsible for monitoring the application of the Regulation in order to protect the fundamental rights and freedoms of individuals in relation to processing and to facilitate the free movement of personal data within the Union. The competent supervisory authority on the territory of the Republic of Bulgaria is the Commission for the Protection of Personal Data.
• “personal data security breach” means a security breach that results in accidental or unlawful destruction, loss, alteration , unauthorized disclosure or access to personal data that is transmitted, stored or otherwise processed;
• “processing” means any operation or set of operations performed on personal data or a set of personal data through automatic (by electronic way) or other means (in paper form) such as collecting, recording, organizing, structuring, storing, adapting or changing, retrieving, consulting, using, disclosing by transmission, distribution or otherwise making the data available, arranging or combining , restriction, deletion or destruction;
• “restriction of processing” means marking stored personal data in order to limit their processing in the future.
• “processor of personal data” means a natural or legal person, public authority, agency or other structure that processes personal data from admin name;
• "risk" is the possibility of material or non-material damage to the data subject under certain conditions, assessed from the point of view of its severity and probability.
• “data subject consent” means any freely expressed, specific, informed and unambiguous indication of the will of the data subject , by means of a statement or a clear affirmative action expressing his consent to the personal data relating to him being processed;
• "data subject" in the sense of this privacy policy is a natural person whose personal data is subject to processing by party of the administrator of personal data within the framework of the activities of "MARINA" OOD and the e-commerce carried out by the company.
• “destruction” is the irreversible physical destruction of the material medium of information.

Terms not defined in the text above have the meaning given to them in Regulation (EU) 2016/679 (the full text of the regulation is available at the following link: https://eur-lex.europa.eu/legal-content/BG/TXT /?uri=celex%3A32016R0679) or the corresponding normative act, in which a definition is expressly provided.

III. DATA CATEGORIES, PURPOSES, LEGAL BASIS AND STORAGE PERIOD

Subject category; Categories and types of personal data	Purpose of processing	Basis and term of storage
E-commerce
Customers Physical identity: two names; Contact data: telephone number, electronic address (email), delivery address; Failure to provide this data prevents the possibility of concluding a contract. For a customer who has claimed receipt of an invoice: Three names of the legal representative (if a legal entity); Three names, social security number and address, if a natural person;	Identification of the subject; Creating and maintaining a user profile (registration); Conclusion and execution of a contract for the purchase and sale of goods, offering in the electronic store; Carrying out correspondence related to the fulfillment of contractual obligations; Implementation of norm. requirements of the Commercial Law, Commercial Law, the Law on Corporate Income Taxation, etc. Issue and delivery of an invoice.	Conclusion or execution of a contract / Art. 6, § 1, letter "b" of the GDPR/; Term: up to 5 years from termination of the contractual basis; Regarding the data in the profile - until a request to delete the created profile.
Financial identity: three names of the holder and bank account number (when paying by bank transfer).	Execution of concluded contract; Keeping accounting records;
Correspondence and handling inquiries
Website visitors using the contact form or making direct email inquiries to the company; Other persons making inquiries and initiating correspondence: Physical identity: two or three names; Contact details: phone or email address. Other information that you have provided in your inquiry (which cannot be pre-identified).	Processing the inquiry and providing a response and assistance in relation to the subject of the correspondence; In certain cases – specification of contractual relations.	Pre-contractual relations / Art. 6, § 1, letter "b" of the GDPR / or Legitimate interest / art. 6, § 1, letter "f" of the GDPR / Term: Up to 1 year, unless the correspondence concerns pre-contractual relations.
Exercising rights under the Regulation and taking action in the event of security breaches
Persons exercising their rights provided for in the Regulation and persons affected by a security breach; Physical identity: three names, address, social security number, phone, email;	Implementation of legally established obligations in accordance with Regulation (EU) 2016/679 and PPE.	Legal obligation / Art. 6, § 1, letter "b" of the GDPR/; Term: 5 years from the last action taken.
Newsletter
Contact details: email;	Send newsletters with offers;	Consent / Art. 6, § 1, letter "a" of the Regulation/; Term: until withdrawal of consent by the subject.

In the event that for a specific type of documents the stipulated statutory period is longer than that indicated in the table above, the administrator shall apply the statutory period. If you wish to receive information regarding the storage period of a specific document, do not hesitate to contact us at the coordinates indicated in this policy.

Through “marinabg.com” we do not process special categories of personal data. We do not process personal data through profiling or other automated decision-making methods.

After the expiration of the storage periods of the personal data, they are anonymized or deleted/destroyed (including the documents in which the latter are objectified), unless:

• are necessary for pending judicial, arbitration, administrative or enforcement proceedings or
• the subject concerned has exercised the right to request the restriction of the processing of personal data concerning him/her.

When providing services through marinabg.com, as well as in our activity outside the website, we do not process personal data of persons under 14 years of age. The services we provide are not intended for persons under this age. In case you detect such processing, please inform us immediately so that we can take the necessary actions.

The electronic store uses "cookies". More information about the cookies used can be found here.

IV. WHAT RIGHTS DO YOU HAVE AND HOW TO EXERCISE THEM?

If MARINA Ltd. processes your data, you have the following rights:


You have the right to receive confirmation as to whether we are processing personal data relating to you. In the event that we process such data, we will provide you with a copy of the data as well as the following information:

• the purposes of processing;
• the relevant categories of personal data;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed;
• when possible, the expected period for which the personal data will be stored, and when not possible – the criteria for its determination;
• the existence of a right to require the controller to correct or delete personal data or to limit the processing of personal data related to the data subject, or to object to such processing;
• the right to appeal to a supervisory authority;
• when the personal data is not collected from the data subject, any available information about its source;
• the existence of automated decision-making, incl. the profiling (with relevant information about the logic used and the meaning and intended consequences of this processing).

In the event that the documents containing personal data about the subject contain personal data of other persons, they will be deleted in an appropriate way.


You have the right to request that we correct the personal data we process about you if it is inaccurate. If you wish us to supplement your personal data, we will ask you to provide us with a declaration/application containing the relevant information.

After receiving your request, we will correct/supplement the data as soon as possible.


You have the right to request the deletion of your personal data. We will delete your data if any of the following grounds apply:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which the processing of the data is based and we have no other legal basis for the processing;
• You object to the processing and there are no overriding legal grounds for the processing;
  When you have objected to processing that takes place for marketing purposes, the data will be deleted without further analysis.
• your personal data has been processed unlawfully;
• personal data must be deleted in order to comply with a legal obligation under EU law or Bulgarian law;
• personal data were collected in connection with the provision of information society services.
  An information society service is any service normally provided for a fee, at a distance, by electronic means and at the individual request of the recipient of the services.

Even if we find that one of the above described hypotheses is present, we will not delete your personal data when the processing is necessary for:

• exercise the right to freedom of expression and the right to information;
• compliance with a legal obligation that requires processing provided for in EU law or Bulgarian law, or for the performance of a task in the public interest, or in the exercise of official powers of the administrator;
• the establishment, exercise or defense of legal claims;
• two more specific hypotheses set forth in Art. 17, § 3, letters "c" and "d" of the Regulation.

You have the right to ask us to restrict processing where:

• You dispute the accuracy of the personal data. In this case, the limitation takes place for the period necessary for "MARINA" OOD to verify the accuracy of the data;
• The processing is unlawful, but you want the use of the personal data to be restricted instead of deleted;
• "MARINA" OOD no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defense of legal claims;
• You have objected to the processing and are awaiting verification of whether the legitimate interests of "MARINA" OOD take precedence over your interests.

The administrator will inform any person to whom data has been disclosed that it has been corrected, deleted or restricted, except in cases where this is impossible or requires a disproportionate effort. In case you wish, we will let you know who these persons are.


You have the right to receive the personal data you have provided to us in a structured, widely used and machine-readable format, and to request that we transfer it to another controller of your choice. In order to take such actions, the following two prerequisites should be present:

• the processing is based on consent or a contractual obligation and
• data to be processed in an automated manner.

You have the right to object to the processing of your personal data when it is based on:

• performance of a task in the public interest or in the exercise of official powers granted to the controller or
• legal (legitimate) interest.

We will stop processing your data immediately if we are unable to demonstrate that there are compelling legal grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.< br>
Where processing is for marketing purposes, we will stop processing your data at the time we process your request.


When the processing of your data is based on consent, you have the right to withdraw the consent provided at any time by notifying us of this at the indicated contacts. The withdrawal does not affect the processing of the data for the period until it is received by the administrator.


Step 1. In case you wish to exercise any of your rights, please download the application from HERE and fill in the required information. The application has been created for your convenience, but you are not required to use it.

If you prefer, you can also send us a request in free form, which must contain the following information:

• your three names;
• TIN/LNC or date of birth (only if you have provided us with such information to date);
• address;
• address for correspondence;
• description of the request;
• preferred form for receiving response and information;
• signature;
• date of submission.

Step 2. Please send your application in one of the following ways:

• by email to office@marina.bg or
• by mail or in person at the address: gr. Gabrovo, p.k. 5300, Voinovo district, Voinovska stop, Commercial complex marina

When the application is submitted by an authorized person, it should be attached power of attorney.

Step 3. After reviewing your application, we will analyze its content and, if necessary, ask you for additional information.
You will receive information about its processing within one month of sending it in the way you have indicated as your preferred communication.

Step 4. In case you need assistance in completing the form we offer, you can contact us at the contact details provided in this policy. We have prepared brief instructions for your convenience with the application (page 3): HERE

You should keep in mind that "MARINA" OOD may refuse to fully or partially satisfy any of the rights described above, when their satisfaction would create a risk to public order and security, the prevention, investigation, detection or prosecution of crimes or the execution of the penalties imposed, including the protection against and prevention of threats to public order and security, other important objectives of broad public interest and in particular an important economic or financial interest, including monetary, budgetary and tax matters, public health and social security, the protection of the subject of the data or the rights and freedoms of other persons or the execution of civil claims.



Each data subject has the right to submit a complaint to a supervisory authority if he/she considers that the processing of personal data concerning him/her violates the provisions of the Regulation or the Personal Data Protection Act. In the event that the subject has a place of employment or habitual residence in the Republic of Bulgaria, as well as when the violation was committed in the Republic of Bulgaria, the latter should refer the Commission for the Protection of Personal Data (KPLD) within 6 months of learning of the violation, but not later - later than 2 years from its execution, by filing a complaint in one of the ways described HERE.

After the entry into force of the Regulation, the subjects of personal data may also submit complaints to other supervisory authorities in the territory of the European Union, when this is provided for in the Regulation.


Without prejudice to your right to appeal to the GDPR, described in item 1, you have the opportunity to file a complaint with the competent administrative court when you believe that your rights under the Regulation/PRGDP have been violated as a result of the processing of your personal data .


In the event that you have suffered material or non-material damages as a result of a violation of the Regulation, you have the right to receive compensation from the administrator for the damages.

V. INFORMATION REGARDING THE SUPERVISORY AUTHORITY

The supervisory authority competent on the territory of the Republic of Bulgaria is the Commission for the Protection of Personal Data (PCPD).

Contact details of CPLD:
Address: Sofia 1592, Prof. Tsvetan Lazarov" No. 2
E-mail: kzld@cpdp.bg
Web page: www.cpdp.bg
Center for information and contacts - phone: 02/91-53-518

VI. WHO DO WE PROVIDE YOUR PERSONAL DATA TO?

Your personal data is provided to:

• competent public authorities in fulfillment of legal provisions or other statutory obligations;
• our partners with whom we have concluded contracts for the provision of various services, incl. lawyers, licensed postal operators, couriers, etc. (all established on the territory of the Republic of Bulgaria).
• when using the chat integrated in the electronic store (Smartsupp) you voluntarily provide information to the company Smartsupp.com, sro , ID No.: 036 68 681 (Czech Republic).

All of our partners comply with the requirements of Regulation (EU) 2016/679, and those of them acting as processors on behalf of "MARINA" OOD have undertaken such commitments through the personal data protection agreements concluded with us (in accordance with Art. 28, §3 of the Regulation).
Your personal data is not provided to other persons within the EU, nor to third countries or international organizations.

VII. SAFETY MEASURES

"MARINA" OOD processes personal data related to you lawfully, in good faith and in a transparent manner, making significant efforts to ensure an appropriate level of security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage to your data. For this purpose, the company applies appropriate technical and organizational measures, including:

• integrated SSL certificate;
• restricted access to the website admin panel;
• keeping operating systems up to date;
• keeping anti-virus programs up-to-date;
• other measures to protect the buildings, premises and facilities in which personal data are processed and stored, detailed in the Company's Internal Rules;
• limited employee access to information resources according to the "need to know" principle;
• documented procedures for processing personal data of natural persons, etc.

VIII. SOCIAL NETWORKS

We use social networks to promote our activities and through them provide information about the services we offer. Each platform has its own privacy policy regarding the processing of your data, which we recommend that you familiarize yourself with.

MARINA OOD maintains the following Facebook page: https://www.facebook.com/marinaOOD. Privacy Policy: https://www.facebook.com/privacy/policy/

CONCLUDING INFORMATION

All amendments and additions to the Privacy Policy will be implemented upon publication of its current content available through our website. In the event that the amendments are substantial and/or substantive, in accordance with the Guidelines on transparency under Regulation 2016/679 of the Article 29 Working Party (now European Data Protection Board), adopted on 29.11.2017, last revised on 11.04 .2018, we will notify you of them by a pop-up message on the Website or by email to the email address you provided (where we have one).