Information about the data controller:

SPACCANAPOLI OOD is a company registered in the Commercial Register of the Registration Agency with UIC: 206772199, e-mail: office@spaccanapoli.bg, phone: 0886 72 72 77.

Legal grounds and purposes for which we use your personal data

We process your personal data on the following legal grounds:

• The Terms of Use of the Website;
• Your explicit consent – the purpose is specified in each individual case;
• A legal obligation provided for by law.

In the following paragraphs you will find detailed information about the processing of your personal data depending on the legal ground on which we process it.

For the performance of a contract

We process your personal data for the purposes of using the Website in accordance with the Terms of Use.

Purposes of processing (where applicable):

1. verifying your identity;
2. providing the functionalities of our website.

On this legal ground, we process only personal data related to the user account you have created.

Data collected on this basis is deleted 2 years after the termination of the contractual relationship, regardless of whether it ends due to the expiry of the contract, cancellation, or any other reason.

Based on your consent

We process your personal data on this basis only after receiving your explicit, unambiguous, and voluntary consent. We will not impose any adverse consequences on you if you refuse to consent to the processing of your personal data.

Consent is a separate legal ground for processing your personal data and the purpose of the processing is specified within it. It is not covered by the purposes listed in this policy. If you give us your consent, and until it is withdrawn or any contractual relationship with you is terminated, we will prepare suitable product and service offers for you by carrying out detailed analyses of your basic personal data.

Data we process on this basis:

On this basis, we may process personal data for the purposes of direct marketing, including website usage data and social media profile data.

Sharing data with third parties

On this basis, we may share your data with marketing agencies, Facebook, Google, or similar platforms.

Withdrawal of consent

Any consent given may be withdrawn at any time. Withdrawal of consent does not affect the performance of contractual obligations. If you withdraw your consent to the processing of your personal data for any or all of the purposes described above, we will no longer use your personal data and information for those purposes. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

To withdraw your consent, simply contact us through our website or using our contact details.

When we delete data collected on this basis

Data collected on this basis is deleted upon your request or 12 months after it was first collected.

How we protect your personal data

To ensure adequate protection of company and customer data, we apply all necessary organisational and technical measures as required by the Personal Data Protection Act.

The company has established rules to prevent misuse and security breaches, which support the processes of safeguarding and securing your data.

For maximum security in the processing, transmission, and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymisation, and others.

User rights

Every user of the website enjoys all rights for the protection of personal data under Bulgarian law and European Union law.

Users may exercise their rights by sending a message to our email address.

Every user has the right to:

• Be informed (in connection with the processing of their personal data by the controller);
• Access their own personal data;
• Rectification (if the data is inaccurate);
• Erasure of personal data (the “right to be forgotten”);
• Restriction of processing by the controller or processor;
• Portability of personal data between controllers;
• Object to the processing of their personal data;
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject;
• Judicial or administrative protection in the event that the rights of the data subject have been infringed.

A user may request erasure if one of the following conditions is met:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• The user withdraws their consent on which the processing is based and there is no other legal ground for the processing;
• The user objects to the processing and there are no overriding legitimate grounds for the processing;
• The personal data has been processed unlawfully;
• The personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State applicable to the controller;
• The personal data was collected in connection with the offer of information society services to children and consent was given by the person holding parental responsibility for the child.

A user has the right to restrict the processing of their personal data by the controller when:

• They contest the accuracy of the personal data – in this case, the restriction applies for a period that allows the controller to verify the accuracy of the data;
• The processing is unlawful but the user does not wish the data to be erased and instead requests that its use be restricted;
• The controller no longer needs the personal data for the purposes of the processing, but the user requires it for the establishment, exercise, or defence of legal claims;
• The user has objected to the processing pending verification of whether the legitimate grounds of the controller override those of the user.

Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and has the right to transmit that data to another controller without hindrance from the controller to whom the data was provided, where the processing is based on consent or a contractual obligation and the processing is carried out by automated means. When exercising the right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Right to object

Users have the right to object to the controller against the processing of their personal data. The controller is obliged to cease processing unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims. Where the objection relates to the processing of personal data for direct marketing purposes, processing must cease immediately.

Complaint to the supervisory authority

Every user has the right to lodge a complaint against unlawful processing of their personal data with the Commission for Personal Data Protection or with the competent court.