"Vimar" EOOD – a company registered in the Republic of Bulgaria, with registered office and management address at: 29 Bulgaria Blvd., entrance B, Veliko Tarnovo, UIC: 814255079, tel.: 0899857327 and email: dpo@shtastliveca.com

In connection with its activity – providing restaurant services – the "Shtastliveca" restaurant chain – the "Company" – processes data, some of which is personal data, in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679, and therefore acts as a personal data controller.
The purpose of this policy is to inform users of www.shtastliveca.com about how their personal data is processed, their rights, the personal data protection methods used by the controller, to whom the Company is entitled to provide the collected personal data, and the methods for exercising the rights of data subjects.

1. Purpose and scope of the policy:

   With this Personal Data Protection Policy, "Vimar" EOOD respects the confidentiality and integrity of personal data. In accordance with legislation and good practices, the Company applies the required technical and organizational measures to protect the personal data of individuals.
   
   Through this Personal Data Protection Policy, the Company aims to inform individuals about the purposes of personal data processing, the recipients or categories of recipients to whom data may be disclosed, whether the provision of data is mandatory or voluntary and the consequences of refusing to provide it, and information about the right of access to and correction of collected data.



2. Key terms and definitions:
• "personal data" means any information relating to an identified natural person or a natural person who can be identified ("data subject"); a natural person who can be identified is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;


• "processing" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;


• "restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future;


• "profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;


• "controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;


• "processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller;


• "recipient" means a natural or legal person, public authority, agency, or other body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;


• "third party" means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;


• "consent of the data subject" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

All quoted terms and definitions are in accordance with the legal definitions given by Regulation 2016/679 (the Regulation).



3. Principles for processing personal data applied by the Company:
   
   • personal data is processed lawfully, fairly, and transparently;
   • specific purposes are required for data processing;
   • data minimization;
   • limitation of the storage period of personal data;
   • ensuring the security of personal data.


4. Purposes and legal basis for processing personal data:

   The Company's main activity is to fulfill orders from users of the website, as well as to offer reservation services and preparation of gift vouchers for dinner at "Shtastliveca" restaurants in the cities of Veliko Tarnovo, Sofia, and Stara Zagora. For this purpose, it is necessary to collect the required information about the respective user for the specific service they have requested.
   
   Another main basis for collecting personal data is direct marketing. The Company collects personal data for marketing and advertising purposes. Data is collected solely with the express, free, clear, and informed consent of the user, which they have indicated when reading this personal data protection policy. Any individual who has given consent to be subject to the Company's direct marketing may withdraw their consent at any time, in an easy and convenient manner, in accordance with the principle of transparency set out as a fundamental principle in the Regulation.

   
   The Company processes personal data only when:
   • it has received clear, free, informed, and unambiguous consent from data subjects who have been informed in advance, through this policy, of how their personal data will be used;
   
   
   • there is a contractual obligation for the performance of a contract, where one party is the natural person (when the Company processes data of its workers/employees) and for the exercise, establishment, and defense of rights and legitimate interests;
   
   
   • processing is necessary for the performance of a task carried out in the public interest (in accordance with EU or national legislation);
   
   
   • it has received express consent from the natural person for direct marketing (e.g. sending promotional emails).
   
   


5. Data that is collected and processed:

   Important: "Vimar" EOOD does not collect or process sensitive personal data of its clients and users.

   The data that is collected and processed includes:
   • User's first and last name – for the purpose of identifying the data subject when a service is requested;
   • Email address – for quick and easy correspondence;
   • Phone number – for direct contact with the data subject;
   • Delivery address (only when delivery is expressly requested by the user);
   • Other data permitted under the Regulation, if necessary for the fulfillment of an obligation of the Company or related to a specific service.

   The provider of personal data has the right not to share all personal data requested from them. In cases where such personal data is necessary for the performance of a specific service, a specialized function, or an effective response to a given inquiry (excluding direct marketing) – e.g. delivery of food to a specified address – "Vimar" EOOD would not be able to fulfill the request due to lack of data, of which the user is expressly informed through this personal data policy.

   When, in connection with the Company's activity, it is necessary to process or store data of persons under 18 years of age, this is done with the express consent of the parent/guardian.



6. Recipients of personal data:

   The Company has the right and obligation to provide personal data of data subjects to certain state institutions for the purpose of compliance with Bulgarian legislation, namely: in connection with data collected from the Company's workers/employees – the National Revenue Agency, the National Social Security Institute, the Employment Agency, etc. Data may be provided to accounting firms, banking organizations, HR agencies, and mobile operators;

   The Company has the right to provide data of natural persons to medical facilities, judicial and investigative authorities;

   Personal data of users of www.shtastliveca.com is not provided to third parties outside the scope of their declared consent or legal requirements.

   The Company does not share data of natural persons with organizations outside the European Union.



7. Retention period for personal data:

   "Vimar" EOOD has reduced the retention period for personal data to a minimum. The Company destroys data immediately after the purpose for which it was collected has been fulfilled, unless the same data is necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority vested in the controllers of personal data, in accordance with Union law or Member State law, as well as in connection with requirements under Bulgarian legislation;

   Retention criteria:
   • for an order without registration, data is kept for 6 months after the last order placed; for the "Culinary Experience Voucher" service – up to 2 months after use of the voucher, for the purpose of tracking and accounting for used vouchers;
   • when subscribing to a promotional newsletter, individuals' data is kept until they unsubscribe. Unsubscription is carried out with one click, in an easy and accessible manner;
   • personal data of workers/employees of "Vimar" EOOD is stored and processed for a longer period in view of the requirements of the Accounting Act;


8. Protection of personal data:

   The Company has taken all necessary technical and organizational measures to protect the personal data of natural persons from accidental or unlawful destruction or accidental loss, from unauthorized access, alteration, or dissemination, as well as from other unlawful forms of processing, by using specialized software and antivirus programs, as well as the services of an IT specialist.

   Personal data stored on paper is kept in folders stored in premises with restricted access, which are also equipped with fire extinguishers for protection against fire.

   The "Company" has a video surveillance system for the protection of premises, equipment, and the personal data of workers/employees and clients of "Vimar" EOOD.



9. Data protection officer

   Due to the fact that the Company processes and stores personal data on a large scale for a large number of natural persons (clients and users of www.shtastliveca.com), "Vimar" EOOD uses the services of a data protection officer, who is responsible for the correct application of Regulation (EU) 2016/679 and the protection of the rights of data subjects;



10. Users' rights:
    • Right of access of users to data relating to them;
    • Right to rectification;
    • Right to object to the processing of data;
    • Right to erasure (right to be forgotten);
    • Right to restriction of processing;
    • Right to data portability;
    • Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before it was withdrawn.

    Where personal data is processed for the purposes of direct marketing, the user has the right at any time to object to the processing of personal data concerning them for such marketing. The user is informed in advance of the existence of the right to object, which is provided to them through a clear notice separate from any other information.



11. Changes to the policy:

    The Company has the right to update, amend, and supplement the personal data protection policy at any time in the future when circumstances require it.



12. Contact details of the personal data controller:

    Address: 29 Bulgaria Blvd., entrance B, Veliko Tarnovo
    phone contact for the data protection officer: 0899857327
    email: dpo@shtastliveca.com



13. Supervisory authority for data protection

    The supervisory authority for data protection at national level is the Commission for Personal Data Protection. It monitors the correct application of Regulation (EU) 2016/679, and any natural person who believes that their rights have been violated in connection with the processing of their personal data may file a complaint with the Commission at the following address:
    
    Sofia, 2 Prof. Tsvetan Lazarov St.
    phone: 02/91-53-555
    email: kzld@cpdp.bg
    website: www.cpdp.bg