Privacy Policy - ForBgKids

NOTICE CONCERNING THE PROCESSING OF PERSONAL DATA

I. Introduction

“Chance for Children and Nature Foundation of Bulgaria” (hereinafter referred to as “the Foundation”) is a non-profit legal entity for carrying out public benefit activities, established under the provisions of the Non-Profit Legal Entities Act. The Foundation is a non-governmental, non-religious and non-political organization. The Foundation is registered in the Commercial Register and the Register of Non-Profit Organizations at the Registry Agency with the UIC: 176040614, with its registered office and management address in the town of Breslau. Sofia, p.k. 1000, “Sredets” district, ul. “Khan Krum” № 3, floor 2, with address for correspondence in Sofia, Sofia. Burgas, pl. “At. Sirekov” № 4, with website: www.forbgkids.org

The Foundation collects and processes personal data as a personal data controller in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “the Regulation”/”the Regulation”). In some cases, the Foundation is not acting as a controller but as a processor of personal data within the meaning of the Regulation (e.g. in view of the conditions of the Erasmus+ Programme provided for in Regulation (EU) 2021/817 of the European Parliament and of the Council of 20 May 2021 establishing Erasmus+ – the Union programme for education and training, youth and sport and repealing Regulation (EU) No 1288/2013), hereinafter referred to as the ‘Erasmus+ Programme’). In the course of the Erasmus+ Programme, data may be transmitted to the European Commission, which is the data controller (European Commission website: https://commission.europa.eu/index_bg).

For all questions related to the processing of your and/or your children’s personal data you can contact us at + 359 887 201 033, or write to us at: pl. “At. You can contact us by e-mail at Atty. Burgas 8000, or email info@forbgkids.org. For the purposes of this Notice, “children” means persons under the age of 18. For the avoidance of doubt, wherever in this Notice data is mentioned (including where it is stated “your data”, “your data”, etc.), both children’s data and adults’ data is meant, even if this is not explicitly stated.

It is very important that the information we have about you is correct and up to date. Please inform us if there are any changes or if you notice any errors.

II.Your responsibilities:

•Read this Notice and check it regularly.
•If you are in a contractual relationship with us, please check the related terms and/or policies: they may contain additional details about how we collect and process your data.
•Also note the additional information and terms and conditions we make you aware of at various stages of our interaction.
•If you provide us with personal information about others, or if others provide us with your information, we will only use that information for the specific purpose for which it was provided to us. If you provide us with information about third parties, you should have a legal basis for doing so and you should also make the third parties aware of how we will process their data, including this Notice.

III.What information do we collect about you?

Information you provide to us:

This is information, which includes personal data, that you provide to us by filling in forms and other documents for participation in competitions, Olympiads, contests, projects/programmes, trainings and other events (hereinafter referred to as “Activities”), sending inquiries and messages via the Foundation’s website or other means (including via the Viber application), and when you make follow-up contact with us in the course of reviewing your documents.

In connection with the organization of Activities, the Foundation processes information about the following data subjects:

a) Participants in Activities – for them the Foundation may process e.g. identification data – full name, date, place of birth, personal identification number; education and qualification data; contact details; photographs; videos, etc.

b/ Parents/guardians/guardians of participants in the Activities – for them the Foundation may process, for example, identification data – full name, SSN; contact details; bank account of parents/guardians/guardians of the winners, in the case of granting a cash prize by the Foundation, etc.
c/Individuals who have sent a message using one of the contact forms on the website or who have sent correspondence electronically or to the Foundation’s contact address;
г/

Jury/committee members – for these the Foundation may process, for example, identification data – full names, education and qualification data; contact details, etc.

e/ Accompanying participants in Activities, for example on trips.

IV.Purposes of processing personal data

We process personal data for certain purposes and on relevant legal grounds, depending on your role vis-à-vis us.

In carrying out its activities, the Foundation processes information constituting personal data about you and your children for the purposes set out below.

1.To carry out its activities and to manage its relationships with participants in Activities organized by the Foundation. The Foundation could process your personal data as well as the personal data of your children in the following cases (if and to the extent applicable to the relevant Activity):

a) Obtaining documents for participation in Activities organized/implemented by the Foundation. Participation in the Activities of the Foundation is voluntary and participants’ data is processed only for the purpose of their participation in the respective Activity and/or promotion of their work;
b) Review of entries/works of entrants in the relevant Activity; judging; where the Activity includes the determination of a winner(s), the determination of the winner(s) and the announcement of the winner(s) on the Foundation’s website;
c) Correspondence with participants in the relevant Activity organised/implemented by the Foundation;
d) Awarding prizes to the winner(s) of the relevant Activity (where the Activity involves the determination of a winner(s));
e) Organizing exhibitions, as well as publishing books, brochures and other materials containing the works of participants in the Activities organized by the Foundation;
f) Videotaping and/or photographing celebrations organized by the Foundation for the awarding of the winner(s) of the Activities (when the Activity includes the determination of a winner(s)) and using such videos/photos for the purpose of promoting the activities of the Foundation;
g) Obtaining preliminary information that is necessary for the conclusion of a contract, when requested by the Foundation to conclude a contract;

(h) Objectives related to contractual obligations:

– identification of a party to a contract, conclusion of a contract, amendment and/or termination of a contract; making payments; sending information relating to payments, correspondence in connection with a concluded contract, performance of contractual obligations, exercise of rights under a contract;
– updating your and/or your child’s personal data.

i) Organizing and/or conducting Activities, including trips, overnight stays, etc.
j) The full names, ages and photographs of participants/finalists/winners of Activities may be published on the official website of the Foundation for the purpose of promoting the activities of the Foundation and/or for the purpose of notifying that the persons concerned are participants/finalists/winners of the Activity.
k) In order to promote its activities, the Foundation could use photographs/videos of you, as well as your name, age, school, etc., and include them in social media posts, media materials, etc.

If you are a party to a Contract with us:

– for the purposes of performing our obligations under the Contract with you, we will process the information on the basis of “for the performance of a contract to which the data subject is a party”.

– we will process information on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a relevant legal obligation (e.g. under tax/accounting legislation);

– we may process your data on the grounds “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;

-we could process your data on the basis of “your consent”;

– other processing activities will be carried out on the basis of our “legitimate interests” to seek/report on the performance of the contract between us and with a view to the possible establishment, exercise or defence of legal claims.

If you represent/work for an organization that has contracted with the Foundation:

-we will process information on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a corresponding legal obligation (e.g. under tax/accounting legislation);

-we could process your data on the grounds “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;

-we could process your data on the basis of “your consent”;

other processing activities will be carried out on the basis of our “legitimate interests” to perform and to seek/report on the performance of the contract and with a view to the possible establishment, exercise or defence of legal claims.

If you are not a party to a Contract with us and do not represent/work for an organisation that has entered into a contract with the Foundation, the processing referred to in this paragraph 1 could be:

-on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a corresponding legal obligation, or

-on the basis of a “legitimate interest” in carrying out the purposes of the Foundation and/or in carrying out activities that it is entitled to carry out, or

-on the basis of “your consent”, or

-on the ground “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

2.Exercising the rights within the meaning of Regulation (EU) 2016/679 before the Foundation, as a personal data controller; dealing with received signals, objections, complaints, carrying out checks, providing feedback. In these cases we process the data:

– on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a corresponding legal obligation, or

– on the grounds of “legitimate interest”, the legitimate interests being to take care of the organisation of the Foundation’s activities and/or to comply with the Foundation’s constitution/by-laws and/or other documents adopted by its bodies, or

– on the ground “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

3.When you are a visitor/user of our website www.forbgkids.org:

a) Automatically collected information: you can access the website without entering personal data. However, in this case certain information is automatically processed – Log files / event files /. In particular, when you visit the website, our web server stores the IP address, date and time of your visit.

We process Log files /event files/ on the grounds of “legitimate interest”, the purposes being security, technical support and/or prevention/detection of breaches/crimes.

b) Social plug-ins or buttons /Social Plug-ins/ Facebook, Instagram, Twitter and/or others. Their use is optional. They link to third party websites that collect and process personal data according to their own terms/policies. For your information and rights, we ask you to read the terms/policies of the respective third parties.

We have placed these plugins/buttons to make our website more functional for visitors, and to promote our activities if you voluntarily share our content on relevant websites. We consider this to be our “legitimate interest” and accordingly apply the “legitimate interest” basis for processing data under this paragraph (b). More information about the social plugins used can be found here .

c) Other links to third party websites.

Our website may also link to other websites. If you choose to follow these links, please read the privacy policies of the respective websites in detail to understand how your information will be handled. The use of these links on our website is based on our “legitimate interest” in making the website more functional for visitors, as well as our and the relevant third party’s “legitimate interest” in developing our business.

d) Personal data that you provide to us through the website.

When you use the contact form or any other form on our website (if there is a form(s) on the website at the relevant time) or any of our other services on the website, we process the personal data for the purpose for which you provide it to us, i.e. in accordance with the specific function and your request. The mandatory fields that we have provided (if any) are the minimum information that we have determined that we need. Please do not provide us with any personal information about you that is not necessary for the relevant purpose. We also process the information that is created for the purpose of our interaction, for example the actual content of messages sent via the website.

There are cases in which we process your data on a so-called pre-contractual basis (basis “to take steps at the request of the data subject before entering into a contract”). We apply this ground in all cases in which you request to enter into a contract with us and we process your necessary data for this purpose. In other cases, there may be a contract between us and the processing of your personal data through the website is in connection with the performance of a contractual obligation by us (“for the performance of a contract to which the data subject is a party” ground). We may also apply the “your consent” ground for a particular purpose.

In the cases referred to in Article 6 of the Electronic Document and Electronic Certification Services Act (e.g. when you send a message via our website), we store information about the time and source of the electronic statements transmitted for a period of one year. We do this on the basis of “to comply with a legal obligation that applies to the Foundation”. The purpose is to comply with relevant legal obligations.

In other cases (for which no other basis is specified in this paragraph “d)”), the basis for processing your data is our “legitimate interest” in responding to/complying with your request and/or to perform a contract entered into between the Foundation and a third party and/or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

e) Sensitive data about you /special categories of data/.

Special categories of data, or also ‘sensitive data’, are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the sole purpose of identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Please do not provide us with such data if we have not requested it from you. Providing such data and other personal data that is not necessary for the relevant purpose of our interaction with you puts your data at unnecessary risk.

IV.If you are a visitor to our office:

In this case, we will ask you to introduce yourself and provide us with basic information about you /your name, the organization you work for or represent/. We may also record the day you visited us, possibly the specific time, and information about the people you met.

We will use the information obtained on the basis of our “legitimate interests”. We process the information in order to control access to our office and for security reasons. We might also use the information for the purpose of reporting/monitoring the activities of the Foundation and the activities of the Foundation’s bodies and those working for the Foundation (including employees).

5.If you are a participant in an event (conference, presentation, cocktail, meeting, forum and other events) that we organise and/or participate in:

We will gather the necessary information for your involvement and participation. Occasionally we may ask for information about your preferences to make the event more enjoyable and/or useful.

In some cases, audio, video, audio-video recordings and/or photographs may be made in connection with events (e.g. during the events themselves). Photographs of you, and possibly other details of you, may be published on the official website of the Foundation to promote its activities. In order to promote its activities, the Foundation could use photographs/videos in which you participate, and possibly other data about you, by including them in social media posts, media materials, etc.

We might also keep your details so that we can contact you occasionally and send you information about our other similar events. We may also ask for your feedback on how you rate our event in order to analyse, plan and/or improve our activities.

We could carry out the data processing activities described in this point 5. on the following grounds:

– on the grounds of ‘legitimate interest’ to fulfil the purposes set out in this paragraph

– on the ground ‘for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’ or

on the grounds of “your consent”..

Depending on the ground we apply, you have the right to object to the above uses of your data or to withdraw consent you have given as described below in relation to your rights.

6.If you are a participant in our campaign.

We could organise such campaigns, for example through our social media accounts. In these cases, we will process the information you provide to us for the purpose of your participation in the relevant campaign on the basis of our “legitimate interest” in running the relevant campaign or on the basis of “the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

7.Blogs, forums and social media.

You may wish to participate in various blogs, forums and social media. Any personal data or other information you share on them is accessible by third parties and may be read, collected and used by other users over whom we have only partial or no control. We recommend that you review the privacy statement of each third party site linked to our site to determine how they use your personal information.

If you have “liked” and/or “follow” our social networking profile/page, in accordance with the practices of the relevant social network, you may automatically see messages, posts and/or materials posted by us. If you make an enquiry to us via the relevant social network or comment on a post, we may use the features of that network to respond to you and if you have requested that we contact you in another way / for example, by giving us your telephone number / we will try to comply with your request.

We will process data under this clause 7 on the basis of our “legitimate interests” to promote/improve our business and/or respond to you.

8.If you are a person with whom we are in contact in connection with a contractual relationship of the Foundation outside of the cases referred to in paragraph 1 of this Section IV:

This means, for example, that you are a donor, beneficiary, recipient, partner or supplier in relation to the Foundation or you represent/work for an organisation that is a donor, beneficiary, recipient, partner or supplier in relation to the Foundation. For example, the Foundation could be party to contracts for funding, donation, purchase of materials, commissioning of work, collaboration, publication, sale and resale of literature, and contracts concerning intellectual property. In order to maintain our business relationship, we will often need information about you, for example: your name, telephone number, e-mail address, information about your position in the relevant organization. We might also process the following information: written/electronic or other correspondence with you; data contained in documentation relating to our relationship, e.g. your signatures, description of your conduct, your statements etc; data relating to payments, accounting and tax obligations; any other information we need in connection with the Foundation’s contractual relationship.

If you are a party to a Contract with us:

– we may process your data on the grounds “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;

If you represent/work for an organization that has contracted with the Foundation:

– we may process your data on the grounds “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;

– other processing activities will be carried out on the basis of our “legitimate interests” to perform and to seek/report on the performance of the contract and with a view to the possible establishment, exercise or defence of legal claims.

9.If you are a person with whom we are in contact in connection with the possible conclusion of a contract outside the cases referred to in paragraph 1 of this Section IV:

This means, for example, that you are a potential donor, beneficiary, recipient, partner or supplier in relation to the Foundation or you represent/work for an organisation that is a potential donor, beneficiary, recipient, partner or supplier in relation to the Foundation. We may have your information from a professional public record, from a person with whom you have worked or whom you know for other reasons, you may have given us your business card or contacts at an event, meeting or otherwise. In these cases, we will make a judgement as to for what purpose and on what basis we might use your contact details. We will take into account the context in which we received your data and your reasonable expectations about the Foundation’s use of your data.

If we determine that we have a legitimate interest in contacting you for the purpose of communicating with you in connection with any future contractual relationship with the Foundation, you will have the right to object to such use of your data as described below in relation to your rights. If you request to enter into a contract with us, we will process your data necessary for this purpose on the basis of “to take steps at the request of the data subject prior to entering into a contract” (this does not apply if the contract will be with an organisation you represent/work for, in which case the “legitimate interest” basis under the previous sentence applies). We may need to ask for your consent, and if you give it, we will process your data on the basis of ‘consent’. In some cases, we may process your data on the basis of “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

10.In other cases (other than those set out above in this Section IV), if you are a person with whom we have contact in connection with carrying out the purposes of the Foundation

The purpose of such processing is to carry out the purposes of the Foundation and/or to carry out activities which it is entitled to carry out. For example, we might process data of members of other non-profit organisations, members of their bodies, members of working groups we have established, and individuals working in various institutions/authorities.

The above processing could be:

– on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a corresponding legal obligation, or

– on the basis of a “legitimate interest” in carrying out the Foundation’s purposes and/or activities that it is entitled to carry out, or

– on the ground “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

11.If you want to become an authority/member of the Foundation:

If you have expressed a wish to do so, we will collect the necessary data for this purpose in accordance with the Foundation’s constitution/by-laws, other documents adopted by its bodies and applicable law. The above processing could be:

– on the basis of “compliance with a legal obligation applicable to the Foundation” where there is a corresponding legal obligation, or

– on the ground “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

12.For what other purposes may we use your personal data?

We have described above the most typical purposes for processing them, but you should also consider the following purposes:

– for the administration of our activities, including reporting and analysis within the Foundation itself – we apply our “legitimate interest” or “for the performance of a task in the public interest or in the exercise of official authority vested in the controller” grounds;

– prevention of fraud and other unlawful activities – we apply our “legitimate interest” or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” grounds;

– to establish, exercise and/or defend our legal claims – we apply the ground of our “legitimate interest”;

– to perform our obligations under a contract to which you are not a party – we apply our “legitimate interest” ground;

– to analyse our performance and improve it – we apply our “legitimate interest” ground.

– for the performance of our obligations under a contract to which you are a party – we apply the ground “for the performance of a contract to which the data subject is a party”;

– to comply with our obligations under applicable law (e.g. accounting law, tax law, etc.) – we apply the grounds “to comply with a legal obligation that applies to the Foundation” or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

V.Legal basis for processing personal data

We apply legal grounds under the Regulation for processing your data.

1.For compliance with a legal obligation applicable to the Foundation (Article 6(1)(c) of the Regulation)

These are the cases where the processing of your personal data is necessary to comply with our legal obligation under tax legislation, accounting legislation, etc.

2.Legitimate interest (Article 6(1)(f) of the Regulation)

When we define our legal basis as “legitimate interest”, we first assess what it is and whether processing your data is necessary to achieve it. We also consider whether it is overridden by your interests or fundamental rights and freedoms which require the protection of personal data. Regardless of our assessment, you always have the right to object to processing based on our legitimate interests as described below in Section XII, item 4.

Where we process your data on the basis of “legitimate interest”, the description of the legitimate interest is the same as the description of the purpose of the data processing.

3.For the performance of a contract to which the data subject is a party (Article 6(1)(b), first hypothesis of the Regulation)

This may apply where you yourself (as an individual) are party to a contract with the Foundation.

4.For taking steps at the request of the data subject before the conclusion of a contract (Article 6(1)(b), second hypothesis of the Regulation)

This may apply where steps are taken at your request before entering into a contract with you (as an individual).

5.Your consent (Article 6(1)(a) of the Regulation)

This is any freely given, specific, informed and unambiguous indication of your will, by means of a statement or a clear confirmatory action, which expresses your consent to the processing of personal data relating to you.

If we need to process your “sensitive data” (see Section IV.3(e) above for more information) on the basis of your consent, this should also be explicitly given. You will find out how you can withdraw your consent at any time in section XII(7).

Note that consent is a different legal basis from those described above. For example, signing a contract between us does not amount to consent.

6.For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) of the Regulation)

In some cases, our personal data processing activities are also based on the need to carry out tasks in the public interest or in the exercise of official authority vested in the controller.

If you have any concerns or doubts about what exactly is the applicable basis for a specific purpose of processing your data, you can always contact us.

VI.Are you obliged to provide the Foundation with the personal data and the possible consequences if these data are not provided:

In general, you are not obliged to provide us with the personal data (you are only obliged to do so if you have a contractual or legal obligation to do so). In some cases, providing some of your personal data is a legal requirement (for example, under tax law) and/or a requirement necessary to enter into a contract (in which case, we will notify you). If you do not provide us with certain personal data, we may not be able to enter into or perform a contract with you or the child, or we may not be able to fulfil one of our other data processing purposes.

VII.Combining information. Obtaining data from other sources

Sometimes we combine information about you that we receive from you through different channels of communication / e.g. by email, telephone, through our website / or from other sources – public sources such as the Trade Register, the Register of Non-Profit Legal Entities and the BULSTAT register or from third parties – e.g. our partners with whom you interact in connection with your relationship with us. When we combine this information, we do not use it for a purpose that you are not aware of. Where we receive information from sources other than yourself, this information is limited to what is necessary in relation to the purposes for which it is processed.

VIII.Principles for the collection and processing of personal data:

The Foundation adheres to the following principles when processing your personal data as well as your child’s data:
– lawfulness, fairness and transparency;
– limitation of the purposes of processing;
– relevance to the purposes of the processing and minimisation of the data processed;
– accuracy and timeliness of the data;
– personal data are not used for profiling;
– personal data are not used for direct marketing;
– limitation of storage for the purpose of achieving the purposes;
– integrity and confidentiality of personal data and ensuring an appropriate level of security of personal data;
– accountability.

IX.Transmission of your personal data and children’s data for processing:

The Foundation may, at its own discretion, provide your personal data, as well as the personal data of children, to third parties in connection with the organisation and conduct of the educational and creative events and/or projects organised by the Foundation – external consultants and service providers, committee members, Foundation employees, partners of the Foundation in joint initiatives, bodies, organisations and individuals with whom we cooperate in organising/conducting Activities (e.g. we receive funding from them), such as the NATIONAL A Sofia 1000, ul. “Graf Ignatiev” № 15, floor 4, registered in the BULSTAT Register: 130047747, state and local authorities.

In addition, we may transfer personal data to accountants, lawyers, advertising agencies, banks – for the purpose of making payments of prize money, co-organisers of events and other activities in which the person will participate, courier companies and postal operators – for the purpose of carrying out correspondence with the data subject individuals, insurers, accommodation providers, persons/organisations providing transport. We may also need to share your personal data with service providers such as hosting companies, information technology (IT) service providers, system administration, mobile operators, social networks.

In the case of the Erasmus+ Programme, data may be transmitted to the European Commission, which is the data controller.

The data may also be provided to state and/or municipal authorities, for example, when legal obligations are to be fulfilled and/or inspections are to be carried out by these authorities (including the NRA, SANS, CPPD, prosecutor’s office, courts and other state/municipal authorities) and/or in order to carry out the purposes of the Foundation, as well as in other cases under applicable law.

Where your data (including that contained in photographs, videos, etc.) is published on our website, on a social network and/or elsewhere on or off the internet, the data may become publicly available (in relation to social networks, to the extent consistent with the relevant functionality/settings). In cases where your data is published on a social network, the data recipient is also the data controller of the relevant social network.

All recipients are legally and/or contractually obligated to maintain the confidentiality and security of any of your personal information and personal data.

X.International data transmission

Your use of Google LLC’s platforms/tools/services (e.g. gmail) and/or Meta Platforms Ireland Ltd (e.g. Facebook social network, Messenger service) could involve the transfer of data outside the European Union (EU) and the European Economic Area (EEA). Such data transfers are based on adequacy decisions, standard contractual clauses, and possibly on your explicit consent (pursuant to Article 49(1)(a) of the Regulation) and/or other basis if such is stated in the Privacy Policies of those platforms/tools/services. For more information on this, you should read the relevant Privacy Policies (for Meta Platforms Ireland Ltd – please visit https://www.facebook.com/privacy/explanation; for Google LLC – please visit https://policies.google.com/privacy?hl=bg) and you can also contact us for assistance using the contact details set out in Section I of this Notice.
In all other cases, personal data is not transferred to third countries (countries that are not members of the European Union and are not parties to the European Economic Area Agreement) and is not transferred to international organisations.

XI.Storage period of personal data

As a data controller within the meaning of the Regulation, the Foundation processes your personal data as well as the personal data of your children for a minimum period of time in accordance with the purposes of the processing and as provided for by the applicable law in accordance with the principle of storage limitation.

In order to determine the appropriate retention period for personal data, we take into account the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes by other means, as well as taking into account applicable legal requirements. We will also take into account applicable legal limitation periods for the discharge of debts (private and public debts).

In most cases, we will retain your data for a period of 6 (six) years from the termination of our relationship with you.

However, please note that some personal data could be deleted earlier – for example, when we withdraw your consent; if we are required by law to delete/erase data; where we have notified you that we will keep certain information for shorter periods; or if we have determined that we do not need certain personal data for the purposes we have identified.

The Foundation retains the personal data it is required to retain under applicable law for the relevant period of time provided for in the legislation, which may exceed the period of time specified above.

In the cases referred to in Article 6 of the Electronic Document and Electronic Certification Services Act (e.g. when you send a message via the contact form on our website), we store information about the time and source of the electronic statements transmitted for a period of one year.

After the expiration of the above period, the Foundation shall take the necessary actions to delete and destroy all your data, as well as the data of the children, without undue delay.

In some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

XII.Exercise of rights under the Regulation:

Under the legislation, you have certain rights, including (but not limited to) you have the right to:

1.Request access to your personal data. You have the right to confirm whether personal data relating to you is being processed. If this is the case, you have the right to access the data and certain information relating to its processing, as well as the right to obtain a copy of that data.

2.Request correction of your personal data. You may require us to correct inaccurate personal data relating to you and/or complete incomplete personal data relating to you (taking into account the purposes of the processing).

3.Request deletion of your personal data. This enables you to ask us to delete/remove your personal data where there is no legitimate reason for us to continue processing it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

4.Object to the processing of your personal data. You have the right, at any time and on grounds relating to your particular situation, to object to processing of your personal data on the grounds of “legitimate interest” or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”, including in cases of profiling on any of these grounds. In order to continue processing, we must demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

In addition, you have the right to object in the following cases:

– You have the right at any time to object to the processing of personal data concerning you when we process it for direct marketing purposes, including in cases of profiling related to direct marketing. Where you object to processing for direct marketing purposes, the processing of personal data for those purposes will cease.

– Where personal data are processed for scientific or historical research purposes or for statistical purposes, you have the right, on the basis of your particular situation, to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

5.Request restriction of the processing of your personal data. This allows you to ask us to stop processing (except for certain processing activities provided for in applicable law) personal information about you in the following cases:

– the accuracy of the personal data is contested by you, and the restriction of processing applies for a period that allows us to verify the accuracy of the personal data;

– the processing is unlawful, but you do not wish the personal data to be erased, but instead request that its use be restricted;

– we no longer need the personal data for processing purposes, but you require it for the establishment, exercise or defence of legal claims;

– You have objected to processing under Article 21(1) of the Regulation pending verification whether the legitimate grounds we apply override your interests.

6.Exercise the right to portability of your personal data. If we process personal data on the grounds of “performance of a contract to which the data subject is a party” or on the grounds of “consent”, you may require us to obtain the personal data in a structured, commonly used and machine-readable format and/or to transfer the personal data to another data controller. The right of portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7.Withdraw your consent – in the event that we process personal data on the basis of your consent or explicit consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of processing based on consent, before it is withdrawn.

In cases of processing of personal data of a child:

His/her parent/guardian may exercise his/her right instead of him/her and on his/her behalf – if the child is under 14 years of age;
A child may exercise his or her right with the consent of his or her parents or guardians – if the child is between 14 and 18 years of age.

You can address your requests to us and exercise your rights related to personal data to: pl. “At. Sirekov” № 4, r. Burgas 8000, or email info@forbgkids.org. We will take all necessary steps and without undue delay to assess whether your specific request complies with the legislation and respond appropriately to your request.

If you decide to exercise any of your rights, please contact us at the email address provided so that we can send you a form to exercise the relevant right or you can address the request to exercise a right provided for in the Regulation with a free text request.

8.Automated processing:
The Foundation does not carry out automated decision-making with your personal data or with the personal data of children.

XIII.Right of appeal to a supervisory authority:

You have the right to lodge a complaint with the competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection, with correspondence details. 1592 Sofia Blvd. “Prof. 02 915 3 555; e-mail: kzld@cpdp.bg , website: www.cpdp.bg.