POLICY FOR
DATA PROTECTION ON THE WEBSITE https://bulgarianwinetourism.com/ MAINTAINED AND ADMINISTERED BY THE ASSOCIATION "Bulgarian Organization for Wine Tourism"
"Bulgarian Organization for Wine Tourism" (hereinafter referred to as the "Association") operates the site bulgarianwinetourism.com to promote wine tourism in Bulgaria, to present its member-wineries, to organize events and to provide useful information to visitors. We respect visitors' privacy and are committed to processing personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Bulgarian law. This policy explains how we collect, use, store and share information when you use our site, submit an inquiry, register for events or apply for membership.
I. GENERAL INFORMATION
On 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the "Regulation," entered into force.
The Regulation aims to ensure the protection of the personal data of individuals located in the Member States of the European Union and to ensure that personal data are not processed without their knowledge and/or explicit consent (where required).
As the DATA CONTROLLER, "Bulgarian Organization for Wine Tourism" – Association, registered in the Trade Register at the Bulgarian Registry with EIK 208449846, with its registered office and place of business in Sofia, Vitosha District, Emmanuil Popdimov Street 13 (the Association), complies with all the Regulation requirements, collecting only data of individuals to the extent necessary to provide the service, and storing them responsibly and lawfully.
The Association reserves the right to change its personal data protection policy insofar as it complies with the Regulation and applicable law.
II. DEFINITIONS
Administrator – the Administrator within the meaning of Art. 4(7) of the Regulation – "Bulgarian Organization for Wine Tourism" – Association, registered in the Trade Register at the Bulgarian Registry with EIK 208449846, with its registered office and place of business in Sofia, Vitosha District, Emmanuil Popdimov Street 13.
Personal data – any information relating to an identified or identifiable natural person ("data subject"), including, but not limited to: names; date of birth; addresses – permanent and/or current; telephone number – landline and/or mobile; online identifier (email, social media profile, etc.);
Personal data security breach – a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Personal Data which is transmitted, stored or processed in any other way.
Processing of personal data – any action or set of actions performed on Personal Data or a set of Personal Data through automated or other means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data accessible, alignment or combination, restriction, erasure or destruction.
Data subject – identified or identifiable natural person, directly or indirectly, by any means, including by an identifier such as name, identification number, location data, online identifier or one or more characteristics specific to physical, physiological, genetic, mental, economic, cultural or social identity of the person.
Consent of the data subject – any freely given, specific, informed and unambiguous indication of the data subject's wishes, by which the data subject, through a statement or clear affirmative action, signifies their agreement to the processing of the personal data relating to them.
Encryption – the process of converting information or data into code to prevent unauthorized access.
Pseudonymization – data altered in such a way that the data cannot be attributed to a specific data subject without a "key" that allows the data to be linked back to the data subject.
Anonymization – data altered in such a way that they cannot be attributed to any data subject by any means or by any person.
III. PERSONAL DATA PROCESSED BY THE ADMINISTRATOR
The Administrator collects only the information necessary to provide the quality service entrusted by contract.
The Administrator does not collect personal data considered sensitive, namely:
• personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs;
• membership in a professional organization;
• genetic data, biometric data, processed solely for the purpose of identifying you as a human being;
• health data;
• data about sexual life or sexual orientation of a person.
Personal data collected and stored by the Administrator are processed lawfully, fairly and only for specific, clearly defined and lawful purposes related to the Administrator's activities and in accordance with the data subject's category.
The personal data processed by the Administrator are:
• ordinary personal data – names, address, email, telephone number;
• correspondence between Association representatives and the data subject on a given matter, conducted via the website.
• other: data on IP address, data about the browser (when using the website).
Personal data are provided voluntarily by you.
You may refuse to provide any personal and/or financial and/or other relevant information, which may hinder the provision of the service or prevent the Administrator from carrying out the assigned activity.
IV. LEGAL BASES FOR PROCESSING PERSONAL DATA
The Administrator processes Personal Data on the basis of Art. 6, para. 1 of the Regulation, based on:
• the data subject's Consent; or
• a contract to which the data subject is a party or representing a party, and for carrying out the necessary actions/procedures for entering into such a contract at the request of the data subject; or
• the necessity to comply with a legal obligation of the Administrator; or
• the necessity to pursue the legitimate interests of the Administrator.
V. PURPOSES OF PROCESSING PERSONAL DATA
The Administrator processes only the personal data you voluntarily provide through the contact form on this website.
These data typically include your name, email and/or phone number, as well as any information you have chosen to send as free text in the message field.
The collected information is used solely for:
• establishing and maintaining contact with you in relation to the inquiry you sent;
• providing a response and subsequent communication regarding your inquiry;
• keeping minimal statistics on the number of received inquiries (without processing sensitive data or profiling users).
Personal data are collected for specific, explicit and legitimate purposes and are not processed in a way that is incompatible with those purposes.
There are some scenarios in which Personal Data may be processed additionally for purposes that go beyond the original purpose for which they were collected. When deciding on the compatibility of the new processing purpose, guidance and approval must be obtained from a representative of the Association or another manager with expressly delegated powers before such processing begins.
In all cases where Consent has not been obtained for the specific additional processing, the Administrator will note certain additional conditions to assess the fairness and transparency of the processing that goes beyond the initial purpose for which the Personal Data were collected, which conditions may be non-exhaustive, as follows:
• Any link between the purpose for which the Personal Data were collected and the purposes of the intended further processing;
• The context in which the Personal Data were collected, particularly the relationship between the data subject and the data controller;
• The nature of the Personal Data, in particular whether Special Categories of data are processed or Personal Data relating to criminal convictions and offences;
• The possible consequences of the intended further processing for the data subject;
• The existence of appropriate safeguards related to further processing, which may include Encryption, Anonymization or Pseudonymization.
VI. DATA RETENTION PERIOD
Personal data are processed and stored only for as long as necessary for the purpose for which they were collected.
If the retention period needs to be extended due to legitimate interests or for other reasons, including but not limited to establishing, exercising or defending legal claims.
The retention period may need to be extended due to legitimate interests or other reasons, including but not limited to establishing, exercising or defending legal claims.
VII. DISCLOSURE OF PERSONAL DATA
The website is intended to inform about the Association's members, events and activities. The Administrator discloses your Personal Data only in cases where this is provided by applicable law. The Administrator may provide Personal Data to the following categories of third parties:
1. Employees and/or subcontractors
The Administrator discloses your Personal Data and/or the Personal Data you have provided to its employees and/or contractors (physical and legal persons) when necessary for performing the service you commissioned, as well as when necessary to maintain the overall service provided by the Association. These persons act as joint controllers or processors and may include:
– persons maintaining the servers, systems, and the Association's website as a whole, located in the Republic of Bulgaria;
– internet service providers;
– persons providing legal and/or accounting services to the Association;
2. Members of the Association
When the inquiry submitted via the contact form is addressed to a specific member of the Association or needs to be forwarded to them, the Personal Data you provide (for example name, email, phone and the content of the inquiry) may be shared with that member solely for responding to your inquiry. Members of the Association receive the data in their capacity as independent data controllers and are responsible for their further processing. The Association is not responsible for subsequent processing by the respective member.
3. Public (state and municipal) authorities
The Administrator has the right to disclose Personal Data to third parties – competent authorities, when provided for by law, with the Administrator providing only those Personal Data necessary to perform the statutory or assigned activity, or as required by proper legal procedure.
4. Transfer to third countries (countries outside the EEA)
The principle is that the Association will not transfer Personal Data outside the EEA.
The Administrator may disclose Personal Data to third countries if:
3.1. explicit consent has been obtained from you for this;
3.2. this is necessary to fulfil mandatory provisions of applicable law;
3.3. the Administrator must protect its rights and legitimate interests.
If such a transfer is performed, it will be organized to comply with the conditions and permissible scenarios for transfer of Personal Data to third countries or international organizations.
When using Google Analytics, data may be stored on Google servers outside the EU, applying standard contractual clauses (SCC).
The Association's site may be accessible from countries outside the European Economic Area.
VIII. PRINCIPLES
The Association adopts the following principles in relation to the management of activities related to the collection, use, retention, transfer, disclosure and destruction of Personal Data:
1. Lawfulness, fairness and transparency
Personal data are processed lawfully, fairly and in a manner transparent to the data subject. This means that when required by law, the Association must inform the data subject what processing is being carried out, i.e. the Association must ensure that individuals are provided with an informational notice regarding the processing of their Personal Data (transparency). The informational notices should provide at a minimum the information listed below (in addition to any other information required by applicable law, e.g., under consumer protection legislation):
• The Association's identifying details as the Data Controller collecting the data;
• The way Personal Data are used;
• The legal basis for Processing;
• Whether the information will be shared or disclosed to third parties or other entities connected with the Association;
• Whether the information will be transferred to a third country; and
• How individuals can exercise their rights of access, rectification or deletion of their Personal Data. In certain circumstances, individuals may also have other rights, such as the right to object to further processing and the right to data portability.
When required by law or when there is no other appropriate legal basis for processing, the Association will seek the data subjects' consent for the collection, use, storage and disclosure of their Personal Data.
When the Association wishes to use Personal Data for a purpose not previously notified to the data subject, the Association may be required to inform the data subject about the new purposes, and in some cases obtain the data subject's consent for the new processing.
Processing must comply with the description given to the data subject (fairness) and must be based on one of the legal bases listed in the applicable data protection legislation (lawfulness).
2. Purpose limitation
Personal data are collected for specific, explicit and legitimate purposes and are not processed in a manner that is incompatible with those purposes. This means the Association must clearly specify for what purposes Personal Data will be used in the Information Notice to the data subjects and limit Processing of those Personal Data to what is necessary to achieve the stated purpose.
3. Data minimization
Personal Data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. The Association will collect and use only the minimum amount of Personal Data to carry out its professional activities and will not disclose Personal Data to anyone (including internal staff) who is not authorized or does not have a professional need to know the information. The Association must not retain any Personal Data longer than strictly necessary.
4. Accuracy
Personal Data must be accurate and up to date. Personal Data must be kept in accurate and up-to-date form during any Processing (e.g., transfer, storage, retrieval) to achieve the purposes for which they are used. This means the Association must have processes to identify and correct outdated, inaccurate and unnecessary Personal Data.
5. Storage limitation
Personal Data are stored in a form that allows identification of the Data Subjects for no longer than necessary for the purposes for which the Personal Data are processed. This means the Association should, where possible, store Personal Data in a way that limits or prevents the identification of the Data Subject. The Association will store Personal Data only for carrying out a specific business activity or for compliance with legal or regulatory requirements. Personal Data should:
• be stored only as long as necessary to carry out business activities or to comply with legal or regulatory requirements;
• be stored in accordance with the Association's Data Retention and Deletion Policy; and
• be securely erased or destroyed at the end of the defined retention period.
6. Security
Personal Data are processed in a manner that ensures appropriate protection of Personal Data, including protection against unlawful or improper Processing and against accidental loss, destruction or damage. The Association must implement appropriate technical and organizational measures to ensure the integrity and confidentiality of Personal Data at all times. The Association will protect all Personal Data collected, used, stored and disclosed in the course of its activities by adhering to the relevant policies regarding usage, technical and organizational policies, standards and processes.
Guardians must take appropriate measures to prevent misuse or loss of Personal Data, prevent unauthorized access, and report any known or suspected case of misuse, loss or unauthorized access to their direct supervisor.
We implement technical and organizational measures to protect data from unauthorized access, accidental loss, destruction or alteration. This includes:
– using HTTPS/SSL to encrypt the connection;
– protecting the infrastructure through Cloudflare and regular updates of the WordPress platform;
– data access control – only authorized staff have access to the administrative panels;
– periodic backups and recovery procedures;
– protection against malware and unauthorized intrusions.
In principle, Personal Data provided to the site will not be stored in paper form, but if that occurs, the Association will arrange special places for this purpose, which are not publicly accessible or available to unauthorized persons.
7. Child policy
The site is not intended for persons under 18 years of age and we do not knowingly collect Personal Data from minors. If we understand that we have collected data from a person under 18, we will delete it immediately. Parents or guardians who believe their child has provided data can contact us.
8. Responsibility
The Association as the Data Controller is responsible for and must be able to demonstrate that its activities comply with the Regulation's requirements. This means the Association must demonstrate that the data protection principles (described above) have been complied with for all Personal Data for which it is responsible.
IX. YOUR RIGHTS
1. Right to information and access
You have the right to access the data relating to you, as well as information relating to the manner, purposes, and grounds for processing your Personal Data, recipients/categories of recipients of your Personal Data and more, in accordance with the Regulation's requirements.
2. Right to rectify, supplement
You have the right to rectify or supplement (or request the Administrator to rectify/supplement) your inaccurate or incomplete Personal Data.
3. Right to erasure
You have the right to request the erasure of Personal Data relating to you, and the Administrator is obliged to erase them within the prescribed timeframes when one of the conditions provided by the Regulation is met.
The Administrator does not erase data that it is legally obliged to retain, including for defense against legal claims or proving its rights.
Withdrawal of consent for data processing / Restriction of processing
If you do not want all or part of your Personal Data, which are processed based on your consent, to be processed by the Administrator for a specific or all processing purposes in the future, you have the right to withdraw your consent.
4. Right to data portability
You have the right to download Personal Data stored and processed for you at any time and to request its transfer to another administrator you designate, where technically feasible.
To exercise any of the above rights, you can submit your request to the Administrator at the contact address/email listed below.
5. Right to restrict processing
If the personal data we process are inaccurate or outdated, or if you believe that our processing is unlawful, you have the right to request that we restrict active processing for a period that allows us to verify the accuracy of the information and correct it accordingly, or until we resolve the matter regarding the legality of our processing.
6. Right to object
You can object to the processing the Administrator carries out on any grounds related to a specific situation (applicable when processing is based on the Administrator's or a third party's legitimate interest). In any case, you have the right to object to processing for direct marketing purposes (if processing is conducted on that basis).
7. Right to withdraw consent:
When we process your Personal Data based on your consent, you have the right to withdraw it at any time. This can be done online by contacting us by email or at our office or by mail to the address below. The withdrawal of your consent does not affect the legality of processing carried out before the withdrawal.
8. Right to lodge a complaint with a supervisory authority:
If you believe that your rights regarding the protection of Personal Data and their security have been violated, you have the right to contact the Bulgarian Commission for Personal Data Protection. The contact details of the Commission are provided at the end of this policy.
X. COOKIE POLICY
The site uses cookies and similar technologies. Cookies are small text files that your browser stores on your device. They allow the site to function, remember your preferences and analyze traffic. Full information and the ability to manage cookies are provided in the pop-up banner on first visit. The main categories we use are:
Necessary cookies – WordPress and Cloudflare use technical cookies to enable basic functions (security, page loading, session retention). These cookies cannot be disabled as they are essential for the site.
Analytical cookies – through Google Analytics we obtain anonymized data about the number of visitors, how they navigate the site, the device used, etc. We use an IP anonymization feature so the IP address is not stored in full. These cookies are loaded only after your consent, which you can give or withdraw through the banner or browser settings.
Third parties – if pages contain embedded videos (e.g., YouTube) or share buttons, the respective services may place their own cookies. We do not control these cookies and advise you to review the policies of the respective platforms.
You can manage all cookies through your browser settings. Most browsers allow you to view, delete or block existing cookies. Note that blocking necessary cookies may cause the site to function improperly.
XI. DATA SECURITY BREACH
In case of a personal data security breach, which may pose a risk to your rights and freedoms, you will be notified of the breach without undue delay, as well as of the measures taken or to be taken.
XII. CONTACT DETAILS
1. Administrator
"Bulgarian Organization for Wine Tourism" – Association, registered in the Trade Register at the Bulgarian Registry with EIK 208449846
Tel.: 0882 096 050
Email: [email protected]
2. Supervisory authority
Commission for Personal Data Protection
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd
Tel.: 02/91-53-555
Email: [email protected]
Website: www.cpdp.bg
Appendix 1 – Sample request form for exercising rights of data subjects
Sample form (request) by a data subject
You can use this sample form to exercise rights regarding your personal data processed by the Association.
Data subject information:
Data about the data subject
Full name
Unique identification number
EGN/LNCH/Other
Contact details
Address
Phone number
Email
Relation to the Association (customer, employee, job applicant, etc.)
Data for the data subject's representative:
If you are acting as the data subject's representative, please indicate precisely in what capacity you act (for example parent/guardian/legal guardian of a minor/incapacitated person; authorized representative? ☐ Authorized representative
☐ Parent
☐ Guardian
☐ Custodian
Data for the data subject’s representative (continued):
Full name
Unique identification number
EGN/LNCH/Other
Contact details
Address
Phone number
Email
Relation to the Association (customer, employee, job applicant, etc.)
Request to exercise rights
Type of request: Description of the request and data to which it relates
Access request ☐ Yes
Information request ☐ Yes
Rectification request ☐ Yes
Erasure request ☐ Yes
Restriction of processing request ☐ Yes
Objection to processing ☐ Yes
Withdrawal of consent ☐ Yes
Data portability request ☐ Yes
Other ☐ Yes
Preferred form for receiving information
How would you like to receive information and feedback about this request? ☐ Phone
☐ Email
☐ Mail
☐ Courier
☐ Other (specify)
Date: __.__.__ г. Signature: ___________________________
Appendix 2 – Data subject complaint form
Data subject complaint form
You may use this sample complaint form regarding the processing of your personal data by the Association to notify us when you believe there is a violation of your rights or other violation of the law, and when you have complaints or concerns about the handling of your personal data.
Data subject information:
Data about the data subject
Full name
Unique identification number
EGN/LNCH/Other
Contact details
Address
Phone number
Email
Relation to the Association (customer, employee, job applicant, etc.)
Data for the data subject's representative:
If you act as the data subject's representative, please indicate in what capacity you act (for example parent/guardian/legal guardian of a minor/incapacitated person; authorized representative? ☐ Authorized representative
☐ Parent
☐ Guardian
☐ Custodian
Data for the data subject’s representative (continued):
Full name
Unique identification number
EGN/LNCH/Other
Contact details
Address
Phone number
Email
Relation to the Association (customer, employee, job applicant, etc.)
Details of the violation/complaint:
Types of personal data affected Please indicate the types of personal data affected by the alleged violation.
Description of the alleged violation Please indicate how the alleged violation manifests.
Affected data of other individuals If applicable, indicate whether there are other individuals whose personal data are also affected by the alleged violation and your relation to these individuals (spouse, parent, child, etc.)
Additional comments Please indicate any other circumstances you consider important and wish to report
Preferred form for receiving information
How would you like to receive information and feedback about this complaint? ☐ Phone
☐ Email
☐ Mail
☐ Courier
☐ Other (specify)