PERSONAL DATA PROCESSING AND PROTECTION POLICY
I. Introduction
On 28.05.2018 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”) entered into force.
The present Personal Data Processing and Protection Policy (hereinafter referred to as the “Policy”) is intended to inform users about what kind of personal data is processed by “GTC Yuzhen Park” EAD (also known and referred to as “GTC Bulgaria”, hereinafter referred to as the “Personal Data Controller” or only the “Controller”) in connection with visiting and using www.gtc.bg website, using the contact form and other similar actions. In this Policy you can become acquainted with your rights as data subject in relation to the personal data, which is collected, processed and stored by us as Controller within the meaning of Art. 4, item 7 of the GDPR. As Controller, we process your personal data for the purposes, within the terms and in the manner described below, in compliance with the principles and rules set forth in the GDPR and the Bulgarian legislation in force - the Personal Data Protection Act (PDPA).
For the purposes of this Policy, the term “processing” of personal data shall be interpreted in the sense set out in Art. 4, item 2 of the GDPR, namely: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
If you have any questions related to your rights and legitimate interests in relation to the processing of personal data, including issues related to this Policy, you can contact us in any of the following ways:
- by sending an e-mail to: dataprotection@gtc.bg;
- Postal address: 1715 Sofia, Bulgaria, 2 Samara Street, floor 1, Advance Business Center, Building 2
II. Who are we?
“GTC Yuzhen Park” EAD (also known as GTC Bulgaria) is part of the family of GTC Group - one of the leading investors in Central, Eastern and Southeastern Europe. Since its establishment in 1994, the group has been building and managing modern first class office buildings and shopping centers throughout the CEE region. In Bulgaria GTC Group is represented by its subsidiary “GTC – Yuzhen Park” EAD, a company incorporated in the Republic of Bulgaria, registered in the Commercial Registry under UIC 175077467, with seat and registered address: 1715 Sofia, Bulgaria, 2 Samara Street, floor 1, Advance Business Center, Building 2
”GTC Yuzhen Park” EAD (hereinafter referred to as “GTC” or “GTC Bulgaria) is the Controller of your personal data and the owner of this website: www.gtc.bg.
The personal data protection officer of the Controller is Ms Nelly Naseva.
E-mail address: dataprotection@gtc.bg
III. Types of personal data and categories of subjects, whose personal data is processed by us
We process personal data of the following groups of individuals:
- Website visitors;
- Users, who use our contact form provided on the website;
Whenever the collection, process or storage of personal data of persons below the age of 16 years is necessary, „GTC Yuzhen Park” EAD shall collect, process or store personal data of such persons only when an explicit consent from their parent/adoptive parent/legal guardian or other person holder of parental responsibilities is received by the Controller.
1. Website visitors
As a visitor on www.gtc.bg, you have the opportunity to browse all its sections and menus, to search for information on it, without having to enter any of your personal data or register on the website. The lack of registration on our website does not limit in any way your online activity, site navigation, and access to its content.
Keep in mind that the site www.gtc.bg uses the so-called “cookies” in order to offer you better, optimized and up-to-date services, product information, and commercial terms, as well as to provide personalized content to our website users. Through the “cookies”, including other similar technologies, the Controller can obtain specific user information such as: the pages you view; the things you download; the links you follow; the duration of the site visit; your IP address; the domain from which you enter our website, etc. This information helps us learn more about how you use the technologies related to us and to provide you with adequate services and information. For more information about the “cookies”, which we use, please read the Cookies Use Policy published on our website.
2. Users, who use our contact form provided on the website
In the “Contacts” section you also have the option to send a message to us by entering a name and email address. Entering the specified personal data is not a registration on our website. In this way, you will not be created a profile on which your personal data will be stored or through which you will be subsequently identified.
For each message which you want to address to us through the form on the site, you must re-enter the name and email address in the empty boxes. Your name and email address can be saved on the site if you have allowed the use of the relevant cookies. For more information about the “cookies used by us, please read the Cookies Use Policy published on our website.
- The purpose for processing of your name and email address is to administer, process and respond to your message;
- The term for which we process and store your personal data is determined by the content of your message, with the minimum time limit for administering and responding to your message. If your message implies any obligations for us to perform certain actions or activities (for example, to perform an alert check, etc.), the processing of your personal data will be extended until finishing the relevant activities/actions or any other legally prescribed period, in connection with our legitimate obligations, rights and interests.
- The legal ground on the basis of which we process your personal data, is: your consent, given under Art. 6, para 1, letter “a” of the GDPR; for the purposes of the legitimate interests pursued by the Controller or by a third party - Art. 6. Para. 1, letter “f” under GDPR.
IV. Rights of our clients
All visitors and users of the site have the rights listed below according to the current European and Bulgarian legislation.
We strive to always process your personal data in a lawful manner, acting in good faith and in a transparent manner, to collect it for specific, explicit and legitimate purposes, to minimize the collection, processing and storage of your data to the necessary minimum. We always stand to ensure that your personal data is processed in a way which guarantees an appropriate and adequate level of security.
As controller of your personal data, we at GTC are ready to answer your questions about processing and storing your data in order to always keep you aware of what data we collect, process and store; for what purpose and for what period we do so, who else can access them, what are your rights and our obligations.
| Rights | Essence of the right | Actions which shall or may be undertaken by the Controller |
|---|---|---|
| 1. Right of consent |
The data subject (visitor or user of the site) shall give consent for processing their data. The consent shall be given freely, explicitly, in an informed and unambiguous way. |
The consent is given by implicit action or by signing an explicit declaration, given by the Collector. Consents of this kind will be stored by us in files protected and archived in a safe and appropriate way. |
| 2. Right of access to data |
You have the right to request access to the personal data which is collected and processed about you. You may request provision of a copy of the personal data collected about you multiple times. |
The Data Protection Officer shall collect the relevant personal data and respond to you in writing within two weeks (in a confidential manner) after identifying the person who has requested access to it. We will give access to personal data ONLY to the person whose personal data is being processed. If you wish your personal data to be provided to another person, we should be provided with an explicit power of attorney. In case of complicated circumstances or multiple requests, the two-week term may be extended up to 20 days; in such case you will be notified of the extension of the term. We have the right to charge an administrative fee of reasonable amount upon receipt of more than one request for a copy of your data. |
| 3. Right of rectification |
ou have the right to ask us to update or rectify your personal data. |
When we receive such request, it will be accepted and the relevant actions for update or rectification will be taken within reasonable time. You will be notified in writing about the actions we have taken. |
| 4. Right to object |
You have the right to object to the processing of your personal data by submitting an objection to us. You can always object to the processing of personal data in connection with direct marketing. |
We have the right to accept or reject the objection while we will always give reasons in our response to you in case of rejection in order that you are aware why we have not accepted your request. If you object to the processing of your personal data in connection with direct marketing, we will always accept your objection. We hereby inform you that we are not conducting profiling. |
| 5. Right of erasure or "the right to be forgotten" |
You may request from us to erase the personal data which we process about you. Please note that this right is not absolute and should be considered in relation to its function to balance other fundamental rights and obligations of the Controller and the data subject in accordance with the principle of proportionality. Keep in mind that there are separate cases in the GDPR, in which there is an obligation for us to erase your personal data. In other cases we do not have such an obligation. |
If the consent for processing of personal data has expired or is revoked, ”GTC Yuzhen Park” EAD may have an obligation to erase the personal data. Apart from these cases, we may either accept or reject the request for erasure of data, and in case of rejection, we will provide reasons for that. Within two weeks of submitting your request for erasure of your personal data, you will receive a response from the Controller regarding the satisfaction of your request or its refusal and the reasons thereof. |
| 6. Right to have the processing restricted |
You have the right to request restriction of the processing of your personal data in certain cases specified in the GDPR. |
We have the right to accept or reject your request; in case of rejection, we will state reasons for that. Within two-weeks term, you will receive a response from us regarding the acceptance of your request or its refusal and the reasons thereof. |
| 7. Right of data portability |
If your personal data is processed on the basis of your explicit consent or on the basis of a contractual obligation for processing and if the processing is done in an automated manner, you have the right to data portability. This entitles you to require from the controller to transfer some or all of the personal data processed by him/her to another controller or to receive the personal data, which concerns you and which are provided by you to the controller in a structured, widely used and machine-readable format. |
When there are circumstances provided in the GDPR, we are obliged to perform the requested action. Keep in mind that we have the right to charge a reasonable administrative fee for the service. |
| 8. Right to lodge a complaint |
If you consider that your rights in relation to protection of your personal data have been violated, you have the right to lodge a complaint with the competent supervisory data protection authority in the Republic of Bulgaria, namely the Commission for Personal Data Protection (CPDP). |
You can contact the CPDP in the following ways: at the address for correspondence: 1715 Sofia, Bulgaria, 2 Samara Street, floor 1, Advance Business Center, Building 2
phone number: 02/915 35 18; Apart from the abovementioned, if you consider that your rights or legitimate interests are violated, you are also entitled to legal protection. |
| 9. Right to withdraw the consent for processing of personal data |
You have the right to withdraw the consent for processing of your personal data at any time, but only when the processing of personal data is based on an explicit consent you have given under Art. 6, para 1, letter “a” of the GDPR. Subsequent withdrawal will not affect the lawfulness of processing made until this moment on the basis of the consent already given. |
Such requests shall be considered and accepted by us within a reasonable time without undue delay. Keep in mind that the withdrawal takes effect in the future. It will not affect the legality of data processing so far. Therefore, if there is a request from a court authority to access such data, we shall provide them with it. |
All rights listed above can be exercised by:
- Sending a written request to the e-mail address specified above to the data protection officer. Please provide us with three names, contact phone number and email address in your request, to which you wish to be contacted, as well as the content of your request. Please also indicate how you want to be provided with copies of your personal data, if you have submitted such a request, in what format, etc.
NOTES:
1. GTC may reject or charge for claims, which are clearly unfounded or excessive. In case of rejection of a request, we will notify you in writing (by e-mail or by post, depending on what you have specified in your request).
2. As a controller of personal data, we are required to monitor, report, and investigate personal data breaches.
Each person acting on behalf of GTC or a third party, such as the data processor, is obliged to immediately notify the data protection officer for breach in security. The latter will endeavor to terminate the breach and will inform the Commission for Personal Data Protection within 72 hours when there is such a requirement under the GDPR.
3. Your requests will be processed without undue delays and will be answered in writing within two weeks as of receipt of the request in our system. Please keep in mind that sometimes there may be delays due to the large amount of information which our employees process. We will do our best to respond to your inquiries and requests as soon as possible, precisely and in compliance with the requirements of the legislation of the European Union and the Republic of Bulgaria.
V. Recipients of your personal data
Your personal data may be disclosed to third parties – the so-called recipients of personal data. Apart from governmental bodies and institutions to which the controller has legal obligations to disclose personal data, such recipients of personal data may also be companies, part of GTC Group, which are solely based in the European Union.
Except the cases above, your personal data may be provided to other persons - controllers/ processors outside our team. For example, advertising agencies, marketing experts and business partners, in connection with the legitimate interests of the controller.
Disclosure of your personal data to third parties fully complies with the requirements of Regulation 2016/679. The recipients of your personal data may be persons in respect of whom there is a statutory obligation for the controller to disclose it: /for example, the Consumer Protection Commission, the Commission for Personal Data Protection, judicial and enforcement authorities, etc/.
Your personal data will not be delivered to recipients based in third countries or international organizations for which an adequate level of protection is not available, in accordance with Art. 45 of the GDPR.
VI. Changes to the present terms
If there are any subsequent updates to the privacy policy of “GTC Yuzhen Park EAD, we will publish the changes on the page of http://gtc.bg/ and will change the date of their update so that you are always aware what information we collect online, how we use it and what options and opportunities in this regard are provided to you.
Publishing the changes and updates will be made publicly on the page of http://gtc.bg/ so you become acquainted with them.
Last update: 14.02.2022
”GTC Yuzhen Park EAD” team