Personal Data Policy

Scope

This Personal Data Protection Policy, hereinafter referred to as the “Personal Data Protection Policy”, provides information on how NERO HOLIDAY Ltd., hereinafter referred to as the “Provider”, “Controller”, “we” and/or “us”, owner of the website nerocomplex.com, hereinafter referred to as the “Website”, processes (including, but not limited to, collects and stores) personal data relating to data subjects, such as users of the Website and the Provider’s services, hereinafter referred to as the “User(s)”, “you” and/or “your”, and on the rights of such persons in this regard. The term “personal data” used in this Personal Data Protection Policy has the meaning given to it in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, hereinafter referred to as the “General Data Protection Regulation” and/or “GDPR”, namely: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Information about NERO HOLIDAY Ltd.

Company name: NERO HOLIDAY Ltd., UIC 206936093
Registered office and management address: Sofia, 52 Borovo Street, Entrance G, Floor 2, Office 2
Tel.: +359889 066000, e-mail: neropamporovo@gmail.com
Registration in public registers: Commercial Register maintained by the Registry Agency under the Ministry of Justice of the Republic of Bulgaria.

Information about the Competent Supervisory Authority

Name: Commission for Personal Data Protection of the Republic of Bulgaria

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Telephone: 02 915 3 519

E-mail: kzld@cpdp.bg

Website: https://www.cpdp.bg/

Collection, Processing and Storage of Personal Data

We process, collect and store your personal data solely in connection with our activities and in accordance with the requirements of applicable legislation, including the Personal Data Protection Act of the Republic of Bulgaria and the General Data Protection Regulation. We process your personal data on at least one of the following legal grounds:

The User’s consent to the processing of personal data;
The processing of personal data is necessary for the performance of the Provider’s contractual obligations to the User;
The processing of personal data is necessary in order to take steps at the request of the User prior to entering into a contract;
The processing of personal data is necessary for compliance with the Provider’s legal obligations;
The processing of personal data is necessary for the purposes of the legitimate interests pursued by the Provider in carrying out its activities.

Purposes of Collecting, Processing and Storing Personal Data

We collect, process and store Users’ personal data in connection with the provision of our services and communications relating to the use of the Website, as well as for the following purposes:

Communication and identification in the performance of a service agreement and a sales agreement (including performance of the relevant agreement);
Communication, identification, processing and fulfilment of enquiries, orders, requests, reservations and purchases of goods or services (including preparation for entering into a contract, acceptance of orders, dispatch of goods, resolution of issues related to order or reservation cancellations, return of purchased goods, refunds of amounts paid, and other matters);
Compliance with tax and other legal obligations;
Accounting purposes in connection with the use of our services;
Protection of our legitimate interests in connection with the performance of our obligations to state and municipal authorities (for example: the National Revenue Agency and the Ministry of Interior);
Protection of our legitimate interests in connection with retaining information for defence against legal or tax claims and for improving the performance of the Website;
Protection of the information security of the Website;
Statistical information regarding the use of the Website;
Provision of advertising content based on the User’s interests;
Sending e-mail newsletters and commercial and informational communications through push notifications;

If a data subject refuses to provide some or all of the personal data required for the relevant purpose stated above, we may be unable to provide the relevant service (for example, to perform a contract concluded with the respective User) or to comply with the relevant legal requirements (for example, to enable the data subject to exercise their rights under the GDPR).

How We Collect, Process and Store Personal Data

We observe the following principles when collecting, processing and storing your personal data: lawfulness, fairness and transparency; purpose limitation; limitation of the storage period in view of achieving the purposes for which the data are processed; data minimisation; accuracy and keeping data up to date; integrity and confidentiality in data processing; and ensuring an appropriate level of personal data security.

CATEGORIES OF PERSONAL DATA

We collect the following categories of Users’ personal data for the following purposes and on the following legal grounds:

Your identifying data (first and last name, telephone number and e-mail address), as well as other data that you provide voluntarily, for the purposes of processing your enquiries, providing service offers and providing services at your request, including communicating with you in this regard, on the grounds of taking steps at your request with a view to potentially entering into a contract, performing a contract to which you are a party, or consent to processing provided by you;
Your identifying data (first and last name, telephone number and e-mail address) and information related to payment and selected payment methods, for the purposes of issuing and sending accounting/tax documents (invoices) in connection with services used by you, including communicating with you in this regard, on the grounds of taking steps at your request with a view to potentially entering into a contract, performing a contract to which you are a party, or compliance with our legal obligation;
E-mail address for the purposes of sending advertising and/or informational content from us, including news, newsletters, promotions, participation in loyalty programmes and activities, notifications of improvements or changes to services provided by us, as well as other advertising messages, where you have expressed a wish to receive them, on the grounds of consent to processing provided by you or our legitimate interest in relation to Users who are already our customers and/or partners;
Your IP address, browser settings and preferred language, pages visited and actions performed, for the purposes of sending push notifications, where you have expressed a wish to receive them;
Your IP address and pages visited, for the purposes of protecting information security;
Other data that may be required in certain cases or related to the provision of services to Users by us, including data required for the performance of contractual obligations (for example, date of birth, signature, Personal Identification Number) or other data that Users voluntarily decide to share with us, on the grounds of performance of a contract to which you are a party, consent to processing provided by you, or compliance with our legal obligation.

We do not process or collect from Users special categories of personal data (for example: data revealing racial or ethnic origin, political opinions, genetic or biometric data, or data concerning the data subject’s sex life or sexual orientation). We do not make decisions based solely on automated data processing, including profiling. We generally receive personal data directly from the data subject. However, we may also receive personal data from other persons, such as other employees of the company in which the relevant data subject works, and from publicly accessible sources such as the Commercial Register and the Register of Non-Profit Legal Entities maintained by the Registry Agency under the Ministry of Justice of the Republic of Bulgaria.

PERSONAL DATA RETENTION PERIOD

We retain Users’ personal data for no longer than is necessary to fulfil the relevant purpose of processing or for the period prescribed by law, where applicable. For example:

personal data provided by you when completing the contact form will be retained until the request has been fulfilled or the enquiry in connection with which you contacted us has been resolved, and for a maximum of one year thereafter for statistical and marketing analysis;
personal data of our customers processed in connection with contracts concluded between us and the relevant User will be retained for a period not exceeding ten years, commencing on 1 January of the year following the year in which the contract was reported for tax purposes;
personal data of our customers processed in connection with the issuance of tax documents (invoices) will be retained for a period not exceeding ten years, commencing on 1 January of the year following the year in which the document was reported for tax purposes;
personal data of our partners/suppliers processed in connection with contracts concluded between us and the relevant partner/supplier will be retained for a period not exceeding ten years, commencing on 1 January of the year following the year in which the contract was reported for tax purposes;
personal data of participants in recruitment and selection procedures will be retained for a period not exceeding six months from the final completion of the recruitment/selection procedure in which the relevant data subject participated, or after the expiry of the period for appealing the relevant procedure, unless the data subject has consented to the retention of their personal data for a longer period, in which case the data subject has the right to withdraw their consent at any time and without stating reasons.
The retention period also depends, among other things, on the duration of the legal relationship established between us and the relevant User, as well as on the purposes for which the personal data are processed. Where there are indications of potential legal claims or liability, these periods will be extended accordingly. Where processing is based on the User’s consent (for example, in cases involving personal data provided by third parties for direct marketing), we retain such personal data for as long as we have valid consent for their processing.

After the expiry of the above periods, we take the necessary steps to delete and/or destroy the relevant personal data without undue delay.

Access to Personal Data and Transfer of Personal Data to Third Parties

As a general rule, the Users’ personal data that we process are accessible to our employees, representatives and partners who require them in order to comply with legal obligations and/or perform contractual obligations (for example, to provide a service under a contract with the User). In this connection, at our discretion and in compliance with the requirements of the GDPR, we may transfer all or part of your personal data to third parties such as accountants and professional advisers, including lawyers (for the purposes of the financial, accounting and administrative management of our activities); cloud platforms for data processing/storage (for the organisational support of our activities, for example storing and processing contracts with Users on cloud platforms to ensure greater security); companies providing postal services (for the organisational support of our activities, for example sending hard-copy contracts to Users); providers of IT services, system administration and marketing services (to ensure more reliable and higher-quality operation of the Website and more secure data processing); and providers of information storage services, i.e. hosting companies (for the purposes of performing contracts with Users). Under applicable legislation or at the request of public authorities, all or part of your personal data may also be made available to public authorities. We do not intend to transfer your personal data to countries outside the European Economic Area or to international organisations.

Rights of Data Subjects

At any time while we process your personal data, and subject to the restrictions laid down in applicable legislation, you, as the data subject, have the following rights:

Right of access – you have the right to request information as to whether we process your personal data and to obtain access to and a copy of such personal data; if you request more than one copy of such personal data, you may be required to pay an appropriate fee for each additional copy;
Right to rectification/correction – you have the right to request that your personal data be corrected if you believe that they are inaccurate or incomplete. We will make such corrections without undue delay;
Right to erasure/right to be forgotten – in certain circumstances (for example, where the relevant personal data are no longer necessary for the purposes for which they were collected, or where you have withdrawn your consent to the processing of certain personal data and there is no other legal ground for their processing), you may request that the personal data we process be erased from our records/database without undue delay. In certain cases, we may refuse to erase such personal data (for example, where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims);
Right to restriction of processing – where certain conditions apply (for example, where the processing of certain personal data is unlawful but you do not wish the data to be erased), you have the right to request restriction of the manner in which your personal data are processed;
Right to data portability – where your personal data have been provided to us by you and are processed by automated means, you have the right to request that such personal data be provided to you in a structured, commonly used and machine-readable format and transferred to another personal data controller, where technically feasible;
Right to object – you have the right, at any time, to object to the processing of your personal data for certain purposes, in which case we will cease using the personal data for the specific purpose unless we have overriding legitimate grounds for doing so (for example, you have the right, at any time, to object to the processing of your personal data for direct marketing purposes, in which case we will cease processing your personal data for those purposes without undue delay);
Right to object to automated processing, including profiling – you have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling, and you also have all rights arising where you are subject to the legal effects of such processing;
Right to withdraw consent to processing – where we process your personal data on the basis of consent, you have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

Where, at the request of a User, we erase their personal data from our database, we will retain only the information that may be necessary to protect our legitimate interests or to comply with requests from public authorities. You have the right to request that we inform you of all recipients to whom the personal data subject to a request for rectification, erasure or restriction of processing have been disclosed. We may refuse to provide this information where doing so would be impossible or would involve disproportionate effort. Where we are required to transfer personal data to another controller, rectify or erase personal data, restrict or cease the processing of personal data, provide information about the recipients to whom the personal data subject to a request for rectification, erasure or restriction of processing have been disclosed, or provide access to personal data, and where we have concerns regarding the identity of the User making the relevant request, we may first request additional information in order to verify the identity of the data subject concerned. Where a third party has received all or part of your personal data in connection with the processing of your personal data (as specified in Part IX above), all of the above requests will be forwarded to that third party. The exercise of the above rights is free of charge for Users, except where requests are manifestly unfounded or excessive. In such cases, we may either charge a reasonable fee for acting on the request or refuse to act on the request. Users may exercise the above rights by contacting us by e-mail at neropamporovo@gmail.com.

Complaint to a Supervisory Authority

If you believe that your personal data are not being processed lawfully or that any of your rights relating to personal data protection have been infringed, you have the right to lodge a complaint with the competent personal data protection supervisory authority specified in Part III above of this Personal Data Protection Policy. You also have the right to seek judicial protection of your rights. Where the Website contains links to other websites, we recommend that you carefully review the personal data protection/privacy policies of those websites, because when you visit them, your personal data may be processed by those websites and such processing is not covered by this Personal Data Protection Policy. We reserve the right to amend this Personal Data Protection Policy at our discretion and whenever we deem appropriate.

Nero