SKI ZONE MALYOVITSA
HOTELS MALYOVITSA, ALPINIST AND ALEN MAK
1. Who are we and what is this policy about?
Agro Land Management Ltd. is a personal data controller within the meaning of Regulation (EU) 2016/679 (GDPR, Regulation) and the applicable Bulgarian legislation.
The protection of personal data and financial information you share with us is a top priority for us. Therefore, the processing of the information provided to us is fully compliant with the principles and requirements of the EU General Data Protection Regulation (GDPR), the Personal Data Protection Act, and the Electronic Commerce Act.
The purpose of this Personal Data Protection Policy is to inform you about the data the Company processes and stores, the manner in which we process your personal data in our capacity as a data controller, and your rights as our clients, partners, and contractors. This Personal Data Protection Policy explains what data we collect and store about you, how we use it, and how we share your data, both on this website and from certain offline sources, as described below. This policy applies to the “Personal Data” we process about you as a natural person.
Key terms used in this policy
“Personal Data” means any information relating directly or indirectly to the identification of a natural person, such as name, identification number, location data, online identifier, or one or more specific characteristics defining the identity of that natural person;
“Special Categories of Personal Data” under applicable legislation are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the sole purpose of identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation;
“Data Subject” means a natural person who can be identified directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier, or one or more specific characteristics defining the identity of that natural person;
“Data Controller” means a natural or legal person, public authority, municipality, or other body which alone or jointly with others determines the purposes and means of processing personal data;
“Data Processor” means a natural or legal person, public authority, municipality, or other body which processes personal data on behalf of the data controller. The relationship between the controller and the processor shall be governed by law, written agreement, or another act of the controller specifying the scope of obligations assigned to the processor;
“Processing” means any operation or set of operations performed on personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
“Third Party” means a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;
“Consent of the Data Subject” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, through a statement or clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed;
“Applicable Legislation” means the legislation of the European Union and the Republic of Bulgaria relating to personal data protection (Personal Data Protection Act, etc.);
This policy does not apply to: (a) anonymous information that cannot be linked to a specific user or household; or (b) business data.
2. How can you contact us?
If you have any questions regarding the processing of your personal data by us or wish to exercise your personal data protection rights, you may contact us at: reservation@malyovitsa.com and tel. 0895982510.
3. Grounds for processing personal data.
Depending on the purpose, there are several legal grounds for processing and storing your personal data:
4. What personal data do we process?
We collect information about you from various sources, including information you provide directly to us (e.g., when you send us an email, register to purchase products from us) and information we automatically collect from you when you access and use our website, as described below.
Depending on the activities you perform, this may include:
A) Personal data you provide to us when using our website, purchasing products, or contacting us regarding our services and products. We collect the requested information you provide in support of these activities. The personal data you provide may include, without limitation, the following categories:
You may choose whether or not to provide such Personal Data, but please note that this information may be required in order to use certain functions of our website or to purchase products.
B) Personal data collected automatically by the Company when you visit our website or otherwise use our online services, including in connection with our emails, online advertisements, and social media pages, as described in this section. As described below, we and our business partners and service providers may use various technologies to help collect this information. This information may include, without limitation, the following categories:
Device information. We may collect information about the devices (e.g., computer, tablet, and mobile phone) you use to access our online services, including your device model, IP address, operating system, temporary or persistent unique device identifiers (sometimes called UDIDs), and mobile carrier information.
C) Personal data received from third parties. The Company may receive the personal data listed above about you from third parties such as our business partners and service providers, including payment processors and marketing service providers.
You may exercise your rights regarding the processed data and information as described in Article 9 below.
5. What do we expect from you?
We expect you to provide us only with accurate personal data about yourself and to promptly inform us if any specific data changes. If you provide us with personal data about other individuals, you must ensure that you are authorized to do so.
6. Why do we process your personal data?
The purposes for which we process your personal data depend on the way you interact with us and the services you wish to use.
You browse our website
We process information about your use of our website to remember your preferences and to manage and improve our website. For more information, please see our Cookie Policy section.
You contact us (e.g., by filling out a form on our website or sending us an email)
We process your personal data in order to respond to your request (e.g., request for information, newsletter subscription, complaint). This processing is based on your consent.
We may also process your personal data based on our legitimate interests. This processing may include profiling. Such profiling may result in improved customer service and personalized offers, which is beneficial to you without otherwise affecting you.
We may also process your personal data for direct marketing of our products/services based on our legitimate interests. We believe it is important that you, as our customer, are informed about our products/services. This processing may include profiling. Such profiling may result in improved customer service and personalized offers, which is beneficial to you without otherwise affecting you.
You have subscribed to Company activities
We may process your personal data when you register for an activity provided on the website (e.g., event, seminar, or webinar), because this is necessary for the performance of our agreement with you regarding the organization of that activity. We may do this in cooperation with business partners with whom we may share your data based on their legitimate interest in knowing who has registered. In this case, we may also process your personal data for direct marketing of our products/services based on our legitimate interests. This processing may include profiling. Such profiling may result in improved customer service and personalized offers, which is beneficial to you without otherwise affecting you.
Processing of personal data during payments
When you place an order, we process information regarding your payments for the purpose of completing the payment. Depending on the payment method, we may forward payment information to third parties (e.g., your credit card provider in the case of card payments).
Payment data may also be used to detect violations. This type of data processing is carried out pursuant to Article 6(1)(a), Article 6(1)(b), and Article 6(1)(f) of the GDPR.
General processing
We may process your personal data to prevent illegal activities and misuse of the Company’s resources. We may anonymize your personal data and process aggregated data for research purposes based on our legitimate interests (e.g., sales statistics, market analysis, product/service development). We believe that research activities may lead to improved customer services, product improvements, and innovations that benefit individuals associated with our products/services (such as customers, distributors, suppliers, and end users).
We may also process your personal data as a controller at group level for global management and global research based on our legitimate interests, those of other entities within the group, and their stakeholders. We believe this is necessary for the efficiency, consistency, and continuity of the Company’s operations and for improving customer experience, ultimately contributing to the protection and promotion of the economic, commercial, social, and financial interests of Agro Land.
We may process your personal data for direct marketing of our products/services based on your consent, to the extent that you have provided such consent.
7. With whom may we share your personal data?
We may transfer your personal data to companies that are business partners and contractors of Agro Land Management Ltd., to companies processing personal data on our behalf and for our account (“processors”), to research institutions in the context of studies, to third parties where there is a legal obligation to do so, to our business partners (e.g., in the organization of joint activities), and to competent state/municipal authorities upon lawful request.
8. Will your personal data be transferred outside the European Union?
The transfer, storage, and processing of personal data collected, processed, and stored by the Company are secured and aligned with modern technical measures. Agro Land Management Ltd. will not transfer your data outside the European Economic Area without complying with the legal requirements. Should any transfer occur based on the grounds listed above, we will implement appropriate safeguards to preserve the confidentiality of your information. Any transfer will be based on appropriate safeguards (adequacy decision and/or European Commission standard contractual clauses).
9. For how long will your personal data be stored?
Your personal data will be stored while you remain in contact with us (e.g., requesting information, purchasing our products/services, subscribing to our newsletter) and for the maximum period permitted by law according to the legal basis for processing and storage.
10. What are your rights?
You may contact us to exercise the following rights, in accordance with the conditions set out in the applicable laws and regulations:
You may exercise the rights listed above by contacting us. Your request will be processed without undue delay and in any case within 30 days of receipt of the request, except in more complex cases or due to a large number of requests received, where this period may be extended, but not beyond the legally permitted period.
You may exercise all these rights by contacting us at the address specified above (Article 2).
Please note that if you submit a request related to your personal data, we will need to verify your identity. To do this, we may ask you to match specific information that you have previously provided to us and, in some cases, to provide a signed declaration under penalty of perjury that you are the user whose personal information is the subject of the request. If additional information needs to be collected from you, we will use it only for verification purposes and delete it as soon as possible after fulfilling the request.
If you submit a data subject rights request through an authorized representative, we will require written proof that the person is authorized to act on your behalf. We will process your request within the period provided for by the applicable legislation.
Personal data security
The personal data you have provided or which has otherwise been obtained by us within the scope of our activities may be processed on paper, by automated means, or electronically, in accordance with applicable laws and regulations, using procedures strictly related to the purposes specified above and which may include all operations provided for in Article 4, paragraph 2 of the GDPR. AM maintains appropriate administrative, technical, and organizational measures designed to ensure the security and confidentiality of your personal data and to protect it against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access, misuse, and any other unlawful form of processing. Adequate control mechanisms are applied to our systems for the separation and management of data with restricted access and secured premises. AM works only with verified partners who provide adequate personal data protection measures. The Company uses established security procedures, as well as technical and physical restrictions on access to and use of personal data.
11. How may we change our Policy?
As our activity develops, our policies may also need to be updated from time to time. We reserve the right to change this Personal Data Protection Policy at any time and to notify you by publishing an updated version of this Personal Data Protection Policy, together with the date on which it was last updated, on our website. You will be able to determine when this Personal Data Protection Policy was last updated by the version number and the “last updated” date included at the top of this Personal Data Protection Policy. We recommend that you review this Personal Data Protection Policy from time to time during visits to the websites and note any changes before continuing to use the website.
Your continued use of the website after we publish any updates to this Personal Data Protection Policy means that you accept the changes to our Privacy Policy. It is your responsibility to periodically check for updates to this Personal Data Protection Policy.