1. CONTROLLER OF PERSONAL DATA:
Name and legal form: INNOCITY Ltd.,
seat and address of administration: Montana, 33, Nikola Vaptsarov Str., fl. 1
Represented by: Ivaylo Todorov Iliev
Person collecting and processing personal data: Ivaylo Todorov Iliev
Phone: 0894 52 88 62;
e-mail:email@example.com and firstname.lastname@example.org
Innocity Ltd. is a company, registered in the Republic of Bulgaria, which, with the cooperation of the Municipality of Plovdiv, is implementing the Plovdiv City Card Program.
Plovdiv City Card is a program, jointly implemented by Innocity Ltd., the Municipality of Plovdiv, and their partners on the territory of the city of Plovdiv, in which they provide for a fee, charged to the citizens and the guests of the Municipality of Plovdiv, the opportunity to receive at preferential terms tourist, cultural and/or sports services, offered by the partners. Citizens and guests, who have bought Plovdiv City Card receive the right to visit certain tourist sites in Plovdiv (landmarks, museums, cultural monuments), and to get certain discounts at chosen units for relax and entertainment (points of interest). The services are used by purchasing and validating Plovdiv City Card on technical or identification medium (cards, QR code, mobile application).
In order to purchase and use Plovdiv City Card, you must provide your personal data.
2. PERSONAL DATA
What does ‘Personal Data of Individuals (natural persons) mean – it means all data that can be used to identify one individual.
The personal data you provide to the Company by filling the electronic platform for purchase of the Card, using Plovdiv City Card mobile application or by registration on the website www.plovdivcitycard.com:
• Confirmation that you are at least 18 years of age *
• Email address
• Facebook/Google+ profile data **
- Billing data – two names, country, city, telephone number and e-mail of the buyer***
* By using the Mobile application or the Website, by registering in it and by purchasing the Card, you confirm that you are at least 18 years of age. Only then you are allowed to use our services;
**By registration via Facebook/Google+, you provide some of your data from your profile account in one of these networks-name, email, profile picture and nationality /without nationality from Google+/.
*** Telephone number and e-mail are mandatory and the latter are to be use for contacting the buyer with regards to the purchase. Buyer’s e-mail may differ from the e-mail, used for setting up the profile account.
The data, provided to create an account, as well as any other data you choose to save in your account, only serves your convenience and embellishes the profile. Comments, reviews and ratings may also contain your data. Your account data, comments, reviews, and ratings are provided by your choice and can be removed at any time.
There are optional fields on the Website, for instance for filling inthe duration of ypur stay in the city of Plovdiv. The data from the optional fieldswill only be used for statistical purposes and will be generalized and processed in a way that the data could not be associated with you.
FOR WHAT PURPOSE DO YOU PROVIDE YOUR PERSONAL DATA:
- / Conclusion and execution of a contract
You provide the abovementioned personal data, filled in the platform for purchase of the Card(name, confirmation of required age, e-mail,country, city), because we need it to conclude a contract for the sale – purchase of Plovdiv City Card and to identify you as a party to the set contract. Concluding the contract for purchase of the Plovdiv City Card is impossible without this data. Besides for the purposes of concluding the contract, your personal data is also collected for the performance of this contract, in which both parties – You, as a Buyer, and the Company, as a Seller, have the obligation to fulfill the terms within the specified deadlines.
Legal basis for processing – Art. 6, item 1, letter. “b” of Regulation 2016/679 of the European Parliament and of the Council; Obligations and Contracts Act; Commercial Act; Public Procedure Code; Measures Against Money Laundering Act;
- / Operation of the Mobile application and the Website
After the mobile app is installed, it receives access to the following information from your device: Your device’s identifier – so we can link the actions you perform in the Application (pushing buttons, etc.) with your device and therefore – execute your requests; Incoming calls data – it allows you to receive calls while the application is active; Storage (phone disk space) – to install the application; Wi-fi and mobile Internet data – for Internet access from the Application. Access to this data is required for the operation of the Application and therefore we need this data in order to carry out the functions, set down in the Application.
By your usage of the Website, Innocity Ltd. receives access to your device’s identifier – so we can link the actions you perform in the Website (pushing buttons, etc.) with your device and therefore – execute your requests
Legal basis for processing – Art. 6, item 1, letter. “b” of Regulation 2016/679 of the European Parliament and of the Council;
3. / Additional functions in the Application
With your consent *, we also receive access to your Location **, Photos and other media files ***, Camera – to scan the QR code from a technical medium /plastic City Card/ in order to import it into the mobile application so that the card may be used in-app as an identification medium. We will not access your photos or camera without first getting your explicit permission and we will never scan or import your photo gallery or camera roll. We will only use your camera after your permission to scan the QR code on your city card in order to import it in the app.
* These data are collected to perform the functions you explicitly requested. Providing this data is not mandatory and your consent to use it may be withdrawn at any time. You can withdraw your consent via an email to us, from the Settings of your device or by uninstalling the Application. Since this data is collected only for the purpose of fulfillment of a specific additional function of the Application, requested by you, and this function cannot be executed without access to your data, upon withdrawal of your consent, Innocity Ltd. will stop providing you with the additional function, which the data was collected for.
** Access to Location is made to show you the tourist sites and points of interest near you. When you open a map in the Application, your location is used for the purpose of navigating you to the selected tourist sites and points of interest.
*** Access to photos and other media files on your device is made for the purpose of uploading a picture in your profile.
Legal basis for processing – Art. 6, item 1, b. “a” of Regulation 2016/679 of the European Parliament and of the Council;
4. / Other information that you voluntarily provided us through the Website
Completing the optional fields in the Website, or creating an account and saving data in the account constitutes consent to the use of this data by Innocity Ltd. for the purposes, outlined above in the current policies (statistical purposes for the data in the optional fields, and respectively –you’re your convenience and embellishing the account, for the rest of the data). Publishing comments, reviews, and ratings on www.plovdivcitycard.com also constitutes consent to the processing of personal data you have provided in your comment, review, or rating. Providing this information is not mandatory and your consent to use it may be withdrawn at any time. You can withdraw your consent by sending us an e-mail or by deleting the data, using the settings from your profile (whenever possible).
Legal basis for processing – Art. 6, item 1, b. “a” of Regulation 2016/679 of the European Parliament and of the Council;
- / Getting in touch with us
Any data you provide us through a correspondence, addressed to us, will be processed for the purposes you had in contacting us. These purposes may be: performance of the contract – when you have a request, regarding the services we provide; your consent – when the query is not directly related to our services; as well as any other reason, depending on your correspondence. The data you provide to us in this case will be processed according to the rules, outlined in these policies, including with accordance to our obligation to store your data and do not disseminate it (unless disseminating it is required for accomplishing the request in your query).
- / Protection of the rights of the Company in case of non-performance of the contract
Besides for the conclusion and performance of a contract, your personal data is also collected in case of non-performance of this contract. This way, for the entire term of the contract, both parties to it – You, as a Buyer and the Company, as a Seller, have the obligation to fulfill the conditions, provided within the contract in the specified deadlines, and any action that deviates from the arrangement entitles each one of the parties to defend its rights in the appropriate manner, including by using the necessary personal data.
Legal basis for processing – Art. 6, item 1, letter. “f” of Regulation 2016/679 of the European Parliament and of the Council; Obligations and Contracts Act; Commercial Act; Public Procedure Code; Measures Against Money Laundering Act;
- / Accounting and tax purposes
Data on the contracts, concluded between us, including the billing data you provided, are stored and processed in relation to the obligations of all persons to perform and maintain tax accounting and to pay taxes. In this case, your personal data can be processed entirely for tax purposes.
Legal basis for processing – Art. 6, item 1, letter “c” of Regulation 2016/679 of the European Parliament and of the Council; Accounting Act; Corporate Income Tax Act; Income Tax Act of Individuals; Commercial Act;
- / Statistical purpose
Following the completion of the agreement between us, the Company keeps your personal data for statistical purposes. In this case, pseudonymization is performed – your personal data is processed in such a way that it can not be linked to you and you can not be identified.
Legal basis for processing – Art. 6, item 1, letter. “f” of Regulation 2016/679 of the European Parliament and of the Council; Commercial Act;
HOW IS YOUR PERSONAL DATA COLLECTED
Your personal data will only be provided by you, at your request and upon confirmation by you, that you wish to enter into a contract for the purchase of Plovdiv City Card. You choose how to provide us with your personal data – by signing up on the Website www. plovdivcitycard.com, by filling in the electronic platform for purchase on the Website, by signing in with a Facebook/Google+ profile, by email or in another suitable way.
HOW WE STORE YOUR PERSONAL DATA
Your personal data is stored online, on the so-called cloud.
Innocity Ltd. has taken all necessary technical and organizational measures to protect your personal data, including through restricted access to the cloud, storage on a separated server, etc.
HOW LONG IS THE PERSONAL DATA STORED
Your personal data is stored for different terms, depending on the purpose for which it is collected.
1./ Conclusion, execution and protection of the rights of the Company in case of non-fulfillment of the contract of – term of up to 10 years from the date on which the full and final performance of the contract occurs by the parties or the termination of the contract on another ground.
In case of a breach of contract and one of the parties has taken actions to defend its rights by judicial, administrative or other manner – up to 5 years from the date of the final judicial, administrative or other act.
2./ Data needed to operation of the mobile application – we keep it until you delete the mobile app from your device.
3./ Providing additional features in the application – this data is deleted when you withdraw your consent for using it. The access to your location ceases at the moment of the withdraw of your consent. Old location data will be kept for 1 year and 6 months, after which it will be generalized and used for statistical purposes.
4./ Other information that you voluntarily provided through the Website – until your consent is withdrawn. Data from the optional fields is kept for no more than 1 year and 6 months after receipt, and then aggregated and used for statistical purposes.
5./ Information from getting in touch with us– up to 5 years after concluding the issue you have approached us with, unless the matter falls under any of the other points of this section (in which case the data is processed for the period specified at the other point).
6./ Accounting and tax purposes – up to 10 years from the date of the last payment. If the revenue administration and or other public authorities initiate revisions and /or inspections, the period for the storage of personal data may be extended by the duration of the relevant state administration activities.
7./ Statistical purposes – up to 10 years from the date of purchase of the Card.
In case that there is a breach of contract and one of the parties has taken action to protect its rights in judicial /administrative or other manner to which Innocity Ltd. is a part of – up to 5 years from the date on which the final judicial, administrative or other act was issued.
HOW THE PERSONAL DATA ARE DESTROYED
To avoid any unwanted negative consequences in relation to the processing of your personal data, by the expiry of the term for which the personal data are stored, the latter shall be destroyed/ pseudonymized in such a way that you can not be identified.
DO WE PROVIDE DATA TO OTHER PERSONS?
Your personal data may be provided to others, depending on the purposes for which the data is stored, namely:
1./ Concluding, implementation and protection of the Company’s rights in case of non-fulfillment of the contract for the sale-trade of Plovdiv City Card on technical and information medium –
for the conclusion of a contract for the sale-purchase of Plovdiv City Card on technical and information medium (card, QR code, mobile application), for protection of the rights of one of the parties in the relevant judicial, administrative or other matter – to Attorney-at-law, notary, accountant / accountancy office, Registry Agency, court, prosecutor’s office, State Agency for National Security, established courier company, Bulgarian Posts Jsc, people responsible for technical and software maintenance of the equipment (IT specialists). In case you want to find the exact name of the people to whom your personal data has been provided, please contact us at the email, address and phone provided in section I above.
2./ Data from getting in touch with us – it will not be provided to others, unless providing it to others is necessary for completing the request in your quiry.
3./ Accounting and tax purposes – to accountants and accounting offices, to the competent state and municipal authorities upon request of them, e.g. National Revenue Agency, Local Taxes and Fees Department at Plovdiv Municipality, State Agency for National Security and others.
4./ Statistical purposes – these data are not provided to other people, except for shareholders representing them, employees of the Company and the competent state and judicial authorities, if it’s necessary and requested by them.
ATTENTION: Your personal data may be provided to the Commission for the protection of personal data when exercising its powers of control over compliance with the provisions of Regulation (EC) 2016/679 of the European Parliament and of the Council.
III. WHAT ARE YOUR RIGHTS with reference to your personal data, processed by us?
1./ Right to access, correct, delete, limit the processing of your data
You have the right to receive information about whether we process your personal data, exactly which personal data we process, which person process it, whether it is provided to others, how long it is processed, what your rights are in relation to your personal data, whether you have the right to appeal. You may receive a copy of your personal data, which we process. In addition, you have the right to ask us to update/correct your personal information if the information we have is incorrect (for example, if you no longer use the old email address that we have for contacting you). You have the right to request from us not to take any action on your data but only to store it (the so-called restriction of processing) and to request the erasure of your personal data when it is no longer necessary for the purposes, for which they are being processed, and after the expiry of the period for which they are stored.
ATTENTION: You submit your personal data by your choice, based on your own decision, and Innocity Ltd. does not perform any profiling or automated processing of your personal data.
2./Right to data transfer
You have the right to receive your personal data that you have provided us with and which we process in a structured and widely used format. In addition, you are entitled to transfer your personal data under the previous sentence to other people and/or administrators, either personally or by transferring our data to another administrator you provide, if it’s technically possible.
3./ Right of objection
The provisions of the Regulation provide for your right of objection in cases where your personal data are processed for the performance of a public interest task or where the processing is necessary for the purposes or legitimate interests of the Company or a third party, when the legal bases for processing your data are based on Art. 6 (1) (e) and (f) of the Regulation. In such cases, you have the right to object and request that we discontinue the processing of your personal data. If you choose to file such an objection, we will review your request and respond to you in the appropriate order and within one month, unless it is technically necessary to take longer time.
4./ Right to appeal
To protect your rights and legitimate interests in relation to the processing of your data you can file a complaint with the Personal Data Protection Commission, address the city of Sofia, 2 Prof. Tzvetan Lazarov Bul.
ATTENTION: If you need any further information regarding the collection, processing, storage, destruction or any other information related to your personal data, please contact us at the above address, phone number and e-mail address. Our team will answer all of your questions.